|Vincent Legoll 972b292356||6 months ago|
|.github/workflows||1 year ago|
|keys||9 months ago|
|libwaive@cdf7c1688d||5 years ago|
|regress||1 year ago|
|.gitattributes||1 year ago|
|.gitignore||3 years ago|
|.gitmodules||6 years ago|
|.ycm_extra_conf.py||8 years ago|
|CHANGELOG.md||9 months ago|
|COPYING||1 year ago|
|Makefile||5 months ago|
|README.md||9 months ago|
|base64.c||6 years ago|
|bcrypt_pbkdf.c||9 months ago|
|blf.h||8 years ago|
|blowfish.c||6 years ago|
|compat.h||1 year ago|
|crypto_api.c||6 years ago|
|crypto_api.h||3 years ago|
|cvs-files||4 years ago|
|explicit_bzero.c||4 years ago|
|explicit_bzero.h||4 years ago|
|fe25519.c||6 years ago|
|fe25519.h||6 years ago|
|ge25519.h||6 years ago|
|ge25519_base.data||5 years ago|
|helper.c||2 years ago|
|mod_ed25519.c||8 years ago|
|mod_ge25519.c||5 years ago|
|ohash.c||5 years ago|
|ohash.h||5 years ago|
|pledge_noop.c||2 years ago|
|pledge_waive.c||2 years ago|
|sc25519.c||6 years ago|
|sc25519.h||6 years ago|
|sha2.c||2 years ago|
|sha2.h||5 years ago|
|signify.1||9 months ago|
|signify.c||1 year ago|
|signify.h||2 years ago|
|timingsafe_bcmp.c||6 years ago|
|update-cvs-files||5 years ago|
|zsig.c||1 year ago|
OpenBSD tool to sign and verify signatures on files. This is a portable version which uses libbsd (version 0.8 or newer is required).
See https://www.tedunangst.com/flak/post/signify for more information.
Signify is distributed under the terms of the ISC license.
Some GNU/Linux distributions have readily available packages in their repositories. It is recommended to use these, unless you absolutely need to build from source code:
apt install signify-openbsd
pacman -S signify
If your system does not provide a package for
libbsd, it is possible to
download and compile it automatically, check the build options
section for more details.
The following options can be passed to Make:
Build only the verification code. Support for signing will not
be available in the built
signify binary. Note that this is
unsupported and compilation may not succeed.
Enables bounds-checking using
compiler must have support for this. Clang 3.4 is known to work.
Downloads, builds libbsd, and links it statically into Signify. This can be used when the version installed in the system is an unsupported version, or when installing it in the system is not desirable.
Enabling this option requires
gpg installed on
the build system. To avoid downloading files while building, there are
make BUNDLED_LIBBSD=1 libbsd-print-urlswill print the URLs of the files which need to be downloaded, one per line.
make BUNDLED_LIBBSD=1 libbsd-downloadwill download the needed files.
Pre-downloading the files will avoid hitting the network during build, but
will still check the PGP signature of the
Disables checking the PGP signature of the bundled libbsd tarball. This avoids the need for GnuPG to be installed for building.
Set the path to the
gpg binary used for checking signatures. If not
specified, the program is searched in the
Enable linking against the Musl libc. At the
moment this needs a patched
libbsd, so enabling this option will
BUNDLED_LIBBSD=1 and patch the locally-built version.
Perform Link-Time Optimizations. Both your compiler and linker must have support for this. Recent binutils and GCC/Clang are known to work.
Choose among one of the alternative implementations of the pledge(2) system call. For the moment the only supported values are:
noop(default): Uses an implementation which does nothing
waive(Linux-only): Uses libwaive, which itself uses seccomp filters.
To use your own implementation, use an empty value, and pass
the needed flags for linking its code. For example:
make PLEDGE='' EXTRA_LDFLAGS=my-pledge.o.
Choose which implementation of
to use. Supported values are:
libc: Relies on the system C library providing the function definition in the
bundled: Use the portable implementation included with Signify's source code in
The build system will try to detect whether the C library includes the
function, and in most cases it will not be needed to specify this option.
Providing a value for
BZERO disables the automatic detection.
Additional flags to be passed to the compiler and the linker, respectively.
For example, you can build a size-optimized version with:
make EXTRA_CFLAGS='-Os -s' LTO=1
The following Make targets are provided as convenience for building static
make static: Build a static binary bundling
libbsdand using the system default C library.
make static-musl: Build a static binary bundling
libbsdusing the Musl C library. This will set
musl-gccboth as the compiler and linker to use and may not work on systems where this wrapper scripts is not available.
PGP detached signatures of source tarballs (
.asc) are done with key
The key can be obtained with the following command:
gpg --keyserver hkps://keys.openpgp.org --recv-keys 5AA3BC334FD7E3369E7C77B291C559DBE4C9123B
Assuming that both the tarball and its signature are in the same directory, a release can be checked using:
gpg --verify signify-<version>.tar.xz.asc
SHA256.sig signed checksum is provided alongside with each
release. The signing key can be found at
keys/signifyportable.pub, its contents are:
untrusted comment: Signify portable release signing public key RWRQFCY809DUoWEHxWmoTNtxph6yUlWNsjfW54PqLI6S3dWfuZN4Ovj1
To verify a release, save the associated
SHA256.sig file in the same
directory as the source tarball. If the signing key is into a file named
signifyportable.pub, then use:
signify -C -p signifyportable.pub -x SHA256.sig
The above Signify public key can itself be verified using the same PGP key used for release tarballs. Grab the keys/signifyportable.pub.asc file as well, the run:
gpg --verify signifyportable.pub.asc
glibcversion, you need to pass