emsign-g3-distrust 0.2.0__py3-none-any.whl

emsign_g3/__init__.py

@@ -0,0 +1,3 @@
+"""Defensive tooling for eMudhra/emSign G3 CA distrust (Mozilla Bug 2083449)."""
+
+__version__ = "0.2.0"

emsign_g3/cli.py

@@ -0,0 +1,79 @@
+"""Unified CLI for emsign-g3 distrust tooling."""
+from __future__ import annotations
+
+import argparse
+
+from emsign_g3.distrust import run_distrust
+from emsign_g3.export import run_export
+from emsign_g3.paths import default_certs_dir, indicators_csv_path
+from emsign_g3.scan import run_scan
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        prog="emsign-g3",
+        description="Detect and deny compromised eMudhra/emSign G3 intermediates (Bug 2083449).",
+    )
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    scan_p = sub.add_parser("scan", help="inventory trust stores (read-only)")
+    scan_p.add_argument("--json", action="store_true", help="machine-readable output")
+
+    dist_p = sub.add_parser("distrust", help="plan or apply intermediate blocklist")
+    dist_p.add_argument("--apply", action="store_true", help="execute (default: dry run)")
+    dist_p.add_argument("--undo", action="store_true", help="roll back instead of distrust")
+    dist_p.add_argument(
+        "--certs-dir",
+        default=None,
+        help=f"directory with eight verified PEMs (default: {default_certs_dir()})",
+    )
+
+    exp_p = sub.add_parser("export-indicators", help="SIEM/SOAR indicator bundle")
+    exp_p.add_argument("--csv", default=None, help="path to indicators.csv")
+    exp_p.add_argument(
+        "--format",
+        choices=("json", "ndjson", "sigma", "elastic-kql"),
+        default="json",
+        help="output format (default: json)",
+    )
+    exp_p.add_argument(
+        "--ndjson",
+        action="store_true",
+        help="shorthand for --format ndjson (deprecated)",
+    )
+    exp_p.add_argument("--verify", action="store_true", help="verify PEMs match CSV")
+    exp_p.add_argument("--certs-dir", default=None, help="PEM directory for --verify")
+    exp_p.add_argument(
+        "--output-dir",
+        default=None,
+        help="write --format sigma or elastic-kql files to this directory",
+    )
+    exp_p.add_argument(
+        "--check-committed-rules",
+        action="store_true",
+        help="verify rules/sigma and rules/elastic match generators",
+    )
+
+    args = parser.parse_args(argv)
+
+    if args.command == "scan":
+        return run_scan(as_json=args.json)
+    if args.command == "distrust":
+        return run_distrust(apply=args.apply, undo=args.undo, certs_dir=args.certs_dir)
+    if args.command == "export-indicators":
+        return run_export(
+            csv_path=args.csv or indicators_csv_path(),
+            fmt=args.format,
+            ndjson=args.ndjson,
+            verify=args.verify,
+            certs_dir=args.certs_dir,
+            output_dir=args.output_dir,
+            check_committed_rules=args.check_committed_rules,
+        )
+
+    parser.error(f"unknown command: {args.command}")
+    return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

emsign_g3/data/certs/EMDVTLSCAG3B.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu6gAwIBAgIQAKSu5njyM2K0wORgt3LyFDAKBggqhkjOPQQDAzBWMQsw
+CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
+ZDEgMB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwHhcNMjUwNDMwMTU1
+NDA4WhcNNDAwNDI4MTgzMDAwWjA/MQswCQYDVQQGEwJOTDETMBEGA1UECgwKZU11
+ZGhyYSBCVjEbMBkGA1UEAwwSRU0gRFYgVExTIENBIC0gRzNCMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAE557ZwEqXc8RzXlERHahawr1eZKs3S4DhLLwgOOweTw47gS/J
+hZ4eZ6+wTi+LyX90hbplqpEe6KTkW2LVzAPVa+Z4s8OMtNyTfKJGDiOEU8iSk10p
+1E+R4VYGtjzO2rRoo4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
+WUIgkFQwHQYDVR0OBBYEFOIeL+ccGTkOVUtiwSAkVzUkiiUUMB0GA1UdJQQWMBQG
+CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow
+KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
+BAGDjiEBAmQwCAYGZ4EMAQIBMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
+aHR0cDovL29jc3AtYi5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
+b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNRFZUTFNDQUczQi5wN2MwNwYDVR0f
+BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
+cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
+AwMDaAAwZQIwLmsGXi6oFMJ2klkcEMXMug6gvxQWZWkewiDWVzQyl2L6z6DuQfPO
+Ibh1grvdULDCAjEAxZvLlxUavG69J6wnSjC8XBbqNIQsJ6CE2QdNOe84Ptxb6VG8
+gt2TlfJbHii+KNvK
+-----END CERTIFICATE-----

