signalscreen-checker 0.2.1

Windows code-signing hygiene checker. Reads the Authenticode signature in a PE file and grades it A-F. Pure Rust, no Windows dependency.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

//! Roll check results into a 0–100 score and an A–F grade. Pure — no parsing.
use crate::checks::{CheckResult, Status};

/// Penalty per failing/warning check id. Encodes the SmartScreen-reputation thesis.
fn penalty(id: &str, status: &Status) -> u32 {
    match (id, status) {
        ("signature", Status::Fail) => 100, // unsigned/invalid => F outright
        ("timestamp", Status::Fail) => 40,
        ("digest", Status::Fail) => 30,
        ("chain", Status::Fail) => 40,
        ("expiry", Status::Fail) => 20,
        ("expiry", Status::Warn) => 10,
        _ => 0,
    }
}

pub fn score(results: &[CheckResult]) -> u32 {
    let total: u32 = results.iter().map(|c| penalty(&c.id, &c.status)).sum();
    100u32.saturating_sub(total)
}

pub fn grade(score: u32) -> char {
    match score {
        90..=100 => 'A',
        80..=89 => 'B',
        70..=79 => 'C',
        60..=69 => 'D',
        _ => 'F',
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::checks::{CheckResult, Status};

    fn c(id: &str, s: Status) -> CheckResult {
        CheckResult {
            id: id.into(),
            status: s,
            detail: String::new(),
        }
    }

    #[test]
    fn clean_is_a() {
        let r = vec![
            c("signature", Status::Pass),
            c("timestamp", Status::Pass),
            c("digest", Status::Pass),
            c("expiry", Status::Pass),
        ];
        assert_eq!(score(&r), 100);
        assert_eq!(grade(100), 'A');
    }

    #[test]
    fn unsigned_is_f() {
        let r = vec![c("signature", Status::Fail)];
        assert_eq!(score(&r), 0);
        assert_eq!(grade(score(&r)), 'F');
    }

    #[test]
    fn missing_timestamp_drops_to_d() {
        let r = vec![
            c("signature", Status::Pass),
            c("timestamp", Status::Fail),
            c("digest", Status::Pass),
            c("expiry", Status::Pass),
        ];
        assert_eq!(score(&r), 60); // 100 - 40
        assert_eq!(grade(60), 'D');
    }
}