<commit_before>.\" Manpage for jsign.
.TH man 1 "25 Mar 2021" "@VERSION@" "jsign man page"

.SH NAME
jsign \- sign and timestamp executable files for Windows, Microsoft Installers (MSI), Cabinet files (CAB) and scripts (PowerShell, VBScript, JScript, WSF)

.SH SYNOPSIS
.B jsign
[OPTIONS] FILE

.SH DESCRIPTION
Jsign is a Java implementation of Microsoft Authenticode that lets you sign
and timestamp executable files for Windows, Microsoft Installers (MSI), Cabinet
files (CAB) and scripts. Jsign is platform independent and provides an
alternative to native tools like signcode/signtool on Windows or the Mono
development tools on Unix systems.

Jsign can use private keys and certificates in various formats, either Java keystores,
PKCS#12 keystores, PKCS#11 hardware tokens or SPC/PVK files.

.SH OPTIONS

.TP
.B -s, --keystore <FILE>
The keystore file containing the certificate and the private key used for signing
the file, or the SunPKCS11 configuration file when a PKCS#11 token is used. jsign
supports Java keystores and PKCS#12 keystores. This option must be specified unless
the keyfile and certfile options are already specified.

.TP
.B --storepass <PASSWORD>
The password to open the keystore

.TP
.B --storetype <TYPE>
The type of the keystore:
.br
- JKS    : Java keystore (.jks files)
.br
- PKCS12 : Standard PKCS#12 keystore (.p12 or .pfx files)
.br
- PKCS11 : PKCS#11 hardware token
.br
- YUBIKEY : YubiKey security key (requires ykcs11)
.br
- AZUREKEYVAULT : Azure Key Vault key management system
.br
- DIGICERTONE : DigiCert ONE Secure Software Manager
.br
- GOOGLECLOUD : Google Cloud KMS
.br
This options is not required if the keystore has a known extension (.jks, .p12 or .pfx).

.TP
.B -a, --alias <NAME>
The alias of the certificate used for signing in the keystore. This option
is mandatory if the keystore option is specified and if the keystore contains more
than one alias.

.TP
.B --keypass <PASSWORD>
The password of the private key. When using a keystore, this parameter can be
omitted if the keystore shares the same password.

.TP
.B --keyfile <FILE>
The file containing the private key. Only PVK files are supported. This option
is used in combination with the certfile option.

.TP
.B -c, --certfile <FILE>
The file containing the PKCS#7 certificate chain (.p7b or .spc files). This
option is used in combination with the keyfile option.

.TP
.B -t, --tsaurl <URL>
The URL of the timestamping authority, either RFC 3161 or Authenticode services.
You can use the COMODO or the Verisign services:
.br
- http://timestamp.comodoca.com/authenticode
.br
- http://timestamp.verisign.com/scripts/timstamp.dll

.TP
.B -m, --tsmode <MODE>
The timestamping mode (RFC3161 or Authenticode). The default mode is Authenticode.

.TP
.B -r, --tsretries <NUMBER>
The number of retries for timestamping (default to 3 attempts).

.TP
.B -w, --tsretrywait <SECONDS>
The number of seconds to wait between timestamping retries (10 seconds by default).

.TP
.B -n, --name <NAME>
The name of the application. This is an optional information embedded in the signature.

.TP
.B -u, --url <URL>
The URL of the application. This is an optional information embedded in the signature.

.TP
.B --proxyUrl <URL>
The URL of the HTTP proxy.

.TP
.B --proxyUser <NAME>
The user for the HTTP proxy. If an user is needed.

.TP
.B --proxyPass <PASSWORD>
The password for the HTTP proxy user. If an user is needed.

.TP
.B --replace
Tells if previous signatures should be replaced. By default the new signature is appended to the existing ones.

.TP
.B -e, --encoding <ENCODING>
The encoding of the script to be signed (UTF-8 by default, or the encoding specified by the byte order mark if there is one).

