diff --git a/Makefile-ostree.am b/Makefile-ostree.am
index 95cf6779..1bdc5f34 100644
--- a/Makefile-ostree.am
+++ b/Makefile-ostree.am
@@ -29,6 +29,7 @@ ostree_SOURCES = src/ostree/main.c \
src/ostree/ot-builtin-commit.c \
src/ostree/ot-builtin-diff.c \
src/ostree/ot-builtin-fsck.c \
+ src/ostree/ot-builtin-gpg-sign.c \
src/ostree/ot-builtin-init.c \
src/ostree/ot-builtin-pull-local.c \
src/ostree/ot-builtin-log.c \
diff --git a/doc/Makefile.am b/doc/Makefile.am
index 5e5e3867..453551c6 100644
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -125,7 +125,7 @@ version.xml:
# This includes the standard gtk-doc make rules, copied by gtkdocize.
include $(top_srcdir)/gtk-doc.make
-man1_MANS = ostree.1 ostree-admin-cleanup.1 ostree-admin-config-diff.1 ostree-admin-deploy.1 ostree-admin-init-fs.1 ostree-admin-instutil.1 ostree-admin-os-init.1 ostree-admin-status.1 ostree-admin-set-origin.1 ostree-admin-switch.1 ostree-admin-undeploy.1 ostree-admin-upgrade.1 ostree-admin.1 ostree-cat.1 ostree-checkout.1 ostree-checksum.1 ostree-commit.1 ostree-config.1 ostree-diff.1 ostree-fsck.1 ostree-init.1 ostree-log.1 ostree-ls.1 ostree-prune.1 ostree-pull-local.1 ostree-pull.1 ostree-refs.1 ostree-remote.1 ostree-reset.1 ostree-rev-parse.1 ostree-show.1 ostree-summary.1 ostree-static-delta.1 ostree-trivial-httpd.1
+man1_MANS = ostree.1 ostree-admin-cleanup.1 ostree-admin-config-diff.1 ostree-admin-deploy.1 ostree-admin-init-fs.1 ostree-admin-instutil.1 ostree-admin-os-init.1 ostree-admin-status.1 ostree-admin-set-origin.1 ostree-admin-switch.1 ostree-admin-undeploy.1 ostree-admin-upgrade.1 ostree-admin.1 ostree-cat.1 ostree-checkout.1 ostree-checksum.1 ostree-commit.1 ostree-gpg-sign.1 ostree-config.1 ostree-diff.1 ostree-fsck.1 ostree-init.1 ostree-log.1 ostree-ls.1 ostree-prune.1 ostree-pull-local.1 ostree-pull.1 ostree-refs.1 ostree-remote.1 ostree-reset.1 ostree-rev-parse.1 ostree-show.1 ostree-summary.1 ostree-static-delta.1 ostree-trivial-httpd.1
man5_MANS = ostree.repo.5 ostree.repo-config.5
diff --git a/doc/ostree-gpg-sign.xml b/doc/ostree-gpg-sign.xml
new file mode 100644
index 00000000..0c7ab7d4
--- /dev/null
+++ b/doc/ostree-gpg-sign.xml
@@ -0,0 +1,80 @@
+
+
+
+
+
+
+
+
+ ostree gpg-sign
+ OSTree
+
+
+
+ Developer
+ Colin
+ Walters
+ walters@verbum.org
+
+
+
+
+
+ ostree gpg-sign
+ 1
+
+
+
+ ostree-gpg-sign
+ Sign a commit
+
+
+
+
+ ostree gpg-sign OPTIONS COMMIT KEY-ID
+
+
+
+
+ Description
+
+
+ Add a new signature to a commit for each specified GPG key.
+
+ Note that currently, this will append a new signature even if
+ the commit is already signed with a given key.
+
+
+
+
+ Options
+
+
+
+ ="HOMEDIR"
+
+
+ GPG Homedir to use when looking for keyrings.
