undefined symbol: yr_finalize

[plutec]

I installed in a clean virtual machine yara from sources:

./bootstrap.sh
./configure
make
sudo make install

and yara works fine.

Then, I installed yara-python from github:

git clone ...
python setup.py build
sudo python setup.py install

And when I received the next error when I import yara in python:

Python 2.7.6 (default, Jun 22 2015, 17:58:13) 
[GCC 4.8.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import yara
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ImportError: /usr/local/lib/python2.7/dist-packages/yara_python-3.4.0.0-py2.7.egg/yara.so: undefined symbol: yr_finalize

Any idea?

[apolkosnik-old]

Inside yara-python folder you need to have yara folder that's a clone of https://github.com/plusvic/yara.git repo . Otherwise, the thing won't build/link properly and there's no descriptive error message that'll say that. and it's good to touch yara-python.c before doing python setup.py build.

[kin9-0rz]

Linux ubuntu 4.4.0-31-generic #50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
Distributor ID:	Ubuntu
Description:	Ubuntu 16.04.1 LTS
Release:	16.04
Codename:	xenial

Python 3.5.2 (default, Sep 10 2016, 08:21:44) 
[GCC 5.4.0 20160609] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import yara
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ImportError: /usr/local/lib/python3.5/dist-packages/yara_python-3.5.0-py3.5-linux-x86_64.egg/yara.cpython-35m-x86_64-linux-gnu.so: undefined symbol: yr_finalize
>>> 

I have the same problem.
I clone the https://github.com/plusvic/yara.git, but it could not build

ubuntu:~/yara-python$ python3 setup.py build
running build
running build_ext
building 'yara' extension
x86_64-linux-gnu-gcc -pthread -DNDEBUG -g -fwrapv -O2 -Wall -Wstrict-prototypes -g -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -fPIC -Iyara/libyara/include -Iyara/libyara/ -I. -I/usr/include/python3.5m -c yara-python.c -o build/temp.linux-x86_64-3.5/yara-python.o
yara-python.c: In function ‘yara_callback’:
yara-python.c:727:60: error: ‘YR_MATCH {aka struct _YR_MATCH}’ has no member named ‘data_length’
       object = PyBytes_FromStringAndSize((char*) m->data, m->data_length);
                                                            ^
yara-python.c: In function ‘handle_error’:
yara-python.c:940:10: error: ‘ERROR_INVALID_EXTERNAL_VARIABLE_TYPE’ undeclared (first use in this function)
     case ERROR_INVALID_EXTERNAL_VARIABLE_TYPE:
          ^
yara-python.c:940:10: note: each undeclared identifier is reported only once for each function it appears in
error: command 'x86_64-linux-gnu-gcc' failed with exit status 1

any idea? Thanks.

[kin9-0rz]

Change yara @ d348dd3 to master, it works.

[blshkv]

there is absolutely no reason to mandatory use a local copy of yara if it is available as a system library.
My patch above fixes it (https://github.com/pentoo/pentoo-overlay/blob/master/dev-python/yara-python/files/yara-systemlib.patch)