mirror of
https://github.com/HDFGroup/hdf5.git
synced 2026-09-25 04:09:44 +03:00
86bdc78365
feat: add optional digital signature verification for HDF5 filter plugins Introduce an opt-in plugin signing and verification system that allows HDF5 deployments to require cryptographically signed filter plugins before loading them. Disabled by default (HDF5_REQUIRE_SIGNED_PLUGINS=OFF). New tool: h5sign - Signs plugin shared libraries by appending an RSA signature and a 14-byte footer (algo_id | sig_len | 8-byte magic | format_ver) to the binary without modifying the original content. - Supports SHA-512 (default), SHA-256, SHA-384, and their PSS variants (-a/--algorithm flag). - Detects already-signed plugins; --force strips the old signature and re-signs. - Security hardened: keeps the file descriptor open through hashing and appending (no TOCTOU window), enforces a 2048-bit minimum RSA key size, rolls back partial writes on failure, and rejects paths that are not regular files. Verification (H5PLsig.c) - At plugin load time, reads the footer, validates the magic and format version, then checks the RSA signature against all public keys found in the KeyStore directory. - File is hashed once; per-key verification operates on the pre-computed digest (no redundant I/O for multi-key keystores). - Plugins whose signature hash appears in revoked_signatures.txt are rejected regardless of key validity. - Runtime debug output via HDF5_DEBUG=pl. KeyStore management - Trusted public keys are PEM files in a directory specified by HDF5_PLUGIN_KEYSTORE_DIR (build time) or HDF5_PLUGIN_KEYSTORE (env var). - HDF5_LOCK_PLUGIN_KEYSTORE cmake option disables the env-var override for security-hardened deployments. Test infrastructure - h5signverifytest: positive, negative, tamper, re-sign, and revocation test cases. - CTest fixture-based dependency graph (FIXTURES_SETUP/FIXTURES_REQUIRED) replaces fragile DEPENDS chains so tests remain correct under -R filtering. - Dedicated signed-plugins.yml CI workflow; full test suite scoped to H5SIGN and H5PLUGIN-signature tests to avoid unrelated flaky failures. - Cross-platform: Linux, macOS, and Windows (MSVC-compatible, BIO-based OpenSSL I/O, HDsleep/HDsetenv portability wrappers). Documentation: docs/PLUGIN_SIGNATURE_README.md covers usage, footer format, revocation file format, FAQ, and troubleshooting. Co-authored-by: Glenn Song <gsong@hdfgroup.org> Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
53 lines
1.6 KiB
CMake
53 lines
1.6 KiB
CMake
#
|
|
# Copyright by The HDF Group.
|
|
# All rights reserved.
|
|
#
|
|
# This file is part of HDF5. The full HDF5 copyright notice, including
|
|
# terms governing use, modification, and redistribution, is contained in
|
|
# the COPYING file, which can be found at the root of the source code
|
|
# distribution tree, or in https://www.hdfgroup.org/licenses.
|
|
# If you do not have access to either file, you may request a copy from
|
|
# help@hdfgroup.org.
|
|
#
|
|
|
|
#[=======================================================================[.rst:
|
|
SignPlugin
|
|
----------
|
|
|
|
Provides a CMake function to sign plugin libraries when HDF5_REQUIRE_SIGNED_PLUGINS is enabled.
|
|
|
|
.. command:: sign_plugin_target
|
|
|
|
Signs a plugin target using the h5sign tool.
|
|
|
|
.. code-block:: cmake
|
|
|
|
sign_plugin_target(<target> <plugin_dir>)
|
|
|
|
``target``
|
|
The CMake target to sign (must be a shared library plugin)
|
|
|
|
``plugin_dir``
|
|
The directory where the plugin will be located after build
|
|
|
|
This function adds a post-build command that:
|
|
- Signs the plugin using the h5sign tool
|
|
- Uses the test private key (${CMAKE_BINARY_DIR}/private.pem)
|
|
- Only executes if HDF5_REQUIRE_SIGNED_PLUGINS is enabled
|
|
|
|
#]=======================================================================]
|
|
|
|
function(sign_plugin_target TARGET PLUGIN_DIR)
|
|
if (HDF5_REQUIRE_SIGNED_PLUGINS)
|
|
add_dependencies(${TARGET} h5sign)
|
|
add_custom_command(
|
|
TARGET ${TARGET}
|
|
POST_BUILD
|
|
COMMAND $<TARGET_FILE:h5sign>
|
|
ARGS -p "${PLUGIN_DIR}/$<TARGET_FILE_NAME:${TARGET}>"
|
|
-k "${CMAKE_BINARY_DIR}/private.pem"
|
|
COMMENT "Signing test plugin ${TARGET} for signature verification"
|
|
)
|
|
endif()
|
|
endfunction()
|