chkrootkit false positive INFECTED on basename, date, dirname, echo, env when rust-coreutils is installed

**Package:** chkrootkit
**Version:** 0.58b-6
**Ubuntu release:** questing

## Summary

When the `rust-coreutils` package is installed alongside `chkrootkit`, the following binaries are incorrectly reported as `INFECTED`:

```
Checking `basename'... INFECTED
Checking `date'... INFECTED
Checking `dirname'... INFECTED
Checking `echo'... INFECTED
Checking `env'... INFECTED
```

This is a false positive. All five binaries are byte-for-byte identical to the official `rust-coreutils_0.2.2-0ubuntu2.1_amd64.deb` from Ubuntu's archive (verified below).

## Root cause

In Ubuntu, `/bin/date` (and the other four binaries) are symlinks to the `rust-coreutils` multicall binary:

```
$ ls -la /bin/date
lrwxrwxrwx 1 root root 31 Sep 26 2025 /bin/date -> ../lib/cargo/bin/coreutils/date

$ dpkg -S /usr/lib/cargo/bin/coreutils/date
rust-coreutils: /usr/lib/cargo/bin/coreutils/date
```

`chkrootkit` detects these as infected via its `GENERIC_ROOTKIT_LABEL` pattern used in `chk_basename()` and equivalent functions:

```sh
GENERIC_ROOTKIT_LABEL="^/bin/.*sh$|bash|elite$|vejeta|\.ark|iroffer"
```

The `bash` alternative matches because `rust-coreutils` is a large (~10 MB) multicall binary that includes embedded bash completion code (from the `clap_complete` Rust crate). Running `strings` on the binary produces strings like `bashdefault`, `BASH_VERSINFO`, and shell completion script fragments — none of which are rootkit indicators:

```
$ strings -a /usr/lib/cargo/bin/coreutils/date | grep bash
complete -F _ -o nosort -o bashdefault -o default
complete -F _ -o bashdefault -o default
if [[ "${BASH_VERSINFO[0]}" -ge 4 ]]; then
...
```

All 14 matches are from the clap_complete shell completion generator bundled in the binary.

## Integrity verification

SHA256 of all five installed binaries matches the official package:

```
$ apt-get download rust-coreutils
$ dpkg-deb -x rust-coreutils_0.2.2-0ubuntu2.1_amd64.deb /tmp/pkg
$ for bin in basename date dirname echo env; do
    diff <(sha256sum /usr/lib/cargo/bin/coreutils/$bin) \
         <(sha256sum /tmp/pkg/usr/lib/cargo/bin/coreutils/$bin)
  done
# (no output — all hashes match)
```

SHA256 of all five (they are hardlinks to the same binary):
`2a9b9ccf4e9724a6d6d8c97c835c9932223fbdefc9706fef9d0dfef7a9076739`

The same consideration applies to all other coreutils binaries that chkrootkit inspects with `GENERIC_ROOTKIT_LABEL`, since `rust-coreutils` hardlinks all ~100 tools to the same binary.