gentoo-mirror/gentoo
1
0
Fork 0
mirror of https://github.com/gentoo-mirror/gentoo.git synced 2026-11-06 17:47:07 -08:00
Code Issues Projects Releases Wiki Activity
Files
stable
gentoo/app-crypt/osslsigncode/files/osslsigncode-2.14.1
T
Nicolas PARLANT ac5d7f54dd app-crypt/osslsigncode: add 2.14 w/ compat openssl-4 
add doc to generate manpage and html w/ pandoc
also add a precompiled manpage

switch to shell-completion

Closes: https://bugs.gentoo.org/985658
Signed-off-by: Nicolas PARLANT <nicolas.parlant@parhuet.fr>
Part-of: https://codeberg.org/gentoo/gentoo/pulls/2343
Signed-off-by: Sam James <sam@gentoo.org>
2026-11-06 04:34:14 +00:00

561 lines
19 KiB
Groff
Raw Permalink Blame History

.\" Automatically generated by Pandoc 3.13
.\"
.TH "osslsigncode" "" "" ""
.SH NAME
osslsigncode \- Authenticode signing, timestamping, extraction,
attachment, removal, and verification tool
.SH SYNOPSIS
\f[CR]osslsigncode\f[R] [\f[CR]\-\-help\f[R]] [\f[CR]\-\-version\f[R]]
.PP
\f[CR]osslsigncode\f[R] \f[CR]sign\f[R] [\f[CR]\-certs\f[R]
\f[I]file\f[R] | \f[CR]\-spc\f[R] \f[I]file\f[R] | \f[CR]\-pkcs12\f[R]
\f[I]file\f[R]] [\f[CR]\-key\f[R] \f[I]file\-or\-URI\f[R]]
[\f[CR]\-ac\f[R] \f[I]file\f[R]] [\f[CR]\-pass\f[R] \f[I]password\f[R] |
\f[CR]\-readpass\f[R] \f[I]file\f[R] | \f[CR]\-askpass\f[R]]
[\f[CR]\-pkcs11module\f[R] \f[I]module\f[R]] [\f[CR]\-pkcs11cert\f[R]
\f[I]URI\f[R]] [\f[CR]\-engine\f[R] \f[I]engine\f[R]]
[\f[CR]\-provider\f[R] \f[I]provider\f[R]] [\f[CR]\-login\f[R]]
[\f[CR]\-engineCtrl\f[R] \f[I]command\f[R][:\f[I]parameter\f[R]]]
[\f[CR]\-h\f[R] \f[I]digest\f[R]] [\f[CR]\-n\f[R] \f[I]description\f[R]]
[\f[CR]\-i\f[R] \f[I]URL\f[R]] [\f[CR]\-jp\f[R] \f[CR]low\f[R]]
[\f[CR]\-comm\f[R]] [\f[CR]\-ph\f[R]] [\f[CR]\-t\f[R] \f[I]URL\f[R]
\&...
| \f[CR]\-ts\f[R] \f[I]URL\f[R] \&...]
[\f[CR]\-TSA\-certs\f[R] \f[I]file\f[R] \f[CR]\-TSA\-key\f[R]
\f[I]file\-or\-URI\f[R] [\f[CR]\-TSA\-time\f[R] \f[I]unix\-time\f[R]]]
[\f[CR]\-HTTPS\-CAfile\f[R] \f[I]file\f[R]] [\f[CR]\-HTTPS\-CRLfile\f[R]
\f[I]file\f[R]] [\f[CR]\-time\f[R] \f[I]unix\-time\f[R]]
[\f[CR]\-addUnauthenticatedBlob\f[R] [\f[CR]\-blobFile\f[R]
\f[I]file\f[R]]] [\f[CR]\-nest\f[R]] [\f[CR]\-add\-msi\-dse\f[R]]
[\f[CR]\-verbose\f[R]] [\f[CR]\-pem\f[R]] \f[CR]\-in\f[R]
\f[I]input\f[R] \f[CR]\-out\f[R] \f[I]output\f[R]
.PP
\f[CR]osslsigncode\f[R] \f[CR]extract\-data\f[R] [\f[CR]\-pem\f[R]]
[\f[CR]\-h\f[R] \f[I]digest\f[R]] [\f[CR]\-ph\f[R]]
[\f[CR]\-add\-msi\-dse\f[R]] \f[CR]\-in\f[R] \f[I]input\f[R]
\f[CR]\-out\f[R] \f[I]output\f[R]
.PP
\f[CR]osslsigncode\f[R] \f[CR]add\f[R]
[\f[CR]\-addUnauthenticatedBlob\f[R] [\f[CR]\-blobFile\f[R]
\f[I]file\f[R]]] [\f[CR]\-t\f[R] \f[I]URL\f[R] \&...
