Glossary
What is code signing?
Code signing is a cryptographic process that digitally signs software, scripts, and executables to verify their authenticity and integrity. It assures users that the code comes from a trusted source and has not been altered or tampered with since it was signed.
Code signing uses public key infrastructure (PKI) to bind a digital certificate to a software artifact, enabling systems to validate the publisher and the trustworthiness of the code.
Why it matters:
Unsigned or tampered software poses significant security risks, including malware injection, supply chain compromise, and loss of trust. Code signing:
- Ensures the origin of the code is verifiable
- Prevents unauthorized modifications or distribution
- Reduces false positives in endpoint protection tools
- Helps organizations meet compliance and platform requirements
Operating systems, browsers, and mobile app stores often block or flag unsigned code, making code signing essential for a smooth user experience and distribution.
How code signing works:
-
Certificate Generation: A code signing certificate is issued by a trusted Certificate Authority (CA) to a verified entity (organization or individual).
-
Signing Process: The developer or build system uses the certificate’s private key to sign a code hash.
-
Metadata Embedding: The digital signature and publisher information are embedded in the binary or script.
-
Verification: When the code is executed or installed, the system checks the signature using the public key and verifies it hasn’t been altered.
- Timestamping (optional but recommended): Attaches a trusted timestamp to preserve the signature’s validity even after the certificate expires.
Platforms like Windows, macOS, Android, and browsers (e.g., Chrome, Firefox) use code signing to assess software trustworthiness.
Benefits
-
Builds User Trust: Assures users and systems that the code is safe and from a verified source.
-
Prevents Tampering: Detects unauthorized modifications during transit or distribution.
-
Supports Secure Distribution: Required for trusted installation on many operating systems and marketplaces.
-
Streamlines Incident Response: Helps trace ownership and integrity of software in breach investigations.
- Improves Compliance: Meets requirements in frameworks like NIST, ISO 27001, and software supply chain security guidelines.
Code signing vs.
|
Term |
Focus Area |
Key Difference from Code Signing |
|
TLS/SSL Certificates |
Secure communication |
Used for securing web traffic, not software artifacts. |
|
Encryption |
Confidentiality |
Code signing ensures authenticity and integrity, not secrecy. |
|
Hashing |
Data integrity |
Code signing builds on hashing with identity verification. |
|
SBOM |
Software inventory |
SBOM shows components; code signing ensures their origin and trust. |
How to limit attacks with code signing:
- Verify every executable or script before execution or deployment
- Use secure private key storage (e.g., HSMs) to prevent certificate theft
- Sign all software artifacts in your CI/CD pipeline to prevent unauthorized changes
- Include trusted timestamping to ensure long-term verifiability
Use cases:
-
Secure Software Distribution: Ensure users and systems can verify the authenticity and integrity of software before installation.
-
CI/CD Pipeline Integrity: Sign artifacts automatically during builds to prevent unauthorized modifications in the release process.
-
Mobile App Store Submissions (Apple, Google): Meet platform requirements and establish trust by signing apps before publishing to app stores.
-
Signed Driver or Kernel Module Validation: Authenticate low-level system components to prevent the execution of unsigned or malicious code.
- Supply Chain Security and Provenance: Provide verifiable proof of origin and trustworthiness for all distributed software components.
Additional considerations:
-
Key Protection: Loss or compromise of the private key can lead to wide-scale trust breakdown—use hardware security modules (HSMs) or cloud key management services.
-
Certificate Expiration: Implement timestamping and renewal workflows to prevent disruptions.
-
Trust Stores: Ensure your certificates are recognized by platform-specific trust stores (e.g., Microsoft, Apple, Mozilla).
- Revocation Procedures: Maintain a process to revoke certificates quickly if needed.