.TP
.B --detached
Tells if a detached signature should be generated or reused. The detached signature
is a file in the same directory using the name of the file signed with the .sig
suffix added (for example application.exe.sig).
.RS
.IP \- 2
If the signature doesn't exist, the file is signed as usual and the detached signature is generated.
.IP \-
If the signature exists it is attached to the file, replacing any existing signature
(in this case the private key isn't used for signing and no timestamping is performed).
.RE

.TP
.B -h, --help
Print the help


.SH EXAMPLES

.TP
Signing with a PKCS#12 keystore and timestamping:

jsign --keystore keystore.p12 --alias test --storepass password --tsaurl http://timestamp.comodoca.com/authenticode application.exe


.TP
Signing with a SPC certificate and a PVK key:

jsign --certfile certificate.spc --keyfile key.pvk --keypass password installer.msi


.TP

Signing with a YubiKey:

When using a YubiKey the "X.509 Certificate for Digital Signature" certificate (slot 9c)
is used by default but can be overridden by specifying another alias. The ykcs11 library
from the Yubico PIV Tool must be installed on the system at the default location. The library
is provided by the yubico-piv-tool package on Fedora, and by the ykcs11 package on Debian/Ubuntu.

jsign --storetype YUBIKEY --certfile full-chain.pem --storepass <PASSWORD> application.exe


.TP

Signing with Azure Key Vault:

Certificates and keys stored in the Azure Key Vault key management system can be used with:

jsign --storetype AZUREKEYVAULT --keystore vaultname --alias test --storepass &lt;api-access-token&gt; application.exe


.TP

Signing with DigiCert ONE:

Certificates and keys stored in the DigiCert ONE Secure Software Manager can be used directly without installing
the DigiCert client tools. It requires an API key and a PKCS#12 keystore holding a client certificate for the
authentication.

jsign --storetype DIGICERTONE --alias test \
      --storepass "<api-key>|/path/to/Certificate_pkcs12.p12|<password>" application.exe


.TP

Signing with Google Cloud KMS:

Google Cloud KMS stores only the private key, the certificate must be provided separately. The keystore parameter
references the path of the keyring. The alias can specify either the full path of the key, or only the short name. If
the version is omitted the most recent one will be picked automatically.

jsign --storetype GOOGLECLOUD --storepass <api-access-token> \\
      --keystore projects/first-rain-123/locations/global/keyRings/mykeyring \\
      --alias test --certfile full-chain.pem application.exe


.SH REPORTING BUGS
Bugs and suggestions can be reported to the project home page: https://ebourg.github.io/jsign

.SH AUTHOR<commit_msg>Improved the man page formatting<commit_after>.\" Manpage for jsign.
.TH man 1 "25 Mar 2021" "@VERSION@" "jsign man page"

.SH NAME
jsign \- sign and timestamp executable files for Windows, Microsoft Installers (MSI), Cabinet files (CAB) and scripts (PowerShell, VBScript, JScript, WSF)

.SH SYNOPSIS
.B jsign
[OPTIONS] FILE

.SH DESCRIPTION
Jsign is a Java implementation of Microsoft Authenticode that lets you sign
and timestamp executable files for Windows, Microsoft Installers (MSI), Cabinet
files (CAB) and scripts. Jsign is platform independent and provides an
alternative to native tools like signcode/signtool on Windows or the Mono
development tools on Unix systems.

Jsign can use private keys and certificates in various formats, either Java keystores,
PKCS#12 keystores, PKCS#11 hardware tokens, SPC/PVK files or from cloud key management
systems.

.SH OPTIONS

.TP
.B -s, --keystore <FILE>
The keystore file containing the certificate and the private key used for signing
the file, or the SunPKCS11 configuration file when a PKCS#11 token is used. jsign
supports Java keystores and PKCS#12 keystores. This option must be specified unless
the keyfile and certfile options are already specified.

.TP
.B --storepass <PASSWORD>
The password to open the keystore

.TP
.B --storetype <TYPE>
The type of the keystore:
.br
- JKS           : Java keystore (.jks files)
.br
- PKCS12        : Standard PKCS#12 keystore (.p12 or .pfx files)
.br
- PKCS11        : PKCS#11 hardware token
.br
- YUBIKEY       : YubiKey security key (requires ykcs11)
.br
- AZUREKEYVAULT : Azure Key Vault key management system
.br
- DIGICERTONE   : DigiCert ONE Secure Software Manager
.br
- GOOGLECLOUD   : Google Cloud KMS
.br
This options is not required if the keystore has a known extension (.jks, .p12 or .pfx).

.TP
.B -a, --alias <NAME>
The alias of the certificate used for signing in the keystore. This option
is mandatory if the keystore option is specified and if the keystore contains more
than one alias.

.TP
.B --keypass <PASSWORD>
The password of the private key. When using a keystore, this parameter can be
omitted if the keystore shares the same password.

.TP
.B --keyfile <FILE>
The file containing the private key. Only PVK files are supported. This option
is used in combination with the certfile option.

