OSTREE SIGN(1)

    .SH "NAME" ostree-sign - Sign a commit
    .SH "SYNOPSIS"
        .HP u
            ostree sign [OPTIONS...] {COMMIT} {KEY-ID...}

    .SH "DESCRIPTION"

        .PP Add a new signature to a commit. Note that currently, this will append a new signature even if the commit is already signed with a given key.
        .PP There are several "well-known" system places for `ed25519` trusted and revoked public keys -- expected single base64-encoded key per line.
        .PP Files:

    • /etc/ostree/trusted.ed25519

    • /etc/ostree/revoked.ed25519

    • /usr/share/ostree/trusted.ed25519

    • /usr/share/ostree/revoked.ed25519

        .PP Directories containing files with keys:

    • /etc/ostree/trusted.ed25519.d

    • /etc/ostree/revoked.ed25519.d

    • /usr/share/ostree/trusted.ed25519.d

    • /usr/share/ostree/rvokeded.ed25519.d

    .SH "OPTIONS"

            .PP KEY-ID

                            .PP for ed25519:

                                base64-encoded secret (for signing) or public key (for verifying).
                                .RE
                                .PP for dummy:

                                    ASCII-string used as secret key and public key.
                                    .RE
                                    .sp
                        .RE
                        .PP --verify

                                Verify signatures
                            .RE
                            .PP -s, --sign-type

                                    Use particular signature mechanism. Currently available ed25519 and dummy signature types. The default is ed25519.
                                .RE
                               .PP --keys-file

                                        Read key(s) from file filename.
                                        Valid for ed25519 signature type. For ed25519 this file must contain base64-encoded secret key(s) (for signing) or public key(s) (for verifying) per line.
                                    .RE
                                    .PP --keys-dir

                                            Redefine the system path, where to search files and subdirectories with well-known and revoked keys.
                                        .RE