@@ -75,7 +75,7 @@ task e2e:kind    # Linux + docker: cert-manager in kind gets a certificate over
 
 This repo builds no bootable image. The hardened kernel, SquashFS rootfs, UKI assembly, Secure Boot signing, the installer ISO and the QEMU + `swtpm` integration suites all live in [`cryptos-appliance`](https://github.com/CryptOS-PKI/cryptos-appliance), which requires this module at a pinned version and builds `init`, `cryptosctl` and the console by import path. See that repo's README and `docs/secure-boot.md` for building, signing and Secure Boot key custody.
 
-The release assets are unsigned and carry no upgrade anchor. `cryptosctl image sign --image <unsigned.uki> --key <key.pem> --cert <cert.pem>` signs one with your own Secure Boot key and adds your certificate as its upgrade anchor, so a node installed from it takes signed in-place upgrades. [`docs/image-sign.md`](docs/image-sign.md) covers it.
+The release assets are unsigned and carry no upgrade anchor. `cryptosctl image sign --image <unsigned.uki> --key <key.pem> --cert <cert.pem>` signs one with your own Secure Boot key and adds your certificate as its upgrade anchor, so a node installed from it takes signed in-place upgrades. Given an unsigned ISO, it signs the UKI inside it and writes a signed ISO. [`docs/image-sign.md`](docs/image-sign.md) covers it.
 
 ## 🤖 Continuous integration
 
 
@@ -21,6 +21,7 @@ limitations under the License.
 // the state partition.
 
 import (
+	"crypto"
 	"crypto/sha256"
 	"crypto/x509"
 	"encoding/hex"
@@ -32,6 +33,7 @@ import (
 	"github.com/spf13/cobra"
 
 	nodev1 "github.com/CryptOS-PKI/cryptos-node/gen/go/cryptos/node/v1"
+	"github.com/CryptOS-PKI/cryptos-node/internal/isoimage"
 	"github.com/CryptOS-PKI/cryptos-node/internal/ukisign"
 )
 
@@ -267,8 +269,10 @@ func newImageActivateCmd(opts *globalOpts) *cobra.Command {
 }
 
 // newImageSignCmd signs an unsigned UKI with the operator's own key and makes
-// that key the image's upgrade anchor (cryptos-appliance#41). It runs on the
-// workstation and never talks to a node.
+// that key the image's upgrade anchor (cryptos-appliance#41). Given an ISO,
+// it signs the UKI the ISO carries and writes it back into the ISO
+// (cryptos-appliance#83). It runs on the workstation and never talks to a
+// node.
 func newImageSignCmd() *cobra.Command {
 	var (
 		imagePath string
@@ -278,12 +282,15 @@ func newImageSignCmd() *cobra.Command {
 	)
 	cmd := &cobra.Command{
 		Use:   "sign",
-		Short: "Sign an unsigned image with your key and make it the upgrade anchor",
+		Short: "Sign an unsigned image or ISO with your key and make it the upgrade anchor",
 		Long: "Sign an unsigned CryptOS image (UKI) with your own Secure Boot key. The " +
 			"certificate is added to the image as its upgrade anchor, the image is " +
 			"Authenticode-signed for Secure Boot, and the detached release signature " +
 			"'image stage' sends is written beside it as <out>.sig. A node installed " +
 			"from the signed image takes in-place upgrades signed by the same key. " +
+			"Given an unsigned ISO instead, it signs the UKI inside it the same way, " +
+			"writes the signed UKI back over every copy in the ISO, and also writes " +
+			"the signed UKI and its .sig beside the signed ISO for staging upgrades. " +
 			"Runs locally; it does not contact a node.",
 		Args: cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {
@@ -294,11 +301,7 @@ func newImageSignCmd() *cobra.Command {
 				return errors.New("--key is required")
 			case certPath == "":
 				return errors.New("--cert is required")
-			}
-			if outPath == "" {
-				outPath = ukisign.DefaultOut(imagePath)
-			}
-			if outPath == imagePath {
+			case outPath == imagePath:
 				return errors.New("--out must differ from --image")
 			}
 
@@ -323,6 +326,16 @@ func newImageSignCmd() *cobra.Command {
 				return err
 			}
 
