title: Canonical way to sign (and verify) an ELF file?
body: <p>I would like to sign ELF files, preferably with a PGP key and later be able to verify the signature. Failing that I'll also go with a Authenticode or SSL certificate for signing if that makes more sense. Existing options, such as <a href="http://sourceforge.net/projects/signelf/" rel="noreferrer">signelf</a>, seem to be only available under copyleft licenses (even if it's the LGPL, but it imposes restrictions that prevent me from using it) or old/unmaintained.</p>
  
  <p>What options do I have that can be used <em>in a proprietary program</em>?</p>
  
  <p>Note: we can limit the scope of the question to Linux even though ELF isn't particular to Linux.</p>
  
  <p>Even if there is no ready to use program and/or library under a liberal (non-copyleft) FLOSS license, I would appreciate pointers to standardization documents in case some kind of de-facto standard has emerged. I'm not aware of one, but then that's the reason I ask.</p>
  
  <hr>
  
  <p>From what I see all distros seem to rely on signing the <em>packages</em> and verify these. That's fine in general but I would like to take it a step further.</p>