emsign_g3/data/certs/EMDVTLSCAG3C.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu6gAwIBAgIPWIsuPCu4zaE+GhIJJUMhMAoGCCqGSM49BAMDMFYxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNTM1
+MDlaFw00MDA0MjgxODMwMDBaMEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVk
+aHJhIEluYzEbMBkGA1UEAwwSRU0gRFYgVExTIENBIC0gRzNDMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAEOnp4YsjETTJN3WkDOmeCwO/u/kBV5ooSP6A3G6O9kZRRTuFy
+pDPjYw8CvRiAN9nlFJ+bd9uUooHfmHsv6oiLdL3+j9pMEJnubKGVZv4+8OX2sJpV
+bMyLpQVh3xsqRB0Bo4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
+WUIgkFQwHQYDVR0OBBYEFK5+EFw8KZbBqEcnBVnx4D3U5QrzMB0GA1UdJQQWMBQG
+CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow
+KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
+BAGDjiEBAmQwCAYGZ4EMAQIBMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
+aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
+b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNRFZUTFNDQUczQy5wN2MwNwYDVR0f
+BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
+cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
+AwMDaAAwZQIxAMEN2HWMocbuWdy1d33pH6JpMvP/V/DIS5PtZbv1Q7TXEbxrcyxg
+yuddOJscYDJJlAIwB4sH1BpbScDzkdD4tJBSwrG/1Mx82vb8YaySehNuu1+1oXNd
+AEKwaJ0mVzScy2+6
+-----END CERTIFICATE-----

emsign_g3/data/certs/EMEVTLSCAG3B.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu2gAwIBAgIQAMfEHv6S2CXwXq6EGkqCwTAKBggqhkjOPQQDAzBWMQsw
+CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
+ZDEgMB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwHhcNMjUwNDMwMTYw
+MzMxWhcNNDAwNDI4MTgzMDAwWjA/MQswCQYDVQQGEwJOTDETMBEGA1UECgwKZU11
+ZGhyYSBCVjEbMBkGA1UEAwwSRU0gRVYgVExTIENBIC0gRzNCMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAEJduoWmTTl9oLEFLp6lRuSHvv6pydnWigxerc/u91ppu11vwB
+9Cv7ym60C81kwHZ+Nv/QXZeoE8WqDGyVMOec9fCGZGjxOAZCCqXIUYQLHiUlQOeQ
+5LZUw4Uu1krx6GV9o4IBlTCCAZEwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
+WUIgkFQwHQYDVR0OBBYEFD7cINmJRpiHe4c/2IFHslwV2EcGMB0GA1UdJQQWMBQG
+CCsGAQUFBwMBBggrBgEFBQcDAjBcBgNVHSAEVTBTMDkGCysGAQQBg44hAQABMCow
+KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
+BAGDjiEBAngwBwYFZ4EMAQEwdQYIKwYBBQUHAQEEaTBnMCQGCCsGAQUFBzABhhho
+dHRwOi8vb2NzcC1iLmVtc2lnbi5jb20wPwYIKwYBBQUHMAKGM2h0dHA6Ly9yZXBv
+c2l0b3J5LmVtc2lnbi5jb20vY2VydHMvRU1FVlRMU0NBRzNCLnA3YzA3BgNVHR8E
+MDAuMCygKqAohiZodHRwOi8vY3JsLmVtc2lnbi5jb20vP3Jvb3R0bHNjYWczLmNy
+bDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQD
+AwNpADBmAjEA9Jq999oaOUKhFwopw33iCmt0OHIn3gjT43GfuOHR/YckXdwoNdDA
+lIEhz0NgRO3/AjEAvY/a3OMvktIZLYjn+WLKmp0QhrIMV+e6EpS7j4GVeOKouNp6
+MN/P+ByGeiRMghzB
+-----END CERTIFICATE-----