| \f[CR]\-ts\f[R] \f[I]URL\f[R] \&...]
[\f[CR]\-TSA\-certs\f[R] \f[I]file\f[R] \f[CR]\-TSA\-key\f[R]
\f[I]file\-or\-URI\f[R] [\f[CR]\-TSA\-time\f[R] \f[I]unix\-time\f[R]]]
[\f[CR]\-HTTPS\-CAfile\f[R] \f[I]file\f[R]] [\f[CR]\-HTTPS\-CRLfile\f[R]
\f[I]file\f[R]] [\f[CR]\-h\f[R] \f[I]digest\f[R]] [\f[CR]\-index\f[R]
\f[I]n\f[R]] [\f[CR]\-verbose\f[R]] [\f[CR]\-add\-msi\-dse\f[R]]
\f[CR]\-in\f[R] \f[I]input\f[R] \f[CR]\-out\f[R] \f[I]output\f[R]
.PP
\f[CR]osslsigncode\f[R] \f[CR]attach\-signature\f[R] \f[CR]\-sigin\f[R]
\f[I]signature\f[R] [\f[CR]\-h\f[R] \f[I]digest\f[R]]
[\f[CR]\-nest\f[R]] [\f[CR]\-add\-msi\-dse\f[R]] \f[CR]\-in\f[R]
\f[I]input\f[R] \f[CR]\-out\f[R] \f[I]output\f[R]
.PP
\f[CR]osslsigncode\f[R] \f[CR]extract\-signature\f[R] [\f[CR]\-pem\f[R]]
\f[CR]\-in\f[R] \f[I]input\f[R] \f[CR]\-out\f[R] \f[I]output\f[R]
.PP
\f[CR]osslsigncode\f[R] \f[CR]remove\-signature\f[R] \f[CR]\-in\f[R]
\f[I]input\f[R] \f[CR]\-out\f[R] \f[I]output\f[R]
.PP
\f[CR]osslsigncode\f[R] \f[CR]verify\f[R] \f[CR]\-in\f[R]
\f[I]input\f[R] [\f[CR]\-c\f[R] | \f[CR]\-catalog\f[R]
\f[I]catalog\-file\f[R]] [\f[CR]\-CAfile\f[R] \f[I]file\f[R]]
[\f[CR]\-CRLfile\f[R] \f[I]file\f[R]] [\f[CR]\-HTTPS\-CAfile\f[R]
\f[I]file\f[R]] [\f[CR]\-HTTPS\-CRLfile\f[R] \f[I]file\f[R]]
[\f[CR]\-TSA\-CAfile\f[R] \f[I]file\f[R]] [\f[CR]\-TSA\-CRLfile\f[R]
\f[I]file\f[R]] [\f[CR]\-p\f[R] \f[I]proxy\f[R]] [\f[CR]\-index\f[R]
\f[I]n\f[R]] [\f[CR]\-ignore\-timestamp\f[R]] [\f[CR]\-ignore\-cdp\f[R]]
[\f[CR]\-ignore\-crl\f[R]] [\f[CR]\-time\f[R] \f[I]unix\-time\f[R]]
[\f[CR]\-require\-leaf\-hash\f[R] \f[I]alg\f[R]:\f[I]hex\f[R]]
[\f[CR]\-verbose\f[R]]
.SH DESCRIPTION
\f[CR]osslsigncode\f[R] signs and verifies Microsoft Authenticode
signatures on supported file formats.
