✨[Feature] Digital Signature Verification for HDF5 Plugins

[brtnfld]

Description

This PR introduces a robust security framework for digitally signing and verifying HDF5 dynamic plugins (filters). This feature ensures that the HDF5 library loads only trusted, unmodified plugins, significantly enhancing security in environments where plugins are distributed dynamically.

Key Features

1. Plugin Signature Verification

• Mechanism: Implements an append-style signature verification where RSA signatures are attached to the plugin binary footer. This allows signed plugins to remain compatible with standard system loaders while enabling cryptographic verification by HDF5.
• Crypto: Utilizes OpenSSL (1.1.0+) for RSA signature verification (SHA-256, SHA-384, SHA-512 supported).
• Key Management: Introduces a "KeyStore" concept. Public keys can be loaded from:
  • A configured directory (HDF5_PLUGIN_KEYSTORE_DIR).
  • An environment variable (HDF5_PLUGIN_KEYSTORE).
  • A compile-time embedded key (fallback).
• Performance: Implements an internal signature cache to prevent redundant verification of the same plugin file, ensuring minimal performance impact after the first load.
• Revocation: Adds support for a revocation list (blocklist) to reject specific known-bad signatures.

2. New Tool: h5sign

• Added a new command-line tool, h5sign, located in tools/src/h5sign.
• Allows plugin developers to sign their binaries using a private key.
• Supports verification mode to check existing signatures.

3. Build & Configuration Changes

• New CMake Option: HDF5_REQUIRE_SIGNED_PLUGINS (Default: OFF). When enabled, HDF5 enforces signature verification and refuses to load unsigned or invalid plugins.
• Dependencies: Adds OpenSSL as a required dependency when signed plugins are enabled.

4. CI/CD & Infrastructure Updates

• New Workflow: Added .github/workflows/signed-plugins.yml to specifically test the new signature verification logic in serial and parallel configurations.

Technical Details

New Files

• src/H5PLsig.c / .h: Core logic for reading signatures, managing the KeyStore, and performing OpenSSL verification.
• tools/src/h5sign/: Source code for the signing utility.
• release_docs/PLUGIN_SIGNATURE_README.md: Comprehensive documentation for developers and users regarding key generation, signing, and air-gapped environment handling.
• test/test_plugin_signature.c: New test suite covering valid signatures, tampered binaries, and invalid keys.

Modified Files

• src/H5PLint.c: Hooked into the plugin loading process to trigger verification before dlopen/LoadLibrary.
• CMakeLists.txt & src/CMakeLists.txt: build logic for OpenSSL linking and new source files.
• .github/workflows/*: CI updates

Testing

• Added h5signverifytest and test_plugin_signature to the test suite.
• Verified that unsigned plugins are rejected when the feature is enabled.
• Verified that tampered plugins (bit-flipped) are rejected.
• Verified support for multiple trusted keys in a single KeyStore.
• Validated caching mechanisms to ensure performance.

Documentation

• Added release_docs/PLUGIN_SIGNATURE_README.md detailing the security model, usage instructions, and best practices.

Fixes #5116

[jhendersonHDF]

Minor changes but otherwise I think it looks good

[hyoklee]

Add --version option that matches -V.

[hyoklee]

Did anyone succeed signing ZFP plugin on OpenBSD?

[hyoklee]

Fix ZFP plugin first and run h5sign test on ZFP later again:

[ 78%] Building C object ZFP/example/CMakeFiles/h5ex_d_zfp.dir/h5ex_d_zfp.c.o
/home/runner/work/actions/actions/hdf5_plugins/ZFP/example/h5ex_d_zfp.c:179:73: warning: format specifies type 'int' but the argument has type 'size_t' (aka 'unsigned long') [-Wformat]
  179 |             printf("   Number of parameters is %d with the value %u\n", nelmts, values_out[0]);
      |                                                ~~                       ^~~~~~
      |                                                %zu
1 warning generated.
[ 79%] Linking C executable ../../bin/h5ex_d_zfp
ld: error: unable to find library -ldl
cc: error: linker command failed with exit code 1 (use -v to see invocation)
*** Error 1 in . (ZFP/example/CMakeFiles/h5ex_d_zfp.dir/build.make:102 'bin/h5ex_d_zfp')
*** Error 2 in . (CMakeFiles/Makefile2:2538 'ZFP/example/CMakeFiles/h5ex_d_zfp.dir/all')
*** Error 2 in /home/runner/work/actions/actions/plugins-build (Makefile:166 'all': /usr/bin/make -s -f CMakeFiles/Makefile2 all)

[lrknox]

I don't think the OpenBSD test configuration for push/pull request enables plugins, sp it's probably not tested there. I'll take a closer look later on.