diff --git a/common/shlibs b/common/shlibs
index dc87931092f..a7d6cf3c997 100644
--- a/common/shlibs
+++ b/common/shlibs
@@ -2848,3 +2848,4 @@ libbacsql-7.4.7.so bacula-common-7.4.7_1
 libbaccats-7.4.7.so bacula-common-7.4.7_1
 libsuperlu.so.5 superlu-5.2.1_1
 libgosu.so.0 gosu-0.12.0_1
+libyara.so.3 libyara-3.5.0_1
diff --git a/srcpkgs/libyara b/srcpkgs/libyara
new file mode 120000
index 00000000000..82141092ead
--- /dev/null
+++ b/srcpkgs/libyara
@@ -0,0 +1 @@
+yara
\ No newline at end of file
diff --git a/srcpkgs/yara-devel b/srcpkgs/yara-devel
new file mode 120000
index 00000000000..82141092ead
--- /dev/null
+++ b/srcpkgs/yara-devel
@@ -0,0 +1 @@
+yara
\ No newline at end of file
diff --git a/srcpkgs/yara/patches/libressl.patch b/srcpkgs/yara/patches/libressl.patch
new file mode 100644
index 00000000000..e5032b399a7
--- /dev/null
+++ b/srcpkgs/yara/patches/libressl.patch
@@ -0,0 +1,31 @@
+--- libyara/libyara.c.orig	2016-09-06 20:09:47.000000000 +0000
++++ libyara/libyara.c	2017-05-10 12:40:13.393089280 +0000
+@@ -71,7 +71,7 @@
+ char altercase[256];
+ 
+ 
+-#if defined HAVE_LIBCRYPTO && OPENSSL_VERSION_NUMBER < 0x10100000L
++#if defined HAVE_LIBCRYPTO && (OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER))
+ 
+ // The OpenSSL library before version 1.1 requires some locks in order
+ // to be thread-safe. These locks are initialized in yr_initialize
+@@ -133,7 +133,7 @@
+   FAIL_ON_ERROR(yr_thread_storage_create(&tidx_key));
+   FAIL_ON_ERROR(yr_thread_storage_create(&recovery_state_key));
+ 
+-  #if defined HAVE_LIBCRYPTO && OPENSSL_VERSION_NUMBER < 0x10100000L
++  #if defined HAVE_LIBCRYPTO && (OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER))
+ 
+   openssl_locks = (YR_MUTEX*) OPENSSL_malloc(
+       CRYPTO_num_locks() * sizeof(YR_MUTEX));
+--- libyara/modules/pe.c.orig	2016-09-06 20:09:47.000000000 +0000
++++ libyara/modules/pe.c	2017-05-10 12:38:23.755095815 +0000
+@@ -42,7 +42,7 @@
+ #include <openssl/bio.h>
+ #include <openssl/pkcs7.h>
+ #include <openssl/x509.h>
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ #define X509_get_signature_nid(o) OBJ_obj2nid((o)->sig_alg->algorithm)
+ #endif
+ #endif
diff --git a/srcpkgs/yara/template b/srcpkgs/yara/template
new file mode 100644
index 00000000000..08e51630785
--- /dev/null
+++ b/srcpkgs/yara/template
@@ -0,0 +1,39 @@
+# Template file for 'yara'
+pkgname=yara
+version=3.5.0
+revision=1
+build_style=gnu-configure
+hostmakedepends="automake libtool"
+makedepends="libressl-devel"
+short_desc="Pattern matching swiss knife for malware researchers"
+maintainer="Michael Gehring <mg@ebfe.org>"
+license="3-clause-BSD"
+homepage="http://virustotal.github.io/yara/"
+distfiles="https://github.com/VirusTotal/yara/archive/v${version}.tar.gz"
+checksum=4bc72ee755db85747f7e856afb0e817b788a280ab5e73dee42f159171a9b5299
+
+pre_configure() {
+	autoreconf -fi
+}
+
+libyara_package() {
+	short_desc+=" - library"
+	pkg_install() {
+		vmove usr/lib/*.so.*
+	}
+}
+
+yara-devel_package() {
+	depends="libyara-${version}-${revision}"
+	short_desc+=" - development files"
+	pkg_install() {
+		vmove usr/include
+		vmove usr/lib/*.a
+		vmove usr/lib/*.so
+		vmove usr/lib/pkgconfig
+	}
+}
+
+post_install() {
+	vlicense COPYING
+}