{"slug": "minisign", "name": "minisign", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 3, "commenters": 5, "warners": 1, "score": 1.868, "rising": -0.98, "first": "2025-11-13", "latest": "2026-01-02", "why": "add https://github.com/jedisct1/minisign to pre-installed packages", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 1, "compare": 0, "warn": 1}, "spark": [1, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "add https://github.com/jedisct1/minisign to pre-installed packages", "kind": "", "icon": false, "domain": null, "github_repo": "github.com/jedisct1/minisign", "official_url": "https://jedisct1.github.io/minisign/", "pricing": "", "aliases": ["minisign", "Minisign"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 743575217, "item_id": 46473451, "url": "https://news.ycombinator.com/item?id=46473451", "by": "some_furry", "date": "2026-01-02", "stance": "recommend", "quote": "Boring, simple, fit-for-purpose.", "excerpt": "PGP/GPG is a complicated mess designed in the 1990's and only incrementally updated to add more complexity and cover more use-cases, most of which you'll never need. Part of PGP/GPG is supporting a large swath of algorithms (from DSA to RSA to ECDSA to EdDSA to whatever post-quantum abomination they'll cook up next). Signify/Minisign is Ed25519. Boring, simple, fit-for-purpose. You can write an implementation of Mini", "context": "", "use_case": "", "switched_from": "", "story": "The PGP Problem (2019)"}, {"id": 743551137, "item_id": 46471946, "url": "https://news.ycombinator.com/item?id=46471946", "by": "maqp", "date": "2026-01-02", "stance": "recommend", "quote": "add https://github.com/jedisct1/minisign to pre-installed packages", "excerpt": "The biggest issue with PGP/gpg is the difficulty of getting rid of it. If you work on big distros, or know someone who works on big distros, please (start asking them to) add https://github.com/jedisct1/minisign to pre-installed packages to facilitate transition. It's almost a chicken egg problem but the sad thing is, no project wants to swap the signing tool to a better one until everyone can verify the new signatur", "context": "", "use_case": "file signing", "switched_from": "", "story": "The PGP Problem (2019)"}, {"id": 734908226, "item_id": 45931764, "url": "https://news.ycombinator.com/item?id=45931764", "by": "kaoD", "date": "2025-11-14", "stance": "recommend", "quote": "For signing minisign[1]", "excerpt": "> there is nothing today as secure as GPG Depending on what part of the huge hulk that GPG is, there are many tools that are as secure (or more) than it. For encryption age[0] comes to mind. For signing minisign[1] or, more recently, plain ssh-keygen[2]. For encryption at rest, restic[3]. PGP having all this built-in with forward-compatibility is a liability. [0] https://github.com/FiloSottile/age [1] https://github.", "context": "", "use_case": "", "switched_from": "", "story": "GPG and Me (2015)"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 743272691, "item_id": 46454543, "url": "https://news.ycombinator.com/item?id=46454543", "by": "1vuio0pswjnm7", "date": "2026-01-01", "stance": "warn", "quote": "discovered multiple vulnerabilities in cryptographic utilities, namely in GnuPG, Sequoia PGP, age, and minisign.", "excerpt": "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i \"When looking into various PGP-related codebases for some personal use cases, we found these expectations not met, and discovered multiple vulnerabilities in cryptographic utilities, namely in GnuPG, Sequoia PGP, age, and minisign.