Three tools, built from apps/src/ when OpenSSL is available. Full detail on each child page.

Synopsis

dso-keygen --name <name> --email <email>
           [--key-id <id>] [--out-dir <dir>] [--separate]
           [--out-private-dir <dir>] [--out-public-dir <dir>]

dso-sign <addon.so> --key <developer.key>
         [--name <n>] [--version <v>] [--author "Name <email>"]
         [--abi-major N] [--abi-minor N] [--quiet]

dso-verify <addon.so> [--keys <trusted-keys.d/>] [--quiet]

Every tool takes -h / --help.

Exit codes

Tool	0	1	2	3	4
dso-keygen	success	usage / I/O / OpenSSL error	—	—	—
dso-sign	success	usage / I/O / OpenSSL / objcopy error	—	—	—
dso-verify	TRUSTED	UNKNOWN	UNSIGNED	REJECTED	ERROR (I/O / format)

dso-verify's exit code is the trust level — scriptable directly:

if dso-verify "$plugin" --keys /etc/app/keys.d/ --quiet; then
    echo trusted
fi

How they chain

dso-keygen  ──►  alice.key ──────────────┐
            └►  alice.pub ──►  /etc/app/trusted-keys.d/alice.pub
                                          │
                    libCircle.so  ──►  dso-sign --key alice.key  ──►  libCircle.so (signed)
                                          │
                                       dso-verify libCircle.so --keys /etc/app/keys.d/
                                          │
                                       exit 0 = TRUSTED

The same check dso-verify runs is what DSOLoader::loadVerified runs at load time — the CLI tool is for CI gates and manual inspection.

Pages: dso-keygen · dso-sign · dso-verify · Shell completion.