wingetCollections
  • Auto
  • Search
  • Awesome Collections
  • Awesome Programs
  • My Favorite Collections
  • My Collections
  • Account / Settings
  • Terms of Service
  • Privacy
  • About

© 2025 winget.ragerworks.com

Loading...
Install osslsigncode using Winget - wingetCollections
  1. Go back
  2. Packages
  3. osslsigncode
osslsigncode logo

osslsigncode Michał Trojnara

Use this command to install osslsigncode:
winget install --id=MichalTrojnara.osslsigncode -e

osslsigncode is a small tool that implements part of the functionality of the Microsoft tool signtool.exe

osslsigncode Description

Primary Purpose:
osslsigncode is a tool designed to provide Authenticode signing and timestamping functionality, similar to Microsoft's signtool.exe but based on OpenSSL and cURL. It enables cross-platform code signing for PE (EXE/SYS/DLL/etc), MSI, CAB files, and Java CAB files.

Key Features:

  • Supports signing of PE, MSI, CAB, and Java CAB files.
  • Implements functionality similar to signtool.exe's "-j javasign.dll -jp low".
  • Integrates with OpenSSL and cURL for compatibility across various platforms.
  • Handles timestamping through proxies.
  • Works with certificates in SPC, PEM, PKCS#12 formats and supports PKCS#11 tokens.

Audience & Benefits:
Ideal for developers needing to sign binaries on non-Windows platforms. It simplifies the process of cross-platform development by avoiding reliance on Windows-specific tools. osslsigncode allows for efficient code signing without the constraints of traditional Windows-based solutions, enhancing workflow and flexibility in software development.

This tool can be installed via winget, ensuring ease of setup across supported environments.

README

osslsigncode

BUILD STATUS

CI

WHAT IS IT?

osslsigncode is a small tool that implements part of the functionality of the Microsoft tool signtool.exe - more exactly the Authenticode signing and timestamping. But osslsigncode is based on OpenSSL and cURL, and thus should be able to compile on most platforms where these exist.

WHY?

Why not use signtool.exe? Because I don't want to go to a Windows machine every time I need to sign a binary - I can compile and build the binaries using Wine on my Linux machine, but I can't sign them since the signtool.exe makes good use of the CryptoAPI in Windows, and these APIs aren't (yet?) fully implemented in Wine, so the signtool.exe tool would fail. And, so, osslsigncode was born.

WHAT CAN IT DO?

It can sign and timestamp PE (EXE/SYS/DLL/etc), CAB, CAT, MSI and APPX files, as well as script files with extensions .ps1, .ps1xml, .psc1, .psd1, .psm1, .cdxml, .mof, and .js. It supports the equivalent of signtool.exe's "-j javasign.dll -jp low", i.e. add a valid signature for a CAB file containing Java files. It supports getting the timestamp through a proxy as well. It also supports signature verification, removal and extraction.

BUILDING

This section covers building osslsigncode for Unix-like operating systems. See INSTALL.W32.md for Windows notes. We highly recommend downloading a release tarball instead of cloning from a git repository.

Configure, build, make tests and install osslsigncode

  • Install prerequisites on a Debian-based distributions, such as Ubuntu:
  sudo apt update && sudo apt install cmake libssl-dev libcurl4-openssl-dev zlib1g-dev python3
  • Install prerequisites on macOS with Homebrew:
  brew install cmake pkg-config openssl@1.1
  export PKG_CONFIG_PATH="/usr/local/opt/openssl@1.1/lib/pkgconfig"

NOTE: osslsigncode requires CMake 3.17 or newer.

You may need to use cmake3 instead of cmake to complete the following steps on your system.

  • Navigate to the build directory and run CMake to configure the osslsigncode project and generate a native build system:
Versions
2.10
2.9
Website
github.com
License
Last Updated
6/24/2025
  mkdir build && cd build && cmake -S ..

optional CMake parameters:

  -DCMAKE_BUILD_TYPE=Debug
  -DCMAKE_C_COMPILER=clang
  -DCMAKE_PREFIX_PATH=[openssl directory];[curl directory]
  -DCMAKE_INSTALL_PREFIX=[installation directory]
  -DBASH_COMPLETION_USER_DIR=[bash completion installation directory]
  • Then call that build system to actually compile/link the osslsigncode project (alias make):
  cmake --build .
  • Make test:
  ctest -C Release
  • Make install:
  sudo cmake --install .
  • Make tarball (simulate autotools' make dist):
  cmake --build . --target package_source

USAGE

Before you can sign a file you need a Software Publishing Certificate (spc) and a corresponding private key.

This article provides a good starting point as to how to do the signing with the Microsoft signtool.exe:

http://www.matthew-jones.com/articles/codesigning.html

To sign with osslsigncode you need the certificate file mentioned in the article above, in SPC or PEM format, and you will also need the private key which must be a key file in DER or PEM format, or if osslsigncode was compiled against OpenSSL 1.0.0 or later, in PVK format.