emsign_g3/data/certs/EMEVTLSCAG3C.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu6gAwIBAgIQAIAJkopkEHYBrwX6LxnxCTAKBggqhkjOPQQDAzBWMQsw
+CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
+ZDEgMB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwHhcNMjUwNDMwMTUz
+OTMxWhcNNDAwNDI4MTgzMDAwWjBAMQswCQYDVQQGEwJVUzEUMBIGA1UECgwLZU11
+ZGhyYSBJbmMxGzAZBgNVBAMMEkVNIEVWIFRMUyBDQSAtIEczQzB2MBAGByqGSM49
+AgEGBSuBBAAiA2IABC1W6Cmm+4LGSkaX2WCvlR6QZ66R+SbTQwbaSKiq63hptqZ+
+bSdCbgRCqgOzbhmI3/Y2UU7hzwf1uks/8qBmRa59MdWGatMao9JG6wsxd+6Zy3Vm
+xRbOdICKZo+R8MR/yqOCAZUwggGRMB8GA1UdIwQYMBaAFOE6qyF88eNNVK7Ucrf9
+i1lCIJBUMB0GA1UdDgQWBBSmJV6AqU2385Z8G8eR35K87kvrXzAdBgNVHSUEFjAU
+BggrBgEFBQcDAQYIKwYBBQUHAwIwXAYDVR0gBFUwUzA5BgsrBgEEAYOOIQEAATAq
+MCgGCCsGAQUFBwIBFhxodHRwOi8vcmVwb3NpdG9yeS5lbXNpZ24uY29tMA0GCysG
+AQQBg44hAQJ4MAcGBWeBDAEBMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
+aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
+b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNRVZUTFNDQUczQy5wN2MwNwYDVR0f
+BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
+cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
+AwMDaAAwZQIwBy1wTnzH4lXDTy2PD91ysLjvnlVN3JbJmc1BIMEU8TOLkYVHibMc
+9HeyonikFSfmAjEA6uE3QRxlrZTz/1/lXPTEMUhoauAtycagtlNFp79kjhvNa2/f
+Aal1GNxsOutLnr0Y
+-----END CERTIFICATE-----

emsign_g3/data/certs/EMOVCSCAG3B.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDWzCCAuCgAwIBAgIPeBiTP4+FtGGaKzX7qD0KMAoGCCqGSM49BAMDMFUxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MR8wHQYDVQQDDBZlbVNpZ24gUm9vdCBDUyBDQSAtIEczMB4XDTI1MDQzMDE2MDgy
+N1oXDTQwMDQyODE4MzAwMFowPjELMAkGA1UEBhMCTkwxEzARBgNVBAoMCmVNdWRo
+cmEgQlYxGjAYBgNVBAMMEUVNIE9WIENTIENBIC0gRzNCMHYwEAYHKoZIzj0CAQYF
+K4EEACIDYgAEqrsPsGZqz88B+tUr/P1MK/LLPDSX3nOVDlgZth/mlQmHQcjEkUOb
+NKBDHK/+W/m0wcjorgAB+fTcitgsWfNjnpbNbD1NsM7+wmw9YlF7N3YTcnQ/jord
+d7EAZPKr5eBQo4IBizCCAYcwHwYDVR0jBBgwFoAUaHQD+IXKjVRQVx0W4MjeRQ2r
+zS0wHQYDVR0OBBYEFHn66OzP2w11jaRY1p+27dx8Sd7mMBMGA1UdJQQMMAoGCCsG
+AQUFBwMDMF4GA1UdIARXMFUwOQYLKwYBBAGDjiEBAAEwKjAoBggrBgEFBQcCARYc
+aHR0cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbTAOBgwrBgEEAYOOIQECgUgwCAYG
+Z4EMAQQBMHQGCCsGAQUFBwEBBGgwZjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3At
+Yi5lbXNpZ24uY29tMD4GCCsGAQUFBzAChjJodHRwOi8vcmVwb3NpdG9yeS5lbXNp
+Z24uY29tL2NlcnRzL0VNT1ZDU0NBRzNCLnA3YzA2BgNVHR8ELzAtMCugKaAnhiVo
+dHRwOi8vY3JsLmVtc2lnbi5jb20vP3Jvb3Rjc2NhZzMuY3JsMA4GA1UdDwEB/wQE
+AwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMAoGCCqGSM49BAMDA2kAMGYCMQC/zr03
+YEELsNKqzUtH2dVFi4BaKFdyrr/6G1dIWp8KAVgsw2/u4lyyboUDaC9jDvICMQC9
+HTxku84tNX9dmHOtH7aC2Nu/JM0jTf6KjZAvovCJzzv1IFWSZpVLZibynMLXOrM=
+-----END CERTIFICATE-----