It can also extract data for detached signing, attach an externally
produced signature, add timestamps or unauthenticated blobs to an
existing signature, and remove an embedded signature.
.PP
Supported input formats include PE files such as EXE, DLL, and SYS, CAB,
CAT, MSI, APPX, and several script file types, including
\f[CR].ps1\f[R], \f[CR].ps1xml\f[R], \f[CR].psc1\f[R], \f[CR].psd1\f[R],
\f[CR].psm1\f[R], \f[CR].cdxml\f[R], \f[CR].mof\f[R], and
\f[CR].js\f[R].
.PP
The program supports these common workflows:
.IP \(bu 2
direct signing of an unsigned file
.IP \(bu 2
detached signing via \f[CR]extract\-data\f[R], \f[CR]sign\f[R], and
\f[CR]attach\-signature\f[R]
.IP \(bu 2
post\-sign timestamping with \f[CR]add\f[R]
.IP \(bu 2
verification of embedded signatures or catalog signatures with
\f[CR]verify\f[R]
.PP
If no subcommand is given, \f[CR]sign\f[R] is assumed.
.SH FORMATS
Support is not identical across all file formats.
.PP
In particular, detached\-signature workflows, nested signatures,
catalog\-based verification, and signature removal are format\-dependent
features.
A command that is valid for one supported file type may be unsupported
for another.
.PP
CAT files are a special case.
They are detached catalog containers for hashes of other files, not
ordinary embedded\-signature payloads.
A CAT file is itself a PKCS#7 structure containing authenticated entries
for one or more external files.
In practice, the catalog signs file digests recorded in the catalog,
rather than embedding a signature into each covered file.
.PP
Because of this, CAT files behave differently from embedded\-signature
formats.
They do not support \f[CR]attach\-signature\f[R],
\f[CR]remove\-signature\f[R], \f[CR]extract\-data\f[R], or nested
signatures.
.PP
MSI files are also a special case.
They support an extended signature mode controlled by
\f[CR]\-add\-msi\-dse\f[R].
In this mode, the MSI signature covers file metadata as well as file
content.
Detached\-signing workflows and any later re\-signing or nesting
operations must use a mode consistent with the MSI file\(cqs existing
signature structure.
.SH COMMANDS
.SS \f[CR]sign\f[R]
Create a new Authenticode signature.
.PP
This command can sign a normal unsigned file, or it can sign PKCS#7 data
previously produced by \f[CR]extract\-data\f[R].
.SS \f[CR]extract\-data\f[R]
Extract the PKCS#7 content to be signed later.
This is used for detached signing workflows.
.SS \f[CR]add\f[R]
Add unauthenticated attributes to an existing signature, typically an
Authenticode timestamp, an RFC 3161 timestamp, or an unauthenticated
blob.
.PP
With \f[CR]\-index\f[R], the selected signature in a multi\-signature
file is updated.
.SS \f[CR]attach\-signature\f[R]
Attach a detached PKCS#7 signature to an input file.
.PP
With \f[CR]\-nest\f[R], the new signature is attached as a nested
signature instead of replacing the primary one, if the file format
supports nested signatures.
.SS \f[CR]extract\-signature\f[R]
Extract the embedded PKCS#7 signature from a signed file.
.SS \f[CR]remove\-signature\f[R]
Remove the embedded signature from a signed file.
.SS \f[CR]verify\f[R]
Verify an embedded signature or a catalog signature.
.PP
Verification may include digest consistency, certificate chain
validation, certificate revocation checking, timestamp validation, and
optional checking of the signer\(cqs leaf certificate hash.
.PP
When verifying that a file is covered by a catalog, use
\f[CR]verify \-catalog catalog.cat \-in file\f[R].
Verifying the CAT file by itself validates the catalog signature;
verifying with \f[CR]\-catalog\f[R] checks whether the specified input
file is covered by that catalog.
.SH OPTIONS
Some options are available only in particular builds or OpenSSL
versions.
