Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Json Output Redo
This PR contains changes in the json output format of the scan command (
--output-format=json
), as (mostly) discussed in the #239 PR.Changes
meta
fieldThe meta field is now an object, rather than an array of arrays.
Old format:
New format:
This maps more appropriately to the idea of the meta fields being a key-value collection.
Top-level json
The top-level json is now formed from an object that then holds the hits as one of its fields, rather than the top-level json being an array of hits.
Old format:
[ { // hit object } ]
New format:
The benefit of the new representation is that it allows us to include extra information about the scan itself, which is useful for archiving the outputs of the scans (see version field).
Version field
The top-level json holds a field with information about the used version of yara-x.
This is one of the possible extra pieces of information useful when archiving the output of the scan.
Denormalized hit objects
The object containing info about a hit contains both info about the scanned file and the rule that it matched.
Old format:
New format:
Reasoning behind this is backwards compatibility. This format is already relied on by our tooling. This is the format that we originally proposed in 00ccc34.
Should there be any further questions about the reasoning behind any of the changes, I would be happy to discuss them in this PR.