zipsign

ZipSign is a command line tool sign and verify ZIP archives.

ZipSign uses Cryptographic Message Syntax (CMS) to sign Zip archives. The signature is stored within the Zip archive's comment. See the "How it works" section on zipsign's GitHub page for further details.

Sign a Zip Archive

zipsign sign -f archive.zip -p private-key.pem -c cert.pem

Verify a previously signed Zip Archive

zipsign verify -f archive.zip -c cert.pem 

Features

- sign and verify Zip archives
- optionally embed certificates in the archive
- support of self signed certificates

Limitation of Snap-Version

The snap limits access to files within the home directory of the current user. To overcome this issue, you can compile the tool from source. If you prefer precompiled binaries or .deb-packages, please leave an issue on zipsign's github page.