signtree

Detached Ed25519 signature verifier — signify / minisign / shellrec jfind-like

v1.0.0

NixOS x86_64

Quick start

Install via jcli (recommended)

jcli install signtree

If you don't have jcli yet, install it first with curl -fsSL https://cli.johlem.net/tools/jcli/install.sh | bash.

Install directly

curl -fsSL https://cli.johlem.net/install.sh | bash -s -- signtree

Ed25519 signature verification is mandatory by default; set ALLOW_UNVERIFIED=1 to explicitly opt out (not recommended).

Run it

signtree --help                # subcommand catalogue + flags
signtree --full                # extended help across every subcommand
signtree --about               # machine-readable attribution (JSON)
signtree --version             # version string

What it does

signtree verifies Ed25519 detached signatures against files. Three sig formats: signify (OpenBSD .sig), minisign (Frank Denis .minisig), and shellrec/jfind-like (one-line JSON with embedded pubkey + sig + sha256). For signify / minisign you supply --pub-key; the jfind-like blob carries its own pubkey. Four subcommands: verify (single file, auto-detects neighbouring .sig / .minisig), walk (recursive directory verification), info (parse-only), list-formats. jfind/v1 emission: asset-inventory Info for verified files, policy-violation Medium for missing signature or missing pubkey, policy-violation High when verification fails. Pre-fills DORA Art. 9 + Art. 28 + NIS2 Art. 21(2)(j) + ISO/IEC 27001:2022 A.8.26. Any non-verified verdict in the batch → exit 4 (CI-friendly gate). 2 unit + 10 integration tests; zero warnings. Suite app: blueteam.

Authorisation and warranty: use only in environments where you have explicit written authorisation. This tool is provided as-is with no warranty. Report vulnerabilities privately at security@johlem.net.

Compliance crosswalk

This table lists controls where signtree's output may form part of the evidence set presented to an assessor. It does not claim signtree alone satisfies any framework — every control still requires assessor judgment and typically evidence from other sources.

Schema: compliance-crosswalk/v1 · Machine-readable: tools/signtree/compliance.json

ISO27001 — ISO/IEC 27001:2022

Ref	Name	How	Coverage
`A.5.28`	Collection of evidence	Verifies Ed25519 signatures on suite artefacts (jfind bundles, evidence files).	evidences
`A.8.24`	Use of cryptography	Ed25519 verify_strict conforms to RFC 8032 §5.1.7.	supports

NIS2 — NIS2 Directive (Dir. 2022/2555)

Ref	Name	How	Coverage
`Art. 21 §2(h)`	Cryptography use, including encryption	Ed25519 verification.	supports

Release artefacts & provenance

Every signed release ships with checksum + signature sidecars plus a CycloneDX SBOM. Enterprise procurement can pin third-party components without unpacking the binary.

manifest.json — pinned SHA-256 + .sig URL + SBOM URL per platform
johlem-release.pub — Ed25519 public key used by signify -V (fingerprint: 4532510f…6748, pinned in jcli verify)
CHANGELOG.md — semver-tagged release notes
Security contact: security@johlem.net