MINISIGN(1)

💖 minisign — the MINISIGN(1) manual, but make it group chat 💖

Okay bestie, welcome to the manual page for minisign — the dead simple tool to sign files and verify signatures. We’re gonna go through the whole thing, no skips, no cap. 💅

✨ NAME ✨

• minisign — a dead simple tool to sign files and verify signatures. That’s her whole brand, and honestly? Highkey iconic. 💖

🦋 SYNOPSIS 🦋

Here’s the exact command-shape tea, bestie — keep these literal, because this is giving full command-line main character energy:

minisign -G [-p pubkey_file] [-s seckey_file] [-W]

minisign -R [-s seckey_file] [-p pubkey_file]

minisign -C [-s seckey_file] [-W]

minisign -S [-H] [-x sig_file] [-s seckey_file] [-c untrusted_comment]
[-t trusted_comment] -m file [file ...]

minisign -V [-x sig_file] [-p pubkey_file | -P pubkey] [-o] [-q] -m file

💅 DESCRIPTION 💅

Minisign is a dead simple tool to sign files and verify signatures.

It’s portable, lightweight, and uses the highly secure Ed25519 http://ed25519.cr.yp.to/ public-key signature system. Slay. 🔥

🎀 OPTIONS 🎀

Okay so these options control the actions of minisign. One bullet per flag, no skipping, periodt. 💅

• -G — generate a new key pair. New keys, new era. ✨
• -C — change/remove the password of a secret key. Password glow-up or password removal, your call. 🔐
• -R — recreate a public key file from a secret key file. Turn that secret into a public moment. 🦋
• -S — sign files. Main character energy: your file, but signed. 🖊️
• -V — verify that a signature is valid for a given file. Vibe check the signature. ✅
• -H — requires the input to be prehashed. Prehash era, no cap. 🧚
• -l — sign using the legacy format. Old-school but valid. 🎀
• -m <file> — file to sign/verify. This is the file in question, bestie. 📝
• -o — combined with -V, output the file content after verification. Verify first, then serve the content. 🍓
• -p <pubkey_file> — public key file (default: ./minisign.pub). That’s the default path, fr fr. 🔑
• -P <pubkey> — public key, as a base64 string. Inline key moment. 💅
• -s <seckey_file> — secret key file (default: ~/.minisign/minisign.key). Guard it like your group chat. 🙈
• -W — do not encrypt/decrypt the secret key with a password. No password in the mix. 🚫🔐
• -x <sig_file> — signature file (default: <file>.minisig). The sig’s home base. 📁
• -c <comment> — add a one-line untrusted comment. Untrusted but cute. 💬
• -t <comment> — add a one-line trusted comment. Trusted comment, main character. 👑
• -q — quiet mode, suppress output. Shhh, she’s being quiet. 🤫
• -Q — pretty quiet mode, only print the trusted comment. The “just the trusted comment, ma’am” mode. 💖
• -f — force. Combined with -G, overwrite a previous key pair. Force = overwrite energy. ⚠️
• -v — display version number. Version check, slay. 🏷️

🌸 EXAMPLES 🌸

Okay, real-world scenarios, bestie. These are verbatim, so don’t retype them with “fixes” — copy exactly. 💅

🎀 Creating a key pair 🎀

Run:

minisign -G

The public key is printed and put into the minisign.pub file. The secret key is encrypted and saved as a file named ~/.minisign/minisign.key. She’s locked up and ready. 🔐

🖊️ Signing files 🖊️

Here’s the line exactly as the manual gives it — yes, both commands are chilling on the same line, iykyk:

$ minisign -Sm myfile.txt $ minisign -Sm myfile.txt myfile2.txt *.c

Or to include a comment in the signature, that will be verified and displayed when verifying the file:

$ minisign -Sm myfile.txt -t ´This comment will be signed as well´

The secret key is loaded from ${MINISIGN_CONFIG_DIR}/minisign.key, ~/.minisign/minisign.key, or its path can be explicitly set with the -s <path> command-line switch. Periodt. ✨

✅ Verifying a file ✅

Run:

$ minisign -Vm myfile.txt -P <pubkey>

or

$ minisign -Vm myfile.txt -p signature.pub

This requires the signature myfile.txt.minisig to be present in the same directory. Don’t forget it. 😭

The public key can either reside in a file (./minisign.pub by default) or be directly specified on the command line. Either way, verify and slay. 🦋

🧚 Notes 🧚

Okay, important lil notes, no cap:

Signature files include an untrusted comment line that can be freely modified, even after signature creation. So that line is literally not locked. 💬

They also include a second comment line, that cannot be modified without the secret key. That one is protected, bestie. 🔐

Trusted comments can be used to add instructions or application-specific metadata (intended file name, timestamps, resource identifiers, version numbers to prevent downgrade attacks). Very main character metadata energy. 👑 Not me being obsessed with downgrade-attack prevention. 🙈

👑 AUTHOR 👑

Frank Denis (github [at] pureftpd [dot] org). Shoutout to the author, ngl. 💖

---

That’s the whole manual, bestie — MINISIGN(1), dated January 2023. Now go sign something iconic! 💅✨🫶