emsign_g3/data/certs/EMOVCSCAG3C.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDWzCCAuGgAwIBAgIPVEt/kiwxriIKSpIpFvbmMAoGCCqGSM49BAMDMFUxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MR8wHQYDVQQDDBZlbVNpZ24gUm9vdCBDUyBDQSAtIEczMB4XDTI1MDQzMDE2Mzg0
+MFoXDTQwMDQyODE4MzAwMFowPzELMAkGA1UEBhMCVVMxFDASBgNVBAoMC2VNdWRo
+cmEgSW5jMRowGAYDVQQDDBFFTSBPViBDUyBDQSAtIEczQzB2MBAGByqGSM49AgEG
+BSuBBAAiA2IABLnw4GNHAqacpqrdRDz9YsQbm6SyCSRpfXl052kaEm+5avs+NML9
+O8X0gwYfJl3CpYQ2NHMjUQQ2so8E84YjYwZ5gOJQPgJTLWVGI1pxZaJZoe9Jb3Qb
+X97neHII5Lj676OCAYswggGHMB8GA1UdIwQYMBaAFGh0A/iFyo1UUFcdFuDI3kUN
+q80tMB0GA1UdDgQWBBTub3MpjW+/p7Mbw5U09hVWRHhmtzATBgNVHSUEDDAKBggr
+BgEFBQcDAzBeBgNVHSAEVzBVMDkGCysGAQQBg44hAQABMCowKAYIKwYBBQUHAgEW
+HGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDgYMKwYBBAGDjiEBAoFIMAgG
+BmeBDAEEATB0BggrBgEFBQcBAQRoMGYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw
+LWMuZW1zaWduLmNvbTA+BggrBgEFBQcwAoYyaHR0cDovL3JlcG9zaXRvcnkuZW1z
+aWduLmNvbS9jZXJ0cy9FTU9WQ1NDQUczQy5wN2MwNgYDVR0fBC8wLTAroCmgJ4Yl
+aHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290Y3NjYWczLmNybDAOBgNVHQ8BAf8E
+BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQDAwNoADBlAjEA8yPg
+8sntOhLwV2QXJ5LEaKSpo/fnE3uOgTadK73fDhyjiqr0Io9GVuQTYqBPbQ2TAjBg
+euApmBS486+iei03lRrp139dPw6k28jjGNvWsAU7A1N86J1zPJVDEyVH+nMAWC0=
+-----END CERTIFICATE-----

