# mtrojnar/osslsigncode

OpenSSL-based Authenticode signing for PE, CAB, CAT, MSI, APPX, and script file

Repository: https://github.com/mtrojnar/osslsigncode
Canonical: https://ross.abutalabs.com/products/osslsigncode
Language: C
License: NOASSERTION
License Family: other
Last push: 2026-08-26T09:54:04+00:00

## Health v2 (maintenance only)
Score: 93/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 81, longevity 100
- inputs: {"age_days": 2841, "days_push": 7, "days_rel": 44, "gap_med": 85.5, "n_releases_24m": 5}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1079, forks 152 (observed 2026-08-28T04:03:30.261075+00:00)

## What it is
osslsigncode is a small C tool that implements Microsoft Authenticode signing and timestamping, based on OpenSSL and cURL. It signs, verifies, timestamps, removes, and extracts signatures from PE, CAB, CAT, MSI, APPX files and various script formats, serving as a cross-platform alternative to signtool.exe.

## Use cases
- sign windows executables on linux
- authenticode sign msi installer without windows
- timestamp a signed dll using openssl
- verify authenticode signature of an exe
- remove signature from a pe file
- sign powershell scripts from ci pipeline
- sign appx package on macos

## When to choose
- you need to sign Windows binaries but don't have a Windows machine
- you want to automate Authenticode signing in Linux or macOS CI pipelines
- you need signature verification, removal, or extraction for PE/CAB/MSI/APPX files

## When to avoid
- you already run signtool.exe on Windows and don't need cross-platform signing
- you need full Authenticode feature parity with Microsoft's signtool.exe
- you need to sign file formats other than PE, CAB, CAT, MSI, APPX, or supported scripts

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, cryptography, cli, developer-tools
- domain: security, developer-tools
- platform: windows, cross-platform, cli
- tags: authenticode, code-signing, openssl, signtool, timestamping, pe-files, msi, appx, command-line, linux, macos

## Member repositories
- mtrojnar/osslsigncode (main) score 93

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:30.261075+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:53:05.469373+00:00, confidence not recorded.
  - readme: https://github.com/mtrojnar/osslsigncode (fetched 2026-08-28T04:03:30.261075+00:00, sha 86859e167c8f)
- Data as of 2026-08-30T08:39:29.467469+00:00.