NAME

       debsigs - process signatures in .deb packages

SYNOPSIS

       debsigs --list|-l [-v] file [file...]

       debsigs --sign=type [--default-key=keyID] [-v] file [file...]

       debsigs --verify|--check|-c file [file...]

       debsigs --delete=type file [file...]

DESCRIPTION

       debsigs is used to manipulate the cryptographic signatures stored inside a .deb file.  It is not used to
       verify those signatures; for that purpose, see debsig-verify(1).

OPTIONS

       --list or -l or -t
            Lists the signatures found in the specified file.

       --sign=type
            Creates a new signature of the type specified in the given file.  The signature will be created
            using the default key for your GPG keyring.  See "SIGNATURE TYPES" below for possible values of the
            "type" field.

       --default-key=keyID
            Uses a key other than the default for signing the package.

       --secret-keyring=file or -K file
            Uses a keyring other than the default for signing the package.  This option is passed along to GPG
            verbatim; see the discussion in the gpg(1) manpage for information on how to specify the keyring
            file.

       -v   Displays verbose output.

       --verify or --check or -c
            Invokes debsig-verify to check the validity of the signature on this package.

       --delete=type
            Deletes the signature of the specified type from the package.

SIGNATURE TYPES

       A Debian package may carry different types of signatures.  The most commonly-used ones are:

       •   "origin"

           The official signature of the organization which distributes the package, usually the Debian Project
           or a GNU/Linux distribution derived from it.  This signature may be added automatically.

       •   "maint"

           The signature of the maintainer of the Debian package.  This signature should be added by the
           maintainer before uploading the package.

       •   "archive"

           An automatically-added signature renewed periodically to ensure that a package downloaded from an
           online archive is indeed the latest version distributed by the organization.

       See the /usr/share/doc/debsigs/signing-policy.txt file for more information and rationale for the
       different signature types.

FUTURE DIRECTIONS

       It would be nice to have a command-line option to change the command used for signing, instead of hard-
       coding "gpg".

AUTHOR

       John Goerzen <jgoerzen@progenylinux.com>

SEE ALSO

       debsig-verify(1), gpg(1)