emsign_g3/data/certs/EMOVTLSCAG3B.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDZjCCAu2gAwIBAgIPbK2jZ/scEACIEg6iAtVoMAoGCCqGSM49BAMDMFYxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNjAw
+MTJaFw00MDA0MjgxODMwMDBaMD8xCzAJBgNVBAYTAk5MMRMwEQYDVQQKDAplTXVk
+aHJhIEJWMRswGQYDVQQDDBJFTSBPViBUTFMgQ0EgLSBHM0IwdjAQBgcqhkjOPQIB
+BgUrgQQAIgNiAARziXqg6zz9yosSQC/68KvE4SErr43ud4rJ7i1tuD+sKAxeBWOK
+56Ks1xwyKo42HN659pxDArndjXPRzGyqsswK7k4hbOl53VGKSvS2JuVoTN1lgDft
+DIVOTMEvTPhkbQ2jggGWMIIBkjAfBgNVHSMEGDAWgBThOqshfPHjTVSu1HK3/YtZ
+QiCQVDAdBgNVHQ4EFgQUm9hlUa/n5yw3rQjuaRnZvzeErgowHQYDVR0lBBYwFAYI
+KwYBBQUHAwEGCCsGAQUFBwMCMF0GA1UdIARWMFQwOQYLKwYBBAGDjiEBAAEwKjAo
+BggrBgEFBQcCARYcaHR0cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbTANBgsrBgEE
+AYOOIQECbjAIBgZngQwBAgIwdQYIKwYBBQUHAQEEaTBnMCQGCCsGAQUFBzABhhho
+dHRwOi8vb2NzcC1iLmVtc2lnbi5jb20wPwYIKwYBBQUHMAKGM2h0dHA6Ly9yZXBv
+c2l0b3J5LmVtc2lnbi5jb20vY2VydHMvRU1PVlRMU0NBRzNCLnA3YzA3BgNVHR8E
+MDAuMCygKqAohiZodHRwOi8vY3JsLmVtc2lnbi5jb20vP3Jvb3R0bHNjYWczLmNy
+bDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQD
+AwNnADBkAjBAk+5BizdJhrED3wb7F2Gm7bWI60dlNd075nghT2TrR4NWKZtJZcbc
+28xxIY/NONICMF6mPdsjosaqmvEMWqKcBh4vsIvXSKnQj5o8zrFB4oKS+accjYTe
+8Dz3bQjauvy9uw==
+-----END CERTIFICATE-----

emsign_g3/data/certs/EMOVTLSCAG3C.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu6gAwIBAgIPKWkmwiejoVJjkrGUgqUEMAoGCCqGSM49BAMDMFYxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNTM3
+NDFaFw00MDA0MjgxODMwMDBaMEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVk
+aHJhIEluYzEbMBkGA1UEAwwSRU0gT1YgVExTIENBIC0gRzNDMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAEE4JRzVKskpjByKrZdzId65fnCb0LTKCspV3IrVHc/J0ViaFZ
+fjpRIOHv1jHGPhg1ysrimGmmLhYx6KKBgatWYW3EXZGKvAnzqw5jz3kqpNztc4e+
+N7ulaVSfHAKycO1no4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
+WUIgkFQwHQYDVR0OBBYEFDTq6gzryQra+dDF4u2beMmHnhtsMB0GA1UdJQQWMBQG
+CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow
+KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
+BAGDjiEBAm4wCAYGZ4EMAQICMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
+aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
+b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNT1ZUTFNDQUczQy5wN2MwNwYDVR0f
+BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
+cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
+AwMDaAAwZQIxAMSZt2xsPeumRdeSMSQ3CbzIZeQ/q7GDCWfeE1Pq+mhgA6gRM44c
+NVF3xJ+wsxJk+wIwFJbaDMokD8Ei6eNOiA8yUMYvfzQyngmrhZQMdPCK1SewrR79
+4rSb9vGqxZzelQth
+-----END CERTIFICATE-----

