Signing Files vs. Signing File Hashes What are the security pitfalls that may occur by signing a list of file hashes, versus signing individual files?

In short, the security trade-offs between:

for file in $FILES; do
    gpg --clearsign $file
done


And:

sha256sum $FILES &gt; signatures
gpg --clearsign signatures
There are a few pitfalls:

File name integrity: signing files one at a time signs the contents of the files.  It (typically) does not protect the file names from tampering.  This could be disastrous in some situations (e.g. an attacker could change blacklist.txt to whitelist.txt).

Set membership integrity: signing individual files does not prevent adding or removing files from the set of files that were transmitted.  In some cases, this is important: if you're transmitting a set of log files, an attacker could selectively remove one that captured incriminating information.  If an attacker has the opportunity to see multiple transmissions, they could add files from an old transmission to the new transmission (essentially a variant on replay attacks).  The files would still have valid signatures individually, so the additions would not be detected.  If you're transmitting a set of user accounts (one per file), an attacker could revert their account to an earlier state (e.g. back to having admin status).

I recommend protecting the transmission as a whole instead of part-by-part, if possible.  The easiest way of doing this is usually to create a tarball or zip file and sign the entire archive.  Signing a list of file hashes is also adequate, but take care when coding the verification mechanism.