diff --git a/groups/221.native_packages_dev.group b/groups/221.native_packages_dev.group
index 0933539..3cab7b8 100644
--- a/groups/221.native_packages_dev.group
+++ b/groups/221.native_packages_dev.group
@@ -4,7 +4,7 @@
 GROUP_TARGET="native_packages";
 NATIVE_PACKAGES_PACKAGES="$(rtl_lconcat "${NATIVE_PACKAGES_PACKAGES}" "
 bison chicken cparser diffutils flex gdb lua lunix m4 make mandoc nasm
-patch patchutils perl python2 python3 ruby smallbasic tk")";
+patch patchutils perl python2 python3 ruby sbsigntools smallbasic tk")";
 : ${PKG_BISON_SHA256SUM:=55e4a023b1b4ad19095a5f8279f0dc048fa29f970759cea83224a6d5e7a3a641};
 : ${PKG_BISON_VERSION:=3.5};
 : ${PKG_BISON_URL:=https://ftp.gnu.org/gnu/bison/bison-${PKG_BISON_VERSION}.tar.xz};
@@ -113,6 +113,10 @@ patch patchutils perl python2 python3 ruby smallbasic tk")";
 : ${PKG_RUBY_CONFIGURE_ARGS_EXTRA:="--disable-install-rdoc --with-baseruby=${PREFIX}/bin/ruby --with-out-ext=fiddle,openssl"};
 : ${PKG_RUBY_MAKEFLAGS_BUILD:=-j1};
 : ${PKG_RUBY_MAKEFLAGS_VERBOSITY:="none"};
+: ${PKG_SBSIGNTOOLS_DEPENDS:="libressl"};
+: ${PKG_SBSIGNTOOLS_URLS_GIT:=sbsigntools-master=https://git.kernel.org/pub/scm/linux/kernel/git/jejb/sbsigntools.git@master};
+: ${PKG_SBSIGNTOOLS_SUBDIR:=sbsigntools-master};
+: ${PKG_SBSIGNTOOLS_IN_TREE:=1};
 : ${PKG_SMALLBASIC_URLS_GIT:="SmallBASIC=https://github.com/smallbasic/SmallBASIC@master"};
 : ${PKG_SMALLBASIC_CFLAGS_CONFIGURE_EXTRA:=-std=gnu99};
 : ${PKG_SMALLBASIC_IN_TREE:=1};
diff --git a/patches/sbsigntools_pre.local.patch b/patches/sbsigntools_pre.local.patch
new file mode 100644
index 0000000..4544399
--- /dev/null
+++ b/patches/sbsigntools_pre.local.patch
@@ -0,0 +1,107 @@
+Only in sbsigntools: aclocal.m4
+Only in sbsigntools: AUTHORS
+Only in sbsigntools: autom4te.cache
+Only in sbsigntools: ChangeLog
+Only in sbsigntools: compile
+Only in sbsigntools: config.h.in
+Only in sbsigntools: configure
+diff -ru sbsigntools-0.9.3.orig/configure.ac sbsigntools/configure.ac
+--- sbsigntools-0.9.3.orig/configure.ac	2020-01-09 18:33:38.000000000 +0100
++++ sbsigntools/configure.ac	2020-05-02 22:04:59.758305183 +0200
+@@ -63,32 +63,6 @@
+     [],
+     AC_MSG_ERROR([libuuid (from the uuid package) is required]))
+ 
+-dnl gnu-efi headers require extra include dirs
+-EFI_ARCH=$(uname -m | sed 's/i.86/ia32/;s/arm.*/arm/')
+-AM_CONDITIONAL(TEST_BINARY_FORMAT, [ test "$EFI_ARCH" = "arm" -o "$EFI_ARCH" = "aarch64" ])
+-
+-##
+-# no consistent view of where gnu-efi should dump the efi stuff, so find it
+-##
+-for path in /lib /lib64 /usr/lib /usr/lib64 /usr/lib32 /lib/efi /lib64/efi /usr/lib/efi /usr/lib64/efi /usr/lib/gnuefi /usr/lib64/gnuefi ; do
+-    if test -e $path/crt0-efi-$EFI_ARCH.o; then
+-       CRTPATH=$path
+-    fi
+-done
+-if test -z "$CRTPATH"; then
+-   AC_MSG_ERROR([cannot find the gnu-efi crt path])
+-fi
+-
+-EFI_CPPFLAGS="-I/usr/include/efi -I/usr/include/efi/$EFI_ARCH \
+- -DEFI_FUNCTION_WRAPPER"
+-CPPFLAGS_save="$CPPFLAGS"
