From 9d297e6699d474039c7ed68127102748230d6eb3 Mon Sep 17 00:00:00 2001
From: William Ballenthin <william.ballenthin@fireeye.com>
Date: Mon, 29 Jun 2020 06:09:02 -0600
Subject: [PATCH 1/5] linter: ignore testbed files

---
 scripts/lint.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/lint.py b/scripts/lint.py
index 0a25f731..ad60d234 100644
--- a/scripts/lint.py
+++ b/scripts/lint.py
@@ -372,6 +372,10 @@ def collect_samples(path):
                 continue
             if name.endswith('.i64'):
                 continue
+            if name.endswith('.frz'):
+                continue
+            if name.endswith('.fnames'):
+                continue
 
             path = os.path.join(root, name)
 

From 7a5d2d025f942f06a0fbd82b1a52b82926f72fb4 Mon Sep 17 00:00:00 2001
From: William Ballenthin <william.ballenthin@fireeye.com>
Date: Mon, 29 Jun 2020 06:09:18 -0600
Subject: [PATCH 2/5] linter: check that lib rules are in lib directory

closes #36
---
 scripts/lint.py | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/scripts/lint.py b/scripts/lint.py
index ad60d234..83480761 100644
--- a/scripts/lint.py
+++ b/scripts/lint.py
@@ -202,6 +202,20 @@ class UnusualMetaField(Lint):
         return False
 
 
+class LibRuleNotInLibDirectory(Lint):
+    name = 'lib rule not found in lib directory'
+    recommendation = 'Move the rule to the `lib` subdirectory of the rules path'
+
+    def check_rule(self, ctx, rule):
+        if is_nursery_rule(rule):
+            return False
+
+        if 'lib' not in rule.meta:
+            return False
+
+        return '/lib/' not in posixpath.normpath(rule.meta['capa/path'])
+
+
 class FeatureStringTooShort(Lint):
     name = 'feature string too short'
     recommendation = 'capa only extracts strings with length >= 4; will not match on "{:s}"'
@@ -255,6 +269,7 @@ META_LINTS = (
     MissingExampleOffset(),
     ExampleFileDNE(),
     UnusualMetaField(),
+    LibRuleNotInLibDirectory(),
 )
 
 

From 6e08cabea1cd763617c99fa895bc14bf535f1e89 Mon Sep 17 00:00:00 2001
From: William Ballenthin <william.ballenthin@fireeye.com>
Date: Mon, 29 Jun 2020 06:15:47 -0600
Subject: [PATCH 3/5] submodule: rules: update

---
 rules | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules b/rules
index 9f023a30..973cb6b1 160000
--- a/rules
+++ b/rules
@@ -1 +1 @@
-Subproject commit 9f023a301ada34e43ce1f12d9f8d068545a7f85d
+Subproject commit 973cb6b1d23cd92634c587bb47cf4ab5ddbf6009

From 325aa9574fa45fef7e048f675b8362e7fe2c7e50 Mon Sep 17 00:00:00 2001
From: William Ballenthin <william.ballenthin@fireeye.com>
Date: Mon, 29 Jun 2020 06:16:19 -0600
Subject: [PATCH 4/5] linter: check that lib rules don't have a namespace

closes #35
---
 scripts/lint.py | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/scripts/lint.py b/scripts/lint.py
index 83480761..e12f1985 100644
--- a/scripts/lint.py
+++ b/scripts/lint.py
@@ -216,6 +216,17 @@ class LibRuleNotInLibDirectory(Lint):
         return '/lib/' not in posixpath.normpath(rule.meta['capa/path'])
 
 
+class LibRuleHasNamespace(Lint):
+    name = 'lib rule has a namespace'
+    recommendation = 'Remove the namespace from the rule'
+
+    def check_rule(self, ctx, rule):
+        if 'lib' not in rule.meta:
+            return False
+
+        return 'namespace' in rule.meta
+
+
 class FeatureStringTooShort(Lint):
     name = 'feature string too short'
     recommendation = 'capa only extracts strings with length >= 4; will not match on "{:s}"'
@@ -270,6 +281,7 @@ META_LINTS = (
     ExampleFileDNE(),
     UnusualMetaField(),
     LibRuleNotInLibDirectory(),
+    LibRuleHasNamespace(),
 )
 
 

From e602ae9d0fb991a1afff16aa7ff8f309800a21d7 Mon Sep 17 00:00:00 2001
From: Moritz Raabe <moritz.raabe@fireeye.com>
Date: Wed, 1 Jul 2020 09:31:01 +0200
Subject: [PATCH 5/5] sync rules

---
 rules | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules b/rules
index e5db2268..a16242d0 160000
--- a/rules
+++ b/rules
@@ -1 +1 @@
-Subproject commit e5db22684432c7fb951cd2bf4cde921f90e62f68
+Subproject commit a16242d0a5db043e263918fff3441a32041c3363