{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"platform/code-signing","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/platform/code-signing/","da":"https://cmaintz.github.io/tech-atlas/da/terms/platform/code-signing/"},"term":{"en":"Code signing","da":"Kodesignering"},"aka":{"en":["software signing"],"da":["softwaresignering"]},"domain":["platform","security"],"cluster":"delivery","layer":"delivery","status":"current","era":1996,"summary":{"en":"Adding a digital signature to software so users and systems can check who made it and that nobody changed it afterwards.","da":"At sætte en digital signatur på software, så brugere og systemer kan tjekke, hvem der har lavet den, og at ingen har ændret den bagefter."},"body":{"formal":{"en":"The publisher computes a hash of a program, update, script or container image and signs it with a private key tied to a digital certificate; before installing or running it, the system checks the signature and certificate and refuses the file on any mismatch.","da":"Udgiveren beregner en hash af et program, en opdatering, et script eller et container-image og signerer den med en privat nøgle knyttet til et digitalt certifikat; før systemet installerer eller kører filen, tjekker det signaturen og certifikatet og afviser filen, hvis noget ikke stemmer."},"plain":{"en":"Like the seal on a medicine bottle printed with the maker's name - if the seal is broken or the name is wrong, you do not swallow what is inside.","da":"Som forseglingen på et medicinglas med producentens navn - er forseglingen brudt eller navnet forkert, sluger man ikke indholdet."},"inPractice":{"en":"A municipality's IT operations team lets staff computers run only software signed by approved publishers; when a fake “update” arrives by email, Windows refuses to start it because the signature is missing.","da":"En kommunes IT-drift lader kun medarbejdernes computere køre software, der er signeret af godkendte udgivere; da en falsk “opdatering” kommer ind med en mail, nægter Windows at starte den, fordi signaturen mangler."},"whyItMatters":{"en":"Attackers often hide malware in updates that look genuine; a signature check stops any file changed after signing, though it cannot help if the signing key itself is stolen.","da":"Angribere gemmer ofte malware i opdateringer, der ser ægte ud; et signaturtjek stopper enhver fil, der er ændret efter signeringen, men hjælper ikke, hvis selve signeringsnøglen bliver stjålet."}},"deepDive":{"en":"Every code-signing scheme applies a digital signature over a digest of the artefact, but formats differ by platform. Microsoft Authenticode (introduced 1996) embeds a PKCS#7/CMS SignedData structure in the PE file's certificate table, hashing the file while excluding the checksum and the signature area itself; Apple's codesign stores a code directory of per-page hashes and requires notarisation for Gatekeeper; Java signs JAR manifests; Linux distributions sign repository metadata or packages with OpenPGP keys; Android uses the APK Signature Scheme v2 and later, which covers the whole archive. The signer's X.509 certificate must carry the codeSigning extended key usage (OID 1.3.6.1.5.5.7.3.3) and chain to a root in the verifier's trust store.\n\nTimestamping solves the expiry problem. A signature is sent to a Time-Stamping Authority per RFC 3161, which countersigns the signature's hash with a trusted time; verifiers then accept the signature after the certificate expires, as long as it was valid at the timestamp. It also shapes revocation: when a key is compromised, the CA can revoke with an invalidity date so that only signatures timestamped after the compromise fail. Publicly trusted code-signing certificates are governed by the CA/Browser Forum's Code Signing Baseline Requirements, which since 1 June 2023 require the subscriber's private key to be generated and kept in a hardware crypto module (HSM, token or cloud HSM service) and since 1 March 2026 limit certificate validity to 460 days.\n\nSigstore, an OpenSSF project, provides \"keyless\" signing aimed at open-source and container supply chains: cosign obtains an OIDC token for the signer's identity (a person's email or a CI workflow identity), Fulcio issues a certificate for an ephemeral key valid for about ten minutes, the signature and certificate are recorded in the Rekor transparency log, and verifiers check both the expected identity and issuer and the log inclusion. Notary Project's notation offers a PKI-based alternative for OCI artefacts; npm, PyPI and Maven Central have adopted Sigstore-based provenance or signatures in various forms.