digital signatures on executables

digital signatures on executables

[Andrew Marlow]

Hello everyone,

I am new to this mailing list so please pardon my ignorance; I don't even
know if this is the right place to discuss the issue I have in mind.

I would very much like to see GNU systems have the ability to add a digital
signature to an executable. Windows already has this feature; when you do
right mouse in the file explorer and select properties the dialog you get
can include a tab for digital signature if the executable has one. A
command line tool is also available for examining, deleting or adding a
signature to an executable.

GPG (the GNU privacy Guard) allows files to be digitally signed but the
emphasis is on text rather than binary. I raised the subject on the GPG
mailing list and was directed to this article about adding sections to an
ELF file:
https://stackoverflow.com/questions/1088128/adding-section-to-elf-file . It
referred to the ERSI project, see https://github.com/thorkill/eresi, which
provides a way to manipulate an ELF via an API. So I was wondering, what if
binutils included the command line tool for adding, deleting and listing
digital signatures on ELF executables (using ERSI)?

-- 
Regards,

Andrew Marlow
http://www.andrewpetermarlow.co.uk

Re: digital signatures on executables

[Nick Clifton]

Hi Andrew,

> I am new to this mailing list so please pardon my ignorance; I don't even
> know if this is the right place to discuss the issue I have in mind.

This is a good place for such a discussion.  You may also like to seek the
options of other groups however, such as the gcc community or the Clang/LLVM
community.


> I would very much like to see GNU systems have the ability to add a digital
> signature to an executable.

Are you aware of the build-id feature supported by the linker ?  Check the
linker documentation for a description of the --build-id option, as this may
satisfy your needs.

Please be aware however that these build-ids are not cryptographically secure,
meaning that whilst they should be immune to accidental corruption, it is still
possible for a malicious actor to spoof them.


> GPG (the GNU privacy Guard) allows files to be digitally signed but the
> emphasis is on text rather than binary.

Actually it does work on binary files too.  Binutils releases for example
are signed by using gpg.

Cheers
   Nick