Metadata-Version: 2.4
Name: opensighub
Version: 0.3.1a1
Summary: OpenSigHub signs boot and operating system artifacts like UEFI Secure Boot, NXP HAB4 or swupdate files
Keywords: code-signing,pkcs11,hsm,secure-boot,uefi,debian,embedded,swupdate
Author-Email: Linutronix GmbH <info@linutronix.de>
License-Expression: GPL-3.0-or-later AND 0BSD
License-File: LICENSES/0BSD.txt
License-File: LICENSES/GPL-3.0-or-later.txt
License-File: LICENSES/LicenseRef-NONE.txt
Classifier: Intended Audience :: System Administrators
Classifier: Intended Audience :: Developers
Classifier: Topic :: Security :: Cryptography
Classifier: Topic :: Software Development :: Embedded Systems
Classifier: Topic :: System :: Boot
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Project-URL: Homepage, https://github.com/Linutronix/opensighub
Project-URL: Repository, https://github.com/Linutronix/opensighub
Project-URL: Issues, https://github.com/Linutronix/opensighub/issues
Project-URL: Documentation, https://github.com/Linutronix/opensighub/blob/main/docs/user-manual.md
Requires-Python: >=3.11
Requires-Dist: PyYAML~=6.0
Requires-Dist: platformdirs~=4.0
Description-Content-Type: text/markdown

<!--
SPDX-FileCopyrightText: 2026 Linutronix GmbH

SPDX-License-Identifier: 0BSD
-->

# OpenSigHub

This project is maintained by:

[![Linutronix](https://raw.githubusercontent.com/Linutronix/.github/master/images/lx_logo_padded.png)](https://www.linutronix.de)

# Overview

OpenSigHub signs boot and operating system artifacts like UEFI Secure Boot,
NXP HAB4 or swupdate files.

Signing operations are performed through PKCS#11 for generic HSM integration.

It supports two modes of operation:
- High-level mode to sign Debian packages following the
  [Debian packaging convention for Secure Boot signing](https://wiki.debian.org/SecureBoot/Discussion).
  These are recipes how to sign multiple files using different signers at once.
- Low-level mode, to sign a single artifact with a specific signer.

## Quick Start

```
pipx install opensighub
```

Install system dependencies (Debian/Ubuntu)

```
sudo apt install softhsm2 p11-kit libengine-pkcs11-openssl sbsigntool \
     devscripts dpkg-dev
```

Set up configuration for user-local SoftHSM token and keys test key in it

```
opensighub setup softhsm
opensighub setup testkeys
```

Sign systemd-boot from the Debian archive with your own key

```
opensighub --output ./signed debsign \
    --archive debian-trixie --suite trixie --version 257.13-1~deb13u1 \
    --architecture amd64 \
    --build \
    systemd-boot-efi-amd64-signed-template
```

## Documentation

- [User Manual](https://github.com/Linutronix/opensighub/blob/main/docs/user-manual.md)
- [Development](https://github.com/Linutronix/opensighub/blob/main/docs/development.md)
