open/llm-security
1
0
Fork 0
Code Issues Releases 1 Activity

refactor(llm-security): build the SIG ruleset from vendored commons (malware-signatures 0.1.0)

Browse source 
Fifth and last consumer swap of v8 Phase 5 step 4. The seven known-bad-identity
signatures stop living in knowledge/signatures.json and are built from the
vendored commons artifact signatures/malware-signatures.json instead.

Measured before the swap over all seven positions -- id, family, severity,
pattern, description, provenance, key order, and recompilation identity under
the engine's unconditional `i` flag: zero divergences over 56 checks, in order.
The commons copy was extracted from this repository's own file at b0de0ca and
had not drifted.

knowledge/signatures.json is REMOVED rather than left in place. Keeping it would
have left two files spelling one table with nothing gating the drift, and its
golden `file:` pin would have gone on passing while pinning bytes no scanner
reads -- a gate reporting success without running. The pin is replaced by a
walked-module anchor over SIGNATURE_RULES, which is strictly stronger: the pin
covered the bytes on disk, the walk covers what `new RegExp` made of them.
Golden diff was exactly that and nothing else: 7 ADDED, 1 REMOVED, 0 CHANGED
(102/7/5 -> 109/7/4), each added source verified equal to the recompiled commons
pattern.

compileRules() moves into the new lib module and is exported, so the built-in
ruleset and the operator's sig.custom_rules_path path keep one implementation
rather than two copies of the defaulting logic.

Coverage by construction, not by memory: the probe table in the scanner test is
asserted against the LOADED ruleset, so a rule commons adds cannot arrive
without an end-to-end probe. Mutation of the vendored JSON fires in three
directions -- under-match (xmrig alternative dropped) reddens two scanner tests
plus golden; over-match (webshell rule widened to a bare `shell`) reddens the
clean-fixture false-positive probe plus golden; reorder reddens the declared-
order test plus golden.

Loud failure is contract: an unresolvable commons writes one line to stderr
rather than silently disabling known-malware detection, and never throws.

Suite 2247 / 2241 pass / 6 skipped / 0 fail. suite-counts.json untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0151x4FVg9Mn55C2LvHLpHKo
This commit is contained in:
Kjell Tore Guttormsen 2026-08-13 21:28:14 +02:00
commit bbada84e9f
12 changed files with 480 additions and 132 deletions
Download patch file Download diff file Expand all files Collapse all files

11
scripts/lib/golden-dump.mjs
View file

@ -43,6 +43,13 @@ const WALKED_MODULES = [
// 19 credential shapes had no digest anchor at all — the hook is not a
// walked module, so a change to the vendored JSON moved nothing here.
['secret-egress', 'scanners/lib/secret-egress.mjs'],
// Swapped to vendored commons in v8 Phase 5. This entry REPLACES the
// `knowledge/signatures.json` file pin below, which was retired with the
// file: the pin covered the bytes on disk, the walk covers what `new RegExp`
// made of them under the engine's unconditional `i` flag. Walked, not
// pinned, for the same reason as secret-egress — the module compiles its
// ruleset from JSON and inlines no regex of its own.
['malware-signatures', 'scanners/lib/malware-signatures.mjs'],
];
/**
@ -53,7 +60,9 @@ const PINNED_FILES = [
'scanners/lib/injection-patterns.mjs',
'scanners/lib/string-utils.mjs',
'scanners/lib/severity.mjs',
'knowledge/signatures.json',
// knowledge/signatures.json was pinned here until v8 Phase 5 step 4. The
// file is gone: the SIG ruleset is built from vendored commons, and its
// anchor is the `malware-signatures` walked module above.
'knowledge/attack-mutations.json',
];