---
name: "systemd-report-sign-plain@.service"
section: "8"
platform: "linux"
package: "systemd"
version: "262.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/systemd-report-sign-plain@.service"
---

# systemd-report-sign-plain@.service(8)

Sign system reports with a local software key

## NAME

systemd-report-sign-plain@.service, systemd-report-sign-plain.socket, systemd-report-sign-plain - Sign system reports with a local software key

## SYNOPSIS

systemd-report-sign-plain@.service

systemd-report-sign-plain.socket

/usr/lib/systemd/systemd-report-sign-plain

## DESCRIPTION

**systemd-report-sign-plain@.service** is a system service that signs system reports generated by [**systemd-report**(1)](/systemd-report/1.md). It is a signing backend for the **--sign=** logic of that tool: it implements the **io.systemd.Report.Signer.Sign()** Varlink method and is reached via a socket linked into the /run/systemd/report.sign/ directory, named plain.

The service is socket-activated (one instance per connection) via systemd-report-sign-plain.socket, and signs the digest passed to it with a local software key. Signatures are made with the Ed25519 (EdDSA) algorithm.

On first use a key pair is generated automatically and stored below /var/lib/systemd/report.sign.plain/: the private key in local.private (PKCS#8 PEM, readable only by the root user) and the public key in local.public (PEM, world readable).

The public key is also exported as a system report metric.

## SEE ALSO

[**systemd**(1)](/systemd/1.md), [**systemd-report**(1)](/systemd-report/1.md)