In particular, \f[CR]\-askpass\f[R] is build\-dependent,
\f[CR]\-provider\f[R] and \f[CR]\-nolegacy\f[R] require OpenSSL 3, and
engine\-related options depend on engine support in the build.
.SS General options
.TP
\f[CR]\-\-help\f[R]
Show help text.
With a subcommand, show help for that subcommand.
.TP
\f[CR]\-v\f[R], \f[CR]\-\-version\f[R]
Show version information.
.TP
\f[CR]\-in\f[R] \f[I]file\f[R]
Input file.
.TP
\f[CR]\-out\f[R] \f[I]file\f[R]
Output file.
Required for all commands except \f[CR]verify\f[R].
.TP
\f[CR]\-verbose\f[R]
Produce more detailed diagnostic output.
.SS Signing material
.TP
\f[CR]\-pkcs12\f[R] \f[I]file\f[R]
Read the signing certificate and private key from a PKCS#12 container.
.TP
\f[CR]\-certs\f[R], \f[CR]\-spc\f[R] \f[I]file\f[R]
Read the signing certificate chain.
The historical alias \f[CR]\-spc\f[R] is accepted.
.TP
\f[CR]\-key\f[R] \f[I]file\-or\-URI\f[R]
Read the private key.
This may also be a store or PKCS#11 URI.
.TP
\f[CR]\-ac\f[R] \f[I]file\f[R]
Add extra certificates to the signature block.
.TP
\f[CR]\-pass\f[R] \f[I]password\f[R]
Password or PIN for the key, token, or PKCS#12 container.
.TP
\f[CR]\-readpass\f[R] \f[I]file\f[R]
Read the password or PIN from \f[I]file\f[R].
Use \f[CR]\-\f[R] to read from standard input.
.TP
\f[CR]\-askpass\f[R]
Prompt for the password interactively.
.SS PKCS#11, engines, and providers
.TP
\f[CR]\-pkcs11module\f[R] \f[I]module\f[R]
Path to a PKCS#11 module.
.TP
\f[CR]\-pkcs11cert\f[R] \f[I]URI\f[R]
PKCS#11 URI identifying the certificate object.
.TP
\f[CR]\-provider\f[R] \f[I]provider\f[R]
OpenSSL 3 provider to load.
This is the preferred modern interface for provider\-based PKCS#11 use.
.TP
\f[CR]\-engine\f[R], \f[CR]\-pkcs11engine\f[R] \f[I]engine\f[R]
OpenSSL engine identifier or path to a dynamic engine module.
This interface is retained for compatibility with builds and deployments
that still support engines.
.TP
\f[CR]\-login\f[R]
Force login to the token for engine\-based PKCS#11 use.
.TP
\f[CR]\-engineCtrl\f[R] \f[I]command\f[R][:\f[I]parameter\f[R]]
Pass a control command to the selected engine.
.TP
\f[CR]\-nolegacy\f[R]
On OpenSSL 3 builds, do not automatically load the legacy provider.
.SS Signature contents and digest control
.TP
\f[CR]\-h\f[R] \f[CR]md5\f[R] | \f[CR]sha1\f[R] | \f[CR]sha2\f[R] | \f[CR]sha256\f[R] | \f[CR]sha384\f[R] | \f[CR]sha512\f[R]
Select the digest algorithm.
The default is \f[CR]sha256\f[R].
\f[CR]sha2\f[R] and \f[CR]sha256\f[R] are equivalent.
.TP
\f[CR]\-n\f[R] \f[I]description\f[R]
Description of the signed content.
.TP
\f[CR]\-i\f[R] \f[I]URL\f[R]
Informational URL associated with the signed content.
.TP
\f[CR]\-comm\f[R]
Use Microsoft Commercial Code Signing purpose instead of the default
individual purpose.
.TP
\f[CR]\-jp\f[R] \f[CR]low\f[R]
Add the Java CAB permission attribute.
Only \f[CR]low\f[R] is currently supported.
.TP
\f[CR]\-ph\f[R]
Generate page hashes for executable files.
