Minisign

Minisign is a dead simple tool to sign files and verify signatures.

For more information, please refer to the
Minisign documentation

Tarballs and pre-compiled binaries can be verified with the following
public key:

RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3

Compilation / installation

Dependencies:

• libsodium
• cmake
• pkg-config

Compilation:

$ mkdir build
$ cd build
$ cmake ..
$ make
# make install

Alternative configuration for static binaries:

$ cmake .. -D STATIC_LIBSODIUM=1

or:

$ cmake .. -D BUILD_STATIC_EXECUTABLES=1

Minisign is also available in Homebrew:

$ brew install minisign

Minisign is also available in Scoop on Windows:

$ scoop install minisign

Minisign is also available in chocolatey on Windows:

$ choco install minisign

Minisign is also available on Ubuntu as a PPA:

$ [sudo] add-apt-repository ppa:dysfunctionalprogramming/minisign

Additional tools, libraries and implementations

• minisign-misc is a very
  nice set of workflows and scripts for macOS to verify and sign files
  with minisign.
• go-minisign is a small module
  in Go to verify Minisign signatures.
• rust-minisign is a Minisign
  library written in pure Rust, that can be embedded in other applications.
• rsign2 is a reimplementation of
  the command-line tool in Rust.
• minisign-verify is
  a small Rust crate to verify Minisign signatures.
• minisign-net is a .NET library
  to handle and create Minisign signatures.
• minisign a Javascript
  implementation.
• WebAssembly implementations of rsign2
  and minisign-cli are available on
  WAPM.

Signature determinism

This implementation uses deterministic signatures, unless libsodium
was compiled with the ED25519_NONDETERMINISTIC macro defined. This
adds random noise to the computation of EdDSA nonces.

Other implementations can choose to use non-deterministic signatures
by default. They will remain fully interoperable with implementations
using deterministic signatures.