1. Introduction & Overview
What is Code Signing?
Code signing is the process of digitally signing software or code to confirm the author’s identity and guarantee that the code has not been altered or corrupted since it was signed. It uses public key infrastructure (PKI) to associate the publisher’s identity with the code.
✅ Code signing ensures trust, authenticity, and integrity in software artifacts.
History or Background
- Introduced in the 1990s alongside growing concerns about software authenticity.
- Early implementations appeared in Windows (Authenticode) and Java (JAR signing).
- Now widely used across mobile apps (iOS, Android), operating systems, and software updates.
Why Is It Relevant in DevSecOps?
In a DevSecOps environment, where rapid delivery meets security, code signing ensures that only verified, tamper-proof software moves through the pipeline.
- Software supply chain security
- Mitigation of malware injection
- Compliance with standards (e.g., NIST, SOC 2, FedRAMP)
2. Core Concepts & Terminology
Key Terms and Definitions
| Term | Definition |
|---|---|
| Digital Signature | A cryptographic hash encrypted with a private key to verify authenticity. |
| Code Signing Certificate | A certificate issued by a trusted Certificate Authority (CA). |
| Timestamping | Ensures a signature remains valid even after a certificate expires. |
| PKI | Infrastructure for managing public-private key pairs. |
How It Fits into the DevSecOps Lifecycle
| DevSecOps Stage | Code Signing Role |
|---|---|
| Plan | Define trusted publishers and compliance requirements. |
| Develop | Sign components before pushing to shared repositories. |
| Build | Automatically sign compiled artifacts or packages. |
| Test | Verify signatures during automated tests. |
| Release | Only allow signed binaries to be deployed to production. |
| Monitor | Audit signing logs for compliance. |
| Respond | Revoke or rotate signing keys during incident response. |
3. Architecture & How It Works
Components
- Signing Key Pair (Private + Public): Private key is securely stored and used to sign code; public key is distributed for verification.
- Certificate Authority (CA): Issues code signing certificates tied to an entity’s identity.
- Timestamp Server: Adds a trusted timestamp to signed code.
- Verification System: Validates the signature during software execution or installation.
Internal Workflow
- Developer/Build System compiles code.
- Signing Engine applies a digital signature using a private key and certificate.
- Optional: Contact Timestamp Server to ensure validity past certificate expiration.
- Signed Code is published, tested, or deployed.
- Consumers or CI systems verify the digital signature.
Architecture Diagram (Descriptive)
[Source Code] → [Build System]
↓
[Signing Service]
/ | \
[Private Key] [Cert CA] [Timestamp Server]
↓
[Signed Artifact] → [CI/CD] → [Prod]
Integration Points with CI/CD or Cloud Tools
| Tool/Platform | Integration Details |
|---|---|
| GitHub Actions | Use signing steps in workflows (e.g., sigstore, GPG, Cosign). |
| GitLab CI | Use runners to sign artifacts during build stage. |
| Azure DevOps | Secure pipeline tasks using integrated code signing tasks. |
| AWS CodePipeline | Use KMS-integrated signing with pre-deploy hooks. |
4. Installation & Getting Started
Basic Setup or Prerequisites
- Access to a code signing certificate (from a CA like DigiCert, Sectigo).
- Secure environment for storing private keys (HSM, YubiKey, cloud KMS).
- Code signing tool appropriate for your language/platform (e.g.,
signtool,cosign,jarsigner,gpg,sigstore).
Hands-On: Signing with cosign (Open Source)
# 1. Install Cosign (by Sigstore)
brew install cosign # or use binary from GitHub releases
# 2. Generate a key pair
cosign generate-key-pair
# 3. Sign an image (e.g., Docker image)
cosign sign --key cosign.key ghcr.io/your-org/app:latest
# 4. Verify signature
cosign verify --key cosign.pub ghcr.io/your-org/app:latest
🔐 For enhanced security:
- Store keys in cloud KMS:
--key gcpkms://projects/...,--key awskms://... - Use keyless signing with GitHub OIDC via
cosign sign --identity-token
5. Real-World Use Cases
1. Software Supply Chain Protection
- Enforce signature verification on binaries before containerization or deployment.
- Tools:
cosign,Notary v2,Sigstore,SLSAframework integration.
2. Mobile Application Distribution
- iOS/Android apps require signing before store submission.
- Managed by Xcode (Apple Developer ID) or Android Studio (JKS or Play App Signing).
3. Production-Grade CI/CD
- Sign all
.jar,.exe,.dll, or container images before deployment. - Jenkins pipelines or GitLab runners integrate with
signtool,jarsigner, orcosign.
4. IoT Firmware Updates
- Secure embedded firmware updates by signing binaries.
- Devices validate signatures before allowing OTA (Over-The-Air) updates.
6. Benefits & Limitations
Key Advantages
- ✅ Integrity Assurance: Detect tampering and ensure original code.
- ✅ Trust Establishment: Link identity to code via certificates.
- ✅ Compliance: Helps meet security standards like NIST SP 800-218 (SLSA), PCI DSS, ISO 27001.
- ✅ Automation-Friendly: Easily integrated into CI/CD.
Limitations
- ⚠️ Certificate Management Complexity: Rotation, renewal, and revocation need governance.
- ⚠️ Cost: Commercial certificates and HSMs can be expensive.
- ⚠️ Key Theft Risk: Poorly secured keys can compromise entire systems.
- ⚠️ Verification Enforcement: Requires downstream systems to verify signatures.
7. Best Practices & Recommendations
Security Tips
- 🔐 Store private keys in HSMs, cloud KMS, or hardware tokens.
- 🔁 Automate key rotation and revocation checks.
- 🧾 Use timestamping to ensure long-term signature validity.
Performance & Maintenance
- Sign only final, release-grade builds.
- Cache signed artifacts to avoid redundant signing in pipelines.
Compliance Alignment
- Align with SLSA, NIST SSDF, OWASP SAMM, or NCSC Secure Development guidelines.
- Maintain audit logs of signing events.
Automation Ideas
- GitHub/GitLab webhook to sign and verify new releases.
- Jenkins post-build step to sign and push signed artifacts to Artifactory.
8. Comparison with Alternatives
| Approach | Pros | Cons |
|---|---|---|
| Code Signing | Strong identity and tamper protection | Requires certificates, key handling |
| Checksum/Hashing | Simple integrity checks | No identity or trust assurance |
| Binary Transparency | Detects unauthorized changes | Requires external logs or servers |
| SBOM (Software Bill of Materials) | Lists components | Doesn’t prevent tampering on its own |
🆚 Use code signing when both identity and integrity are required. Combine with SBOM and binary transparency for full coverage.
9. Conclusion
Code signing is an essential DevSecOps practice to ensure authenticity and integrity of software artifacts throughout the pipeline. With increasing threats from software supply chain attacks, integrating automated, secure, and verifiable code signing into CI/CD workflows is no longer optional—it’s mandatory.
Future Trends
- 🔄 Keyless Signing (e.g., Sigstore with OIDC)
- 🔍 In-toto + SLSA for signed provenance tracking
- ☁️ Cloud-native signing platforms integrated with CI/CD
