Add support for precompiled rules

[bradlarsen]

Compiling the rules into a Vectorscan database currently is very expensive in debug builds, where I see it taking some 6 seconds. In release builds, the compilation is much faster (perhaps 1/3 of a second). The slow compilation in debug builds is especially irksome, because that's the development configuration where you'd like to be able to quickly iterate.

It would be ideal if, instead of compiling the rules database from scratch each run, Nosey Parker could load a precompiled rules database.

Last I looked at Vectorscan, there were APIs for serialization of databases, but the serialized format did not sound to be machine-independent. So it would be difficult to precompile that database and include it as an asset in the release binary.

An alternative would be to have Nosey Parker optionally (and by default) look in a special location at runtime for a machine-specific precompiled rule file that it could load, and generate that if needed. Though this approach is fraught with its own perils, such as: what if the notable location ends up in a network-mounted home directory shared across systems?

[bradlarsen]

Nosey Parker also has to compile the rules into Rust regex objects. That is also expensive, though not nearly as much as Vectorscan compilation.

When I looked into the possibility of serializing the regex objects into precompiled form several months ago, it seems like it was not possible with currently exposed Rust regex APIs.

[munntjlx]

I like this idea, since I can 'add' things to nosey w/o having to recompile it each time I add a sig! like "noseycompile --directory /path/to/sigs and a nosey.conf which tells me where to look for these.

[bradlarsen]

I like this idea, since I can 'add' things to nosey w/o having to recompile it each time I add a sig! like "noseycompile --directory /path/to/sigs and a nosey.conf which tells me where to look for these.

Note, you should be able to add new rules to Nosey Parker without recompiling the program. The scan --rules PATH option loads additional rules from PATH. These would not be default rules, however: you'd have to include those extra rules in each invocation.