debuginfod: PR28204 - RPM IMA per-file signature verification

debuginfod: PR28204 - RPM IMA per-file signature verification

Recent versions of Fedora/RHEL include per-file cryptographic
signatures in RPMs, not just an overall RPM signature.  This work
extends debuginfod client & server to extract, transfer, and verify
those signatures.  These allow clients to assure users that the
downloaded files have not been corrupted since their original
packaging.  Downloads that fail the test are rejected.

Clients may select a desired level of enforcement for sets of URLs in
the DEBUGINFOD_URLS by inserting special markers ahead of them:

ima:ignore       pay no attention to absence or presence of signatures
ima:enforcing    require every file to be correctly signed

The default is ima:ignore mode.  In ima:enforcing mode, section
queries are forced to be entire-file downloads, as it is not
possible to crypto-verify just sections.

IMA signatures are verified against a set of signing certificates.
These are normally published by distributions.  The environment
variable $DEBUGINFOD_IMA_CERT_PATH contains a colon-separated path for
finding DER or PEM formatted certificates / public keys.  These
certificates are assumed trusted.  The profile.d scripts transcribe
/etc/debuginfod/*.certdir files into that variable.

As for implementation:

* configure.ac: Add --enable-debuginfod-ima-verification parameter.
  Add --enable-default-ima-cert-path=PATH parameter.
  Check for libimaevm (using headers only).

* config/Makefile.am: Install defaults into /etc files.
* config/profile.{csh,sh}.in: Process defaults into env variables.
* config/elfutils.spec.in: Add more buildrequires.

* debuginfod/debuginfod.cxx (handle_buildid_r_match): Added extraction of the
  per-file IMA signature for the queried file and store in http header.
  (find_globbed_koji_filepath): New function.
  (parse_opt): New flag --koji-sigcache.
* debuginfod/debuginfod-client.c (debuginfod_query_server): Added policy for
  validating IMA signatures
  (debuginfod_validate_imasig): New function, with friends.
* debuginfod/debuginfod.h.in: Added DEBUGINFOD_IMA_CERT_PATH_ENV_VAR.
* debuginfod/Makefile.am: Add linker flags for rpm and crypto.

* doc/debuginfod-client-config.7: Document DEBUGINFOD_IMA_CERT_PATH,
  update DEBUGINFOD_URLS.
* doc/debuginfod.8: Document --koji-sigcache.
* doc/debuginfod-find.1, doc/debuginfod_find_debuginfo.3: Update SECURITY.

* tests/run-debuginfod-ima-verification.sh: New test.
* tests/debuginfod-ima: Some new files for the tests.
* tests/Makefile.am: run/distribute them.

Signed-off-by: Ryan Goldberg <rgoldber@redhat.com>
Signed-off-by: Frank Ch. Eigler <fche@redhat.com>