ostree-sign − Sign a commit
|
ostree sign [OPTIONS...] {COMMIT} {KEY−ID...} |
Add a new signature to a commit. Note that currently, this will append a new signature even if the commit is already signed with a given key.
There are several "well−known" system places for ‘ed25519‘ trusted and revoked public keys −− expected single base64−encoded key per line.
Files:
• /etc/ostree/trusted.ed25519
• /etc/ostree/revoked.ed25519
• /usr/share/ostree/trusted.ed25519
• /usr/share/ostree/revoked.ed25519
Directories containing files with keys:
• /etc/ostree/trusted.ed25519.d
• /etc/ostree/revoked.ed25519.d
• /usr/share/ostree/trusted.ed25519.d
• /usr/share/ostree/rvokeded.ed25519.d
KEY−ID
for ed25519:
base64−encoded secret (for signing) or public key (for verifying).
for dummy:
ASCII−string used as secret key and public key.
−−verify
Verify signatures
−s, −−sign−type
Use particular signature mechanism. Currently available ed25519 and dummy signature types. The default is ed25519.
−−keys−file
Read key(s) from file filename. Valid for ed25519 signature type. For ed25519 this file must contain base64−encoded secret key(s) (for signing) or public key(s) (for verifying) per line.
−−keys−dir
Redefine the system path, where to search files and subdirectories with well−known and revoked keys.