diff --git a/pkgs/tools/security/bpb/default.nix b/pkgs/tools/security/bpb/default.nix
new file mode 100644
index 0000000000000..121c5674c08c5
--- /dev/null
+++ b/pkgs/tools/security/bpb/default.nix
@@ -0,0 +1,29 @@
+{ stdenv
+, lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "bpb";
+  version = "unstable-2018-07-27";
+
+  src = fetchFromGitHub {
+    owner = "withoutboats";
+    repo = "bpb";
+    rev = "b1ef5ca1d2dea0e2ec0b1616f087f110ea17adfa";
+    sha256 = "sVfM8tlAsF4uKLxl3g/nSYgOx+znHIdPalSIiCd18o4=";
+  };
+
+  cargoSha256 = "7cARRJWRxF1kMySX6KcB6nrVf8k1p/nr3OyAwNLmztc=";
+
+  # a nightly compiler is required unless we use this cheat code.
+  RUSTC_BOOTSTRAP = 1;
+
+  meta = with lib; {
+    description = "Tool to automatically sign git commits, replacing gpg for that purpose";
+    homepage = "https://github.com/withoutboats/bpb";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jtojnar ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 85a4be3fbeb85..9f2d0c99f9e08 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2067,6 +2067,8 @@ with pkgs;
   bozohttpd = callPackage ../servers/http/bozohttpd { };
   bozohttpd-minimal = callPackage ../servers/http/bozohttpd { minimal = true; };
 
+  bpb = callPackage ../tools/security/bpb { };
+
   bpytop = callPackage ../tools/system/bpytop { };
 
   brasero-original = lowPrio (callPackage ../tools/cd-dvd/brasero { });