+
+
+
+
+
diff --git a/src/ostree/main.c b/src/ostree/main.c
index b8dccd6b..93656fd4 100644
--- a/src/ostree/main.c
+++ b/src/ostree/main.c
@@ -41,6 +41,9 @@ static OstreeCommand commands[] = {
{ "config", ostree_builtin_config },
{ "diff", ostree_builtin_diff },
{ "fsck", ostree_builtin_fsck },
+#ifdef HAVE_GPGME
+ { "gpg-sign", ostree_builtin_gpg_sign },
+#endif
{ "init", ostree_builtin_init },
{ "log", ostree_builtin_log },
{ "ls", ostree_builtin_ls },
diff --git a/src/ostree/ot-builtin-gpg-sign.c b/src/ostree/ot-builtin-gpg-sign.c
new file mode 100644
index 00000000..74354d03
--- /dev/null
+++ b/src/ostree/ot-builtin-gpg-sign.c
@@ -0,0 +1,94 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2015 Colin Walters
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ * Author: Colin Walters
+ */
+
+#include "config.h"
+
+#include "ot-main.h"
+#include "ot-builtins.h"
+#include "ostree.h"
+#include "otutil.h"
+
+static char *opt_gpg_homedir;
+
+static GOptionEntry options[] = {
+ { "gpg-homedir", 0, 0, G_OPTION_ARG_STRING, &opt_gpg_homedir, "GPG Homedir to use when looking for keyrings", "HOMEDIR"},
+};
+
+static void
+usage_error (GOptionContext *context, const char *message, GError **error)
+{
+ gs_free char *help = g_option_context_get_help (context, TRUE, NULL);
+ g_printerr ("%s", help);
+ g_set_error_literal (error, G_IO_ERROR, G_IO_ERROR_FAILED, message);
+}
+
+gboolean
+ostree_builtin_gpg_sign (int argc, char **argv, GCancellable *cancellable, GError **error)
+{
+ GOptionContext *context;
+ gs_unref_object OstreeRepo *repo = NULL;
+ gs_free char *resolved_commit = NULL;
+ const char *commit;
+ char **key_ids;
+ int n_key_ids, ii;
+ gboolean ret = FALSE;
+
+ context = g_option_context_new ("COMMIT KEY-ID... - Sign a commit");
+
+ if (!ostree_option_context_parse (context, options, &argc, &argv, OSTREE_BUILTIN_FLAG_NONE, &repo, cancellable, error))
+ goto out;
+
+ if (argc < 2)
+ {
+ usage_error (context, "Need a COMMIT to sign", error);
+ goto out;
+ }
+
+ if (argc < 3)
+ {
+ usage_error (context, "Need at least one GPG KEY-ID to sign with", error);
+ goto out;
+ }
+
+ commit = argv[1];
+ key_ids = argv + 2;
+ n_key_ids = argc - 2;
+
+ if (!ostree_repo_resolve_rev (repo, commit, FALSE, &resolved_commit, error))
+ goto out;
+
+ for (ii = 0; ii < n_key_ids; ii++)
+ {
+ if (!ostree_repo_sign_commit (repo, resolved_commit, key_ids[ii],
+ opt_gpg_homedir, cancellable, error))
+ goto out;
+ }
+
+ ret = TRUE;
+
+out:
+ if (context)
+ g_option_context_free (context);
+
+ return ret;
+}
+
diff --git a/src/ostree/ot-builtins.h b/src/ostree/ot-builtins.h
index 099b2bc4..95262ec4 100644
--- a/src/ostree/ot-builtins.h
+++ b/src/ostree/ot-builtins.h
@@ -35,6 +35,7 @@ BUILTINPROTO(checkout);
BUILTINPROTO(checksum);
BUILTINPROTO(commit);
BUILTINPROTO(diff);
+BUILTINPROTO(gpg_sign);
BUILTINPROTO(init);
BUILTINPROTO(log);
BUILTINPROTO(pull);
diff --git a/tests/test-gpg-signed-commit.sh b/tests/test-gpg-signed-commit.sh
index 8a75660a..a3d1ad37 100644
--- a/tests/test-gpg-signed-commit.sh
+++ b/tests/test-gpg-signed-commit.sh
@@ -39,3 +39,11 @@ cd ${test_tmpdir}
${OSTREE} commit -b test2 -s "A GPG signed commit" -m "Signed commit body" --gpg-sign=${TEST_GPG_KEYID} --gpg-sign=${TEST_GPG_KEYID} --gpg-sign=${TEST_GPG_KEYID} --gpg-homedir=${TEST_GPG_KEYHOME} --tree=dir=files
$OSTREE show --print-detached-metadata-key=ostree.gpgsigs test2 > test2-gpgsigs
assert_file_has_content test2-gpgsigs 'byte '
+
+# Commit and sign separately
+cd ${test_tmpdir}
+${OSTREE} commit -b test2 -s "A GPG signed commit" -m "Signed commit body" --tree=dir=files
+$OSTREE show --print-detached-metadata-key=ostree.gpgsigs test2 2> /dev/null && (echo 1>&2 "unsigned commit unexpectedly had detached metadata"; exit 1)
+$OSTREE gpg-sign test2 ${TEST_GPG_KEYID} --gpg-homedir=${TEST_GPG_KEYHOME}
+$OSTREE show --print-detached-metadata-key=ostree.gpgsigs test2 > test2-gpgsigs
+assert_file_has_content test2-gpgsigs 'byte '