Sigil.Sign 0.9.1

Sigil

Cryptographic signing and verification for any file. No cloud, no accounts, no dependencies beyond the .NET BCL.

Disclaimer

This tool is developed primarily for the author's internal and personal use and is made available to the community under the terms of its license. You are welcome to use it, but you do so entirely at your own risk. The software is provided as-is with no warranties or guarantees of fitness for any particular purpose, and the author assumes no liability for any issues arising from its use.

Install

Pre-built executables (recommended)

Pre-built self-contained executables are available for Windows, Linux, and macOS as GitHub Releases. These require no .NET SDK or runtime — download, extract, and run.

.NET global tool

Requires .NET 10 SDK.

dotnet tool install --global Sigil.Sign

Update:

dotnet tool update --global Sigil.Sign

Build from source:

git clone <repo-url>
cd <repo-name>
dotnet build Sigil.slnx
dotnet test Sigil.slnx

What it does

Sigil lets you sign files and verify signatures. That's it.

• Sign a file — Sigil produces a small .sig.json file next to it
• Sign a directory — Sigil produces a single .manifest.sig.json covering all files atomically
• Sign an archive — Sigil produces an .archive.sig.json with per-entry digests for ZIP, tar.gz, and tar files
• Sign a PE binary — Sigil embeds a standard Authenticode signature in the PE and produces a .sig.json for trust/policy evaluation
• Anyone can verify the file hasn't been tampered with — the public key is embedded in the envelope
• No key store, no import/export, no hidden state

It works with any file: binaries, SBOMs, container images, config files, tarballs — anything. When signing a CycloneDX or SPDX JSON file, Sigil automatically detects the format and embeds SBOM metadata in the signature envelope.

Sigil also creates attestations — signed in-toto statements wrapped in DSSE envelopes that prove how an artifact was built (CI system, inputs, steps). These follow the SLSA provenance standard.

Why not just use Sigstore/PGP/X.509?

Sigil is for people who want to sign things without asking permission from a cloud service.

For a comprehensive feature-by-feature comparison, see Competitive Comparison.

Quick start

Sign a file (ephemeral)

sigil sign my-app.tar.gz

A key pair is created in memory, the file is signed, and the private key is discarded.

Verify a file

sigil verify my-app.tar.gz

The public key is embedded in the .sig.json envelope — no key import needed.

Sign with a persistent key

sigil generate -o mykey
sigil sign my-app.tar.gz --key mykey.pem

Same fingerprint every time. This enables trust.

Verify with trust

sigil trust create trust.json --name "My Org"
sigil trust add trust.json --fingerprint sha256:a1b2c3...
sigil verify my-app.tar.gz --trust-bundle trust.json

Features

How it works

Identity = Key pair. Your key fingerprint (SHA-256 of the public key) is your identity. No email, no username, no account.

Signatures are detached. Sigil never modifies your files. It produces a separate .sig.json envelope containing the file's digests, the public key, and the cryptographic signature.

Algorithms:

Core algorithms use .NET's built-in System.Security.Cryptography. Ed25519 and Ed448 are provided by the optional Sigil.Crypto.BouncyCastle package.

What's coming

• Plugin system — Extension architecture for CVE scanners, license policy checks, SBOM diffing, and reproducibility validators.

Documentation

Full reference documentation: docs/manual.md

License

AGPL-3.0 — free to use, modify, and distribute. If you distribute a modified version, you must release your source under the same license.