Testing with Malware Samples
The default checkout and ordinary test suites do not contain or require real malware samples. They use harmless fixtures for scanner behavior and rule-boundary coverage.
Maintainers can run the separate laboratory corpus suite by provisioning the verified corpus, setting AMWSCAN_CORPUS_DIR, and running:
composer test:corpus
The requested run fails if corpus files are missing or do not match tests/Corpus/manifest.json. Samples are read only as data and must never be executed, included, evaluated, or served.
The baseline tests report mismatches per sample and record definition-source hashes and PHP/PCRE settings. Optimized signature group IDs can change when definitions or grouping change. Review added and removed matches and regex errors before refreshing expectations; keep sample paths, sizes, and SHA-256 checksums unchanged. Empty results or recorded regex errors do not establish that a sample is clean.
The corpus is sensitive laboratory material. It is not downloaded automatically, included in release packages, or made available to untrusted pull-request jobs.