--- name: "sigtool" section: "1" platform: "linux" package: "clamav" version: "1.5.4-1" release: "Arch Linux 2026-11-01" platforms: ["linux"] url: "https://new.carta.tech/sigtool" --- # sigtool(1) signature and database management tool ## NAME sigtool - signature and database management tool ## SYNOPSIS sigtool \[options\] ## DESCRIPTION sigtool can be used to generate MD5 checksums, convert data into hexadecimal format, list virus signatures and build/unpack/test/verify CVD databases and update scripts. ## COMMON OPTIONS - **-h, --help** Output help information and exit. - **-V, --version** Print version number and exit. - **--quiet** Be quiet, output only error messages. - **--debug** Enable debug messages - **--stdout** Write all messages to stdout. - **--tempdir=DIRECTORY** Create temporary files in DIRECTORY. Directory must be writable for the user running sigtool. - **--leave-temps** Do not remove temporary files. - **--datadir=DIR** Use DIR as the default database directory for all operations. ## COMMANDS FOR WORKING WITH SIGNATURES - **-l\[FILE\], --list-sigs\[=FILE\]** List all signature names from the local database directory (default) or from FILE. - **-fREGEX, --find-sigs=REGEX** Find and display signatures from the local database directory which match the given REGEX. The whole signature body (name, hex string, etc.) is checked. - **--decode-sigs=REGEX** Decode signatures read from the standard input (eg. piped from --find-sigs) - **--test-sigs=DATABASE TARGET\_FILE** Test all signatures from DATABASE against TARGET\_FILE. This option will only give valid results if the target file is the final one (after unpacking, normalization, etc.) for which the signatures were created. ## COMMANDS TO GENERATE SIGNATURES - **--md5 \[FILES\]** Generate MD5 checksum from stdin or MD5 sigs for FILES. - **--sha1 \[FILES\]** Generate SHA1 checksum from stdin or SHA1 sigs for FILES. - **--sha2-256 \[FILES\]** Generate SHA2-256 checksum from stdin or SHA2-256 sigs for FILES. The previous option --sha256 is deprecated and may be removed in a future version. - **--mdb \[FILES\]** Generate .mdb (PE section hash) signatures for FILES. - **--imp \[FILES\]** Generate .imp (PE import address table hash) signatures for FILES. - **--fuzzy-img \[FILES\]** Generate image fuzzy hash for each file. ## COMMANDS TO NORMALIZE FILES - **--html-normalise=FILE** Create normalised HTML files comment.html, nocomment.html, and script.html in current working directory. - **--ascii-normalise=FILE** Create normalised text file from ascii source. - **--utf16-decode=FILE** Decode UTF16 encoded data. ## COMMANDS FOR FILE ANALYSIS - **--vba=FILE** Extract VBA/Word6 macros from given MS Office document. - **--vba-hex=FILE** Extract Word6 macros from given MS Office document and display the corresponding hex values. - **--print-certs=FILE** Print Authenticode details from a PE file. - **--hex-dump** Read data from stdin and write hex string to stdout. ## COMMANDS FOR WORKING WITH CVDS - **-i, --info** Print a CVD information and verify MD5 and a digital signature. - - **--build=FILE, -b FILE** Build a CVD file. -s, --server is required for signed virus databases(.cvd), or, --unsigned for unsigned(.cud). - **--max-bad-sigs=NUMBER** Maximum number of mismatched signatures when building a CVD. Default: 3000 - **--flevel** Specify a custom flevel. Default: 77 - **--cvd-version** Specify the version number to use for the build. Default is to use the value+1 from the current CVD in --datadir. If no datafile is found the default behaviour is to prompt for a version number, this switch will prevent the prompt. NOTE: If a CVD is found in the --datadir its version+1 is used and this value is ignored. - **--no-cdiff** Don't create a .cdiff file when building a new database file. - **--hybrid** Create a hybrid (standard and bytecode) database file. - **--unsigned** Create a database file without digital signatures (.cud). - **--server=ADDR** ClamAV Signing Service address (for virus database maintainers only). - - **--unpack=FILE, -u FILE** Unpack FILE (CVD) to a current directory. - - **--unpack-current** Unpack a local CVD file (main or daily) to current directory. - **--fips-limits** Enforce FIPS-like limits on using hash algorithms for cryptographic purposes. Will disable MD5 & SHA1 FP sigs and will require '.sign' files to verify CVD authenticity. ## COMMANDS FOR WORKING WITH CDIFF PATCH FILES - **--diff=OLD NEW, -d OLD NEW** Create a diff file for OLD and NEW CVDs/INCDIRs. - **--compare=OLD NEW, -c OLD NEW** This command will compare two text files and print differences in a cdiff format. - **--run-cdiff=FILE, -r FILE** Execute update script FILE in current directory. - **--verify-cdiff=FILE, -r FILE** Verify DIFF against CVD/INCDIR. ## COMMANDS FOR CREATING AND VERIFYING DETACHED DIGITAL SIGNATURES - **--sign** Sign a file. The resulting .sign file name will be in the form: dbname-version.cvd.sign or FILE.sign for non-CVD targets. It will be created next to the target file. If a .sign file already exists, then the new signature will be appended to file. - **--key=FILE** Specify a signing key. - **--cert=FILE** Specify a signing cert. May be used more than once to add intermediate and root certificates. - **--append** Use to add a signature line to an existing .sign file. Otherwise an existing .sign file will be overwritten. - - **--verify** Find and verify a detached digital signature for the given file. The digital signature file name must be in the form: dbname-version.cvd.sign or FILE.sign for non-CVD targets. It must be found next to the target file. - **--cvdcertsdir=DIR** Specify a directory containing the root CA cert needed to verify the signature. If not provided, then sigtool will look in the default certs directory. ## ENVIRONMENT VARIABLES Sigtool uses the following environment variables: - **SIGNDUSER** The username to authenticate with the signing server when building a signed CVD database. - **SIGNDPASS** The password to authenticate with the signing server when building a signed CVD database. - **CVD\_CERTS\_DIR** Specify a directory containing the root CA cert needed to verify detached CVD digital signatures. If not provided, then sigtool will look in the default directory. ## EXAMPLES - Generate hex string from testfile and save it to testfile.hex: **cat testfile \| sigtool --hex-dump \> testfile.hex** ## CREDITS Please check the full documentation for credits. ## AUTHOR Tomasz Kojm \ ## SEE ALSO [freshclam(1)](/freshclam/1.md), [freshclam.conf(5)](/freshclam.conf/5.md)