1.\" $OpenBSD: signify.1,v 1.39 2016/09/19 21:15:58 tedu Exp $ 2.\" 3.\"Copyright (c) 2013 Marc Espie <espie@openbsd.org> 4.\"Copyright (c) 2013 Ted Unangst <tedu@openbsd.org> 5.\" 6.\"Permission to use, copy, modify, and distribute this software for any 7.\"purpose with or without fee is hereby granted, provided that the above 8.\"copyright notice and this permission notice appear in all copies. 9.\" 10.\"THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11.\"WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12.\"MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13.\"ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14.\"WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15.\"ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16.\"OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17.Dd $Mdocdate: September 19 2016 $ 18.Dt SIGNIFY 1 19.Os 20.Sh NAME 21.Nm signify 22.Nd cryptographically sign and verify files 23.Sh SYNOPSIS 24.Nm signify 25.Fl C 26.Op Fl q 27.Fl p Ar pubkey 28.Fl x Ar sigfile 29.Op Ar 30.Nm signify 31.Fl G 32.Op Fl n 33.Op Fl c Ar comment 34.Fl p Ar pubkey 35.Fl s Ar seckey 36.Nm signify 37.Fl S 38.Op Fl ez 39.Op Fl x Ar sigfile 40.Fl s Ar seckey 41.Fl m Ar message 42.Nm signify 43.Fl V 44.Op Fl eqz 45.Op Fl p Ar pubkey 46.Op Fl t Ar keytype 47.Op Fl x Ar sigfile 48.Fl m Ar message 49.Sh DESCRIPTION 50The 51.Nm 52utility creates and verifies cryptographic signatures. 53A signature verifies the integrity of a 54.Ar message . 55The mode of operation is selected with the following options: 56.Bl -tag -width Dsssigfile 57.It Fl C 58Verify a signed checksum list, and then verify the checksum for 59each file. 60If no files are specified, all of them are checked. 61.Ar sigfile 62should be the signed output of 63.Xr sha256 1 . 64.It Fl G 65Generate a new key pair. 66.It Fl S 67Sign the specified message file and create a signature. 68.It Fl V 69Verify the message and signature match. 70.El 71.Pp 72The other options are as follows: 73.Bl -tag -width Dsssignature 74.It Fl c Ar comment 75Specify the comment to be added during key generation. 76.It Fl e 77When signing, embed the message after the signature. 78When verifying, extract the message from the signature. 79(This requires that the signature was created using 80.Fl e 81and creates a new message file as output.) 82.It Fl m Ar message 83When signing, the file containing the message to sign. 84When verifying, the file containing the message to verify. 85When verifying with 86.Fl e , 87the file to create. 88.It Fl n 89Do not ask for a passphrase during key generation. 90Otherwise, 91.Nm 92will prompt the user for a passphrase to protect the secret key. 93.It Fl p Ar pubkey 94Public key produced by 95.Fl G , 96and used by 97.Fl V 98to check a signature. 99.It Fl q 100Quiet mode. 101Suppress informational output. 102.It Fl s Ar seckey 103Secret (private) key produced by 104.Fl G , 105and used by 106.Fl S 107to sign a message. 108.It Fl t Ar keytype 109When deducing the correct key to check a signature, make sure 110the actual key matches 111.Pa /etc/signify/*-keytype.pub . 112.It Fl x Ar sigfile 113The signature file to create or verify. 114The default is 115.Ar message Ns .sig . 116.It Fl z 117Sign and verify 118.Xr gzip 1 119archives, where the signing data 120is embedded in the 121.Xr gzip 1 122header. 123.El 124.Pp 125The key and signature files created by 126.Nm 127have the same format. 128The first line of the file is a free form text comment that may be edited, 129so long as it does not exceed a single line. 130.\" Signature comments will be generated based on the name of the secret 131.\" key used for signing. 132.\" This comment can then be used as a hint for the name of the public key 133.\" when verifying. 134The second line of the file is the actual key or signature base64 encoded. 135.Sh EXIT STATUS 136.Ex -std signify 137It may fail because of one of the following reasons: 138.Pp 139.Bl -bullet -compact 140.It 141Some necessary files do not exist. 142.It 143Entered passphrase is incorrect. 144.It 145The message file was corrupted and its signature does not match. 146.It 147The message file is too large. 148.El 149.Sh EXAMPLES 150Create a new key pair: 151.Dl $ signify -G -p newkey.pub -s newkey.sec 152.Pp 153Sign a file, specifying a signature name: 154.Dl $ signify -S -s key.sec -m message.txt -x msg.sig 155.Pp 156Verify a signature, using the default signature name: 157.Dl $ signify -V -p key.pub -m generalsorders.txt 158.Pp 159Verify a release directory containing 160.Pa SHA256.sig 161and a full set of release files: 162.Bd -literal -offset indent -compact 163$ signify -C -p /etc/signify/openbsd-61-base.pub -x SHA256.sig 164.Ed 165.Pp 166Verify a bsd.rd before an upgrade: 167.Bd -literal -offset indent -compact 168$ signify -C -p /etc/signify/openbsd-61-base.pub -x SHA256.sig bsd.rd 169.Ed 170.Pp 171Sign a gzip archive: 172.Bd -literal -offset indent -compact 173$ signify -Sz -s key-arc.sec -m in.tgz -x out.tgz 174.Ed 175.Pp 176Verify a gzip pipeline: 177.Bd -literal -offset indent -compact 178$ ftp url | signify -Vz -t arc | tar ztf - 179.Ed 180.Sh SEE ALSO 181.Xr fw_update 1 , 182.Xr gzip 1 , 183.Xr pkg_add 1 , 184.Xr sha256 1 185.Sh HISTORY 186The 187.Nm 188command first appeared in 189.Ox 5.5 . 190.Sh AUTHORS 191.An -nosplit 192.An Ted Unangst Aq Mt tedu@openbsd.org 193and 194.An Marc Espie Aq Mt espie@openbsd.org . 195