emsign_g3/data/indicators.csv

@@ -0,0 +1,12 @@
+ca_common_name,type,sha256_fingerprint,serial,issuer,pem_basename,suricata_sid,tls_issuer_cn_match,bug_id
+EM DV TLS CA - G3B,TLS,42c4accd12c4f59597925e1a08a7a90102608543809308d50ec427e118ba1493,A4AEE678F23362B4C0E460B772F214,emSign Root TLS CA - G3,EMDVTLSCAG3B,92083401,EM DV TLS CA - G3B,2083449
+EM DV TLS CA - G3C,TLS,0164d7ceae5bb909c272af151ff44b1177ae9b47d9424b94f1d9558c30934d19,588B2E3C2BB8CDA13E1A1209254321,emSign Root TLS CA - G3,EMDVTLSCAG3C,92083402,EM DV TLS CA - G3C,2083449
+EM EV TLS CA - G3B,TLS,e7568fe6e12331f4fd7de61da4c7559d0f8eb192a218d4741a3ba75184333838,C7C41EFE92D825F05EAE841A4A82C1,emSign Root TLS CA - G3,EMEVTLSCAG3B,92083403,EM EV TLS CA - G3B,2083449
+EM EV TLS CA - G3C,TLS,432ec25f0d28de9006d97bf752f17bbb2cd41f669933fcb072d9a1148d0261f3,8009928A64107601AF05FA2F19F109,emSign Root TLS CA - G3,EMEVTLSCAG3C,92083404,EM EV TLS CA - G3C,2083449
+EM OV TLS CA - G3B,TLS,98b896625c0c230adeec3eb2cf6aad5001ecf9156a68644e82374ce5833bc25b,6CADA367FB1C100088120EA202D568,emSign Root TLS CA - G3,EMOVTLSCAG3B,92083405,EM OV TLS CA - G3B,2083449
+EM OV TLS CA - G3C,TLS,cb6e15165ac802e9b3f993f16c25d41f4e81c21ebde71ae1b012ac00bf9c7c3f,296926C227A3A1526392B19482A504,emSign Root TLS CA - G3,EMOVTLSCAG3C,92083406,EM OV TLS CA - G3C,2083449
+EM OV CS CA - G3B,CodeSigning,9e39de2881273acc225a149c72ba3e0f51424963669ab633ee1dc7df5db067b4,7818933F8F85B4619A2B35FBA83D0A,emSign Root CS CA - G3,EMOVCSCAG3B,92083407,EM OV CS CA - G3B,2083449
+EM OV CS CA - G3C,CodeSigning,4b2460a466f95fd40113bcdcca2ceb29b3b093921de45474da7df48874c630b1,544B7F922C31AE220A4A922916F6E6,emSign Root CS CA - G3,EMOVCSCAG3C,92083408,EM OV CS CA - G3C,2083449
+emSign Root TLS CA - G3,RootTLS,7dd78d5f4f13459a83dff9abbba62edbaf6f2d102bf257fd712f4d9f2746ed8d,,,,,,2083449
+emSign Root CS CA - G3,RootCS,f2edaaff3d9b701fb4d14c9f285f8c0bad90fc3bcc1fa07d47f4718edaba34a5,,,,,,2083449
+AAA Certificate Services,CrossSign,d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4,,,,,,2083449

