feat: PE Rich-header fingerprint (offsetscan rich); strip long dashes; add FUNDING - 0.4.0

[warpedatom]

Summary by Sourcery

Add PE Rich-header parsing and fingerprinting as a new OffsetScan subcommand and release version 0.4.0.

New Features:

• Introduce the offsetscan rich subcommand to parse PE Rich headers and emit a build-toolchain fingerprint hash (RichHash) and comp.id records.
• Expose the Rich-header analysis as a structured JSON output type with per-file metadata and warnings, integrated into the existing corpus-scanning pipeline.

Enhancements:

• Document the Rich-header capability in the README alongside existing IOC, clustering, and YARA features, including usage examples and output shape.
• Clarify JSON parity boundaries by explicitly noting that the cluster and rich subcommands sit outside the OffsetInspect compatibility contract.
• Normalize documentation wording by replacing long dashes with standard hyphens in user-facing text for consistency.

Build:

• Bump the crate version from 0.3.0 to 0.4.0 in Cargo.toml to publish the new Rich-header functionality.

Documentation:

• Add detailed CHANGELOG and README entries for the 0.4.0 release describing the new Rich-header fingerprinting feature, its schema, and validation against pefile.

Chores:

• Add a GitHub funding configuration file to enable the repository sponsor button.

[sourcery-ai]

Reviewer's Guide

Adds a new offsetscan rich subcommand to parse PE Rich headers and emit a build-toolchain fingerprint (RichHash and comp.id records), wires it into the CLI and corpus runner, bumps the crate to v0.4.0, documents the feature in README/CHANGELOG, and normalizes various docs/comments to use hyphen-minus instead of em dashes.

Sequence diagram for the new offsetscan rich subcommand

sequenceDiagram
    actor User
    participant offsetscan as offsetscan_main
    participant expand_paths
    participant run
    participant fs as fs_read
    participant rich

    User->>offsetscan: offsetscan rich path --recurse
    offsetscan->>expand_paths: expand_paths(path, recurse)
    expand_paths-->>offsetscan: files
    offsetscan->>run: run(files, ndjson, closure)
    loop for each file
        run->>fs: read(file)
        fs-->>run: data
        run->>rich: parse_rich(data, file_path)
        rich-->>run: RichInfo
        run-->>User: RichInfo (JSON/NDJSON)
    end

Loading

File-Level Changes

Change	Details	Files
Introduce PE Rich-header parsing with a stable RichHash and structured comp.id records, exposed via a new offsetscan rich subcommand.	Create a new rich module that locates and decrypts the PE Rich header, derives a toolchain-invariant MD5 RichHash from the decrypted array, and exposes a RichInfo schema with entries and warnings. Implement robust detection logic that scans for the Rich trailer, verifies it via XOR-decrypted DanS, handles malformed/absent headers gracefully, and includes unit tests covering invariance to XOR key, determinism, decoy markers, and JSON field names. Wire rich::parse_rich into the CLI as offsetscan rich using the existing path expansion and run streaming machinery so it works on single files and corpora with --recurse/--ndjson. Reuse the existing md-5 dependency for hashing without adding new crate dependencies.	src/rich.rs src/main.rs Cargo.toml Cargo.lock
Document and version the new Rich-header feature and adjust narrative docs to reflect it and normalize punctuation.	Add a 0.4.0 CHANGELOG entry describing offsetscan rich, its output shape, parity guarantees with pefile, and its OffsetScan-only status. Expand README with a new Rich header section, CLI usage examples for offsetscan rich, and mention that rich sits outside the OffsetInspect parity contract. Normalize README, CHANGELOG, and Rust doc comments to prefer ASCII hyphen-minus '-' over extended dashes in prose and bullet text.	CHANGELOG.md README.md src/schema.rs src/cluster.rs src/entropy.rs src/pe.rs src/strings.rs src/ioc.rs src/yara_scan.rs Cargo.toml
Repository/meta updates for the new release.	Add GitHub Sponsors configuration so the repo displays a sponsor button. Tidy project configuration files and ignore patterns as part of the release cut to v0.4.0.	.github/FUNDING.yml .gitignore Cargo.lock

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• The Rich header parsing duplicates some DOS/PE header logic (MZ check, e_lfanew handling) that already exists in pe.rs; consider centralizing this in a shared helper to avoid future divergence between modules.
• In rich.rs, you import the Digest trait from sha2 but use it only with Md5; it would be clearer to pull the trait from the same hashing crate (or from digest) to avoid the cross-crate coupling in this module.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The Rich header parsing duplicates some DOS/PE header logic (MZ check, e_lfanew handling) that already exists in `pe.rs`; consider centralizing this in a shared helper to avoid future divergence between modules.
- In `rich.rs`, you import the `Digest` trait from `sha2` but use it only with `Md5`; it would be clearer to pull the trait from the same hashing crate (or from `digest`) to avoid the cross-crate coupling in this module.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}