Two small things for signify -C: Contrary to what usage suggests, the -p pubkey argument for signify -C is optional in that signify will use the key specified in the untrusted comment. In -V mode, the key can be tied down a little by specifying -t.
Right now, the -t keytype argument is silently ignored in -C mode: $ ftp https://cdn.openbsd.org/pub/OpenBSD/6.6/amd64/{INSTALL.amd64,SHA256.sig} >/dev/null $ signify -C -t pkg -x SHA256.sig INSTALL.amd64 Signature Verified INSTALL.amd64: OK Diff below fixes usage and makes the above command error out with: signify: incorrect keytype: openbsd-66-base.pub is not pkg while -t base will work $ signify -C -t base -x SHA256.sig INSTALL.amd64 Signature Verified INSTALL.amd64: OK Index: signify.1 =================================================================== RCS file: /var/cvs/src/usr.bin/signify/signify.1,v retrieving revision 1.48 diff -u -p -r1.48 signify.1 --- signify.1 10 Aug 2019 03:56:02 -0000 1.48 +++ signify.1 8 Nov 2019 17:04:01 -0000 @@ -24,7 +24,8 @@ .Nm signify .Fl C .Op Fl q -.Fl p Ar pubkey +.Op Fl p Ar pubkey +.Op Fl t Ar keytype .Fl x Ar sigfile .Op Ar .Nm signify Index: signify.c =================================================================== RCS file: /var/cvs/src/usr.bin/signify/signify.c,v retrieving revision 1.134 diff -u -p -r1.134 signify.c --- signify.c 22 Dec 2019 06:37:25 -0000 1.134 +++ signify.c 25 Dec 2019 12:37:08 -0000 @@ -78,7 +78,7 @@ usage(const char *error) fprintf(stderr, "%s\n", error); fprintf(stderr, "usage:" #ifndef VERIFYONLY - "\t%1$s -C [-q] -p pubkey -x sigfile [file ...]\n" + "\t%1$s -C [-q] [-p pubkey] [-t keytype] -x sigfile [file ...]\n" "\t%1$s -G [-n] [-c comment] -p pubkey -s seckey\n" "\t%1$s -S [-enz] [-x sigfile] -s seckey -m message\n" #endif @@ -715,13 +715,13 @@ verifychecksums(char *msg, int argc, cha } static void -check(const char *pubkeyfile, const char *sigfile, int quiet, int argc, - char **argv) +check(const char *pubkeyfile, const char *sigfile, const char *keytype, + int quiet, int argc, char **argv) { unsigned long long msglen; uint8_t *msg; - msg = verifyembedded(pubkeyfile, sigfile, quiet, &msglen, NULL); + msg = verifyembedded(pubkeyfile, sigfile, quiet, &msglen, keytype); verifychecksums((char *)msg, argc, argv, quiet); free(msg); @@ -846,7 +846,7 @@ main(int argc, char **argv) err(1, "pledge"); if (!sigfile) usage("must specify sigfile"); - check(pubkeyfile, sigfile, quiet, argc, argv); + check(pubkeyfile, sigfile, keytype, quiet, argc, argv); return 0; } #endif
