Download ssign

ssign is a single program file: download the archive for your system and extract it. These links always point to the latest release.

System	Download	Contains
Linux Intel or AMD 64-bit (x86_64)	ssign-linux-x86_64.tar.gz	`ssign`
Linux ARM 64-bit (aarch64)	ssign-linux-aarch64.tar.gz	`ssign`
macOS Apple silicon (M-series chip)	ssign-macos-aarch64.tar.gz	`ssign`
macOS Intel Mac	ssign-macos-x86_64.tar.gz	`ssign`
Windows 64-bit (x86_64)	ssign-windows-x86_64.zip	`ssign.exe`

Release notes and older versions: all releases on GitHub.

Install

Linux and macOS: extract the archive and put ssign on your PATH (use the archive name for your system):
```
tar xzf ssign-linux-x86_64.tar.gz
sudo install -m755 ssign /usr/local/bin/ssign
ssign --help
```
Windows: extract the zip; it contains ssign.exe.

The Windows files (ssign.exe and ssign_pkcs11.dll) are Authenticode-signed with ssign itself during the release, from a Linux runner, and checked with osslsigncode verify. The macOS files are signed and notarized with Apple, and built for macOS 11 or later.

PKCS#11 module

To sign MSI, CAB, catalogs, APPX or PowerShell scripts with osslsigncode, download the module for your system. How to use it: PKCS#11 and osslsigncode.

System	Download	Contains
Linux Intel or AMD 64-bit (x86_64)	ssign-pkcs11-linux-x86_64.tar.gz	`libssign_pkcs11.so`
Linux ARM 64-bit (aarch64)	ssign-pkcs11-linux-aarch64.tar.gz	`libssign_pkcs11.so`
macOS Apple silicon (M-series chip)	ssign-pkcs11-macos-aarch64.tar.gz	`libssign_pkcs11.dylib`
macOS Intel Mac	ssign-pkcs11-macos-x86_64.tar.gz	`libssign_pkcs11.dylib`
Windows 64-bit (x86_64)	ssign-pkcs11-windows-x86_64.zip	`ssign_pkcs11.dll`

With Cargo

If Rust is installed, the command is on crates.io:

cargo install ssign

The PKCS#11 module is not on crates.io: it is a shared library, which cargo install cannot install. Take the prebuilt module above, or build it from a clone of the repository:

cargo build -p ssign-pkcs11 --release   # → target/release/libssign_pkcs11.so

What you need

A Certum SimplySign cloud code-signing certificate, the account e-mail, and the authenticator app you set up from the SimplySign QR code.
Network access to cloudsign.webnotarius.pl (HTTPS) and to the timestamp server, http://time.certum.pl/ by default.
A system certificate store: ssign checks HTTPS certificates through the operating system's trust store, so a bare container image without CA certificates will not work.

Next step: sign your first file.