pesign-client(1)

Usage

pesign-client [-i file] [-o file] [-e file] [-t token] [-c nickname] ⟨ [{-k | }] [{-q | }] [{-s | }] [-u] ⟩ [-f fd] [-F file]

Overview

pesign-client is a command line tool for manipulating signatures and cryptographic digests of UEFI applications.

Options

-i file | --infile file: The input binary file to be signed with --sign
-o file | --outfile file: The output binary file to be signed with --sign
-e file | --export file: Export signature from --sign to file
-t token | --token token: Sign using NSS token token
-c nickname | --certificate nickname: Sign using NSS certificate nickname
-k | --kill: Kill the pesign server
-q | --is-unlocked: Query the lock status of the token specified by --token
-s | --sign: Sign the file specified by --infile
-u | --unlock: Unlock the token specified with --token using the PIN read from --pinfd or --pinfile, or specified by PESIGN_TOKEN_PIN
-f fd | --pinfd fd: File descriptor to read the PIN from for --unlock
-F file | --pinfile file: File to read the PIN from for unlock

Environment

PESIGN_TOKEN_PIN: PIN for use with --unlock for the token specified by -fl -token

Releases

6 releases since Debian 9 (Stretch); the text changed 1 time.

--is-unlocked since Debian 13 (Trixie); -k since Debian 13 (Trixie); -q since Debian 13 (Trixie); -s since Debian 13 (Trixie); -u since Debian 13 (Trixie).

--certificate until Debian 12 (Bookworm); --export until Debian 12 (Bookworm); --infile until Debian 12 (Bookworm); --outfile until Debian 12 (Bookworm); --pinfd until Debian 12 (Bookworm); --pinfile until Debian 12 (Bookworm); --token until Debian 12 (Bookworm).

Referred to by