emsign_g3/distrust.py

@@ -0,0 +1,202 @@
+"""Explicitly distrust the eight compromised eMudhra/emSign G3 intermediates."""
+from __future__ import annotations
+
+import glob
+import hashlib
+import os
+import platform
+import subprocess
+import sys
+from pathlib import Path
+
+from emsign_g3.indicators import expected_pem_fingerprints
+from emsign_g3.paths import default_certs_dir
+
+
+def sha256_of_pem(path: str | Path) -> str | None:
+    der = subprocess.run(
+        ["openssl", "x509", "-inform", "PEM", "-outform", "DER", "-in", str(path)],
+        capture_output=True,
+    ).stdout
+    return hashlib.sha256(der).hexdigest() if der else None
+
+
+def load_certs(certs_dir: str | Path) -> list[tuple[str, str, str]]:
+    certs: list[tuple[str, str, str]] = []
+    expected = expected_pem_fingerprints()
+    for path in sorted(glob.glob(os.path.join(str(certs_dir), "EM*.pem"))):
+        name = os.path.splitext(os.path.basename(path))[0]
+        fp = sha256_of_pem(path)
+        want = expected.get(name)
+        if want and fp == want:
+            certs.append((name, path, fp))
+        else:
+            print(f"  !! skip {name}: fingerprint mismatch or unknown ({fp})", file=sys.stderr)
+    return certs
+
+
+def plan_for_os(system: str, certs: list[tuple[str, str, str]], undo: bool):
+    steps: list[tuple[str, list[str], str]] = []
+    if system == "Darwin":
+        kc = "/Library/Keychains/System.keychain"
+        for name, path, _ in certs:
+            if undo:
+                steps.append(
+                    (
+                        f"macOS: remove distrust for {name}",
+                        ["sudo", "security", "remove-trusted-cert", "-d", path],
+                        "re-run without --undo to re-apply",
+                    )
+                )
+            else:
+                steps.append(
+                    (
+                        f"macOS: distrust {name} (admin System keychain)",
+                        [
+                            "sudo",
+                            "security",
+                            "add-trusted-cert",
+                            "-d",
+                            "-r",
+                            "deny",
+                            "-k",
+                            kc,
+                            path,
+                        ],
+                        f"sudo security remove-trusted-cert -d {path}",
+                    )
+                )
+    elif system == "Linux":
+        blk = (
+            "/etc/pki/ca-trust/source/blocklist"
+            if os.path.isdir("/etc/pki/ca-trust")
+            else "/usr/local/share/ca-certificates/emsign-blocklist"
+        )
+        update = (
+            ["sudo", "update-ca-trust"]
+            if os.path.isdir("/etc/pki/ca-trust")
+            else ["sudo", "update-ca-certificates"]
+        )
+        for name, path, _ in certs:
+            dst = os.path.join(blk, f"{name}.pem")
+            if undo:
+                steps.append(
+                    (
+                        f"Linux: unblock {name}",
+                        ["sudo", "rm", "-f", dst],
+                        "restore by re-running without --undo",
+                    )
+                )
+            else:
+                steps.append(
+                    (
+                        f"Linux: blocklist {name} -> {dst}",
+                        ["sudo", "install", "-D", "-m", "644", path, dst],
+                        f"sudo rm -f {dst} && {' '.join(update)}",
+                    )
+                )
+        steps.append(("Linux: refresh trust store", update, "(same command re-runs)"))
+    elif system == "Windows":
+        for name, path, _ in certs:
+            if undo:
+                steps.append(
+                    (
+                        f"Windows: remove {name} from disallowed",
+                        ["certutil", "-delstore", "disallowed", path],
+                        "re-add with certutil -addstore -f disallowed",
+                    )
+                )
+            else:
+                steps.append(
+                    (
+                        f"Windows: add {name} to disallowed store",
+                        ["certutil", "-addstore", "-f", "disallowed", path],
+                        f"certutil -delstore disallowed <serial-of-{name}>",
+                    )
+                )
+    home = os.path.expanduser("~")
+    for base in (
+        os.path.join(home, ".mozilla", "firefox"),
+        os.path.join(home, "Library", "Application Support", "Firefox", "Profiles"),
+        os.path.join(os.environ.get("APPDATA", ""), "Mozilla", "Firefox", "Profiles"),
+    ):
+        if base and os.path.isdir(base):
+            for d in os.listdir(base):
+                prof = os.path.join(base, d)
+                if os.path.exists(os.path.join(prof, "cert9.db")):
+                    for name, path, _ in certs:
+                        if undo:
+                            steps.append(
+                                (
+                                    f"NSS {d}: delete distrust entry {name}",
+                                    [
+                                        "certutil",
+                                        "-D",
+                                        "-n",
+                                        f"emSign-distrust-{name}",
+                                        "-d",
+                                        "sql:" + prof,
+                                    ],
+                                    "re-run without --undo",
+                                )
+                            )
+                        else:
+                            steps.append(
+                                (
+                                    f"NSS {d}: mark {name} explicitly distrusted (p,p,p)",
+                                    [
+                                        "certutil",
+                                        "-A",
+                                        "-n",
+                                        f"emSign-distrust-{name}",
+                                        "-t",
+                                        "p,p,p",
+                                        "-d",
+                                        "sql:" + prof,
+                                        "-i",
+                                        path,
+                                    ],
+                                    f"certutil -D -n emSign-distrust-{name} -d sql:{prof}",
+                                )
+                            )
+    return steps
+
+
+def run_distrust(
+    *,
+    apply: bool = False,
+    undo: bool = False,
+    certs_dir: str | Path | None = None,
+) -> int:
+    certs_path = Path(certs_dir) if certs_dir else default_certs_dir()
+    system = platform.system()
+    certs = load_certs(certs_path)
+    if len(certs) != 8:
+        print(
+            f"WARNING: expected 8 verified intermediate PEMs, found {len(certs)} in "
+            f"{certs_path}. Proceeding with what verified.",
+            file=sys.stderr,
+        )
+    steps = plan_for_os(system, certs, undo)
+
+    verb = "ROLLBACK" if undo else "DISTRUST"
+    print(
+        f"# emSign-G3 {verb} plan on {platform.node()} ({system}) — "
+        f"{'APPLY' if apply else 'DRY RUN'}\n"
+    )
+    if not steps:
+        print("No supported trust store found to modify on this host.")
+        return 0
+    for desc, cmd, undo_hint in steps:
+        print(f"* {desc}")
+        print(f"    cmd:  {' '.join(cmd)}")
+        if not undo:
+            print(f"    undo: {undo_hint}")
+        if apply:
+            r = subprocess.run(cmd, capture_output=True, text=True)
+            status = "ok" if r.returncode == 0 else f"FAILED rc={r.returncode}"
+            print(f"    -> {status} {r.stderr.strip()[:160]}")
+        print()
+    if not apply:
+        print("Dry run only. Re-run with --apply (likely under sudo/Administrator) to execute.")
+    return 0

