altsign(1)

ALTSIGN(1)

User Commands

ALTSIGN(1)

NAME

altsign - submit a signing request to an altsign session

SYNOPSIS

altsign [OPTIONS]

DESCRIPTION

altsign sends a signing request to a session socket created by altsign-set(1). The input and output paths are opened locally and passed to the session daemon as file descriptors, so the file data never travels on the command line.

By default the input is treated as a kernel module. Use --pe to sign a PE binary instead. The tool prints the session response to standard output.

OPTIONS

-i, --infile=FILE: Input file to be signed. This option is required.
-o, --outfile=FILE: Output file to write the signed result. This option is required.
-S, --socket=SOCKET: Session socket path. By default the socket path is selected based on sign type: --module (default) uses /run/altsign-module/session/sockdir/session.sock, and --pe uses /run/altsign-pe/session/sockdir/session.sock. An explicit --socket always overrides this selection.
--module: Sign a kernel module (default) and select the module session socket path by default. Mutually exclusive with --pe.
--pe: Sign a PE binary and select the PE session socket path by default. Mutually exclusive with --module.
-?, --help: Show the full help text.
--usage: Show a short usage summary.

FILES

/run/altsign-module/session/sockdir/session.sock: Default session socket path for module signing.
/run/altsign-pe/session/sockdir/session.sock: Default session socket path for PE signing.

EXIT STATUS

0: Signing completed successfully.
non-zero: An error occurred during setup or signing.

EXAMPLES

Start a session and sign a module:

sock=$(altsign-set --certificate release)
altsign --infile driver.ko --outfile driver.signed.ko --socket "$sock"

Sign a PE binary using the default PE session socket:

altsign --infile app.exe --outfile app.signed.exe --pe

Sign a module using the default module session socket:

altsign --infile driver.ko --outfile driver.signed.ko --module