JOSE-JWS-SIG(1)

📦
version 15 · 13 versions
, in arch rolling

💅 jose-jws-sig(1) — like, the whole entire manual page, bestie

okay so real talk: this is the jose-jws-sig(1) page, and by the end of it you're gonna be signing payloads like it's nothing. no cap. 🎀

✨ NAME ✨

jose-jws-sig — signs a payload using one or more JWKs. that's it. that's the whole vibe. 💖

🦋 SYNOPSIS 🦋

jose jws sig [-i JWS] [-I PAY] [-s SIG] -k JWK [-o JWS] [-O PAY] [-c]

look at her. iconic. every one of those flags matters, babe, we'll get to all of them. 🫶

🌸 OVERVIEW 🌸

so the jose jws sig command signs a payload using one or more JWKs. the payload can show up in one of two ways: either in its decoded form (that's -I), or embedded inside an existing JWS (that's -i). pick your fighter. ⭐

want a detached JWS? you're gonna specify the -O option. when you do that, the decoded payload gets written to the output you specified and it will not be included in the JWS. so the payload's like "i'm out, but my signature stayed" 💀

if you're only using one key (-k), then the resulting JWS may be output in JWS Compact Serialization by using the -c option. one key, one compact string, slay. 🔥

this command uses a template based approach for constructing a JWS. you can specify templates of the JWS itself (-i) or for the JWS Signature Object (-r). attributes you specify in either of these templates will appear unmodified in the output. 👑

one exception to that rule, and it's important so listen up: the JWS Protected Header should be specified in its decoded form in the JWS Signature Object template. this command will automatically encode it as part of the encryption process. so you don't have to do it, she does it for you. 💅

now, if you specify a JOSE Header Parameter (via either the -i or -r options) that affects the construction of the JWE, this command will attempt to behave according to this parameter as if it were configuration. currently, jose will modify its behavior for the "alg" JOSE Header Parameter (see RFC 7515 Section 4.1.1). 🧚

but bestie, it is not necessary to provide any templates. jose jwe enc will automatically fill in the "alg" parameter by inferring the correct algorithm from the provided input JWKs. therefore, the -i and -r options should generally be used for providing extended JWE metadata. 🍓

also, plot twist: it's possible to specify an existing JWS as the JWS template input (-i). this allows the addition of new signatures to an existing JWS. glow-up on top of a glow-up. 🌈

🎀 OPTIONS 🎀

here she is, the full roster. all of them. no skips. 💜

  • -i JSON, --input=JSON — parse the JWS template from JSON
  • -i FILE, --input=FILE — read the JWS template from FILE
  • -i -, --input=- — read the JWS template from standard input
  • -I FILE, --detached=FILE — read the decoded payload from FILE
  • -I -, --detached=- — read the decoded payload from standard input
  • -s JSON, --signature=JSON — parse the JWS signature template from JSON
  • -s FILE, --signature=FILE — read the JWS signature template from FILE
  • -s -, --signature=- — read the JWS signature template from standard input
  • -k FILE, --key=FILE — read the JWK(Set) from FILE
  • -k -, --key=- — read the JWK(Set) from standard input
  • -o FILE, --output=FILE — write the JWS to FILE
  • -o -, --output=- — write the JWS to stdout (this is the default, fyi ✨)
  • -O FILE, --detach=FILE — detach the payload and decode it to FILE
  • -O -, --detach=- — detach the payload and decode it to standard output
  • -c, --compact — output the JWS using compact serialization
side note bestie: -i is for the JWS template, -I is for the payload, -s is for the signature template, -k is your key, -o is output, -O is detach. capital letters are not the same as lowercase ones. do not mix them up. i'm begging. 😭

🌟 EXAMPLES 🌟

💖 sign data with a symmetric key using JWE JSON Serialization

$ jose jwk gen -i '{"alg":"HS256"}' -o key.jwk
$ jose jws sig -I msg.txt -k key.jwk -o msg.jws

you generate the key, you sign the thing. ate. 🔥

🦋 sign data using detached JWE Compact Serialization

$ jose jws sig -I msg.txt -k key.jwk -O /dev/null -c -o msg.jws

/dev/null so the detached payload just… vanishes into the void. dramatic but valid. 💀

👑 sign with two keys

$ jose jwk gen -i '{"alg":"ES256"}' -o ec.jwk
$ jose jwk gen -i '{"alg":"RS256"}' -o rsa.jwk
$ jose jws sig -I msg.txt -k ec.jwk -k rsa.jwk -o msg.jws

two -k flags, two keys, one iconic signature situation. main character energy fr fr. 🌈

💅 AUTHOR 💅

Nathaniel McCallum <npmccallum@redhat.com> — the icon, the legend. we stan. 🫶

🧚 SEE ALSO 🧚

and that's the whole page bestie!! you ate that 💖 this lil masterpiece is from the JOSE-JWS-SIG(1) manual, dated 06/09/2026 — so go forth, sign responsibly, and remember: lowercase -i, capital -I, never ever confuse them. mwah. 💜🎀

📦 where this page comes from