emsign_g3/elastic.py

@@ -0,0 +1,71 @@
+"""Generate Elastic KQL detection stubs from Bug 2083449 indicators."""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+from emsign_g3.indicators import COMPROMISED_TYPES, load_rows
+
+MOZILLA_BUG = "2083449"
+GENERIC_SID = 92083409
+
+_SAFE = re.compile(r"[^a-zA-Z0-9_-]+")
+
+
+def _slug(name: str) -> str:
+    return _SAFE.sub("_", name).strip("_").lower()
+
+
+def build_elastic_kql_rule(row: dict) -> str:
+    cn = row["tls_issuer_cn_match"]
+    sid = int(row["suricata_sid"])
+    serial = row.get("serial") or "unknown"
+    lines = [
+        f"// eMudhra emSign G3 compromised issuer: {row['ca_common_name']}",
+        f"// Mozilla Bug {MOZILLA_BUG} | serial {serial} | Suricata sid {sid}",
+        "// Starter KQL for Suricata EVE / ECS-normalized TLS events.",
+        "// Adjust field names (e.g. suricata.eve.alert.signature_id) for your stack.",
+        f'alert.signature_id == {sid} or tls.issuerdn : *"{cn}"*',
+        "",
+    ]
+    return "\n".join(lines)
+
+
+def build_elastic_kql_backstop() -> str:
+    return "\n".join(
+        [
+            "// eMudhra emSign G3 compromised-family issuer (generic review)",
+            f"// Mozilla Bug {MOZILLA_BUG} | Suricata sid {GENERIC_SID}",
+            "// Review hits manually; prefer per-CA rules in this directory.",
+            f"alert.signature_id == {GENERIC_SID}",
+            "",
+        ]
+    )
+
+
+def elastic_kql_from_rows(rows: list[dict]) -> list[tuple[str, str]]:
+    out: list[tuple[str, str]] = []
+    for row in rows:
+        if row["type"] not in COMPROMISED_TYPES:
+            continue
+        base = row.get("pem_basename") or _slug(row["ca_common_name"])
+        out.append((f"emsign_g3_{base.lower()}.kql", build_elastic_kql_rule(row)))
+    out.append(("emsign_g3_generic_backstop.kql", build_elastic_kql_backstop()))
+    return out
+
+
+def render_elastic_kql_bundle(rows: list[dict] | None = None) -> str:
+    rows = rows if rows is not None else load_rows()
+    parts = [content for _, content in elastic_kql_from_rows(rows)]
+    return "\n".join(parts)
+
+
+def write_elastic_kql_rules(output_dir: Path, rows: list[dict] | None = None) -> list[Path]:
+    output_dir.mkdir(parents=True, exist_ok=True)
+    written: list[Path] = []
+    rows = rows if rows is not None else load_rows()
+    for filename, content in elastic_kql_from_rows(rows):
+        path = output_dir / filename
+        path.write_text(content, encoding="utf-8")
+        written.append(path)
+    return written