minisign

Minisign can be run as a Docker container. Use the -v flag to mount your current directory to /minisign inside the container.

Generate a key pair in Docker:

docker run -i --rm -v .:/minisign jedisct1/minisign -s minisign.key -G

Sign a file in Docker:

docker run -i --rm -v .:/minisign jedisct1/minisign -s minisign.key -S -m files_to_sign

Verify a signature in Docker:

docker run -i --rm -v .:/minisign jedisct1/minisign -Vm file_to_verify -p minisign.pub

Note: -s minisign.key specifies the secret key to use. The public key will be named minisign.pub.

Use the -V flag to verify that a signature is valid for a given file. The signature file (defaulting to <file>.minisig) must be present in the same directory. You can provide the public key via a file using -p <pubkey_file> or as a base64 string using -P <pubkey>.

Additional options:

• -o: Output the file content after successful verification.
• -H: Requires the signature to be prehashed.
• -q: Quiet mode (suppress output).
• -Q: Pretty quiet mode (only print the trusted comment).

Minisign is available as prebuilt packages for several platforms:

• macOS (Homebrew): brew install minisign
• Windows (Scoop): scoop install minisign
• Windows (Chocolatey): choco install minisign

To build Minisign using CMake, you need the following dependencies:

• libsodium (required)
• CMake
• pkg-config
• GCC or Clang

Standard Build:

mkdir build
cd build
cmake ..
make
make install

Static Binary Configuration: You can configure static binaries using either of these flags:

• cmake -D STATIC_LIBSODIUM=1 ..
• cmake -D BUILD_STATIC_EXECUTABLES=1 ..

You can build Minisign using the Zig build system.

Dependencies:

• libsodium (optional)
• zig (version 0.15.1 or later)

Compilation Options:

• With libsodium (dynamically linked): zig build -Doptimize=ReleaseSmall
• With libsodium (statically linked): zig build -Doptimize=ReleaseSmall -Dstatic
• Without libsodium (no dependencies): zig build -Doptimize=ReleaseSmall -Dwithout-libsodium

Note: Replace ReleaseSmall with ReleaseFast for faster execution at the cost of larger binary size. The resulting binary is located at zig-out/bin/minisign.

Use the -S flag to create signatures for one or more files.

By default:

• The secret key is loaded from ${MINISIGN_CONFIG_DIR}/minisign.key or ~/.minisign/minisign.key.
• The signature file is named <file>.minisig.

Options:

• -m <file>: The file(s) to sign.
• -s <seckey_file>: Path to the secret key file.
• -t <comment>: Add a one-line trusted comment. This comment is signed and cannot be modified without the secret key. Useful for metadata like timestamps or version numbers to prevent downgrade attacks.
• -c <comment>: Add a one-line untrusted comment. This can be modified after the signature is created.
• -l: Use the legacy format.
• -x <sig_file>: Specify a custom signature file name.

Use the -G flag to generate a new Ed25519 key pair.

By default:

• The public key is printed to stdout and saved to minisign.pub.
• The secret key is encrypted and saved to ~/.minisign/minisign.key.

Options:

• -f: Force overwrite of an existing key pair.
• -W: Do not encrypt/decrypt the secret key with a password.
• -s <seckey_file>: Specify a custom path for the secret key file.

Use the -V flag to verify that a signature is valid for a given file.

By default:

• The signature file <file>.minisig must be present in the same directory as the file.
• The public key is loaded from ./minisign.pub.

Options:

• -m <file>: The file to verify.
• -p <pubkey_file>: Path to the public key file.
• -P <pubkey>: The public key provided as a base64 string.
• -o: Output the file content after successful verification.
• -H: Requires the signature to be prehashed.
• -q: Quiet mode, suppresses output.
• -Q: Pretty quiet mode, only prints the trusted comment.
• -x <sig_file>: Specify a custom signature file name.

Minisign provides utilities to manage the secret key file:

• Change/remove password: Use -C to change or remove the password protecting a secret key.
• Recreate public key: Use -R to recreate a public key file from an existing secret key file.
• Secret key location: The secret key is typically at ~/.minisign/minisign.key, but can be explicitly set using the -s <seckey_file> flag in most commands.

Use the -G flag to generate a new key pair. This creates a public key (default: minisign.pub) and a password-protected secret key (default: minisign.key).

minisign -G