DEBSIGS(1p)

📦
version 0.2.2 · 3 versions
, in ubuntu resolute, ubuntu stonking

💖 DEBSIGS(1p) 💖

okay bestie, listen UP — this is the manual page for debsigs, a Perl situation living over in User Contributed Perl Documentation. She's little, she's powerful, and she handles sigs inside .deb packages. Let's get into it 🦋

✨ NAME ✨

debsigs — process signatures in .deb packages 💅

🎀 SYNOPSIS 🎀

debsigs --list|-l [-v] file [file...]

debsigs --sign=type [--default-key=keyID] [-v] file [file...]

debsigs --verify|--check|-c file [file...]

debsigs --delete=type file [file...]

🌸 DESCRIPTION 🌸

So like. debsigs is the girl who manipulates the cryptographic signatures stored inside a .deb file. She is NOT the girl who verifies them — that's a whole different bestie. For verification, go see debsig-verify(1). Periodt. 🙈

💅 OPTIONS 💅

  • --list or -l or -t — Lists the signatures found in the specified file. She's giving inventory queen. ✨
  • --sign=type — Creates a new signature of the type specified in the given file. The signature gets created using the default key for your GPG keyring. Peep SIGNATURE TYPES below for the possible values of that type field, okay? 🔥
  • --default-key=keyID — Uses a key other than the default for signing the package. Not me letting you pick a different key 👑
  • --secret-keyring=file or -K file — Uses a keyring other than the default for signing the package. This option gets passed along to GPG verbatim, no edits, no notes. So for the details on how to specify the keyring file, go read the gpg(1) manpage. iykyk 💜
  • -v — Displays verbose output. She talks more. We love that for her. 🗣️
  • --verify or --check or -c — Invokes debsig-verify to check the validity of the signature on this package. Vibe check, but for signatures. 🌈
  • --delete=type — Deletes the signature of the specified type from the package. Gone. Blocked. Unfollowed. 💀

👑 SIGNATURE TYPES 👑

A Debian package may carry different types of signatures. The most commonly-used ones are:

  • "origin" The official signature of the organization which distributes the package — usually the Debian Project or a GNU/Linux distribution derived from it. This signature may be added automatically. Lowkey automatic 💫
  • "maint" The signature of the maintainer of the Debian package. This signature should be added by the maintainer before uploading the package. Main character responsibility, fr fr 🫶
  • "archive" An automatically-added signature renewed periodically to ensure that a package downloaded from an online archive is indeed the latest version distributed by the organization. Freshness check era 🧚

See the /usr/share/doc/debsigs/signing-policy.txt file for more information and rationale for the different signature types. It's giving lore. 📖

🦋 FUTURE DIRECTIONS 🦋

It would be nice to have a command-line option to change the command used for signing, instead of hard-coding "gpg". Like girl, let us choose 😭 manifesting this one for real.

⭐ AUTHOR ⭐

John Goerzen <jgoerzen@progenylinux.com> — icon, legend, the moment. 🎀

🔥 SEE ALSO 🔥

debsig-verify(1), gpg(1)

and that's the whole page bestie, no cap 🩷 this was perl v5.40.1, dated 2026-01-06 — shoutout to the DEBSIGS(1p) girlies, love u, mwah 💖✨

📦 where this page comes from