\" \"The vulnerabilities have implementation bugs at their core, for example in parsing code, rather than bugs i", "context": "", "use_case": "", "switched_from": "", "story": "A Vulnerability in Libsodium"}]}], "who": [], "tags": [], "use_cases": ["file signing", "signing releases"], "compared": [{"slug": "gnupg", "name": "GnuPG", "co": 5, "switched_from": 0, "switched_to": 0}, {"slug": "age", "name": "age", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "signify", "name": "Signify", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=46409473", "title": "The PGP Problem (2019)", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=46435614", "title": "A Vulnerability in Libsodium", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=45885070", "title": "GPG and Me (2015)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=45825040", "title": "Switching from GPG to Age", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 1, "recommend": 1}, "2025-12": {}, "2026-01": {"warn": 1, "recommend": 2}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 743575217, "item_id": 46473451, "url": "https://news.ycombinator.com/item?id=46473451", "by": "some_furry", "date": "2026-01-02", "stance": "recommend", "quote": "Boring, simple, fit-for-purpose.", "excerpt": "PGP/GPG is a complicated mess designed in the 1990's and only incrementally updated to add more complexity and cover more use-cases, most of which you'll never need. Part of PGP/GPG is supporting a large swath of algorithms (from DSA to RSA to ECDSA to EdDSA to whatever post-quantum abomination they'll cook up next). Signify/Minisign is Ed25519. Boring, simple, fit-for-purpose. You can write an implementation of Mini", "context": "", "use_case": "", "switched_from": "", "story": "The PGP Problem (2019)"}, {"id": 743551137, "item_id": 46471946, "url": "https://news.ycombinator.com/item?id=46471946", "by": "maqp", "date": "2026-01-02", "stance": "recommend", "quote": "add https://github.com/jedisct1/minisign to pre-installed packages", "excerpt": "The biggest issue with PGP/gpg is the difficulty of getting rid of it. If you work on big distros, or know someone who works on big distros, please (start asking them to) add https://github.com/jedisct1/minisign to pre-installed packages to facilitate transition. It's almost a chicken egg problem but the sad thing is, no project wants to swap the signing tool to a better one until everyone can verify the new signatur", "context": "", "use_case": "file signing", "switched_from": "", "story": "The PGP Problem (2019)"}, {"id": 743272691, "item_id": 46454543, "url": "https://news.ycombinator.com/item?id=46454543", "by": "1vuio0pswjnm7", "date": "2026-01-01", "stance": "warn", "quote": "discovered multiple vulnerabilities in cryptographic utilities, namely in GnuPG, Sequoia PGP, age, and minisign.", "excerpt": "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i \"When looking into various PGP-related codebases for some personal use cases, we found these expectations not met, and discovered multiple vulnerabilities in cryptographic utilities, namely in GnuPG, Sequoia PGP, age, and minisign.\" \"The vulnerabilities have implementation bugs at their core, for example in parsing code, rather than bugs i", "context": "", "use_case": "", "switched_from": "", "story": "A Vulnerability in Libsodium"}, {"id": 734908226, "item_id": 45931764, "url": "https://news.ycombinator.com/item?id=45931764", "by": "kaoD", "date": "2025-11-14", "stance": "recommend", "quote": "For signing minisign[1]", "excerpt": "> there is nothing today as secure as GPG Depending on what part of the huge hulk that GPG is, there are many tools that are as secure (or more) than it. For encryption age[0] comes to mind. For signing minisign[1] or, more recently, plain ssh-keygen[2]. For encryption at rest, restic[3]. PGP having all this built-in with forward-compatibility is a liability. [0] https://github.com/FiloSottile/age [1] https://github.", "context": "", "use_case": "", "switched_from": "", "story": "GPG and Me (2015)"}, {"id": 734658161, "item_id": 45916135, "url": "https://news.ycombinator.com/item?id=45916135", "by": "networked", "date": "2025-11-13", "stance": "neutral", "quote": "I first thought of Minisign, too.", "excerpt": "> I'm now experimenting with `age`, which touts itself as \"simple, modern, and secure encryption\". If needed, I will use `minisign` for signatures. I have also switched from GPG to age. When I wanted to start signing my open-source software releases because of recent supply-chain attacks, I first thought of Minisign, too. I tried it for binaries and even found a few third-party Git integrations (https://codeberg.org/", "context": "", "use_case": "signing releases", "switched_from": "", "story": "Switching from GPG to Age"}]}