OSTREE SIGN(1) ostree sign OSTREE SIGN(1)

.SH "NAME" ostree-sign - Sign a commit

.SH "SYNOPSIS"

.HP 288u

**ostree sign** \[OPTIONS...] {COMMIT} {KEY-ID...}

.SH "DESCRIPTION"

.PP Add a new signature to a commit. Note that currently, this will append a new signature even if the commit is already signed with a given key.

.PP For \`ed25519\` and \`spki\`, there are several "well-known" system places for trusted and revoked public keys as listed below.

.PP Files:

•/etc/ostree/trusted.*SIGN-TYPE*

•/etc/ostree/revoked.*SIGN-TYPE*

•/usr/share/ostree/trusted.*SIGN-TYPE*

•/usr/share/ostree/revoked.*SIGN-TYPE*

.PP Directories containing files with keys:

•/etc/ostree/trusted.*SIGN-TYPE*.d

•/etc/ostree/revoked.*SIGN-TYPE*.d

•/usr/share/ostree/trusted.*SIGN-TYPE*.d

•/usr/share/ostree/revoked.*SIGN-TYPE*.d

.PP The format of those files depends on the signature mechanism; for \`ed25519\`, keys are stored in the base64 encoding per line, while for \`spki\` they are stored in the PEM "PUBLIC KEY" encoding.

.SH "OPTIONS"

.PP **KEY-ID**

.PP **for ed25519 and spki:**

base64-encoded secret (for signing) or public key (for verifying).

.RE

.PP **for dummy:**

ASCII-string used as secret key and public key.

.RE  
.sp

.RE  
.PP **--verify**

Verify signatures

.RE  
.PP **-s, --sign-type**

Use particular signature mechanism. Currently available ed25519, spki, and dummy signature types. The default is ed25519.

.RE  
.PP **--keys-file**

Read keys from file filename.

Valid for ed25519 and spki signature types. This file must contain one base64-encoded key per line. Each key may be a secret key (for signing) or a public key (for verifying).

.RE  
.PP **--keys-dir**

Redefine the system path, where to search files and subdirectories with well-known and revoked keys.

.RE

OSTree

---

Document: ostree-sign(1) from ostree 2026.4-r2 (Chainguard OS)
Source: https://github.com/ostreedev/ostree