How to Install and Use Minisign on Linux for Secure File Signing and Verification

In modern software engineering, automated deployment pipelines, and systems security, verifying the authenticity and cryptographic integrity of downloaded tarballs, binaries, configuration scripts, and releases is vital. While GNU Privacy Guard (GPG) is historically popular, it is notorious for excessive complexity, oversized keys, bloated dependencies, and brittle key server infrastructures. Minisign is an open-source, dead-simple, highly secure cryptographic file signing utility designed specifically as an ergonomic alternative to GPG for digital signatures.

In this guide, you will learn how to install Minisign on Linux, generate lightweight Ed25519 public and private key pairs, sign software artifacts, verify digital signatures, and integrate automated signature checks into shell scripts.

What Is Minisign and Why Use It Over GPG?

Minisign is built upon the high-speed, modern Ed25519 elliptic curve signature algorithm (the same foundation behind OpenSSH keys and WireGuard). It produces compact signatures and public keys that can easily be transmitted over email, pasted into chat channels, or embedded directly into source repositories.

Key highlights of Minisign include:

• Compact Keys: Public keys are short, Base64-encoded strings with a small key ID prefix, making them easy to distribute.
• Zero Dependencies: Lightweight standalone binary with no complex keyring daemons, background agents, or web-of-trust overhead.
• Pre-Hashed Signing: Automatically hashes large files (using Blake2b) prior to signing, allowing fast verification of multi-gigabyte ISO images and archives without loading entire files into system memory.
• Untrusted Comments: Supports embedding arbitrary metadata (such as release versions or commit hashes) directly into signature files alongside the cryptographic payload.

Installing Minisign on Linux

Minisign is available in the official package repositories of most major Linux distributions.

Method 1: Installing via Native Package Managers

On Ubuntu and Debian (Debian 11+ / Ubuntu 20.04+):

sudo apt update
sudo apt install minisign

On Fedora, RHEL, and Rocky Linux:

sudo dnf install minisign

On Arch Linux and Manjaro:

sudo pacman -S minisign

On Alpine Linux:

sudo apk add minisign

Method 2: Compiling from Source or Pre-Built Binary

If your distribution does not package the latest release, you can compile it from source using CMake and libsodium:

# Install build dependencies on Debian/Ubuntu
sudo apt install build-essential cmake libsodium-dev git

# Clone repository and build
git clone https://github.com/jedisct1/minisign.git
cd minisign
mkdir build && cd build
cmake ..
make
sudo make install

# Verify installation
minisign -v

Generating a Minisign Key Pair

Before signing files, you must generate a secret signing key and a corresponding public verification key.

minisign -G

The utility prompts you for:

1. Secret key path: Defaults to ~/.minisign/minisign.key. Press Enter to accept.
2. Password: Enter a strong passphrase to encrypt your secret key using Scrypt.
3. Password confirmation: Re-enter the passphrase.

Minisign generates two files:

• ~/.minisign/minisign.key: Your encrypted secret key. Keep this file strictly confidential.
• minisign.pub: Your public key, containing a key ID and a single 32-byte Ed25519 public key string (e.g., RWT7...). Distribute this file freely to users who need to verify your releases.

Signing Files with Minisign

To sign an archive, binary, or release artifact, use the -S (sign) and -m (message / file) flags:

minisign -S -m release-v1.4.0.tar.gz

Minisign will prompt for your secret key passphrase. Once authenticated, it outputs a signature file with the .minisig extension: release-v1.4.0.tar.gz.minisig.

Adding Comments to Signatures

You can embed human-readable context into the signature file using the -t (trusted comment) flag:

minisign -S -m app-linux-x86_64.bin -t "Production Release v1.4.0 - SHA256 verified"

Trusted comments are cryptographically signed alongside the payload; tampering with the comment invalidates the signature.

Verifying Signatures with Minisign

Users verifying your files only require the signed artifact, the .minisig signature file, and your public key.

Method 1: Verifying Using a Public Key File

minisign -V -m release-v1.4.0.tar.gz -p minisign.pub

If the file is genuine and unmodified, Minisign prints:

Signature and comment signature verified
Trusted comment: Production Release v1.4.0 - SHA256 verified

Method 2: Verifying Directly Using a Public Key String

You do not need to download a separate public key file if the author publishes their public key string in their documentation or GitHub README:

minisign -V -m release-v1.4.0.tar.gz -P "RWT7G...YourPublicKeyString"

Automating Verification in Bash Scripts

Minisign returns an exit status code of 0 on success and non-zero on failure. You can easily integrate verification checks into automated deployment pipelines or download scripts:

#!/bin/bash
set -e

FILE="firmware.bin"
SIG="firmware.bin.minisig"
PUBKEY="RWT7G3QJ5Y91...EXAMPLE"

echo "Verifying cryptographic integrity..."
if minisign -V -m "$FILE" -P "$PUBKEY" -q; then
    echo "SUCCESS: Signature is valid. Proceeding with deployment."
else
    echo "ERROR: Signature verification failed! Aborting."
    exit 1
fi