# info > DEBSIGN

---
type: CommandReference
command: debsign
mode: man
section: 1
source: man-pages
---

## Quick Reference

- `debsign` — Sign a `.changes`, `.dsc`, or `.buildinfo` file with GPG
- `debsign foo.changes` — Sign a specific changes file
- `debsign -r user@host:path/file.changes` — Sign a file on a remote host (copies via scp)
- `debsign -kKEYID foo.changes` — Sign with a specific GPG key ID
- `debsign -S` — Sign a source-only `.changes` file
- `debsign` — Sign the package described by `debian/changelog` (looks for `.changes` in parent dir)

## Name

debsign - sign a Debian .changes and .dsc file pair using GPG

## Synopsis

shell
debsign [options] [changes-file|dsc-file|commands-file ...]
## Options

### Signing control

- `-r [username@]remotehost` — Files to sign live on the remote host. Specify absolute or relative path; uses `scp` to copy. Wildcards allowed.
- `-p progname` — Use `progname` instead of `gpg` for signing (searches PATH).
- `-m maintainer` — Set maintainer name for signing.
- `-e maintainer` — Same as `-m` but takes precedence over it.
- `-k keyid` — Specify GPG key ID; overrides `-m` and `-e`.

### File selection

- `-S` — Use source-only `.changes` file instead of binary-build.
- `-a debian-architecture` — Affect `.changes` file search (see `dpkg-architecture`).
- `-t GNU-system-type` — Affect `.changes` file search (see `dpkg-architecture`).
- `--multi` — Multiarch mode: use most recent file matching `package_version_*+*.changes`.
- `--debs-dir DIR` — Look for files in `DIR` instead of parent of source directory.

### Signature handling

- `--re-sign` — Recreate signature even if already signed.
- `--no-re-sign` — Use existing signature if present.
- (Default: prompt user if already signed.)

### Configuration

- `--no-conf`, `--noconf` — Do not read any configuration files (must be first option).
- `--help`, `-h` — Display help and exit.
- `--version` — Display version and copyright.

### Configuration variables

Read from `/etc/devscripts.conf` and `~/.devscripts` (in that order). Command line overrides these.

- `DEBSIGN_PROGRAM` — Equivalent to `-p`.
- `DEBSIGN_MAINT` — Equivalent to `-m`.
- `DEBSIGN_KEYID` — Equivalent to `-k`.
- `DEBSIGN_ALWAYS_RESIGN` — Always re-sign without prompting.
- `DEBRELEASE_DEBS_DIR` — Equivalent to `--debs-dir` (also affects `debrelease`).

## Examples

shell
# Sign a specific changes file
debsign foo_1.0-1_amd64.changes

# Sign using a remote signing machine
debsign -r builder@signhost:~/packages/foo_1.0-1_amd64.changes

# Sign with a specific GPG key
debsign -k 0xDEADBEEF foo_1.0-1_amd64.changes

# Sign a source-only changes file (no binary)
debsign -S foo_1.0-1_source.changes

# Use an alternative signing program (e.g., gpg2)
debsign -p gpg2 foo.changes

# Sign the package in the current working tree (reads debian/changelog)
debsign
## See Also

- [debrsign(1)](http://localhost/phpMan.php/man/debrsign/1/markdown) — remote signing wrapper
- [debuild(1)](http://localhost/phpMan.php/man/debuild/1/markdown) — build and sign packages
- [dpkg-architecture(1)](http://localhost/phpMan.php/man/dpkg-architecture/1/markdown)
- [dpkg-buildpackage(1)](http://localhost/phpMan.php/man/dpkg-buildpackage/1/markdown)
- [gpg(1)](http://localhost/phpMan.php/man/gpg/1/markdown), [gpg2(1)](http://localhost/phpMan.php/man/gpg2/1/markdown)
- [md5sum(1)](http://localhost/phpMan.php/man/md5sum/1/markdown), [sha1sum(1)](http://localhost/phpMan.php/man/sha1sum/1/markdown), [sha256sum(1)](http://localhost/phpMan.php/man/sha256sum/1/markdown)
- [scp(1)](http://localhost/phpMan.php/man/scp/1/markdown)
- [devscripts.conf(5)](http://localhost/phpMan.php/man/vscripts.conf/5/markdown)