I work on a project where DVDs with configuration files and software updates are delivered periodically to end users, and our software loads those discs. For example, we might load a disc with an updated set of hostnames and IP addresses when the network topology is updated, or we might get a disc with virus definition updates.

Is there any way to sign those discs with GPG or similar such that they could be verified in an offline environment? The systems in question don't have Internet access. Ideally I would like to embed the GPG signature on the discs so they can be self-verifying.

When I look at how this is typically handled, folks like Debian and Ubuntu will provide a GPG signature alongside their ISO. It's not in the ISO; it's a separate detached file. That doesn't work for us since we deliver physical discs, not ISOs.

  • Currently we sign individual files on the DVDs. It works, but it's not ideal on a DVD with tens or hundreds of files.
  • My understanding is that embedded signatures only work with file formats that are designed for them, such as RPM. ISOs don't have such a mechanism. Is that correct?
  • I suppose we could tar up the contents of the DVDs and store a tarball and signature on the discs instead. Is that the best answer? Any better ideas?

I'm open to non-GPG-based solutions. If there's a way to embed a SHA-2 checkum, for instance, that could also work.

  • 3
    You can sign files on the disk and add those signatures to the disk. You can't sign the entire disk because that will generate a signature that will change the signature of the disk. – user Jan 10 at 15:54
  • 2
    you could put everything into an archive file like zip or iso, and distribute that and a text file with a signature on your physical volume. – dandavis Jan 10 at 18:08

Normally, you'd just run a good hashing algorithm on all files, generate a list of file hashes, put that along with your files, and then just cryptographically sign that. So, procedure:


  1. your recipients need to have a public key of yours that they can trust, pre-shared¹
  2. cd path/to/files/to/end/up/on/CD; sha256sum --tag **/** > hashes.sha256
  3. gpg --output hashes.sha256.sig --sign hashes.sha256
  4. burn all these files on your DVD
  5. the recipient:
    1. Verifies the hashes' signature: gpg --verify hashes.sha256.sig hashes
    2. If that succeeds, they verify the hashes themselves sha256sum --check --strict hashes.sha256

I might add that I don't like GPG (although it's very well-suited for this kind of task) due to its complex CLI and its versatility that often lead to accidental unsafe usage.

¹you could also let them have the public part of a keypair whose private key is used to sign your key, but building a root of trust with signing keys might be a bit over the top in flexibility here...


You can do very much the same with OpenBSD's signify tool (which is available for most operating systems), which is much, much lighter, only does exactly this, and whose public keys are not any less secure, but much shorter, so that you are able to hand them over much easier e.g. in printout form.

  1. your recipients need to have a public key of yours that they can trust, pre-shared²
  2. cd path/to/files/to/end/up/on/CD; sha256sum --tag **/** > hashes
  3. signify -S -s signingkey.sec -m hashes -e
  4. burn all these files on your DVD
  5. the recipient:
    1. Verifies the hashes' signature, and then automatically checks all the hashes signify -C -p signingkey.pub -x hashes.sig

²Since fewer people have used signify than GPG: Create a keypair with signify -G -c "Your Name <your@email.com>" -p signingkey.pub -s signingkey.sec.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.