sign(8)

📦
version 2.8.4 · 2 versions
, in fedora 43, fedora 44

🌸 sign(8) — the girlies' guide to signing files 💅

okay bestie, buckle up, because we're doing sign from the System Manager's Manual and it's genuinely iconic. ✨

✨ NAME ✨

sign — sign files or rpms 🎀

🦋 SYNOPSIS 🦋

sign [-c|-d|-r|-a] [-u user] [-h hash] [file]
sign -k|-p [-u user] [-h hash]
sign -g type expire name email
sign -x expire pubkey
sign -C pubkey
sign -t

💖 DESCRIPTION 💖

okay so sign literally adds a cryptographic signature to a file. that's the whole vibe. 🫶

it can do a clearsign signature (that's the -c option), create a detached signature (-d), or slap a signature block onto a rpm package (-r). no mode specified? then sign does a rpm sign if the file name ends in .rpm, and otherwise it does a clearsign. no file name at all? then it reads from stdin and writes to stdout. main character behaviour, honestly. 💅

you can pick a specific user or hash method with the -u and -h options. rn sign understands sha1, sha256, and sha512 hashes. no cap.

here's the thing tho — sign does not create signatures by itself. it needs a running signing daemon (called signd) to do the actual work. the host and port info gets read from the /etc/sign.conf file. so like, it's the middleman. the hype girl. the liaison. 😭

the -k option makes sign print the keyid instead of signing a file, and -p makes it print the public key.

brand new keys? yes bestie, use the -g option. in that case you need to provide a file name to store the private key with the -P option. that private key can be used for signing by also using the -P option with the other modes. the pubkey of the generated key gets printed to stdout. periodt. ✨

need an X509 certificate (like, for linux kernel modules for example)? the key can be converted to a (self-signed) certificate with the -C option. 🎀

and the expire time of existing keys can be extended with the -x option. keeping it fresh. 🦋

🔥 SIGNING MODES 🔥

  • -c — Clearsign ✨
  • -r — Sign RPM package 📦
  • -d — Create a detached gpg signature
  • -D — Create a unarmored detached gpg signature
  • -O — Create a raw X509 signature. Enforces RSA unless the -A option is used.
  • -a — Sign AppImage container 🎀
  • --appx — Sign a windows appx container
  • --pesign — Sign a PE/COFF file
  • --kosign — Sign a linux kernel object
  • --cmssign — Create a detached pkcs7/CMS signature

💜 COMMON OPTIONS 💜

in some cases it's useful to specify the signature time. you can do that with the -T option. 🕐

the -S option specifies a checksum file — it makes sign append a line containing the checksum of the signed rpms. this can be used to speed up repository metadata generation. efficiency queen. 👑

  • -v — Verbose mode 🗣️
  • -u username — Specify the key to use. The user must be in the keyring used by signd.
  • -h hash — Either sha1, sha256, or sha512. The default is sha1, because some old distributions, e.g., RHEL 7, cannot handle sha256. On modern systems you should use sha256.
  • -T unixtime — Explicit sign time. If RPM mode (-r) is used also accepts the string "buildtime".
  • -P keyfile — Private key file. This file must contain the encrypted privatekey generated with the -g option.
  • -S checksumfile — Usable only with -r option: appends checksums into the file.
  • -4 — Create a pgp v4 signature instead of v3
  • -A pubkeyalgo — Enforce that the specified algorithm (rsa, dsa, ecdsa, eddsa) is used for signing
  • --cert certfile — Speficy a x509 certificate to use. A certificate is needed by some of the signing modes, like appx signing or kernel object signing.
  • --cms-nocerts — Do not include certificates in the pkcs7/cms signature
  • --cms-keyid — Identify the certificate with the keyid instead of the issuer/serial
  • --bulk-cpio — The input is a cpio archive in newc format. Each file in the archive is signed. All the signatures are packed into a new cpio archive which filenames consisting of the original files plus a ".sig" suffix. This mode is currently only supported for raw X509 signature creation (-O).

🧚 KEY GENERATION 🧚

  • -g [-P privkey] type expire name email — Generate new key-pair. Where:
    • type: one of {dsa,rsa}@{1024,2048,4096} ed25519 nistp256 nistp384
    • expire: integer, days before expire
    • name: real name
    • email: email

Write pubkey and the encrypted private key to stdout. If the -P option isused, the private key will be written to the specified file and only the pubkey goes to stdout. ✨

  • -x expire pubkey — Extend key. Requires a private key to be specified with the -P option.
  • -C pubkey — Convert a gpg pubkey to a self-signed X509 certificate 🎀

🌈 OTHER MODES 🌈

  • -t — Ping signd. If ping was successful, return exit code 0. 👋
  • -k — Print the keyid of the key used for signing (root key or defined by -u)
  • -p — Print the pubkey of of the key used for signing (root key or defined by -u)

🚨 SECURITY 🚨

unless the allow-unprivileged-ports option has been set to true for signd, sign needs to bind to a reserved port, in which case it works only for user root or needs to be installed suid-root. if the latter is the case, sign grants the users specified in the "allowuser" lines of the configuration the right to sign files.
sign and signd are supposed to run in isolated networks only. no cap, this is not a drill bestie. 💀

💀 EXIT STATUS 💀

sign returns 0 if everything worked, otherwise it returns 1 and prints an error message to stderr. so like, 0 = slay, 1 = not slay. 😭

🫶 SEE ALSO 🫶

signd(8), sign.conf(5)

and that's the whole page, bestie!! 💖 this lil gem comes from the System Manager's Manual, dated Apr 2007. go forth and sign responsibly. mwah. 💅✨🎀

📦 where this page comes from