5

I want to sign a whole directory of files using GPG, and that entails creating an archive or compressed file, since GPG can only sign a file, not a directory. However, I imagine that some archive formats may contain some kind of user-agent-specific data or timestamps or nonces that may make cryptographic signatures non-reproducible.

My question: is there an archive format, such as zip or tar, that does not vary at all, such that the cryptographic signatures generated by one will be the same across all computers that create a similar archive using the same inputs?

  • 2
    You're describing a hash, not a cryptographic signature (which always involves a secret of some kind or another). Most archive file formats (ZIP, 7zip, etc but not tar) include both a CRC for the whole file and a CRC for each document. – Stephane Jan 12 '18 at 11:44
  • What is the question: given the same directory will all computers generate the same archive, or given the same zip (or tar) file and a GPG key will all computer generate the same signature? – Serge Ballesta Jan 12 '18 at 13:47
6

that entails creating an archive or compressed file

That premise is not necessarily true. You don't necessarily need to create an archive to cryptographically sign multiple files. I'll give a few examples.


Manifest file

You can sign a file that contains a list of file hashes, this file is usually called a "manifest". The signature on the manifest will cover all the hashed files. Using a manifest instead of an archive has the advantage that you can add and remove files from your directory without completely invalidating the signature; other people can modify two files and prove that they only modified the two files as only the hash of two files changed from your original version. Essentially, you sign the directory using this kind of script:

find $directory -type f -print0 | sort -z | xargs --null sha256sum | gpg2 --clearsign > manifest.txt

This is more or less the strategy that is used in a JAR file (though jarsigner uses x509 certificate instead of OpenPGP).


Signed git repository

You can create a git repository and cryptographically sign the files using gpg-signed commits/tags.

$ git init

$ git add .
$ git commit --gpg-sign -m "Version 1"

or

$ git tag --sign version-1

Reproducible tar file

If you insist on creating an archive, you can make a reproducible tar file. These are much more complex because an archive can contain metadata, but fortunately the tar program have many arguments that allows you to select which metadata you want to preserve. With an archive, you have a lot of flexibility on whether or not you want to sign permissions, modification times (which may be necessary if you later want to use tools like make), and other metadata. You can create a reproducible tar like so:

tar --sort=name \
  --mtime="0" \
  --owner=0 --group=0 --numeric-owner \
  -cf file.tar $directory
gpg2 --sign file.tar

For more about creating reproducible tar file, I would suggest reading this article.

| improve this answer | |
  • Thank you, Lie! The third option was exactly what I needed! – Jonathan Wilbur Jan 12 '18 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.