Struct KnownBadDb 

pub struct KnownBadDb { /* private fields */ }

Provenance-tracked malware hash lookup database.

Phase 1: backed by a HashMap (exact matching, zero false positives). Phase 2 (future): might_be_malicious will be backed by an XOR filter pre-screen, but the public API will remain unchanged.

Implementations

impl KnownBadDb

pub fn from_entries( iter: impl IntoIterator<Item = ([u8; 32], BadFileInfo)>, ) -> Self

Construct from an iterator of (sha256, info) pairs.

pub fn might_be_malicious(&self, sha256: &[u8; 32]) -> bool

Fast pre-screen. Returns true if the hash MIGHT be in the database.

No false negatives. Phase 1: backed by HashMap (no false positives either). Phase 2 will swap in an XOR filter pre-screen.

pub fn lookup(&self, sha256: &[u8; 32]) -> Option<&BadFileInfo>

Exact lookup with full provenance. Returns None if definitely not present.

pub fn len(&self) -> usize

Number of entries in the database.

pub fn is_empty(&self) -> bool