.TP
\f[CR]\-add\-msi\-dse\f[R]
For MSI files, enable the \f[CR]MsiDigitalSignatureEx\f[R] signing mode.
In this mode, the signature covers MSI metadata as well as file content.
The metadata portion includes stream names, sizes, and selected
timestamps in the MSI structure.
This option changes the MSI signature format and should be used
consistently in any detached\-signing workflow involving
\f[CR]extract\-data\f[R], \f[CR]sign\f[R], \f[CR]attach\-signature\f[R],
or \f[CR]add\f[R].
.RS
For a newly signed MSI, this mode is generally preferred because it
extends signing coverage beyond file content alone.
For an already signed MSI, however, the chosen mode must match the
file\(cqs existing signature structure.
Switching between basic MSI signing and \f[CR]MsiDigitalSignatureEx\f[R]
during re\-signing or nested\-signature operations can invalidate the
existing signature.
.RE
.TP
\f[CR]\-pem\f[R]
Write PKCS#7 output in PEM format instead of DER.
.SS Timestamping and network options
The following timestamping modes are \f[B]mutually exclusive\f[R] within
a single \f[CR]sign\f[R] or \f[CR]add\f[R] invocation:
.IP \(bu 2
Authenticode timestamping with \f[CR]\-t\f[R]
.IP \(bu 2
RFC 3161 timestamping with \f[CR]\-ts\f[R]
.IP \(bu 2
built\-in RFC 3161 timestamp generation with \f[CR]\-TSA\-certs\f[R] and
\f[CR]\-TSA\-key\f[R]
.TP
\f[CR]\-t\f[R] \f[I]URL\f[R]
Add an Authenticode timestamp from the specified URL.
May be repeated.
.TP
\f[CR]\-ts\f[R] \f[I]URL\f[R]
Add an RFC 3161 timestamp from the specified URL.
May be repeated.
.TP
\f[CR]\-p\f[R] \f[I]proxy\f[R]
Proxy used for timestamp or CRL retrieval.
.TP
\f[CR]\-noverifypeer\f[R]
Do not verify the TLS certificate of the remote timestamp service.
.TP
\f[CR]\-HTTPS\-CAfile\f[R] \f[I]file\f[R]
PEM bundle used to verify HTTPS peers contacted by
\f[CR]osslsigncode\f[R].
.TP
\f[CR]\-HTTPS\-CRLfile\f[R] \f[I]file\f[R]
PEM CRL file used while verifying HTTPS peers.
.TP
\f[CR]\-TSA\-certs\f[R] \f[I]file\f[R]
PEM certificate chain for locally generated RFC 3161 timestamps.
.TP
\f[CR]\-TSA\-key\f[R] \f[I]file\-or\-URI\f[R]
Private key for locally generated RFC 3161 timestamps.
.TP
\f[CR]\-TSA\-time\f[R] \f[I]unix\-time\f[R]
Timestamp time for locally generated RFC 3161 responses.
.SS Nested signatures and indexed operations
.TP
\f[CR]\-nest\f[R]
Add a nested signature instead of replacing the primary signature.
.TP
\f[CR]\-index\f[R] \f[I]n\f[R]
Select a signature by index for \f[CR]add\f[R] or \f[CR]verify\f[R].
Index 0 is the primary signature.
.SS Unauthenticated blob options
.TP
\f[CR]\-addUnauthenticatedBlob\f[R]
Add an unauthenticated blob to the signature.
.TP
\f[CR]\-blobFile\f[R] \f[I]file\f[R]
Read blob contents from \f[I]file\f[R].
If omitted, a placeholder blob is created.
.SS Verification options
.TP
\f[CR]\-c\f[R], \f[CR]\-catalog\f[R] \f[I]file\f[R]
Verify the input file against the specified catalog file.
.TP
\f[CR]\-CAfile\f[R] \f[I]file\f[R]
PEM bundle of trusted CA certificates for signer validation.
.TP
\f[CR]\-CRLfile\f[R] \f[I]file\f[R]
PEM file containing CRLs for signer validation.