+-CPPFLAGS="$CPPFLAGS $EFI_CPPFLAGS"
+-AC_CHECK_HEADERS([efi.h], [], [], $EFI_INCLUDES)
+-CPPFLAGS="$CPPFLAGS_save"
+-AC_SUBST(EFI_CPPFLAGS, $EFI_CPPFLAGS)
+-AC_SUBST(EFI_ARCH, $EFI_ARCH)
+-AC_SUBST(CRTPATH, $CRTPATH)
+-
+ AC_CONFIG_FILES([Makefile src/Makefile lib/ccan/Makefile]
+-		[docs/Makefile tests/Makefile])
++		[docs/Makefile])
+ AC_OUTPUT
+Only in sbsigntools: depcomp
+diff -ru sbsigntools-0.9.3.orig/docs/Makefile.am sbsigntools/docs/Makefile.am
+--- sbsigntools-0.9.3.orig/docs/Makefile.am	2020-01-09 18:33:38.000000000 +0100
++++ sbsigntools/docs/Makefile.am	2020-05-02 22:12:41.441538721 +0200
+@@ -1,5 +1,5 @@
+ 
+-man1_MANS = sbsign.1 sbverify.1 sbattach.1 sbvarsign.1 sbsiglist.1
++man1_MANS = sbsign.1 sbverify.1 sbattach.1
+ 
+ EXTRA_DIST = sbsign.1.in sbverify.1.in sbattach.1.in \
+ 		sbvarsign.1.in sbsiglist.1.in
+Only in sbsigntools/docs: Makefile.in
+Only in sbsigntools: .git
+Only in sbsigntools: INSTALL
+Only in sbsigntools: install-sh
+Only in sbsigntools/lib: ccan
+Only in sbsigntools/lib/ccan.git: ccan
+Only in sbsigntools/lib/ccan.git: config.h
+Only in sbsigntools/lib/ccan.git: doc
+Only in sbsigntools/lib/ccan.git: .git
+Only in sbsigntools/lib/ccan.git: .gitignore
+Only in sbsigntools/lib/ccan.git: junkcode
+Only in sbsigntools/lib/ccan.git: licenses
+Only in sbsigntools/lib/ccan.git: Makefile
+Only in sbsigntools/lib/ccan.git: Makefile-ccan
+Only in sbsigntools/lib/ccan.git: Makefile-web
+Only in sbsigntools/lib/ccan.git: README
+Only in sbsigntools/lib/ccan.git: tools
+Only in sbsigntools/lib/ccan.git: web
+diff -ru sbsigntools-0.9.3.orig/Makefile.am sbsigntools/Makefile.am
+--- sbsigntools-0.9.3.orig/Makefile.am	2020-01-09 18:33:38.000000000 +0100
++++ sbsigntools/Makefile.am	2020-05-02 22:16:07.359375795 +0200
+@@ -1,2 +1,2 @@
+ 
+-SUBDIRS = lib/ccan src docs tests
++SUBDIRS = lib/ccan src
+Only in sbsigntools: Makefile.in
+Only in sbsigntools: missing
+diff -ru sbsigntools-0.9.3.orig/src/Makefile.am sbsigntools/src/Makefile.am
+--- sbsigntools-0.9.3.orig/src/Makefile.am	2020-01-09 18:33:38.000000000 +0100
++++ sbsigntools/src/Makefile.am	2020-05-02 22:09:31.013544683 +0200
+@@ -1,5 +1,5 @@
+ 
+-bin_PROGRAMS = sbsign sbverify sbattach sbvarsign sbsiglist sbkeysync
++bin_PROGRAMS = sbsign sbverify sbattach
+ 
+ coff_headers = coff/external.h coff/pe.h
+ AM_CFLAGS = -Wall -Wextra --std=gnu99
+Only in sbsigntools/src: Makefile.in
+diff -ru sbsigntools-0.9.3.orig/src/sbverify.c sbsigntools/src/sbverify.c
+--- sbsigntools-0.9.3.orig/src/sbverify.c	2020-01-09 18:33:38.000000000 +0100
++++ sbsigntools/src/sbverify.c	2020-05-02 22:11:22.921541180 +0200
+@@ -56,7 +56,7 @@
+ #include <openssl/pem.h>
+ #include <openssl/x509v3.h>
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ #define X509_OBJECT_get0_X509(obj) ((obj)->data.x509)
+ #define X509_OBJECT_get_type(obj) ((obj)->type)
+ #define X509_STORE_CTX_get0_cert(ctx) ((ctx)->cert)
+Only in sbsigntools: test-driver
+Only in sbsigntools/tests: Makefile.in