Signify - Sign and Verify
OpenBSD tool to signs and verify signatures on files. This is a portable version which uses libbsd (version 0.7 or newer is required).
See http://www.tedunangst.com/flak/post/signify for more information.
- GNU Make (any version above 3.70).
- C compiler. Both GCC and Clang are tested and supported.
- libbsd 0.8 or newer.
If your system does not provide a package for
libbsd, it is possible to
download and compile it automatically, check the build options
section for more details.
The following options can be passed to Make:
Build only the verification code. Support for signing will not be available in the built
signifybinary. Note that this is unsupported and compilation may not succeed.
Enables bounds-checking using
__attribute__((bounded)). Your compiler must have support for this. Clang 3.4 is known to work.
Downloads and builds libbsd, and links it statically into Signify. This can be used when the version installed in the system is an unsupported version, or when installing it in the system is not desirable.
Enabling this options needs
gpginstalled in the build system. To avoid downloading files while building, there are two options:
make BUNDLED_LIBBSD=1 libbsd-print-urlswill print the URLs of the files which need to be downloaded, one per line.
make BUNDLED_LIBBSD=1 libbsd-downloadwill download the needed files.
Pre-downloading the files will avoid hitting the network during build, but will still check the PGP signature of the
Disables checking the PGP signature of the bundled libbsd tarball. This avoids the need for GnuPG to be installed for building.
Set the path to the
gpgbinary used for checking signatures. If not specified, the program is searched in the
Enable linking against the Musl libc. At the moment this needs a patched
libbsd, so enabling this option will automatically set
BUNDLED_LIBBSD=1and patch the locally-built version.
Perform Link-Time Optimizations. Both your compiler and linker must have support for this. Recent binutils and GCC/Clang are known to work.
Choose among one of the alternative implementations of the pledge() system call. For the moment the only supported values is:
noop(default): Uses an implementation which does nothing
waive(Linux-only): Uses libwaive, which itself uses seccomp filters.
To use your own implementation, use an empty value, and pass the needed flags for linking its code. For example:
make PLEDGE='' EXTRA_LDFLAGS=my-pledge.o.
Additional flags to be passed to the compiler and the linker, repectively.
For example, you can build a size-optimized version with:
make EXTRA_CFLAGS='-Os -s' LTO=1
- Problem: Undefined references to
Solution: Your system has an old
glibcversion, you need to pass