3 files changed, 17 insertions, 8 deletions
diff --git a/libbpkg/manifest.cxx b/libbpkg/manifest.cxx
index 21f1050..dfdffe0 100644
--- a/libbpkg/manifest.cxx
+++ b/libbpkg/manifest.cxx
@@ -7787,7 +7787,7 @@ namespace bpkg
       }
       else if (n == "signature")
       {
-        if (!signature.empty ())
+        if (signature)
           bad_name ("signature redefinition");
 
         if (v.empty ())
@@ -7812,8 +7812,6 @@ namespace bpkg
     //
     if (sha256sum.empty ())
       bad_value ("no sha256sum specified");
-    else if (signature.empty ())
-      bad_value ("no signature specified");
 
     // Make sure this is the end.
     //
@@ -7831,7 +7829,9 @@ namespace bpkg
     s.next ("", "1"); // Start of manifest.
 
     s.next ("sha256sum", sha256sum);
-    s.next ("signature", base64_encode (signature));
+
+    if (signature)
+      s.next ("signature", base64_encode (*signature));
 
     s.next ("", ""); // End of manifest.
   }
diff --git a/libbpkg/manifest.hxx b/libbpkg/manifest.hxx
index 40672d1..3fe3da3 100644
--- a/libbpkg/manifest.hxx
+++ b/libbpkg/manifest.hxx
@@ -2206,11 +2206,13 @@ namespace bpkg
     //
     std::string sha256sum;
 
-    // Signature of the corresponding package_manifests. Calculated by
-    // encrypting package_manifests checksum (stored in sha256sum) with the
-    // repository certificate private key.
+    // Signature of the corresponding package_manifests. Should only be
+    // present if the certificate member is present in the corresponding
+    // repository_manifest. Calculated by encrypting package_manifests
+    // checksum (stored in sha256sum) with the repository certificate private
+    // key.
     //
-    std::vector<char> signature;
+    butl::optional<std::vector<char>> signature;
 
   public:
     signature_manifest () = default;
diff --git a/tests/manifest/testscript b/tests/manifest/testscript
index da8671a..6a4d619 100644
--- a/tests/manifest/testscript
+++ b/tests/manifest/testscript
@@ -5470,6 +5470,13 @@
     TobGycX7MDf2mbBmR/KmEkMBJ4mziWLAycSAGyE5VRYDwHPJlQE0143wBzT8eNw4VLm/r+88VYw=
     \
     EOF
+
+  : roundtrip-no-signature
+  :
+  $* -s <<EOF >>EOF
+    : 1
+    sha256sum: a2b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
+    EOF
 }}
 
 : effective-constraints