AV/YARA Scan Runbook (AIRGAP-AV-510-011)

Purpose: ensure every offline-kit bundle is scanned pre-publish and post-ingest, with deterministic reports and optional signatures.

Inputs

Steps (offline)

  1. Scan all bundle files:
    clamscan -r --max-filesize=2G --max-scansize=4G --no-summary bundle/ > reports/av-scan.txt
  2. Convert to structured report:
    python - <<'PY'
import hashlib, json, pathlib, sys
root = pathlib.Path("bundle")
report = {
    "scanner": "clamav",
    "scannerVersion": "1.4.1",
    "startedAt": "2025-12-02T00:02:00Z",
    "completedAt": "2025-12-02T00:04:30Z",
    "status": "clean",
    "artifacts": [],
    "errors": []
}
for path in root.glob("**/*"):
    if path.is_file():
        h = hashlib.sha256(path.read_bytes()).hexdigest()
        report["artifacts"].append({
            "path": str(path.relative_to(root)),
            "sha256": h,
            "result": "clean",
            "yaraRules": []
        })
json.dump(report, sys.stdout, indent=2)
PY
  3. Validate report against schema:
    jq empty --argfile schema docs/modules/airgap/schemas/av-report.schema.json 'input' < docs/modules/airgap/samples/av-report.sample.json >/dev/null
  4. Optionally sign report (detached):
    openssl dgst -sha256 -sign airgap-av-key.pem reports/av-report.json > reports/av-report.sig
  5. Update manifest.json:
    • Set avScan.status to clean or findings.
    • avScan.reportPath and avScan.reportSha256 must match the generated report.

Acceptance checks

References