mirror of
https://github.com/HDFGroup/hdf5.git
synced 2026-09-25 04:09:44 +03:00
86bdc78365
feat: add optional digital signature verification for HDF5 filter plugins Introduce an opt-in plugin signing and verification system that allows HDF5 deployments to require cryptographically signed filter plugins before loading them. Disabled by default (HDF5_REQUIRE_SIGNED_PLUGINS=OFF). New tool: h5sign - Signs plugin shared libraries by appending an RSA signature and a 14-byte footer (algo_id | sig_len | 8-byte magic | format_ver) to the binary without modifying the original content. - Supports SHA-512 (default), SHA-256, SHA-384, and their PSS variants (-a/--algorithm flag). - Detects already-signed plugins; --force strips the old signature and re-signs. - Security hardened: keeps the file descriptor open through hashing and appending (no TOCTOU window), enforces a 2048-bit minimum RSA key size, rolls back partial writes on failure, and rejects paths that are not regular files. Verification (H5PLsig.c) - At plugin load time, reads the footer, validates the magic and format version, then checks the RSA signature against all public keys found in the KeyStore directory. - File is hashed once; per-key verification operates on the pre-computed digest (no redundant I/O for multi-key keystores). - Plugins whose signature hash appears in revoked_signatures.txt are rejected regardless of key validity. - Runtime debug output via HDF5_DEBUG=pl. KeyStore management - Trusted public keys are PEM files in a directory specified by HDF5_PLUGIN_KEYSTORE_DIR (build time) or HDF5_PLUGIN_KEYSTORE (env var). - HDF5_LOCK_PLUGIN_KEYSTORE cmake option disables the env-var override for security-hardened deployments. Test infrastructure - h5signverifytest: positive, negative, tamper, re-sign, and revocation test cases. - CTest fixture-based dependency graph (FIXTURES_SETUP/FIXTURES_REQUIRED) replaces fragile DEPENDS chains so tests remain correct under -R filtering. - Dedicated signed-plugins.yml CI workflow; full test suite scoped to H5SIGN and H5PLUGIN-signature tests to avoid unrelated flaky failures. - Cross-platform: Linux, macOS, and Windows (MSVC-compatible, BIO-based OpenSSL I/O, HDsleep/HDsetenv portability wrappers). Documentation: docs/PLUGIN_SIGNATURE_README.md covers usage, footer format, revocation file format, FAQ, and troubleshooting. Co-authored-by: Glenn Song <gsong@hdfgroup.org> Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
53 lines
2.6 KiB
CMake
53 lines
2.6 KiB
CMake
# CMake configuration for building and testing the h5diff tool
|
|
# Configures dynamic plugin library for h5diff if shared builds are enabled
|
|
# Sets up include directories, linking, and formatting for plugin targets
|
|
# Includes test scripts for h5diff if test tools are enabled
|
|
|
|
cmake_minimum_required (VERSION 3.26)
|
|
project (HDF5_TOOLS_TEST_H5DIFF C)
|
|
|
|
#-----------------------------------------------------------------------------
|
|
# If plugin library tests can be tested
|
|
#-----------------------------------------------------------------------------
|
|
if (BUILD_SHARED_LIBS)
|
|
set (H5DIFF_TOOL_PLUGIN_LIB_CORENAME "dynlibdiff")
|
|
set (H5DIFF_TOOL_PLUGIN_LIB_NAME "${HDF5_EXTERNAL_LIB_PREFIX}${H5DIFF_TOOL_PLUGIN_LIB_CORENAME}")
|
|
set (H5DIFF_TOOL_PLUGIN_LIB_TARGET ${H5DIFF_TOOL_PLUGIN_LIB_CORENAME})
|
|
|
|
add_library (${H5DIFF_TOOL_PLUGIN_LIB_TARGET} SHARED dynlib_diff.c)
|
|
target_include_directories (${H5DIFF_TOOL_PLUGIN_LIB_TARGET} PRIVATE "${HDF5_SRC_INCLUDE_DIRS};${HDF5_SRC_BINARY_DIR};$<$<BOOL:${HDF5_ENABLE_PARALLEL}>:${MPI_C_INCLUDE_DIRS}>")
|
|
TARGET_C_PROPERTIES (${H5DIFF_TOOL_PLUGIN_LIB_TARGET} SHARED)
|
|
target_link_libraries (${H5DIFF_TOOL_PLUGIN_LIB_TARGET} PRIVATE ${HDF5_LIBSH_TARGET})
|
|
H5_SET_LIB_OPTIONS (${H5DIFF_TOOL_PLUGIN_LIB_TARGET} ${H5DIFF_TOOL_PLUGIN_LIB_NAME} SHARED "LIB")
|
|
|
|
#-----------------------------------------------------------------------------
|
|
# Add Target to clang-format
|
|
#-----------------------------------------------------------------------------
|
|
if (HDF5_ENABLE_FORMATTERS)
|
|
clang_format (HDF5_TOOLS_TEST_H5DIFF_PLUGIN_FORMAT ${H5DIFF_TOOL_PLUGIN_LIB_TARGET})
|
|
endif ()
|
|
|
|
# make plugins dir
|
|
file (MAKE_DIRECTORY "${CMAKE_BINARY_DIR}/plugins")
|
|
#-----------------------------------------------------------------------------
|
|
# Copy plugin library to a plugins folder
|
|
#-----------------------------------------------------------------------------
|
|
add_custom_command (
|
|
TARGET ${H5DIFF_TOOL_PLUGIN_LIB_TARGET}
|
|
POST_BUILD
|
|
COMMAND ${CMAKE_COMMAND}
|
|
ARGS -E copy_if_different
|
|
"$<TARGET_FILE:${H5DIFF_TOOL_PLUGIN_LIB_TARGET}>"
|
|
"${CMAKE_BINARY_DIR}/plugins/$<TARGET_FILE_NAME:${H5DIFF_TOOL_PLUGIN_LIB_TARGET}>"
|
|
)
|
|
|
|
#-----------------------------------------------------------------------------
|
|
# Sign the plugin if signature verification is enabled
|
|
#-----------------------------------------------------------------------------
|
|
sign_plugin_target(${H5DIFF_TOOL_PLUGIN_LIB_TARGET} "${CMAKE_BINARY_DIR}/plugins")
|
|
endif ()
|
|
|
|
if (HDF5_TEST_TOOLS)
|
|
include (CMakeTests.cmake)
|
|
endif ()
|