Work in progress: Clam 2677 2678 codesigning

[micahsnyder]

This is a work in progress near completion. It bears similarities to #1344, adding external code signing signature files (.cvd.sign) to accompany existing .cvd databases.

The .sign take a form similar to other clamav signatures where comment lines start with a # and all other lines are signatures. Each signature line takes the form:

min_flevel : max_flevel (optional) : sig_format : public_key_fingerprint : signature_text

min_flevel:  the minimum flevel required to support the signature format.
max_flevel:  the maximum flevel supporting the signature format. This is optional, and may be empty. 
signature_format:  for the initial implementation, it must be: "pkcs7-pem".
signature_text:  must be printable ascii with no new lines. If "sig_format" is "pkcs7-pem" it is the base64 encoded part of the a PEM signature (aka header and footer removed) with all new-lines removed. if additional formats are added, this field would be used to store things like the hash of the file, the algorithm, plus any other required signing details. 

I've added commands to sigtool for signing:

  Commands creating and verifying .sign detached digital signatures:

    --sign FILE                            Sign a file.
                                           The resulting .sign file name will
                                           be in the form: dbname-version.cvd.sign
                                           or FILE.sign for non-CVD targets.
                                           It will be created next to the target file.
                                           If a .sign file already exists, then the
                                           new signature will be appended to file.
    --key /path/to/private.key             Specify a signing key.
    --cert /path/to/private.key            Specify a signing cert.
                                           May be used more than once to add
                                           intermediate and root certificates.

    --verify FILE                          Find and verify a detached digital
                                           signature for the given file.
                                           The digital signature file name must
                                           be in the form: dbname-version.cvd.sign
                                           or FILE.sign for non-CVD targets.
                                           It must be found next to the target file.
    --cvdcertsdir DIRECTORY                Specify a directory containing the root
                                           CA cert needed to verify the signature.
                                           If not provided, then sigtool will look in:
                                           /usr/local/etc/certs/

I have not included scripts needed for openssl to generate signing keys and certs.

I am still working on adding changes to freshclam and then cvdupdate to download .cvd.sign files.

@mark-carey-sap @aghassemlouei

Fixes: #564

Replaces: #1344

[micahsnyder]

Do we want to also check this for CUD? Probably. This would be a case where database is not signed with old MD5-RSA, and only signed with external PKCS7 sig.

[micahsnyder]

Consider if we want to make a config or commandline option to disable the older md5-based RSA checks, or simply let it fail if FIPS is enabled and the cert-based method doesn't work/isn't available.

I think it's okay either way.

[micahsnyder]

This is temporarily pointing a copy of the rust clam-sigutil project in my workspace. Will change it to a github URL soon.

[micahsnyder]

sigtool --sign: After debug-logging the certs for the cert stack, should info-print:

• cert Serial
• CommonName
• the issuer commonName (if an issuer exists)

[micahsnyder]

For verifying,

1. Load all ca certs from the ca certs directory into the x509 store and put the x509 store into the Verifier.

2. The Verifier should be stored in the cl_engine.

Edit: done.