Description¶

systemd-report-sign-plain@.service is a system service that signs system reports generated by systemd-report(1). It is a signing backend for the --sign= logic of that tool: it implements the io.systemd.Report.Signer.Sign() Varlink method and is reached via a socket linked into the /run/systemd/report.sign/ directory, named plain.

The service is socket-activated (one instance per connection) via systemd-report-sign-plain.socket, and signs the digest passed to it with a local software key. Signatures are made with the Ed25519 (EdDSA) algorithm.

On first use a key pair is generated automatically and stored below /var/lib/systemd/report.sign.plain/: the private key in local.private (PKCS#8 PEM, readable only by the root user) and the public key in local.public (PEM, world readable).

The public key is also exported as a system report metric.

See Also¶

systemd(1), systemd-report(1)