# Sigsum C library

Sigsum is a system for public and transparent logging of signed
checksums, see [sigsum.org][] for an overview of the system.

This repository contains a C library, libsigsum, and a command line
tool sigsum-c-verify. The library supports offline
verification of Sigsum proofs, and related operations. See [library
documentation](./doc/sigsum-c.md). Support for related network
protocols is out of scope.

[sigsum.org]: https://www.sigsum.org/

## Hacking

The Sigsum C library mostly follows the GNU coding standards.

### Dependencies

The Sigsum C library depends on the GNU Nettle library. Needed build
tools include `autoconf`, GNU `make` and a C compiler. The testsuite also
needs `jq`. On a Debian system, the needed dependencies can be
installed using
```
apt install gcc make autoconf nettle-dev jq
```

### Building

To build from a git checkout, the steps are

* Run `autoreconf`. This generates the files `configure` and
  `config.h.in`. These files are not platform specific, and would be
  included if sigsum-c were distributed as a traditional tar archive.

* Run `./configure` (or `.../sigsum-c/configure` if you use a
  separate build directory). This scripts generates various files with
  substitutions depending on the build environment and the configure
  options, in particular all `Makefile`s, as well as the
  `config.status` script. Run `./configure --help` for a summary of
  options, e.g., `--prefix`, to set the install location.

* Run `make` to build the library. Other useful make targets include
  `make check`, to run the testsuite, and `make install`, to install
  the library and its header files.

## Licensing

The Sigsum C library itself is licensed under the permissive BSD
2-clause license, see the LICENSE and AUTHORS files.

When using this library in your own program, you will typically make a
combined work that includes parts of this library, as well as parts of
the GNU Nettle and GNU GMP libraries it depends on. The combined work
is not subject only to the BSD 2-clause license, but also to the
licence conditions of Nettle and GMP. There are several options for
compliance, the simplest two being to either provide complete source
code under a GPL-compatible license, or link dynamically to Nettle and
GMP, in a way that satisfies the rather weak conditions of LGPLv3.