\n\nThe key limitation is that a signature attests to who signed, not to what the code does. Stolen keys have signed malware (Stuxnet used certificates stolen from Realtek and JMicron), and compromised build systems produce perfectly valid signatures on malicious code, as with SolarWinds Orion in 2020 and the 3CX desktop client in 2023. Effective programmes therefore protect keys in HSMs with separate approval for each signing operation, sign only in hardened release pipelines rather than on developer machines, pair signatures with build provenance (SLSA) and SBOMs, and enforce verification at the consumer: Windows Defender Application Control or AppLocker policies, macOS Gatekeeper, package-manager signature checks and Kubernetes admission controllers that reject unsigned images.","da":"Alle ordninger for kodesignering lægger en digital signatur over et digest af artefaktet, men formaterne varierer efter platform. Microsoft Authenticode (introduceret 1996) indlejrer en PKCS#7/CMS SignedData-struktur i PE-filens certifikattabel og hasher filen, idet checksummen og selve signaturområdet udelades; Apples codesign gemmer et code directory med hashes per side og kræver notarisering for Gatekeeper; Java signerer JAR-manifester; Linux-distributioner signerer repository-metadata eller pakker med OpenPGP-nøgler; Android bruger APK Signature Scheme v2 og senere, som dækker hele arkivet. Underskriverens X.509-certifikat skal have extended key usage codeSigning (OID 1.3.6.1.5.5.7.3.3) og kæde op til en rod i verifikatorens tillidslager.\n\nTidsstempling løser problemet med udløb. Signaturen sendes til en Time-Stamping Authority efter RFC 3161, som kontrasignerer signaturens hash med et betroet tidspunkt; verifikatorer accepterer så signaturen, efter certifikatet er udløbet, så længe det var gyldigt på tidsstemplet. Det påvirker også tilbagekaldelse: bliver en nøgle kompromitteret, kan CA'en tilbagekalde med en invalidity date, så kun signaturer tidsstemplet efter kompromitteringen fejler. Offentligt betroede kodesigneringscertifikater er underlagt CA/Browser Forums Code Signing Baseline Requirements, der siden 1. juni 2023 kræver, at abonnentens private nøgle genereres og opbevares i et hardwarebaseret kryptomodul (HSM, token eller HSM-tjeneste i skyen), og som siden 1. marts 2026 begrænser certifikaters gyldighed til 460 dage.\n\nSigstore, et OpenSSF-projekt, tilbyder \"nøgleløs\" signering rettet mod open source- og container-forsyningskæder: cosign henter et OIDC-token for underskriverens identitet (en persons e-mail eller en CI-workflows identitet), Fulcio udsteder et certifikat til en flygtig nøgle, der er gyldigt i omkring ti minutter, signaturen og certifikatet registreres i transparensloggen Rekor, og verifikatorer tjekker både den forventede identitet og udsteder og optagelsen i loggen. Notary Projects notation er et PKI-baseret alternativ til OCI-artefakter; npm, PyPI og Maven Central har i forskellige former indført Sigstore-baseret provenance eller signaturer.\n\nDen vigtigste begrænsning er, at en signatur bevidner, hvem der signerede, ikke hvad koden gør. Stjålne nøgler har signeret malware (Stuxnet brugte certifikater stjålet fra Realtek og JMicron), og kompromitterede byggesystemer giver fuldt gyldige signaturer på ondsindet kode, som med SolarWinds Orion i 2020 og 3CX' desktopklient i 2023. Effektive programmer beskytter derfor nøgler i HSM'er med separat godkendelse af hver signering, signerer kun i hærdede frigivelsespipelines frem for på udvikleres maskiner, kobler signaturer med build-provenance (SLSA) og SBOM'er og håndhæver verifikation hos modtageren: Windows Defender Application Control- eller AppLocker-politikker, macOS Gatekeeper, pakkehåndteringens signaturtjek og admission controllers i Kubernetes, der afviser usignerede images."},"edges":[{"type":"requires","to":"cs/digital-signature","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/digital-certificate","confidence":"high","strength":"normal"},{"type":"part-of","to":"platform/software-supply-chain","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/supply-chain-attack","why":{"en":"Software that was changed after it was signed, or signed by the wrong party, fails the check and is not installed.","da":"Software, der er ændret efter signeringen eller signeret af den forkerte part, fejler tjekket og bliver ikke installeret."},"confidence":"high","strength":"primary"},{"type":"mitigates","to":"ai/ai-supply-chain-attack","why":{"en":"Checking a signature on model files and add-ons shows they come from the claimed publisher and were not changed on the way.","da":"Kontrol af signaturen på modelfiler og tilføjelser viser, at de kommer fra den påståede udgiver og ikke er ændret undervejs."},"confidence":"medium","strength":"normal"},{"type":"used-with","to":"platform/pipeline","confidence":"high","strength":"normal"},{"type":"used-with","to":"platform/sbom","why":{"en":"An SBOM lists what went into the software; a signature proves the software and its list came from the named maker unchanged.","da":"En SBOM angiver, hvad softwaren består af; en signatur beviser, at softwaren og listen kom uændret fra den nævnte producent."},"confidence":"high","strength":"normal"}],"depth":4,"sources":[{"title":"NIST - Security Considerations for Code Signing","url":"https://csrc.nist.gov/pubs/cswp/1/final","tier":"standard","publisher":"NIST"},{"title":"Sigstore documentation","url":"https://docs.sigstore.dev/","tier":"official-doc","publisher":"OpenSSF"},{"title":"CA/Browser Forum - Baseline Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates","url":"https://cabforum.org/working-groups/code-signing/requirements/","tier":"standard","publisher":"CA/Browser Forum"}],"draft":true}