Automic VaultAutomic Vault

brew

Install minisign with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, scoop, winget, zypper

Sign files & verify signatures. Works with signify in OpenBSD. Version 0.12 via Homebrew; verified from local package data.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install minisign

local Homebrew formula metadata

MacPortsverified · 94%
sudo port install minisign

MacPorts ports tree · security/minisign/Portfile · source: api.github.com

Linux

Alpine Linux apkverified · 92%
sudo apk add minisign

Alpine Linux edge package indexes · minisign · source: dl-cdn.alpinelinux.org

Debian aptverified · 92%
sudo apt install minisign

Debian stable package indexes · minisign · source: deb.debian.org

Fedora dnfverified · 92%
sudo dnf install minisign

Fedora Rawhide package metadata · minisign · source: dl.fedoraproject.org

Nixverified · 92%
nix profile install nixpkgs#minisign

nixpkgs package indexes · pkgs/by-name/mi/minisign/package.nix · source: api.github.com

Arch Linux pacmanverified · 92%
sudo pacman -S minisign

Arch Linux sync databases · minisign · source: geo.mirror.pkgbuild.com

openSUSE zypperverified · 92%
sudo zypper install minisign

openSUSE Tumbleweed package metadata · minisign · source: download.opensuse.org

Windows

Scoopverified · 92%
scoop install main/minisign

Scoop official bucket manifest trees · bucket/minisign.json · source: api.github.com

Windows Package Managerverified · 92%
winget install --id jedisct1.minisign -e

Windows Package Manager source index · jedisct1.minisign · source: cdn.winget.microsoft.com

overview

Package summary

Sign files & verify signatures. Works with signify in OpenBSD

Commands and aliases

  • minisign

history

Project history and usage

Minisign is Frank Denis's portable file-signing and signature-verification tool. It follows the same broad idea as OpenBSD signify: keep release signing small, scriptable, and based on public-key signatures rather than a large certificate or web-of-trust system. The project page describes it as lightweight and built around Ed25519 keys; Homebrew summarizes the package as a tool to sign files and verify signatures that works with OpenBSD signify.

Project history

Operationally, minisign creates a key pair, signs one or more files into .minisig signature files, and verifies a file using either a public-key file or a public key supplied directly on the command line. A notable part of its format is the trusted comment, which can bind metadata such as filenames, resource identifiers, timestamps, or version numbers to the signature and helps prevent downgrade-style mistakes. Its documented signature format moved toward pre-hashed Ed25519 signatures using Blake2b-512, while retaining awareness of a legacy non-prehashed format.

How it is used

Minisign's ecosystem role is release-integrity plumbing: projects can publish a small public key and detached signatures without adopting a heavier package-signing infrastructure. Its packaging footprint in the input record spans Homebrew, Alpine, Debian, Fedora, MacPorts, Nix, Arch, Scoop, Ubuntu, WinGet, and openSUSE, which fits that role as a small security utility expected to be present across many operating systems.

security posture

Risk level: green

narrow executable package without higher-risk signals.

Risk classifier

green risk · low confidence · appliance

Why

  • narrow executable package without higher-risk signals

Signals

  • metadata:no-higher-risk-signals

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 8 platform targets.
  • Installs with 1 runtime dependencies.
  • Build metadata lists 2 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
minisigncliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08
manager version0.12
manager updated
local dataok
upstreamcurrent
latest detected0.12

https://github.com/jedisct1/minisign

  • infoNo package-manager update timestamp was available.low confidence

install metadata

Package metadata

Package keybrew:minisign
Version0.12
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/minisign
Homepagehttps://jedisct1.github.io/minisign/
Repositoryhttps://github.com/jedisct1/minisign
Upstream docshttps://jedisct1.github.io/minisign
LicenseISC
Source archivehttps://github.com/jedisct1/minisign/archive/refs/tags/0.12.tar.gz
Dependencieslibsodium
Build dependenciescmake, pkgconf
Bottleavailable (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, sonoma, ventura, x86_64_linux)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Nameminisign
Version Scheme0
Revision0
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Debian apt95%

