Sign hashes with SMCTL

DigiCert® Signing Manager Controller (SMCTL) is a Command Line Interface (CLI) that facilitates manual and automated private key management, certificate management, and signing with or without the need for human intervention.

Hash signing ensures data integrity by generating unique cryptographic signatures for files, offering an extra layer of security against tampering and unauthorized modifications throughout the software distribution process.

You can integrate third-party signing tools with SMCTL for simplified signing. For other SMCTL commands, refer to the SMCTL command manual.

작은 정보

SMCTL does not support all characters in sign commands, review the following:

Supported characters: @ % ( ) - _ = [ ] { } ;
Unsupported characters: | ` $ > < # ! ' & + ^
Note: Jarsigner supports the ^ character in sign commands.

To avoid errors, remove unsupported characters from file paths before attempting to sign or sign directly via the third party tool.

Prerequisites

SMCTL version 1.44.0 or higher
DigiCert ONE API key
DigiCert ONE client authentication certificate
Keypair and default certificate
Hash to be signed

Download and integrate third-party signing tools

Refer to the article below to identify the third-party signing tools that you require based on your operating system and the types of files you need to sign:

Integrate third-party signing tools

Set PATH environment variables

Operating systems use the environment variable called PATH to determine where executable files are stored on your system. Use the PATH environment variable to store the file path to your signing tools to ensure that the CLI can reference these signing tools.

예 1. Windows

You can configure the signing tools using SMCTL or environment variables.

To set the path to your signing tools via SMCTL:

Run:

set PATH=%path%;<Path to DigiCert ONE Signing Manager Tools folder>

Command sample:

set PATH=%path%;C:\Program Files\DigiCert\DigiCert One Signing Manager Tools

To verify that the tool has been integrated run the following command in SMCTL:
```
smctl healthcheck --tools
```

To set the path to your signing tools for your system or account:

Search for environment variables in the Windows start menu.
Select Edit environment variables for your account or Edit system environment variables.
Double click on the Path variable.
Click New.
Select Browse.
Select the path to the signing tool.
Signtool 64-bit path example: C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64
Signtool 32-bit path example: C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x86
Jarsigner path example: C:\Program Files\Java\jdk-17\bin\
Apksigner path example: C:\build-tools\31.0.0
Click OK to save the path.
Click on OK to close the dialog.

예 2. Linux

Configure the signing tools using SMCTL.

Launch the Terminal application.
Open the file in an editor:
```
nano ~/.profile
```

Add any exports definitions you need:

export PATH=<Path to Jarsigner>
export PATH=<Path to Jsign>
export PATH=<Path to osslsigncode>

Click CTRL+X to exit.
Click Y to save.
Click Enter to keep the same file name.
Execute the new .profile by restarting Terminal or using:
```
 source ~/.profile
```

예 3. macOS

Configure the signing tools using SMCTL.

Launch the Terminal application.
Create a profile file:
```
touch ~/.zprofile
```
Open the file in an editor:
```
open ~/.zprofile
```

Add any exports definitions you need, such as:

export PATH=<Path to Apksigner>
export PATH=<Path to Jarsigner>
export PATH=<Path to Jsign>
export PATH=<Path to osslsigncode>
export PATH=<Path to Codesign>
export PATH=<Path to Productsign>

To save the new .zprofile, click File > Save (CMD + S).
Close the terminal window and reopen to use new saved variables.

Sign hash with SMCTL

Command:

smctl sign sign-hash --file <file path> --hash-algorithm <hash algorithm> --signature-algorithm <algorithm> <keypair ID> --signature-file <signature file path> --binary

Command sample:

smctl sign sign-hash --file UNSIGNED_JAR.jar --hash-algorithm SHA-512 --signature-algorithm MLDSA44 c16f3975-101b-4837-8de5-42160e791220 --signature-file mldsasign44.txt --binary

참고

For more information refer to the sign-hash command manual.

Verify signed hash with SMCTL