`sign`¶

sign <input-file> --backend <name> --key-id <id> --public-key <file.asc> [flags]

Constructor: signingcli.NewCmdSign(log Logger) *cobra.Command.

Produce an ASCII-armored OpenPGP detached signature over a single input file using a crypto.Signer resolved from a compiled-in go/signing backend, and an existing armored OpenPGP public key as the identity source. The signature is written to --output (default <input>.sig) with mode 0644 — signatures are public, non-sensitive artefacts distributed alongside the signed file.

The private key never leaves the backend; signing is one round-trip through the crypto.Signer interface. The backend-resolved key must match the public half in --public-key, or sign refuses to proceed — so the emitted signature's fingerprint always matches that file.

Arguments¶

Argument	Required	Description
`<input-file>`	yes (exactly one)	Path to the file to sign.

Flags¶

Flag	Required	Default	Description
`--backend`	yes	—	Signing backend name. Valid values are the backends compiled into the binary (see Compile in signing backends); `--help` lists them.
`--key-id`	yes	—	Backend-specific key identifier. For `aws-kms`: a KMS key ID, ARN, or alias. For `local`: a PEM file path.
`--public-key`	yes	—	Path to the armored OpenPGP public-key file (`.asc`, produced by `keys mint`). Must contain the public half of the key resolved by `--backend` / `--key-id`.
`--output`	no	`<input>.sig`	Output file path for the armored detached signature. Refuses to equal the input path.
`--created`	no	now	Signature creation time (RFC3339), truncated to whole seconds. Pin it to produce byte-identical signatures across re-runs.
`--append`	no	`false`	Merge the new signature into an existing armored signature at `--output` instead of overwriting, producing one armored block with multiple signature packets. No-op when `--output` does not exist yet.

Backends may register additional flags — e.g. the aws-kms backend adds --kms-region. These appear in --help only when a backend that declares them is compiled in.

`--append` and key rotation¶

--append is the dual-sign primitive for a key-rotation overlap window. Sign once with the old key, then --append the new key's signature into the same armored file:

sign --backend aws-kms --key-id alias/release-signing-v1 \
    --public-key v1.asc --output checksums.txt.sig checksums.txt
sign --backend aws-kms --key-id alias/release-signing-v2 \
    --public-key v2.asc --output checksums.txt.sig --append checksums.txt

Verifiers skip signature packets from issuers they do not know, so one armored file carrying both packets verifies for binaries that trust either key.

Examples¶

# Sign checksums.txt with a production KMS key
sign \
    --backend aws-kms \
    --kms-region eu-west-2 \
    --key-id alias/gtb-release-signing-v1 \
    --public-key release.asc \
    checksums.txt

# Reproducible signature: pin --created to a fixed instant
sign \
    --backend local \
    --key-id ./release.pem \
    --public-key ./release.asc \
    --created 2026-01-01T00:00:00Z \
    --output build.txt.sig \
    build.txt

Output¶

On success sign writes the armored .sig file and logs a structured INFO line carrying backend, key_id, public_key, input, output, sig_creation_time, and the primary-key fingerprint — so operators can confirm the signing identity without a follow-up gpg --verify.

sign¶