/usr/bin/sigtool

                      Clam AntiVirus: Signature Tool 1.5.4
           By The ClamAV Team: https://www.clamav.net/about.html#credits
           (C) 2025 Cisco Systems, Inc.

    sigtool [options]

    --help                 -h              Show this help
    --version              -V              Print version number and exit
    --quiet                                Be quiet, output only error messages
    --debug                                Enable debug messages
    --stdout                               Write to stdout instead of stderr. Does not affect 'debug' messages.
    --tempdir=DIRECTORY                    Create temporary files in DIRECTORY
    --leave-temps[=yes/no(*)]              Do not remove temporary files
    --datadir=DIR                          Use DIR as default database directory

  Commands for working with signatures:

    --list-sigs[=FILE]     -l[FILE]        List signature names
    --find-sigs=REGEX      -fREGEX         Find signatures matching REGEX
    --decode-sigs                          Decode signatures from stdin
    --test-sigs=DATABASE TARGET_FILE       Test signatures from DATABASE against
                                           TARGET_FILE

  Commands to generate signatures:

    --md5 [FILES]                          Generate MD5 hash from stdin
                                           or MD5 sigs for FILES
    --sha1 [FILES]                         Generate SHA1 hash from stdin
                                           or SHA1 sigs for FILES
    --sha2-256 [FILES]                     Generate SHA2-256 hash from stdin
                                           or SHA2-256 sigs for FILES
    --mdb [FILES]                          Generate .mdb (section hash) sigs
    --imp [FILES]                          Generate .imp (import table hash) sigs
    --fuzzy-img FILE(S)                    Generate image fuzzy hash for each file

  Commands to normalize files, so you can write more generic signatures:

    --html-normalise=FILE                  Create normalised parts of HTML file
    --ascii-normalise=FILE                 Create normalised text file from ascii source
    --utf16-decode=FILE                    Decode UTF16 encoded files

  Assorted commands to aid file analysis:

    --vba=FILE                             Extract VBA/Word6 macro code
    --vba-hex=FILE                         Extract Word6 macro code with hex values
    --print-certs=FILE                     Print Authenticode details from a PE
    --hex-dump                             Convert data from stdin to a hex
                                           string and print it on stdout

  Commands for working with CVD signature database archives:

    --info=FILE            -i FILE         Print CVD database archive information

    --build=NAME [cvd] -b NAME             Build a CVD file.
                                           The following options augment --build.
    --max-bad-sigs=NUMBER                  Maximum number of mismatched signatures
                                           When building a CVD. Default: 3000
    --flevel=FLEVEL                        Specify a custom flevel.
                                           Default: 234
    --cvd-version=NUMBER                   Specify the version number to use for
                                           the build. Default is to use the value+1
                                           from the current CVD in --datadir.
                                           If no datafile is found the default
                                           behaviour is to prompt for a version
                                           number, this switch will prevent the
                                           prompt.  NOTE: If a CVD is found in the
                                           --datadir its version+1 is used and
                                           this value is ignored.
    --no-cdiff                             Don't generate .cdiff file.
                                           If not specified, --build will try to
                                           create a cdiff by comparing with the
                                           current CVD in --datadir
                                           If no datafile is found the default
                                           behaviour is to skip making a CDIFF.
    --hybrid                               Create a hybrid (standard and bytecode)
                                           database file
    --unsigned                             Create unsigned database file (.cud)
    --server=ADDR                          ClamAV Signing Service address

    --unpack=FILE          -u FILE         Unpack a CVD/CLD file

    --unpack-current=SHORTNAME             Unpack local CVD/CLD into cwd

    --fips-limits                          Enforce FIPS-like limits on using hash algorithms for
                                           cryptographic purposes. Will disable MD5 & SHA1
                                           FP sigs and will require '.sign' files to verify CVD
                                           authenticity.

  Commands for working with CDIFF patch files:

    --diff=OLD NEW         -d OLD NEW      Create diff for OLD and NEW CVDs
    --compare=OLD NEW      -c OLD NEW      Show diff between OLD and NEW files in
                                           cdiff format
    --run-cdiff=FILE       -r FILE         Execute update script FILE in cwd
    --verify-cdiff=DIFF CVD/CLD            Verify DIFF against CVD/CLD

  Commands creating and verifying .sign detached digital signatures:

    --sign FILE                            Sign a file.
                                           The resulting .sign file name will
                                           be in the form: dbname-version.cvd.sign
                                           or FILE.sign for non-CVD targets.
                                           It will be created next to the target file.
                                           If a .sign file already exists, then the
                                           new signature will be appended to file.
    --key /path/to/private.key             Specify a signing key.
    --cert /path/to/private.key            Specify a signing cert.
                                           May be used more than once to add
                                           intermediate and root certificates.
    --append                               Use to add a signature line to an existing .sign file.
                                           Otherwise an existing .sign file will be overwritten.

    --verify FILE                          Find and verify a detached digital
                                           signature for the given file.
                                           The digital signature file name must
                                           be in the form: dbname-version.cvd.sign
                                           or FILE.sign for non-CVD targets.
                                           It must be found next to the target file.
    --cvdcertsdir DIRECTORY                Specify a directory containing the root
                                           CA cert needed to verify the signature.
                                           If not provided, then sigtool will look in the default directory.n
Environment Variables:

    SIGNDUSER                              The username to authenticate with the signing server when building a
                                           signed CVD database.
    SIGNDPASS                              The password to authenticate with the signing server when building a
                                           signed CVD database.
    CVD_CERTS_DIR                          Specify a directory containing the root CA cert needed
                                           to verify detached CVD digital signatures.
                                           If not provided, then sigtool will look in the default directory.