title: How to sign a Linux shared library?
body: <p>I am working at a small software startup and we are in the process of licensing software we have developed to another company. The software is written in C++ and runs on Linux.</p>
  
  <p>This is not the first time we license software to this company. We suspect that parts of a previously delivered software have been used for other programs than those agreed upon. However we were not able to prove this, since we had delivered source code and the company distributes compiled executables, which retain no evidence of our ownership.</p>
  
  <p>This time we would like to make sure that the company uses our software only for purposes covered by the license agreement. We do not want to restrict the usability of our software, but we would like to somehow sign our code so that we can identify it when it is part of a larger program.</p>
  
  <p>As a first measure this time we will deliver our software as a shared library instead of source code. However, the company could still rename the library file, remove copyright notices from the file or statically embed it into an executable <a href="https://stackoverflow.com/a/725550/1404847">using the tools described in this post</a>.
  Therefore I am searching for possibilities to apply some sort of digital signature to the ELF file we are going to deliver.</p>
  
  <p>I was learning about the ELF file format and the various things to consider when writing shared libraries, but I found little information on how to digitally sign ELF files. 
  I came across tools like <a href="https://github.com/bartman/elfgpg" rel="nofollow noreferrer">elfpgp</a> or <a href="https://sourceforge.net/projects/signelf/" rel="nofollow noreferrer">signelf</a>, however they do not seem to be actively maintained.
  I am particularly looking for a signature technique that would stay in place even if the library was embedded into a larger executable.</p>
  
  <p>How can I sign a Linux shared library in a way that allows me to identify it and to prove ownership of the library? Which measures can I take to do so even if my library is statically embedded into an executable?</p>