minisign 0.12-1

Dead simple tool to sign files and verify signatures

https://jedisct1.github.io/minisign/

sudo apt install minisign
  • Section: misc
  • Architecture: amd64
  • 2 dependencies
  • normalized package name match
  • Matched by: Minisign
Debian stable package indexes · deb.debian.org · Debian stable package indexes: minisign from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
Nix95%

minisign

nix profile install nixpkgs#minisign
  • normalized package name match
  • Matched by: Minisign
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/mi/minisign/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
Ubuntu apt95%

minisign 0.11-1

Dead simple tool to sign files and verify signatures

https://jedisct1.github.io/minisign/

sudo apt install minisign
  • Section: universe/misc
  • Architecture: amd64
  • 2 dependencies
  • normalized package name match
  • Matched by: Minisign
Ubuntu 24.04 LTS package indexes · archive.ubuntu.com · Ubuntu 24.04 LTS package indexes: minisign from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz
apk95%

minisign 0.12-r2

Simple tool to sign files and verify signatures

https://jedisct1.github.io/minisign/

sudo apk add minisign
  • License: ISC
  • Architecture: x86_64
  • Source Package: minisign
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Minisign
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: minisign from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
apk95%

minisign-doc 0.12-r2

Simple tool to sign files and verify signatures (documentation)

https://jedisct1.github.io/minisign/

sudo apk add minisign-doc
  • License: ISC
  • Architecture: x86_64
  • Source Package: minisign
  • normalized package name match
  • Matched by: Minisign
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: minisign-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
dnf95%

minisign 0.12-3.fc44

A dead simple tool to sign files and verify digital signatures

https://github.com/jedisct1/minisign

sudo dnf install minisign
  • License: ISC
  • Category: Unspecified
  • Architecture: x86_64
  • Source Package: minisign
  • 3 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Minisign
Fedora Rawhide package metadata · dl.fedoraproject.org · Fedora Rawhide package metadata: minisign from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst
pacman95%

minisign 0.12-2

A dead-simple tool to sign files and verify digital signatures

https://github.com/jedisct1/minisign

sudo pacman -S minisign
  • License: ISC
  • Architecture: x86_64
  • 1 dependencies
  • normalized package name match
  • Matched by: Minisign
Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: minisign from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz
zypper95%

minisign 0.12-2.3

A dead simple tool to sign files and verify signatures

https://jedisct1.github.io/minisign/

sudo zypper install minisign
  • License: ISC
  • Category: Productivity/Networking/Security
  • Architecture: x86_64
  • Source Package: minisign
  • 2 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Minisign
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: minisign from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
MacPorts95%

minisign

sudo port install minisign
  • normalized package name match
  • Matched by: Minisign
MacPorts ports tree · api.github.com · MacPorts ports tree: security/minisign/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1
Scoop95%

main/minisign

scoop install main/minisign
  • normalized package name match
  • Matched by: Minisign
Scoop official bucket manifest trees · api.github.com · Scoop official bucket manifest trees: bucket/minisign.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1
winget95%

jedisct1.minisign

winget install --id jedisct1.minisign -e
  • normalized package name match
  • Matched by: Minisign
Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: jedisct1.minisign from https://cdn.winget.microsoft.com/cache/source.msix

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Related tools

  • cmakeBuild dependency declared by Homebrew.
  • pkgconfBuild dependency declared by Homebrew.
  • minisignSame normalized package name appears in another local ecosystem. Shared terms: cli, cryptography, minisign, security, signatures.

Same workflow

  • minizignShares av.db curated category or tags: cli, cryptography, digital-signatures, security, signature-verification.
  • sequoia-chameleon-gnupgShares av.db curated category or tags: cli, cryptography, security, signature-verification.
  • sequoia-sqvShares av.db curated category or tags: cli, cryptography, security, signature-verification.
  • aescryptShares av.db curated category or tags: cli, cryptography, security.
  • aespipeShares av.db curated category or tags: cli, cryptography, security.
  • ageShares av.db curated category or tags: cli, cryptography, security.
  • minisignSame normalized package name in another local ecosystem.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment