fix(yara): modified Source0 with malware-scanner-tripping fixture stripped

[PawelWMS]

The upstream yara-4.5.4.tar.gz tarball ships tests/oss-fuzz/dotnet_fuzzer_corpus/obfuscated, a deliberately obfuscated .NET binary used as an oss-fuzz seed-corpus input for YARA's own .NET parser fuzzer. The file is benign by intent (it is a fuzzer input, not a runtime artefact), but it matches generic .NET-obfuscator detection heuristics by design and is rejected by the automated malware scan in our package signing pipeline.

Koji build.

[Copilot]

Pull request overview

Adjusts the yara component to use a repacked upstream Source0 tarball with a benign OSS-Fuzz fixture removed, avoiding false-positive malware detection during the signing pipeline while keeping the spec’s Source0 filename stable.

Changes:

• Add a dedicated yara.comp.toml that removes the upstream sources file and replaces Source0 via source-files pointing at a modified-tarball blob URL.
• Update rendered yara spec metadata (release bump + changelog) and the sources SHA512 to match the modified tarball.
• Add a helper script (modify_source.sh) to deterministically repack the upstream tarball with the flagged fixture stripped.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
specs/y/yara/yara.spec	Release bump and changelog entry reflecting the modified Source0 artifact.
specs/y/yara/sources	Updates SHA512 for yara-4.5.4.tar.gz to the modified tarball hash.
locks/yara.lock	Refreshes input fingerprint to reflect the new component configuration/source.
base/comps/yara/yara.comp.toml	Introduces component customization: drop upstream sources and define source-files to fetch the modified tarball.
base/comps/yara/modify_source.sh	Adds deterministic repack script to strip the malware-scanner-tripping fixture and output the required SHA512.
base/comps/components.toml	Removes yara from the inline unmodified-component list now that it has a dedicated .comp.toml.

[PawelWMS]

Checking if we can do better than this or a pattern replacement in the sources file.

[github-actions]

📄❌ Rendered specs are out of date

FIX: — run this and commit the result:

azldev component render yara

Or download the fix patch and apply it:

gh run download 25578576227 -R microsoft/azurelinux -n rendered-specs-patch
git apply rendered-specs.patch

Category	Count
Content diffs	1
Extra files (untracked)	0
Missing files (deleted)	0

Content diffs

`specs/y/yara/yara.spec`

--- committed/specs/y/yara/yara.spec
+++ rendered/specs/y/yara/yara.spec
@@ -202,8 +202,7 @@
 %changelog
 ## START: Generated by rpmautospec
 * Thu May 07 2026 Pawel Winogrodzki <pawelwi@microsoft.com> - 4.5.4-5
-- yara: serve modified Source0 with malware-scanner-tripping fixture
-  stripped
+- yara: modified Source0 with malware-scanner-tripping fixture stripped
 
 * Thu Apr 30 2026 Daniel McIlvaney <damcilva@microsoft.com> - 4.5.4-4
 - feat: introduce deterministic commit resolution via Azure Linux lock file