FIPS-mode support Re: md5 -> sha2-256 caching, FP signatures, legacy CVD dsig verification, and related improvements - #1532

Merged

val-ms merged 34 commits into

Cisco-Talos:mainfrom

val-ms:CLAM-1859-sha256-cache

Aug 19, 2025

Commits on Aug 15, 2025

Swap clean cache from MD5 to SHA2-256
val-ms
committed
aa7b7e9
Record unique object-id for each layer scanned
val-ms
committed
f7e60d5
For metadata JSON feature, also save URIs for contained HTML files
val-ms
committed
81baf60
Record scan matches (evidence) at each recursion layer
val-ms
committed
7f25b92
libclamav: Add engine option to toggle temp directory recursion
val-ms
committed
31dcec1
ClamBC: fix crashes on startup
val-ms
committed
87a2957
Reformat clamav.h for readability
val-ms
committed
ff42820
libclamav: Add 'ex'-scan functions to API w. hash and type in/out parameters
val-ms
committed
e64590d
ClamScan: Add hash & file-type in/out CLI options
val-ms
committed
466c875
Tests: Add clamscan tests for new hash and file-type options
val-ms
committed
b4f0d68
Fix double-extraction of OOXML-based office documents
val-ms
committed
d0853bf
Always run callbacks for embedded files
val-ms
committed
42c4a88
libclamav: scan-layer callback API functions
val-ms
committed
f05770f
ClamScan & libclamav: improve precision of bytes-scanned, bytes-read
val-ms
committed
51adfb8
FIPS & FIPS-like limits on hash algs for cryptographic uses
val-ms
committed
13c4788
Auto-format touch-up
val-ms
committed
4660141
Update generated Rust sys.rs interface
val-ms
committed
f302a2c
NSIS: When extracting files, get the path's basename when recording the name
val-ms
committed
1478763
ClamsScan: add missing --json-store-extra-hashes option to help and manpage
val-ms
committed
cf11815
Tests: Enable --fips-limits for fp-check tests
val-ms
committed
91072db
Tests: clamscan --fips-limits for CVD loading
val-ms
committed
8e1fb00
clamav.h: cl_fmap_get_hash() output paramater is allocated, not const
val-ms
committed
3255ec1
Example program: demonstrate more features and support scripted inputs
val-ms
committed
e223ddb
Add missing message string when printing CL_BREAK code
val-ms
committed
9d25367
libclamav: cl_scan*_ex() functions provide verdict separate from errors
val-ms
committed
6d9b57e
Added additional ex_scan_callbacks test and fixed a couple related bugs
val-ms
committed
ed3e1e5
Replace CL_CLEAN with CL_SUCCESS in clamav.h, and scanners.c
val-ms
committed
520971d
Example Program: Add --disable-cache feature
val-ms
committed
39fa618
libclamav: Fix issue reporting trusted verdicts
val-ms
committed
0ea66b5
metadata JSON: Rename "Viruses" key to "Alerts"
val-ms
committed
3975c43
Metadata JSON: Simplify recording alerts and indicators
val-ms
committed
3b23133
Minor improvement to debug log messages from code review
val-ms
committed
b34ea5e

Commits on Aug 18, 2025

Fix OpenSSL 1 compatibility issue, plus minor improvements
val-ms
committed
27fe03c
Update generated sys.rs file
val-ms
committed
5314973

Navigation Menu

Uh oh!

FIPS-mode support Re: md5 -> sha2-256 caching, FP signatures, legacy CVD dsig verification, and related improvements - #1532

FIPS-mode support Re: md5 -> sha2-256 caching, FP signatures, legacy CVD dsig verification, and related improvements#1532
val-ms merged 34 commits into
Cisco-Talos:mainfrom
val-ms:CLAM-1859-sha256-cache

Commits on Aug 15, 2025

Swap clean cache from MD5 to SHA2-256

Record unique object-id for each layer scanned

For metadata JSON feature, also save URIs for contained HTML files

Record scan matches (evidence) at each recursion layer

libclamav: Add engine option to toggle temp directory recursion

ClamBC: fix crashes on startup

Reformat clamav.h for readability

libclamav: Add 'ex'-scan functions to API w. hash and type in/out parameters

ClamScan: Add hash & file-type in/out CLI options

Tests: Add clamscan tests for new hash and file-type options

Fix double-extraction of OOXML-based office documents

Always run callbacks for embedded files

libclamav: scan-layer callback API functions

ClamScan & libclamav: improve precision of bytes-scanned, bytes-read

FIPS & FIPS-like limits on hash algs for cryptographic uses

Auto-format touch-up

Update generated Rust sys.rs interface

NSIS: When extracting files, get the path's basename when recording the name

ClamsScan: add missing --json-store-extra-hashes option to help and manpage

Tests: Enable --fips-limits for fp-check tests

Tests: clamscan --fips-limits for CVD loading

clamav.h: cl_fmap_get_hash() output paramater is allocated, not const

Example program: demonstrate more features and support scripted inputs

Add missing message string when printing CL_BREAK code

libclamav: cl_scan*_ex() functions provide verdict separate from errors

Added additional ex_scan_callbacks test and fixed a couple related bugs

Replace CL_CLEAN with CL_SUCCESS in clamav.h, and scanners.c

Example Program: Add --disable-cache feature

libclamav: Fix issue reporting trusted verdicts

metadata JSON: Rename "Viruses" key to "Alerts"

Metadata JSON: Simplify recording alerts and indicators

Minor improvement to debug log messages from code review

Commits on Aug 18, 2025

Fix OpenSSL 1 compatibility issue, plus minor improvements

Update generated sys.rs file