.TP
.B -c, --certfile <FILE>
The file containing the PKCS#7 certificate chain (.p7b or .spc files). This
option is used in combination with the keyfile option.

.TP
.B -t, --tsaurl <URL>
The URL of the timestamping authority, either RFC 3161 or Authenticode services.
You can use the COMODO or the Verisign services:
.br
- http://timestamp.comodoca.com/authenticode
.br
- http://timestamp.verisign.com/scripts/timstamp.dll

.TP
.B -m, --tsmode <MODE>
The timestamping mode (RFC3161 or Authenticode). The default mode is Authenticode.

.TP
.B -r, --tsretries <NUMBER>
The number of retries for timestamping (default to 3 attempts).

.TP
.B -w, --tsretrywait <SECONDS>
The number of seconds to wait between timestamping retries (10 seconds by default).

.TP
.B -n, --name <NAME>
The name of the application. This is an optional information embedded in the signature.

.TP
.B -u, --url <URL>
The URL of the application. This is an optional information embedded in the signature.

.TP
.B --proxyUrl <URL>
The URL of the HTTP proxy.

.TP
.B --proxyUser <NAME>
The user for the HTTP proxy. If an user is needed.

.TP
.B --proxyPass <PASSWORD>
The password for the HTTP proxy user. If an user is needed.

.TP
.B --replace
Tells if previous signatures should be replaced. By default the new signature is appended to the existing ones.

.TP
.B -e, --encoding <ENCODING>
The encoding of the script to be signed (UTF-8 by default, or the encoding specified by the byte order mark if there is one).

.TP
.B --detached
Tells if a detached signature should be generated or reused. The detached signature
is a file in the same directory using the name of the file signed with the .sig
suffix added (for example application.exe.sig).
.RS
.IP \- 2
If the signature doesn't exist, the file is signed as usual and the detached signature is generated.
.IP \-
If the signature exists it is attached to the file, replacing any existing signature
(in this case the private key isn't used for signing and no timestamping is performed).
.RE

.TP
.B -h, --help
Print the help


.SH EXAMPLES

.TP
Signing with a PKCS#12 keystore and timestamping:

jsign --keystore keystore.p12 --alias test --storepass password \\
      --tsaurl http://timestamp.comodoca.com/authenticode application.exe


.TP
Signing with a SPC certificate and a PVK key:

jsign --certfile certificate.spc --keyfile key.pvk --keypass password installer.msi


.TP

Signing with a YubiKey:

When using a YubiKey the "X.509 Certificate for Digital Signature" certificate (slot 9c)
is used by default but can be overridden by specifying another alias. The ykcs11 library
from the Yubico PIV Tool must be installed on the system at the default location. The library
is provided by the yubico-piv-tool package on Fedora, and by the ykcs11 package on Debian/Ubuntu.

jsign --storetype YUBIKEY --certfile full-chain.pem --storepass <PASSWORD> application.exe


.TP

Signing with Azure Key Vault:

Certificates and keys stored in the Azure Key Vault key management system can be used with:

jsign --storetype AZUREKEYVAULT --keystore vaultname --alias test \\
      --storepass <api-access-token> application.exe


.TP

Signing with DigiCert ONE:

Certificates and keys stored in the DigiCert ONE Secure Software Manager can be used directly without installing
the DigiCert client tools. It requires an API key and a PKCS#12 keystore holding a client certificate for the
authentication.

jsign --storetype DIGICERTONE --alias test \\
      --storepass "<api-key>|/path/to/Certificate_pkcs12.p12|<password>" application.exe


.TP

Signing with Google Cloud KMS:

Google Cloud KMS stores only the private key, the certificate must be provided separately. The keystore parameter
references the path of the keyring. The alias can specify either the full path of the key, or only the short name. If
the version is omitted the most recent one will be picked automatically.

jsign --storetype GOOGLECLOUD --storepass <api-access-token> \\
      --keystore projects/first-rain-123/locations/global/keyRings/mykeyring \\
      --alias test --certfile full-chain.pem application.exe


.SH REPORTING BUGS
Bugs and suggestions can be reported to the project home page: https://ebourg.github.io/jsign

.SH AUTHOR
{'fraction_non_alphanumeric': 0.07187932892104049, 'fraction_numerical': 0.010312451900877328, 'mean_word_length': 3.7220203488372094, 'pattern_counts': {'":': 0, '<': 46, '<?xml version=': 0, '>': 46, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6977806', 'n_tokens_mistral': 4063, 'n_tokens_neox': 3801, 'n_words': 1902}