---
name: "pkg_sign"
section: "1"
platform: "openbsd"
package: "man"
version: "8.0-current-20261101"
release: "OpenBSD 8.0-current (2026-11-01)"
platforms: ["openbsd"]
url: "https://new.carta.tech/pkg_sign"
---

# pkg\_sign(1)

sign binary packages for distribution

## NAME

**pkg\_sign** – sign binary packages for distribution

## SYNOPSIS

**pkg\_sign** \[**-Cvi**\] \[**-D** *name*\[=*value*\]\] \[**-j** *maxjobs*\] \[**-o** *dir*\] **-s** **signify2** **-s** *privkey* \[**-S** *source*\] \[*pkg-name* *...*\]

## DESCRIPTION

The **pkg\_sign** command is used to sign existing collections of binary packages created by [pkg\_create(1)](/pkg_create/1.md).

It will sign the packages and optionally, produce a *SHA256* manifest file in the output directory. The options are as follows:

- **-C**

  Append [sha256(1)](/sha256/1.md) checksums to *SHA256* in the output directory, then sort it.

- **-i**

  Incremental mode. Ignore packages that are already in the output repository. Note that, in verbose mode, they will still show up as ‘Signed’ in the listing.

- **-j** *maxjobs*

  Sign existing packages in parallel.

- **-o** *dir*

  Specify output directory for signing packages. Otherwise, signed packages are created in the current directory.

- **-S** *source*

  Source repository for packages to be signed.

-

  **-s** **signify2** **-s** *privkey* Specify signature parameters for signed packages. Option parameters are as follows:

  - **signify2**

    Choose [signify(1)](/signify/1.md) new style signatures, where the [gzip(1)](/gzip/1.md) compressed data is signed.

  - *privkey*

    The path to the signer's private key. For **signify**, the private key name is used to set the **@signer** annotation. If a corresponding public key is found, the first signatures will be checked for key mismatches.

- **-v**

  Turn on verbose output, display ‘Signed output/pkg.tgz’ after each package is signed.

## SIGNATURE DETAILS

The signature is stored within the [gzip(1)](/gzip/1.md) comment, as plain text data, according to [signify(1)](/signify/1.md) **-zS** mode. It contains the ed25519 signature, some meta-information, and SHA512/256 checksums for each 64K block of compressed data.

Additionally, for further manual checking, the packing-list contains a complete manifest of files within the package, checksummed with [sha256(1)](/sha256/1.md) and annotated with proper **@mode**, **@user**, **@group** annotations, so that pkg\_add(1) will refuse to give special rights to any file which isn't properly annotated, and so that it will abort on installation of a file whose checksum does not match.

Meta-information from [signify(1)](/signify/1.md) gets inserted in the packing-list during extraction, adding a **@digital-signature** annotation and a **@signer** annotation for further manual inspection.

## SEE ALSO

[cksum(1)](/cksum/1.md), pkg\_add(1), [signify(1)](/signify/1.md), [tar(1)](/tar/1.md), [package(5)](/package/5.md)

## HISTORY

The **pkg\_sign** command first appeared in OpenBSD 5.5. The signature process was completely redesigned for OpenBSD 6.1.

## AUTHORS

Marc Espie