SIGSUM-SUBMIT(1)

📦
version 0.14.1 · 6 versions
, in ubuntu stonking

💖 SIGSUM-SUBMIT(1) — bestie edition 💖

okay so. sit down, grab a boba, because we're talking about sigsum-submit from the User Commands corner of your manual, and it's genuinely iconic. it signs checksums and logs them. no cap. 🦋

✨ NAME ✨

sigsum-submit — sign and log checksums 💅

🌸 SYNOPSIS 🌸

sigsum-submit [-v] [-a key-file] [--diagnostics log-level] [-d domain-
name] [--help] [-k key-file] [--leaf-hash] [-o output-file] [-O output-
dir] [-P policy-name] [-p policy-file] [--raw-hash] [-t timeout] [input
files]

🫶 DESCRIPTION 🫶

So the whole vibe is: you sign checksums, and then you submit them for logging with add-leaf requests. that's the job. that's the whole thing.

If you give it no input files and no output options, it processes a single add-leaf request — reads from stdin, writes to stdout. simple. clean. main character energy.

If you don't hand it a signing key (that's the -k option), then the input must be the body of an add-leaf request. it gets parsed and verified before submission, bestie. no skipping the vibe check.

If you don't specify a trust policy (that's the -p option), the output is gonna be the body of an add-leaf request. this is lowkey the good part: it means you can sign a checksum on one system and then submit that request for logging on a different system. slay, honestly.

If you do specify a signing key (-k), an add-leaf request gets created by signing the input as a signed checksum. and! if your input has already been hashed with SHA256, use the --raw-hash option. 🎀

If you specify a trust policy (-p), the proof is collected such that the policy is satisfied. in other words: the checksum will be in any of the logs with enough witness cosignatures. that's the goal. that's the dream.

If you specify one or more input files, each file corresponds to a separate add-leaf request. output gets written to file(s) based on this whole ruleset, and yes we're numbering it:

  1. If there's exactly one input file and the -o option is used, then output is written to that file. Any existing file is overwritten. 🙈
  2. If the output is an add-leaf request (no -p option), then the output file name is formed by adding .req to the input file name.
  3. If the output is a proof (-p option), then the output file name is formed by adding .proof to the input file name. If the input is an add-leaf request, any .req suffix is removed first.
  4. If the output is written to a directory (-O option), then any directory part of the input file name is stripped and the output is written as a file in the specified output directory.

If a .proof file already exists, then sigsum-submit just ensures the proof is valid without performing a new add-leaf request. an invalid proof will cause sigsum-submit to exit with an error. 💀

If a .req file already exists, then it is simply overwritten. no drama.

💜 OPTIONS 💜

  • -a, --token-signing-key=key-file — private key in OpenSSH format to sign DNS rate-limit tokens; or a corresponding public key where the private part is accessed using the SSH agent protocol
  • --diagnostics=log-level — available levels: fatal, error, warning, info, debug [info]
  • -d, --token-domain=domain-name — domain name to use for rate-limiting; "_sigsum_v1." will be prepended
  • --help — show usage message and exit
  • -k, --signing-key=key-file — private key in OpenSSH format to sign checksums; or a corresponding public key where the private part is accessed using the SSH agent protocol
  • --leaf-hash — output the request's leaf hash without submission and exit
  • -o, --output=output-file — store output in a file, only works for a single input
  • -O, --output-dir=output-dir — store output in a directory [same as corresponding input file]
  • -P, --named-policy=policy-name — use a named trust policy defining logs, witnesses, and a quorum rule; omit policy to only output requests and exit
  • -p, --policy=policy-file — trust policy file defining logs, witnesses, and a quorum rule; omit policy to only output requests and exit
  • --raw-hash — input has already been hashed and formatted as 32 octets or a hex string
  • -t, --timeout=timeout — timeout for submitting all signed checksums and collecting the proofs [10m0s]
  • -v, --version — show software version and exit

⭐ RETURN CODES ⭐

a non-zero return code is used to indicate failure. that's it, that's the whole tea. 🍓

🌈 CONTACT 🌈

send an email to the sigsum-general mailing list at sigsum-general@lists.sigsum.org. you can also reach out in room #sigsum at OFTC.net and matrix.org. come say hi, we don't bite 🧚

🦋 ENVIRONMENT 🦋

the behavior of the sigsum tools is affected by the following environment variables:

  • SIGSUM_POLICY_DIR — if set, this determines the location where the sigsum tools will look for named policy files (*.sigsum-policy).

💖 FILES 💖

  • /etc/sigsum/policy — this directory is the default location for named policy files (*.sigsum-policy), when SIGSUM_POLICY_DIR is not set.

😭 REPORTING BUGS 😭

use the issue tracker located at https://git.glasklar.is/sigsum/core/sigsum-go/-/issues. to file issues without a GitLab account, send an email to sigsum-core-sigsum-go-issues@incoming.glasklar.is and wait for a maintainer to make the issue public. patience bestie, they're on it. ✨

👑 SEE ALSO 👑

sigsum-key(1) sigsum-monitor(1) sigsum-policy(1) sigsum-token(1) sigsum-tools(5) sigsum-verify(1)

pookie, go read those too. iykyk. 💅

aight that's the whole page. this one's sigsum-submit version 0.14.1-2, dated June 2026, and it's been a genuine pleasure. go sign something. log something. stay iconic. 🔥💜

📦 where this page comes from