SafeSign 1.2.0

<br> <a href="https://github.com/glennawatson/SafeSign"> <img width="160" height="160" src="https://raw.githubusercontent.com/glennawatson/SafeSign/main/icons/icon.png" alt="SafeSign"> </a> <br>

SafeSign

SafeSign is a fast, cross-platform .NET 10 and .NET 11 code-signing command-line tool (safesign) and modular library suite with standalone Native AOT binaries for Linux, macOS, and Windows.

SafeSign implements binary format parsing, Authenticode/CMS ASN.1 DER encoding, RFC 3161 timestamping, and cloud KMS / HSM remote digest signing directly in managed C# without requiring SignTool.exe, Windows-only CryptoAPI/CNG Subject Interface Packages (SIPs), or native PKCS #11 middleware.

• Digest-Only Remote Signing: Only the cryptographic digest of the CMS signed attributes leaves your machine. Large binaries and installers are streamed locally and never uploaded over the network.
• Atomic File Output: Every file format is signed into a sibling temporary file and atomically moved into place only after the provider signature verifies against the X.509 public key and any RFC 3161 timestamp succeeds.
• Zero-Allocation Hot Paths & Native AOT: Built with SIMD-accelerated PE checksums (Vector256<ushort> / Vector128<ushort>), pooled streaming I/O, and source-generated System.Text.Json serialization for trimming-safe Native AOT compilation.
• First-Class Certum SimplySign Support: Authenticates directly with Certum SimplySign Cloud (cloudsign.webnotarius.pl) using user credentials and either a current 6-digit TOTP code or a base32/hex TOTP shared secret, with no desktop tray app or PKCS #11 library required.

Installation

.NET Global Tool

dotnet tool install --global SafeSign

Once installed, invoke the tool via safesign:

safesign --help
safesign providers
safesign formats

Standalone Native AOT Binaries

Standalone Native AOT executables (requiring no .NET runtime installation) are published on net11.0 for:

• linux-x64
• osx-arm64
• win-x64

Library Packages

You can also embed SafeSign's signing engine directly in your own .NET applications:

Command-Line Interface

Commands

safesign sign <files>... [options]   Sign one or more files in place (or to --output)
safesign providers                   List all supported signing providers and their status
safesign formats                     List all supported file formats and their status

safesign sign Options

Supported Signing Providers

Run safesign providers at any time to inspect the built-in provider catalog. All 18 providers below are fully implemented (Working) and configured via --provider-option (-o) or environment variables:

Usage Examples

1. Sign a Windows PE executable, MSI installer, and NuGet package with Certum SimplySign Cloud

export CERTUM_USER_ID="developer@example.com"
export CERTUM_OTP_URI="otpauth://totp/Certum:developer@example.com?secret=JBSWY3DPEHPK3PXP&algorithm=SHA256&digits=6&period=30"

safesign sign artifacts/MyApp.exe artifacts/MyAppSetup.msi artifacts/MyPackage.1.0.0.nupkg \
  --provider certum \
  --hash SHA256 \
  --timestamp-url http://time.certum.pl \
  --description "MyApp" \
  --description-url https://example.com

2. Sign with Azure Artifact Signing (formerly Azure Trusted Signing)

safesign sign bin/Release/net11.0/win-x64/publish/MyApp.exe \
  --provider azure-artifact-signing \
  -o endpoint=https://eus.codesigning.azure.net \
  -o account=my-signing-account \
  -o profile=my-public-trust-profile \
  -o access-token="$AZURE_CODESIGNING_ACCESS_TOKEN" \
  --timestamp-url http://timestamp.acs.microsoft.com

3. Sign a NuGet package, MSIX bundle, and PowerShell script with a local PFX certificate

safesign sign MyLibrary.1.0.0.nupkg MyApp.msix Deploy.ps1 \
  --provider file \
  -o path=certs/codesign.pfx \
  -o password="$PFX_PASSWORD" \
  --timestamp-url http://timestamp.digicert.com

4. Sign an RPM package with AWS KMS

safesign sign dist/myapp-1.0.0-1.x86_64.rpm \
  --provider aws-kms \
  -o region=us-east-1 \
  -o key-id=arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012 \
  -o certificate-path=certs/aws-codesign.cer

Supported File Formats

Run safesign formats to view all registered format handlers. SafeSign implements native format signing for each format below (never substituting detached signatures for embedded format signatures):

Programmatic Usage

using System.Security.Cryptography;
using Refit;
using SafeSign.Formats;
using SafeSign.Providers.Certum;
using SafeSign.Signing;
using SafeSign.Signing.Cms;

var provider = new CertumSimplySignProvider(
    new RefitSettings(),
    new CertumOptions
    {
        Email = "developer@example.com",
        TotpSecret = "JBSWY3DPEHPK3PXP",
    },
    TimeProvider.System);

var certificate = await provider.GetCertificateAsync(CancellationToken.None);
var timestampApi = RestService.ForGenerated<IRfc3161TimestampApi>("http://time.certum.pl");
var session = new SigningSession(
    provider,
    certificate,
    HashAlgorithmName.SHA256,
    new TimestampSettings(new Uri("http://time.certum.pl"), HashAlgorithmName.SHA256, timestampApi),
    Description: "My Application",
    DescriptionUrl: new Uri("https://example.com"),
    TimeProvider.System);

var signer = await FormatCatalog.ResolveSignerAsync("MyApp.exe", CancellationToken.None);
await signer.SignAsync(new FileSignRequest("MyApp.exe", "MyApp.exe", session), CancellationToken.None);

Repository Layout

Building, Testing, and Benchmarking

Run these commands from src/:

# Build all projects across net10.0 and net11.0
dotnet build SafeSign.slnx -c Release

# Run TUnit test suites
dotnet test --project tests/SafeSign.Signing.Tests/SafeSign.Signing.Tests.csproj -c Release
dotnet test --project tests/SafeSign.Formats.Tests/SafeSign.Formats.Tests.csproj -c Release
dotnet test --project tests/SafeSign.Providers.Tests/SafeSign.Providers.Tests.csproj -c Release
dotnet test --project tests/SafeSign.Tests/SafeSign.Tests.csproj -c Release

# Run the allocation justification audit (verifies against allocations-explained.json)
dotnet run --project benchmarks/SafeSign.Benchmarks/SafeSign.Benchmarks.csproj -c Release -f net11.0 -- --alloc

# Run BenchmarkDotNet speed benchmarks
dotnet run --project benchmarks/SafeSign.Benchmarks/SafeSign.Benchmarks.csproj -c Release -f net11.0 -- --filter 'SafeSign.Benchmarks.SafeSignBenchmarks.*' --job short

# Publish a standalone Native AOT executable (net11.0)
dotnet publish SafeSign/SafeSign.csproj -c Release -f net11.0 -r linux-x64 -p:PublishAot=true

License

MIT — see LICENSE.

Acknowledgements

SafeSign was implemented independently from Microsoft Authenticode, PKCS #7 / CMS (RFC 5652), RFC 3161, OPC, OLE CFB, RPM v4, and vendor REST API specifications. The following projects provided inspiration:

• jsign (Apache-2.0) by Emmanuel Bourg
• dotnet/sign (MIT) by the .NET Foundation
• ssign (MIT) by Le-Syl21