osslsigncode 2.15, using:
	OpenSSL 4.0.3 29 Sep 2026 (Library: OpenSSL 4.0.3 29 Sep 2026)
Default -CAfile location: /etc/ssl/certs/ca-certificates.crt

Please send bug-reports to Michal.Trojnara@stunnel.org

osslsigncode is a small tool that implements part of the functionality of the Microsoft
tool signtool.exe - more exactly the Authenticode signing and timestamping.
It can sign and timestamp PE (EXE/SYS/DLL/etc), CAB, CAT, MSI and APPX files,
as well as script files with extensions .ps1, .ps1xml, .psc1, .psd1,
.psm1, .cdxml, .mof and .js,
supports getting the timestamp through a proxy as well.
osslsigncode also supports signature verification, removal and extraction.

--version | -v         = print osslsigncode version and usage
--help                 = print osslsigncode help menu

Commands:
add                    = add an unauthenticated blob or a timestamp to a previously-signed file
attach-signature       = sign file using a given signature
extract-signature      = extract signature from a previously-signed file
extract-data           = extract a data content to be signed
remove-signature       = remove sections of the embedded signature on a file
sign                   = digitally sign a file
verify                 = verifies the digital signature of a file

For help on a specific command, enter /usr/bin/osslsigncode <command> --help

Usage: /usr/bin/osslsigncode

 [ --version | -v ]
 [ --help ]

 [ sign ] -pkcs12 <file> | ( [ -certs <file|URI> | -spc <file> ]
            ( -key <file|URI> [ -pkcs11module <module> ] [ -pkcs11cert <pkcs11 cert URI> ] )
            [ -provider <provider> |             [ -nolegacy ]
            [ -pass <password>  [ -askpass ] [ -readpass <file> ]
            (use "-" with readpass to read from stdin)
            [ -ac <file> ]
            [ -h {md5,sha1,sha2(56),sha384,sha512} ]
            [ -n <desc> ] [ -i <url> ] [ -jp <level> ] [ -comm ]
            [ -ph ]
            [ -t <timestampurl> [ -t ... ] [ -p <proxy> ] [ -noverifypeer  ]
            [ -ts <timestampurl> [ -ts ... ] [ -p <proxy> ] [ -noverifypeer ] ]
            [ -TSA-certs <file> ] [ -TSA-key <file> ]
            [ -TSA-time <unix-time> ]
            [ -HTTPS-CAfile <file> ]
            [ -HTTPS-CRLfile <file> ]
            [ -time <unix-time> ]
            [ -addUnauthenticatedBlob [ -blobFile <file> ] ]
            [ -nest ]
            [ -verbose ]
            [ -add-msi-dse ]
            [ -pem ]
            [ -in ] <file> [-out ] <file>

 extract-data [ -pem ]
            [ -h {md5,sha1,sha2(56),sha384,sha512} ]
            [ -ph ]
            [ -add-msi-dse ]
            [ -in ] <file> [ -out ] <file>

 add [ -addUnauthenticatedBlob [ -blobFile <file> ] ]
            [ -t <timestampurl> [ -t ... ] [ -p <proxy> ] [ -noverifypeer  ]
            [ -ts <timestampurl> [ -ts ... ] [ -p <proxy> ] [ -noverifypeer ] ]
            [ -TSA-certs <file> ] [ -TSA-key <file> ]
            [ -TSA-time <unix-time> ]
            [ -HTTPS-CAfile <file> ]
            [ -HTTPS-CRLfile <file> ]
            [ -h {md5,sha1,sha2(56),sha384,sha512} ]
            [ -index <index> ]
            [ -verbose ]
            [ -add-msi-dse ]
            [ -in ] <file> [ -out ] <file>

 attach-signature [ -sigin ] <file>
            [ -h {md5,sha1,sha2(56),sha384,sha512} ]
            [ -nest ]
            [ -add-msi-dse ]
            [ -in ] <file> [ -out ] <file>

 extract-signature [ -pem ]
            [ -in ] <file> [ -out ] <file>

 remove-signature [ -in ] <file> [ -out ] <file>

 verify [ -in ] <file>
            [ -c | -catalog <file> ]
            [ -CAfile <file> ]
            [ -CRLfile <file> ]
            [ -HTTPS-CAfile <file> ]
            [ -HTTPS-CRLfile <file> ]
            [ -TSA-CAfile <file> ]
            [ -TSA-CRLfile <file> ]
            [ -p <proxy> ]
            [ -index <index> ]
            [ -ignore-timestamp ]
            [ -ignore-cdp ]
            [ -ignore-crl ]
            [ -time <unix-time> ]
            [ -require-leaf-hash {md5,sha1,sha2(56),sha384,sha512}:XXXXXXXXXXXX... ]
            [ -verbose ]