To sign a PE or MSI file you can now do:

  osslsigncode sign -certs  -key  \
    -n "Your Application" -i http://www.yourwebsite.com/ \
    -in yourapp.exe -out yourapp-signed.exe

or if you are using a PEM or PVK key file with a password together with a PEM certificate:

  osslsigncode sign -certs  \
    -key  -pass  \
    -n "Your Application" -i http://www.yourwebsite.com/ \
    -in yourapp.exe -out yourapp-signed.exe

or if you want to add a timestamp as well:

  osslsigncode sign -certs  -key  \
    -n "Your Application" -i http://www.yourwebsite.com/ \
    -t http://timestamp.digicert.com \
    -in yourapp.exe -out yourapp-signed.exe

You can use a certificate and key stored in a PKCS#12 container:

  osslsigncode sign -pkcs12  -pass  \
    -n "Your Application" -i http://www.yourwebsite.com/ \
    -in yourapp.exe -out yourapp-signed.exe

To sign a CAB file containing Java class files:

  osslsigncode sign -certs  -key  \
    -n "Your Application" -i http://www.yourwebsite.com/ \
    -jp low \
    -in yourapp.cab -out yourapp-signed.cab

Only the 'low' parameter is currently supported.

If you want to use a PKCS#11 token, you should specify the PKCS#11 engine and module. An example of using osslsigncode with SoftHSM:

  osslsigncode sign \
    -engine /usr/lib64/engines-1.1/pkcs11.so \
    -pkcs11module /usr/lib64/pkcs11/libsofthsm2.so \
    -pkcs11cert 'pkcs11:token=softhsm-token;object=cert' \
    -key 'pkcs11:token=softhsm-token;object=key' \
    -in yourapp.exe -out yourapp-signed.exe

Since OpenSSL 3.0, you can use a PKCS#11 token with the PKCS#11 provider. An example of using osslsigncode with OpenSC:

  osslsigncode sign \
    -provider /usr/lib64/ossl-modules/pkcs11prov.so \
    -pkcs11module /usr/lib64/opensc-pkcs11.so \
    -pkcs11cert 'pkcs11:token=my-token;object=cert' \
    -key 'pkcs11:token=my-token;object=key' \
    -in yourapp.exe -out yourapp-signed.exe

You can use a certificate and key stored in the Windows Certificate Store with the CNG engine version 1.1 or later. For more information, refer to

https://www.stunnel.org/cng-engine.html

A non-commercial edition of CNG engine is available for testing, personal, educational, or research purposes.

To use the CNG engine with osslsigncode, ensure that the cng.dll library is placed in the same directory as the osslsigncode.exe executable.

Below is an example of how to use osslsigncode with the CNG engine:

  osslsigncode sign \
    -engine cng \
    -pkcs11cert osslsigncode_cert \
    -key osslsigncode_cert \
    -engineCtrl store_flags:0 \
    -engineCtrl store_name:MY \
    -engineCtrl PIN:yourpass \
    -in yourapp.exe -out yourapp-signed.exe

You can check that the signed file is correct by right-clicking on it in Windows and choose Properties --> Digital Signatures, and then choose the signature from the list, and click on Details. You should then be presented with a dialog that says amongst other things that "This digital signature is OK".

UNAUTHENTICATED BLOBS

The "-addUnauthenticatedBlob" parameter adds a 1024-byte unauthenticated blob of data to the signature in the same area as the timestamp. This can be used while signing, while timestamping, after a file has been code signed, or by itself. This technique (but not this project) is used by Dropbox, GoToMeeting, and Summit Route.

Example 1. Sign and add blob to unsigned file

osslsigncode sign -addUnauthenticatedBlob -pkcs12 yourcert.pfx -pass your_password -n "Your Company" -i https://YourSite.com/ -in srepp.msi -out srepp_added.msi

Example 2. Timestamp and add blob to signed file

osslsigncode.exe add -addUnauthenticatedBlob -t http://timestamp.digicert.com -in your_signed_file.exe -out out.exe

Example 3. Add blob to signed and time-stamped file

osslsigncode.exe add -addUnauthenticatedBlob -in your_signed_file.exe -out out.exe

WARNING

This feature allows for doing dumb things. Be very careful with what you put in the unauthenticated blob, as an attacker could modify this. Do NOT, under any circumstances, put a URL here that you will use to download an additional file. If you do that, you would need to check the newly downloaded file is code signed AND that it has been signed with your cert AND that it is the version you expect.

BUGS, QUESTIONS etc.

Check whether your question or suspected bug was already discussed on https://github.com/mtrojnar/osslsigncode/issues. Otherwise, open a new issue.

BUT, if you have questions related to generating spc files, converting between different formats and so on, please spend a few minutes searching on google for your particular problem since many people probably already have had your problem and solved it as well.