+			if isoimage.IsISO(image) {
+				return signISO(cmd.OutOrStdout(), imagePath, outPath, image, key, cert)
+			}
+
+			if outPath == "" {
+				outPath = ukisign.DefaultOut(imagePath)
+			}
+			if outPath == imagePath {
+				return errors.New("--out must differ from --image")
+			}
 			res, err := ukisign.Sign(image, key, cert)
 			if err != nil {
 				return err
@@ -338,14 +351,56 @@ func newImageSignCmd() *cobra.Command {
 			return writeImageSigned(cmd.OutOrStdout(), outPath, sigPath, res.Image, cert)
 		},
 	}
-	cmd.Flags().StringVar(&imagePath, "image", "", "unsigned CryptOS image (UKI) to sign")
+	cmd.Flags().StringVar(&imagePath, "image", "", "unsigned CryptOS image to sign: a UKI, or an ISO that carries one")
 	cmd.Flags().StringVar(&keyPath, "key", "", "RSA signing key, PEM (PKCS#1 or PKCS#8, not encrypted)")
 	cmd.Flags().StringVar(&certPath, "cert", "", "signing certificate, PEM or DER; it becomes the upgrade anchor")
-	cmd.Flags().StringVar(&outPath, "out", "", "signed image path (default: <image> without .unsigned, else <image>.signed.uki)")
+	cmd.Flags().StringVar(&outPath, "out", "", "signed image path (default: <image> without .unsigned, else <image>.signed.uki; "+
+		"for an ISO, <image> without -unsigned, else <image>.signed.iso, with the signed UKI beside it as <out without .iso>.uki)")
 
 	return cmd
 }
 
+// signISO signs the UKI inside an ISO and writes the signed ISO, the signed
+// UKI and the UKI's detached signature. Nothing is written unless the signed
+// ISO passed its self-check.
+func signISO(w io.Writer, isoPath, outPath string, iso []byte, key crypto.Signer, cert *x509.Certificate) error {
+	if outPath == "" {
+		outPath = ukisign.DefaultISOOut(isoPath)
+	}
+	ukiPath := ukisign.ISOUKIPath(outPath)
+	sigPath := ukiPath + ".sig"
+	for _, p := range []string{outPath, ukiPath, sigPath} {
+		if p == isoPath {
+			return fmt.Errorf("signing %s would overwrite it; pick another --out", isoPath)
+		}
+	}
+	res, err := ukisign.SignISO(iso, key, cert)
+	if err != nil {
+		return err
+	}
+	if err := os.WriteFile(outPath, res.ISO, 0o644); err != nil {
+		return fmt.Errorf("write the signed ISO: %w", err)
+	}
+	if err := os.WriteFile(ukiPath, res.Image, 0o644); err != nil {
+		return fmt.Errorf("write the signed image: %w", err)
+	}
+	if err := os.WriteFile(sigPath, res.Signature, 0o644); err != nil {
+		return fmt.Errorf("write the release signature: %w", err)
+	}
+
+	sum := sha256.Sum256(res.ISO)
+	if _, err := fmt.Fprintf(w, "Signed ISO:       %s\nISO SHA-256:      %s\n", outPath, hex.EncodeToString(sum[:])); err != nil {
+		return err
+	}
+	for _, c := range res.Copies {
+		if _, err := fmt.Fprintf(w, "Signed in ISO:    %s\n", c); err != nil {
+			return err
+		}
+	}
+
+	return writeImageSigned(w, ukiPath, sigPath, res.Image, cert)
+}
+
 // writeImageSigned reports what was written and which certificate the image
 // now trusts for upgrades, by subject and SHA-256 fingerprint.
 func writeImageSigned(w io.Writer, outPath, sigPath string, image []byte, cert *x509.Certificate) error {
 
@@ -30,6 +30,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/CryptOS-PKI/cryptos-node/internal/isoimage/isotest"
 	"github.com/CryptOS-PKI/cryptos-node/internal/ukisign"
 )
 
