sign stable port information

Package: sign
Version: 1.0.7
Revision: 1001
###
Source: http://swapped.cc/sign/files/%n-%v.tar.gz
Source-MD5: f01c3f5dffc80d3ccd096d039e0c94f1
Depends: openssl098-shlibs
BuildDepends: openssl098-dev
###
###
DocFiles: LICENSE LICENSE.openssh LICENSE.openssl README
###

PatchScript: <<
perl -pi.bak -e "s|INSTALL=/usr|INSTALL=%d%p|" Makefile
perl -pi.bak -e "s|/man/man1|/share/man/man1|g" Makefile
perl -pi.bak -e "s|(ln -s) \S+|\1 sign|" Makefile
<<

SetCPPFLAGS: -DEVP_F_EVP_DECRYPTFINAL=EVP_F_EVP_DECRYPTFINAL_EX

CompileScript: <<
make
<<

InstallScript: <<
mkdir -p %d%p/bin
mkdir -p %d%p/share/man/man1
make install
<<

Description: File signing & signature verification utility
DescDetail: <<
First of all, sign is a file processing tool, it reads from the files
(including stdin) and writes to the files (including stdout). It can
be used to append signatures to the files or to verify and/or strip them.

Between signing and verifying latter will account for a bulk of usage.
When checking the signature, sign will check for both intergrity and
authenticity of the file. An integrity check is done by validating SHA-1
hash embedded into the signature, and an authenticity is ensured by checking
signer's credentials against a trusted list.

sign adopts OpenSSH-style authentication model, where the trust hierarchy
is flat (no certificates), an authentication is done with public keys and
the list of trusted keys is grown gradually on as-needed basis.

Every trusted key is associated with a file name prefix called the title.
The key can trusted for signing files, whose name start with key's title.
The same key may be associated with more than one title, but not vice versa.

The signature is appended at the end of the file and it carries three bits
of information - the title, the public key of the signer and the hash of all
preceeding data encrypted with signer's private key.
The verification is performed as follows:

* The filename is checked to start with a title
* The hash is decrypted using the public key
* The hash is compared to the locally computed value
(this ensures integrity)
* The title is looked up locally; if it's known and
associated public key is the same as in the signature,
the file is deemed authentic.
* Otherwise if the title is known, but the key is different,
the file is considered to be signed by untrusted,
impersonating party and the check fails.
* And lastly, if the title is unknown, the authenticity
of the file cannot be established. The user is provided
with public key fingerprint, which should be manually
authenticated. Then the title and the key are added to the
trusted list; and subsequent signatures from the this signer
for this particular title will be cleared automatically.

In order to sign files, the signing keypair must first be generated.
The keypair is maintained on per-user basis and can be created by
running sign with a special command-line flag. The signing process
itself is as follows (give or take insignificant details):

* Run the filename through a list of owned titles and find the
best match. Alternately accept explicit title from the user
using one of the command-line flags.
* Attach the title, attach public signing key
* Compute the hash, encrypt it with private signing key
* Attach encrypted hash.
<<
###
License: BSD
Maintainer: Darian Lanx
Homepage: http://swapped.cc/sign/