feat(frameworks): deprecate signatures dir in favor of fingerprint modules

Author: TBX3D

internal/modules/bridge.go

@@ -21,7 +21,7 @@ import (
 
 // bridgeableToFramework reports whether def is a fingerprint whose semantics
 // the framework engine can reproduce exactly: root path, default confidence,
-// all weights > 0 (the C2 shared domain). anything else stays module-only.
+// all weights > 0 (the shared domain). anything else stays module-only.
 //
 // even on this domain the firing boundary still differs at score == 0.5: the
 // module engine fires at score >= confidence, the framework engine at
@@ -76,7 +76,7 @@ func bridgeFingerprint(def *YAMLModule) (bool, string) {
 // bridgedDetector adapts a bridgeable fingerprint module into a
 // frameworks.Detector. structurally the same as frameworks' own (unexported)
 // customDetector; kept as a small local copy here rather than exporting that
-// type, since frameworks cannot import modules (1.5, avoids an import cycle).
+// type, since frameworks cannot import modules and this avoids an import cycle.
 type bridgedDetector struct {
 	frameworks.BaseDetector
 	versionRe    *regexp.Regexp

internal/modules/fingerprint_bridge_test.go

@@ -10,7 +10,7 @@ import (
 
 // okFingerprintDef builds a root-path, default-confidence, all-positive-weight
 // fingerprint module: the one shape the framework engine can reproduce exactly
-// (C2's shared domain).
+// (the shared domain).
 func okFingerprintDef(id string) *YAMLModule {
 	return &YAMLModule{
 		ID:   id,
@@ -80,7 +80,7 @@ func TestBridgeFingerprint_CustomConfidence_Refuses(t *testing.T) {
 
 // TestBridgeFingerprint_MatchesNativeAcrossSampledInputs proves the bridged
 // detector and the native module scorer agree on the shared domain, mirroring
-// C2's TestScorerEquivalenceSharedDomain but through the bridge itself.
+// TestScorerEquivalenceSharedDomain but through the bridge itself.
 func TestBridgeFingerprint_MatchesNativeAcrossSampledInputs(t *testing.T) {
 	def := okFingerprintDef("fp-bridge-sampled")
 	registered, reason := bridgeFingerprint(def)
@@ -116,12 +116,12 @@ func TestBridgeFingerprint_MatchesNativeAcrossSampledInputs(t *testing.T) {
 }
 
 // TestBridgeFingerprint_ExactlyHalfBoundaryDiverges pins the one documented
-// residual (3.4): on the shared domain the scores agree, but the module
-// engine fires at score >= threshold (inclusive) while the framework engine's
-// gate (detectionThreshold, applied by the caller as best.confidence <=
+// residual: on the shared domain the scores agree, but the module engine
+// fires at score >= threshold (inclusive) while the framework engine's gate
+// (detectionThreshold, applied by the caller as best.confidence <=
 // detectionThreshold) is exclusive of exactly 0.5. this test only pins the
 // score-equality half from inside the bridge; the exclusivity of the
-// framework gate itself is proven by TestFrameworkThresholdIsStrict (C3).
+// framework gate itself is proven by TestFrameworkThresholdIsStrict.
 func TestBridgeFingerprint_ExactlyHalfBoundaryDiverges(t *testing.T) {
 	def := okFingerprintDef("fp-bridge-half")
 	def.Fingerprint.Signatures = []FPSignature{

internal/scan/frameworks/custom.go

@@ -152,6 +152,7 @@ func loadCustomDetectorsFromDir(dir string) int {
 	}
 	if len(detectors) > 0 {
 		output.Module("FRAMEWORK").Info("Loaded %d custom signatures", len(detectors))
+		output.Module("FRAMEWORK").Info("~/.config/sif/signatures is deprecated; write type: fingerprint modules under ~/.config/sif/modules instead")
 	}
 	return len(detectors)
 }

internal/scan/frameworks/custom_deprecation_test.go

@@ -0,0 +1,76 @@
+package frameworks
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/vmfunc/sif/internal/output"
+)
+
+// TestLegacyCustomSignatureDeprecationLogged extends the backcompat proof in
+// TestLegacyCustomSignatureStillLoads (custom_backcompat_test.go): the legacy
+// signatures/ dir must keep loading AND now also emit one deprecation notice
+// steering users at the unified fingerprint-module surface. it must not fail,
+// stop loading, or migrate anything.
+func TestLegacyCustomSignatureDeprecationLogged(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "acme.yaml")
+	yamlSrc := "name: acme\n" +
+		"signatures:\n" +
+		"  - pattern: \"X-Acme\"\n" +
+		"    weight: 1\n" +
+		"    header: true\n"
+	if err := os.WriteFile(path, []byte(yamlSrc), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	var n int
+	stdout := captureStdout(t, func() {
+		n = loadCustomDetectorsFromDir(dir)
+	})
+
+	if n != 1 {
+		t.Fatalf("loadCustomDetectorsFromDir loaded %d detectors, want 1", n)
+	}
+	if _, ok := GetDetector("acme"); !ok {
+		t.Fatal("acme detector did not register")
+	}
+	if !strings.Contains(stdout, "Loaded 1 custom signatures") {
+		t.Fatalf("missing load-count line, got: %q", stdout)
+	}
+	if !strings.Contains(stdout, "deprecated") {
+		t.Fatalf("missing deprecation notice, got: %q", stdout)
+	}
+}
+
+// captureStdout swaps os.Stdout for a pipe and repoints output's sink at it
+// via SetSilent(false), which reads os.Stdout at call time (see
+// internal/output/silent_test.go for the same idiom), then runs fn and
+// returns everything written.
+func captureStdout(t *testing.T, fn func()) string {
+	t.Helper()
+
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatalf("pipe: %v", err)
+	}
+	saved := os.Stdout
+	os.Stdout = w
+	output.SetSilent(false)
+
+	ch := make(chan string, 1)
+	go func() {
+		data, _ := io.ReadAll(r)
+		ch <- string(data)
+	}()
+
+	fn()
+
+	os.Stdout = saved
+	output.SetSilent(false)
+	w.Close()
+	return <-ch
+}