@@ -114,3 +115,26 @@ func TestImageSign_RefusesANonUKIAndWritesNothing(t *testing.T) {
 		}
 	}
 }
+
+// An ISO is told apart from a UKI by its content. One whose boot image holds
+// something that is not a UKI is refused, and none of the three outputs is
+// written.
+func TestImageSign_ISOWithANonUKIIsRefusedAndWritesNothing(t *testing.T) {
+	dir := t.TempDir()
+	keyPath, certPath := writeSigningPair(t, dir)
+	iso := filepath.Join(dir, "cryptos-amd64-vmware-unsigned-abc1234.iso")
+	built := isotest.Build(t, bytes.Repeat([]byte("not a PE "), 1000), isotest.Options{GPT: true})
+	if err := os.WriteFile(iso, built.Image, 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	err := runSign(t, "--image", iso, "--key", keyPath, "--cert", certPath)
+	if !errors.Is(err, ukisign.ErrNotUKI) {
+		t.Fatalf("err = %v, want ErrNotUKI", err)
+	}
+	for _, name := range []string{"cryptos-amd64-vmware-abc1234.iso", "cryptos-amd64-vmware-abc1234.uki", "cryptos-amd64-vmware-abc1234.uki.sig"} {
+		if _, err := os.Stat(filepath.Join(dir, name)); !errors.Is(err, os.ErrNotExist) {
+			t.Errorf("%s was written for a refused ISO", name)
+		}
+	}
+}
@@ -19,10 +19,15 @@ A node installed from an image you signed this way takes signed in-place
 upgrades: any later image you sign with the same key can be staged onto it
 with `cryptosctl image stage`.
 
+It signs an unsigned ISO the same way, so you can install from a signed ISO
+without rebuilding it; see [Sign an ISO](#sign-an-iso).
+
 ## Before you start
 
-- An unsigned CryptOS UKI, for example a release asset or
-  `build/out/cryptos-amd64.uki.unsigned` from a cryptos-appliance build.
+- An unsigned CryptOS UKI or ISO, for example a release asset, or
+  `build/out/cryptos-amd64.uki.unsigned` or
+  `build/out/cryptos-amd64-vmware-unsigned-<build>.iso` from a
+  cryptos-appliance build.
 - Your Secure Boot signing key as an unencrypted RSA PEM file (PKCS#1 or
   PKCS#8), and its certificate as PEM or DER. This is the certificate
   enrolled in your machines' Secure Boot db. Keep the key file readable by you
@@ -62,6 +67,53 @@ with `cryptosctl image stage`.
 
    `image stage` picks up `cryptos-amd64.uki.sig` by default.
 
+## Sign an ISO
+
+Give `--image` an ISO instead of a UKI. The command tells the two apart by
+their content, not their names. It needs no root, no `xorriso` and no rebuild.
+
+1. Sign it:
+
+   ```sh
+   cryptosctl image sign \
+     --image cryptos-amd64-vmware-unsigned-v0.1.0.iso \
+     --key release.key \
+     --cert release.crt
+   ```
+
+   It signs the UKI inside the ISO exactly as it signs a UKI on its own, then
+   writes the signed UKI back over every copy the ISO carries:
+
+   - `EFI/BOOT/BOOTX64.EFI` in the EFI boot image, which the firmware boots;
+   - `/cryptos.uki`, which the installer copies to the disk it installs.
+
+   It writes three files. With no `--out`, the signed ISO is the input name
+   without `-unsigned` (`cryptos-amd64-vmware-v0.1.0.iso`); an input with any
+   other name gets `.signed.iso`. Beside the ISO it writes the signed UKI,
+   named like the ISO with `.uki` in place of `.iso`
+   (`cryptos-amd64-vmware-v0.1.0.uki`), and that UKI's release signature
+   (`cryptos-amd64-vmware-v0.1.0.uki.sig`). The command prints each place in
+   the ISO it signed, the paths and the SHA-256 of the ISO and the UKI.
+
+   Before it writes anything, it reads the new ISO back, checks that every
+   copy is the signed UKI, and checks the signature and the anchor.
+
+2. Optionally, check the Secure Boot signature on the UKI written beside the
+   ISO, the same bytes as the copies inside it:
+
+   ```sh
+   sbverify --cert release.crt cryptos-amd64-vmware-v0.1.0.uki
+   ```
+
+3. Install a node from the signed ISO. Keep the signed `.uki` and `.sig`:
+   they are what you stage onto a node, and later ISOs or UKIs you sign with
+   the same key upgrade every node installed from this one.
+
+> [!CAUTION]
+> The EFI boot image inside the ISO keeps its size. A cryptos-appliance build
+> leaves 2 MiB free in it, far more than signing adds, but an ISO built some
+> other way with no free space is refused, and nothing is written.
+
 ## What it changes in the image
 
 - **The anchor.** A small uncompressed cpio archive holding