{"id":19230499,"url":"https://github.com/ctron/elfsign","last_synced_at":"2025-10-06T14:59:28.701Z","repository":{"id":65334551,"uuid":"588080292","full_name":"ctron/elfsign","owner":"ctron","description":"Signing elf files, not to be confused with singing elves","archived":false,"fork":false,"pushed_at":"2023-01-26T08:25:37.000Z","size":357,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-10-06T14:59:26.159Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ctron.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2023-01-12T09:26:42.000Z","updated_at":"2024-09-11T22:30:30.000Z","dependencies_parsed_at":"2023-02-14T15:30:46.349Z","dependency_job_id":null,"html_url":"https://github.com/ctron/elfsign","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/ctron/elfsign","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ctron%2Felfsign","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ctron%2Felfsign/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ctron%2Felfsign/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ctron%2Felfsign/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ctron","download_url":"https://codeload.github.com/ctron/elfsign/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ctron%2Felfsign/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278629052,"owners_count":26018482,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-06T02:00:05.630Z","response_time":65,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-09T15:39:37.738Z","updated_at":"2025-10-06T14:59:28.680Z","avatar_url":"https://github.com/ctron.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# elfsign\n\nTrying to sign elf files.\n\n## Motivation\n\nYou download a binary from the internet, but what is in there? `cargo auditable` can put a dependency list into the\nfinal binary. But anyone could modify this.\n\nUnless, you would sign the binary.\n\nThe idea of this PoC is to sign ELF binaries, ensuring that the information inside it was indeed created by the person\nwho created the binary.\n\nThere is a bit of documentation in the [docs/](docs/) folder.\n\n## State\n\nThis is a PoC. This is full of bugs and not finished. Also is the content format not stable.\n\n## Usage (the idea)\n\nSign with Sigstore:\n\n```shell\nelfsign sign my-bin my-bin-signed\n```\n\nValidate with:\n\n```shell\nelfsign verify my-bin-signed\n```\n\n## ToDo\n\n* [x] Find a way to add a signature record to the file\n* [x] Capture all content subject to signing\n  * [ ] Check it is really everything\n  * [ ] Re-iterate over digesting the \"program sections\" (aka \"memory segments\")\n  * [ ] Add more fields from the header\n  * [x] Add data from `.shstrtab` (minus the `.note.signature.v1` string)\n* [x] Implement sign \u0026 store\n  * [ ] Implement re-signing \n* [x] Improve storing stuff, this is a mess right now (good for now)\n* [ ] Implement verify\n  * [x] verify the signature\n  * [x] add the certificate, and allow enforcing policies \n* [x] check using \"digest\" vs \"digested signer\"\n* [ ] allow more options, currently this is highly opinionated towards sigstore and rekor","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fctron%2Felfsign","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fctron%2Felfsign","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fctron%2Felfsign/lists"}