systemd-report-sign-plain@.service - Man Page

systemd-report-sign-plain@​.service

systemd-report-sign-plain​.socket

/usr/lib/systemd/systemd-report-sign-plain

systemd-report-sign-plain@​.service is a system service that signs system reports generated by systemd-report(1)​. It is a signing backend for the --sign= logic of that tool: it implements the io​.systemd​.Report​.Signer​.Sign() Varlink method and is reached via a socket linked into the /run/systemd/report​.sign/ directory, named plain​.

The service is socket-activated (one instance per connection) via systemd-report-sign-plain​.socket, and signs the digest passed to it with a local software key​. Signatures are made with the Ed25519 (EdDSA) algorithm​.

On first use a key pair is generated automatically and stored below /var/lib/systemd/report​.sign​.plain/: the private key in local​.private (PKCS#8 PEM, readable only by the root user) and the public key in local​.public (PEM, world readable)​.

The public key is also exported as a system report metric​.

systemd(1), systemd-report(1)

systemd.directives(7), systemd.index(7).