OSTREE-SIGN(1)

📦
version 2026.6 · 16 versions
, in arch rolling

🎀 NAME 🎀

okay so welcome to the OSTREE SIGN(1) manual page, aka ostree sign — this is the one about signing commits, bestie. The name line energy is: ostree-sign — Sign a commit. slay. 💅

✨ SYNOPSIS ✨

ostree sign [OPTIONS...] {COMMIT} {KEY-ID...}

💅 DESCRIPTION 💅

This adds a new signature to a commit. Heads up, though: currently this will append a new signature even if the commit is already signed with a given key. Not me explaining it twice, it’s literally in the manual: append energy. 😭

For ed25519 and spki, there are several "well-known" system places for trusted and revoked public keys as listed below.

Files:

  • /etc/ostree/trusted.SIGN-TYPE
  • /etc/ostree/revoked.SIGN-TYPE
  • /usr/share/ostree/trusted.SIGN-TYPE
  • /usr/share/ostree/revoked.SIGN-TYPE

Directories containing files with keys:

  • /etc/ostree/trusted.SIGN-TYPE.d
  • /etc/ostree/revoked.SIGN-TYPE.d
  • /usr/share/ostree/trusted.SIGN-TYPE.d
  • /usr/share/ostree/revoked.SIGN-TYPE.d

The format of those files depends on the signature mechanism; for ed25519, keys are stored in the base64 encoding per line, while for spki they are stored in the PEM "PUBLIC KEY" encoding. iykyk ✨

🌈 OPTIONS 🌈

  • KEY-ID — the key ID situation, and it changes depending on the mechanism, bestie:
    • for ed25519 and spki: base64-encoded secret (for signing) or public key (for verifying).
    • for dummy: ASCII-string used as secret key and public key.
  • --verify — Verify signatures. that’s the vibe check for signatures. ✅
  • -s, --sign-type — Use particular signature mechanism. Currently available: ed25519, spki, and dummy signature types. The default is ed25519. default queen behavior. 👑
  • --keys-file — Read keys from file filename. Valid for ed25519 and spki signature types. This file must contain one base64-encoded key per line. Each key may be a secret key (for signing) or a public key (for verifying). one key per line, no chaotic multi-key lines, okay? 🫶
  • --keys-dir — Redefine the system path, where to search files and subdirectories with well-known and revoked keys. custom path moment. 🦋

mwah 💋 footer cutie check: source/version OSTree, page OSTREE SIGN(1) — the date wasn’t in this footer, so I’m not inventing one, periodt 💀🎀✨

📦 where this page comes from