.TP
\f[CR]\-TSA\-CAfile\f[R], \f[CR]\-untrusted\f[R] \f[I]file\f[R]
PEM bundle of trusted CA certificates for timestamp validation.
.TP
\f[CR]\-TSA\-CRLfile\f[R], \f[CR]\-CRLuntrusted\f[R] \f[I]file\f[R]
PEM file containing CRLs for timestamp validation.
.TP
\f[CR]\-time\f[R], \f[CR]\-st\f[R] \f[I]unix\-time\f[R]
Verification time.
If a valid timestamp is present and used, chain validation is normally
performed at the timestamp time.
.TP
\f[CR]\-ignore\-timestamp\f[R]
Skip verification of the timestamp signature.
.TP
\f[CR]\-ignore\-cdp\f[R]
Do not fetch CRLs from CRL Distribution Points.
.TP
\f[CR]\-ignore\-crl\f[R]
Disable CRL retrieval and CRL validation.
.TP
\f[CR]\-require\-leaf\-hash\f[R] \f[I]alg\f[R]:\f[I]hex\f[R]
Require the signer\(cqs leaf certificate to hash to the specified value.
The hash is computed over the DER encoding of the leaf certificate.
.SH EXIT STATUS
.TP
\f[CR]0\f[R]
Success.
.TP
non\-zero
Failure.
.SH DIAGNOSTICS
Common causes of failure include:
.TP
missing CA trust bundle
On Unix\-like systems, \f[CR]verify\f[R] expects a readable CA bundle,
either from \f[CR]\-CAfile\f[R] or from a detected system default.
.TP
detached\-signing mismatch
\f[CR]extract\-data\f[R], \f[CR]sign\f[R], and
\f[CR]attach\-signature\f[R] must use compatible digest\-affecting
options such as \f[CR]\-h\f[R], and where relevant \f[CR]\-ph\f[R] and
\f[CR]\-add\-msi\-dse\f[R].
.TP
unsupported format feature
Some file formats do not support every subcommand or every signature
mode.
.TP
missing TSA trust chain
Timestamp verification may fail unless the appropriate TSA trust anchors
are supplied with \f[CR]\-TSA\-CAfile\f[R], and where needed
\f[CR]\-TSA\-CRLfile\f[R].
.TP
conflicting timestamp modes
\f[CR]\-t\f[R], \f[CR]\-ts\f[R], and built\-in TSA signing cannot be
combined in one command.
.TP
MSI signature mode mismatch
Re\-signing or nesting an MSI signature must be consistent with whether
the file already uses \f[CR]MsiDigitalSignatureEx\f[R].
Mixing modes may invalidate the existing signature.
.SH ENVIRONMENT
.TP
\f[CR]HTTP_PROXY\f[R], \f[CR]http_proxy\f[R]
Default proxy for HTTP access if \f[CR]\-p\f[R] is not given.
.TP
\f[CR]HTTPS_PROXY\f[R], \f[CR]https_proxy\f[R]
Default proxy for HTTPS access if \f[CR]\-p\f[R] is not given.
.TP
\f[CR]OPENSSL_ENGINES\f[R]
May help OpenSSL find engine modules.
.SH FILES
On Unix\-like systems, \f[CR]osslsigncode\f[R] tries common CA bundle
locations for its default \f[CR]\-CAfile\f[R], including:
.IP \(bu 2
\f[CR]/etc/ssl/certs/ca\-certificates.crt\f[R]
.IP \(bu 2
\f[CR]/etc/pki/tls/certs/ca\-bundle.crt\f[R]
.IP \(bu 2
\f[CR]/usr/share/ssl/certs/ca\-bundle.crt\f[R]
.IP \(bu 2
\f[CR]/usr/local/share/certs/ca\-root\-nss.crt\f[R]
.IP \(bu 2
\f[CR]/etc/ssl/cert.pem\f[R]
.PP
If no readable CA bundle is available, \f[CR]verify\f[R] may require an
explicit \f[CR]\-CAfile\f[R].
.SH NOTES
Use \f[CR]extract\-data\f[R] when you need to create a new detached
signature object.
