Breadcrumbs

SignWrapper-GPG

Enterprise

The SignServer SignWrapper-GPG replaces the gpg (GnuPG) command, intercepting calls from tools that use GPG for signing and forwarding them to SignServer through SignClient.

The signwrapper-gpg tool is available with SignServer Enterprise software and in the SignClient Enterprise bundle.

Prerequisites

SignClient Configuration

Provide the Worker name in the -u WorkerName option. Additionally, set the following environment variables:

Variable

Description

SIGNCLIENT_HOSTS

Value for the -hosts HOSTS SignClient parameter is the hostname or IP-address of the SignServer host or a comma separated list of hosts.

Example: signserver1.example.com

SIGNCLIENT_PORT

Value for the -port PORT SignClient parameter is the TCP port on the SignServer host to use.

Example: 8080

SIGNCLIENT_PARAMS

(Optional) Value for any extra parameters to put on the SignClient command line.

Example: -truststore TRUSTSTORE -truststorepwd PWD

Using the SignWrapper-GPG

The signwrapper-gpg is a wrapper script around the SignClient signdocument command:

USAGE: /opt/signserver/bin/signwrapper-gpg <-u WORKERNAME> <-o OUTFILE.sig>

Configure a tool requiring a gpg command to instead use the path to the signwrapper-gpg tool.

Set the required environment variables so they are available when the tool is executed.

Locating SignClient

SignWrapper-GPG needs to know where SignClient is located. If signwrapper-gpg is not kept in the SignClient folder, set one of the following environment variables:

  • SIGNCLIENT_CMD: Set to the full path of the bin/signserver script, or

  • SIGNCLIENT_HOME or SIGNSERVER_HOME: Set to the root folder of the SignClient distribution.

Signing RPM Packages

The SignWrapper-GPG can leverage the SignClient for securing RPM packages. For step-by-step setup instructions, see Sign with RPM Signatures.