HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
jedisct1
minisign
C2019–2026
jedisct1 / minisign

minisign

A dead simple tool to sign files and verify digital signatures.

Security & Privacy
Explore on GitHubRead Hacker News discussions
7Distinct people
7Mentions
0Explicit recommenders
2.9KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

A dead simple tool to sign files and verify digital signatures.

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year7 dated mentions

Observed mentions: 2019-07-21 12:29:41 UTC to 2026-01-03 01:50:52 UTC.

0122019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20192020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments20222023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC101
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC000
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC211
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC000
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC000
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC202
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC101
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC101

What Hacker News says

7 sources
maqp·Jan 3, 2026
The biggest issue with PGP/gpg is the difficulty of getting rid of it. If you work on big distros, or know someone who works on big distros, please (start asking them to) add https://github.com/jedisct1/minisign to pre-installed packages to facilitate transition. It's almost a chicken egg problem but the sad thing is, no project wants to swap the signing tool to a better one until everyone can verify the new signatures.
In The PGP problem (2019)
kaoD·Nov 14, 2025
> there is nothing today as secure as GPG Depending on what part of the huge hulk that GPG is, there are many tools that are as secure (or more) than it. For encryption age[0] comes to mind. For signing minisign[1] or, more recently, plain ssh-keygen[2]. For encryption at rest, restic[3]. PGP having all this built-in with forward-compatibility is a liability. [0] https://github.com/FiloSottile/age [1] https://github.com/jedisct1/minisign [2] https://man.openbsd.org/ssh-keygen.1 [3] https://github.com/restic/restic
In GPG and Me (2015)
palata·Dec 26, 2024
> if you're "genuinely" asking questions, you might want to be careful about back-loading them with assertions that suggest you already believe you know the answer I don't know the answers. English is not my language, so I express myself as best as I can. I just re-read my answer above, and what you are saying isn't obvious to me. Not saying you're wrong: most likely you are right. Maybe I should write in my first language and hope that people translate it :-). I am just saying that it's often worth assuming good faith. It's not the first time I try to ask when I see criticism of PGP, and I still don't have answers. I am not saying PGP is great: just that I can actually use it with my hardware keys everywhere I need to. When I search for "minisign", I find different repositories from different authors I don't know. Is it better to use PGP
Read the rest
or to use some alternative from the first result given by my search engine? Some other thoughts (all are things I can currently do with PGP): * age is written in Go, so I assume it won't work on Android. Are there alternatives that support Android? I haven't found any. * rage is written in rust. Assuming it is trustworthy (it's not the same author as age), I haven't seen any information about Android. * The age-plugin-yubikey doesn't seem to work on Android [4] * It's really not clear to me if minisign works with hardware keys [1][2]. There is an "experimental" fork by Yubico, but it hasn't been updated in a year [3]. Not sure about other hardware keys. [1]: https://github.com/jedisct1/minisign/issues/100 [2]: https://github.com/jedisct1/minisign/issues/95 [3]: https://github.com/YubicoLabs/minisign-fido/ [4]: https://github.com/str4d/age-plugin-yubikey/issues/109
In Operational PGP (2015)

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.