Use \f[CR]extract\-signature\f[R] when you need to copy an existing
embedded PKCS#7 signature out of a file.
.PP
For safer secret handling, prefer \f[CR]\-readpass\f[R] or
\f[CR]\-askpass\f[R] over \f[CR]\-pass\f[R].
.PP
Data added with \f[CR]\-addUnauthenticatedBlob\f[R] is not protected by
the signature and must not be treated as trusted.
.PP
For new MSI signatures, \f[CR]\-add\-msi\-dse\f[R] is generally
preferred because it extends signing coverage to MSI metadata as well as
file content.
However, it is format\-affecting rather than cosmetic, so existing
signed MSI files should be re\-signed only in a mode consistent with
their current signature structure.
.PP
Output files are not overwritten.
.SH EXAMPLES
.SS Sign and verify a file
.IP
.EX
osslsigncode sign \(rs
\-pkcs12 signer.p12 \(rs
\-readpass p12\-pass.txt \(rs
\-n \(dqExample Application\(dq \(rs
\-i \(dqhttps://example.com/\(dq \(rs
\-ts \(dqhttps://tsa.example.net/\(dq \(rs
\-in app.exe \(rs
\-out app\-signed.exe
osslsigncode verify \(rs
\-CAfile ca\-bundle.pem \(rs
\-TSA\-CAfile tsa\-ca\-bundle.pem \(rs
\-in app\-signed.exe
.EE
.SS Detached signing workflow
.IP
.EX
osslsigncode extract\-data \(rs
\-h sha384 \(rs
\-ph \(rs
\-in app.exe \(rs
\-out app\-data.der
osslsigncode sign \(rs
\-pkcs12 signer.p12 \(rs
\-readpass p12\-pass.txt \(rs
\-h sha384 \(rs
\-in app\-data.der \(rs
\-out app\-sig.der
osslsigncode attach\-signature \(rs
\-h sha384 \(rs
\-sigin app\-sig.der \(rs
\-in app.exe \(rs
\-out app\-signed.exe
osslsigncode verify \(rs
\-CAfile ca\-bundle.pem \(rs
\-in app\-signed.exe
.EE
.SS Sign a new MSI with extended MSI metadata coverage
.IP
.EX
osslsigncode sign \(rs
\-pkcs12 signer.p12 \(rs
\-readpass p12\-pass.txt \(rs
\-add\-msi\-dse \(rs
\-in installer.msi \(rs
\-out installer\-signed.msi
.EE
.SS Use a PKCS#11 provider
.IP
.EX
osslsigncode sign \(rs
\-provider /path/to/pkcs11prov.so \(rs
\-pkcs11module /path/to/opensc\-pkcs11.so \(rs
\-pkcs11cert \(aqpkcs11:token=my\-token;object=cert\(aq \(rs
\-key \(aqpkcs11:token=my\-token;object=key\(aq \(rs
\-readpass pin.txt \(rs
\-in app.exe \(rs
\-out app\-signed.exe
.EE
.SS Add a timestamp to an already signed file
.IP
.EX
osslsigncode add \(rs
\-ts \(dqhttps://tsa.example.net/\(dq \(rs
\-in app\-signed.exe \(rs
\-out app\-signed\-ts.exe
.EE
.SS Verify that a file is covered by a catalog
.IP
.EX
osslsigncode verify \(rs
\-catalog drivers.cat \(rs
\-CAfile ca\-bundle.pem \(rs
\-CRLfile ca\-crl.pem \(rs
\-in driver.sys
.EE
.SH REPORTING BUGS
Report bugs and suspected issues via the project issue tracker:
.PP
\c
.UR https://github.com/mtrojnar/osslsigncode/issues
.UE \c
.SH AUTHORS
Originally written by Per Allansson.
.PP
Maintained and extended by Michał Trojnara.
.PP
Major contributions by Małgorzata Olszówka.
.PP
Additional contributions by other project contributors.
.SH SEE ALSO
\f[B]OpenSSL\f[R] Library
.PP
\c
.UR https://openssl-library.org/
.UE \c
Reference in New Issue View Git Blame Copy Permalink