strix-scan

Overview ¶

Command strix-scan is a tiny, dependency-free client for a running yarad's HTTP /scan endpoint. It exists for the host that DELIVERS mail (a Dovecot LDA / Sieve box) but does NOT carry the YARA rules: pipe a message in, let the central yarad scan it, act on the exit code.

Unlike the main `yarad` binary it links no CGO / libyara and embeds no rules — it is pure Go and compiles to a small static binary you can drop on any mail host. The whole job is: read the message (stdin or a file), POST it to <url>/scan with the shared token, and translate the JSON verdict into an exit code a Sieve `vnd.dovecot.execute` / pipe filter can branch on.

Usage:

strix-scan -url http://strixd:8079 [-token-file F] [flags] [file]
strix-scan -url http://strixd:8079 - < /var/mail/cur/123:2,S
cat message | strix-scan -url http://strixd:8079

Exit codes (scriptable):

0  clean — no actionable rule matched (also returned for log-only canary/
   allowlisted hits, and on a fail-open scanner outage)
1  at least one actionable rule matched
2  usage / read / (fail-closed) transport error

Fail-open is the delivery-safety default: a scanner outage, timeout, or non-200 is treated as clean (exit 0) so mail is never blocked by a down backend. Pass -fail-open=false for interactive triage, where a silent miss is worse than a visible error.