Signo
Signo is a free, open-source signing service that you self-host for file signatures and Windows Authenticode signing.
What Signo is
Signo is a free, open-source signing service that you self-host for file signatures and Windows Authenticode signing. Its HTTP API returns plain binary signatures or Authenticode signatures for Windows executables, supporting CI applications that use certificates stored on PKCS#11 hardware tokens such as YubiKey. Tokens must be activated by entering their PIN before signing. Multiple users can manage tokens, signing engines, and signees, which are API clients. Administrators can grant each signee access to selected engines, and requests use HMAC authentication. Configuration supports MySQL or SQLite. Signo runs on Linux, with the quick start calling for Node.js 16 or 18. Installation is available through NPM or Docker Hub, with NPM described as the simplest route. Setup requires an SSL certificate for HTTPS and a list of PKCS#11 modules. The repository uses a GPL-3.0 license. PDF signing, operation logging, key and CSR generation, and certificate import are listed as planned features.
Good
- Open-source and free to use
- Supports PKCS#11 hardware tokens
- Signs files through an HTTP API
- Authenticode support for Windows executables
- Per-client signing-engine permissions
Watch out
- Requires self-hosting on Linux
- Node.js 16 or 18 required for quick start
- Token PIN must be entered manually
- Several features remain planned
Who it suits
It suits teams needing self-hosted CI signing with hardware-protected certificates and controlled API access. Linux administrators comfortable configuring SSL, PKCS#11 modules, and a supported database are the intended users.
Verdict
Signo provides a focused, self-hosted API for hardware-backed file and executable signing. Its permissions and HMAC requests suit CI workflows, but deployment requires Linux, SSL, token-module configuration, and supported runtime setup.
The facts
Each one read from Signo's own pages, with the date it was checked.
What it does
- API access
- API clients, called signees, can be assigned access to individual signing engines, and API requests are HMAC signed.checked 4 Oct 2026
- API authentication
- API requests are HMAC signed.checked 10 Oct 2026
- Databases
- Configuration supports either MySQL or SQLite.checked 10 Oct 2026
- Distribution
- The project says Signo is available through NPM or Docker Hub, with NPM described as the simplest installation route.checked 4 Oct 2026
- File signing
- It signs files through an HTTP API and supports plain signatures and Authenticode signing for Windows executables.checked 4 Oct 2026
- Installation
- The README offers installation through NPM or Docker Hub and describes a Linux setup requiring Node.js 16 or 18.checked 10 Oct 2026
- Integrations
- The README names YubiKey as a hardware-token example and points to a separate signo-client NPM package for API use.checked 10 Oct 2026
- Intended use
- The project aims to let CI applications generate signed executables using certificates stored on hardware tokens.checked 4 Oct 2026
- License
- The repository identifies the project as GPL-3.0 licensed.checked 10 Oct 2026
- PKCS#11
- Signo supports PKCS#11 tokens and is intended to help CI applications use hardware-stored code-signing certificates.checked 10 Oct 2026
- Purpose
- Signo is an open source, self-hosted signing service that signs files through an HTTP API.checked 10 Oct 2026
- Runtime requirement
- The quick start calls for a Linux machine with NodeJS 16 or 18 installed.checked 4 Oct 2026
- Security setup
- The setup instructions require configuring an SSL certificate and listing PKCS#11 modules.checked 4 Oct 2026
- Signature types
- It supports plain signing, which returns a binary signature, and Authenticode signing for Windows executables.checked 10 Oct 2026
- Signing permissions
- Administrators can enable specific signing engines for each signee, which represents an API client.checked 10 Oct 2026
- Token controls
- The service lists detected tokens and their keys and certificates; a token must be activated by entering its PIN before it can sign.checked 10 Oct 2026
- Transport security
- The setup instructions require an SSL certificate for the HTTPS service, and say a self-signed certificate can be used if the infrastructure trusts it.checked 10 Oct 2026
- User management
- Multiple users can manage tokens, signing engines, and signees.checked 10 Oct 2026
Money
- Planned features
- The README lists a cryptographically verifiable operation log, PDF signing, key and CSR generation, and importing certificates to tokens as planned features.checked 10 Oct 2026
Alternatives to Signo
- 1
Sigstore
Free planOpen sourceWebAPILinuxmacOS7.6Free plan - 2
SignPath
Free planWebAPILinuxmacOS7.2Free plan - 3
AWS Signer
Free planWebAPILinuxmacOS7.1Free plan - 4
Cosign
Free planLinuxmacOSSelf-hostedWindows6.6Free plan - 5
OpenPubkey
Free planAPILinuxmacOSSelf-hosted6.6Free plan - 6
SignServer
Free planWebAPILinuxmacOS6.5Free plan