Cybersecurity glossary
What is Code Signing?
Learn what code signing is, how digital signatures prove software origin and integrity, where certificates fit, and practices that keep signing keys from becoming a single point of failure.
Definition
Code signing is the cryptographic practice of attaching a digital signature to software so verifiers can confirm the artifact came from an expected publisher and was not altered after signing.
Why code signing matters
Users and operating systems need a scalable way to answer two questions about software: who published this, and has it changed since then? Code signing provides that cryptographic answer for binaries, packages, and updates.
Without signatures, every mirror, CDN edge, and USB stick becomes an integrity gamble. With weak key protection, signatures become a false sense of safety.
What a signature actually proves
Integrity
Any bit flip after signing invalidates the signature over the protected content.
Publisher identity
Verification chains to a certificate or key that represents an organization or project.
Non-repudiation signal
Signed releases create strong evidence of which key authorized a distribution.
Policy hooks
OS and enterprise controls can require signatures before execution or install.
How code signing works
Build the artifact
Produce a final binary, package, or image digest intended for distribution.
Hash the content
A cryptographic digest summarizes the artifact bytes (and sometimes metadata).
Sign with private key
The publisher’s private key signs the digest inside a controlled signing service.
Distribute signature + cert
The signature, certificate chain, and often a timestamp travel with the software.
Client verifies
The verifier checks signature validity, trust anchors, revocation, and policy.
Signing models compared
| Model | Identity basis | Watch out for |
|---|---|---|
| Public CA code-signing cert | Vetted organization certificate | Key theft and slow revocation propagation |
| Platform store signing | Vendor account (Apple, Google, etc.) | Account takeover equals distribution abuse |
| Project key / Sigstore-style | Key or identity-bound ephemeral cert | Trust-root and identity mapping mistakes |
| Internal enterprise PKI | Company-operated CA | Weak issuance controls inside the org |
Code signing security checklist
- Store signing keys in HSM/KMS; never commit them to source control.
- Require strong identity and approval to invoke production signing.
- Timestamp signatures so verification survives certificate expiry.
- Separate test-signing and release-signing identities.
- Monitor for unexpected signed publishes and certificate transparency where applicable.
- Have a revocation and re-sign playbook before you need it.
- Combine signing with provenance so you know which pipeline produced the bits.
- Educate users that ‘signed’ is not a malware-free guarantee.
The practical takeaway
Code signing cryptographically binds an artifact to a publisher identity and detects post-sign tampering. It is necessary for trustworthy distribution—and insufficient if signing keys or publisher accounts are weak.
Protect the private key like production crown jewels, verify signatures everywhere you install software, and pair signing with build provenance for a complete integrity story.
Related security terms
Artifact Signing
Broader signing of packages, images, and build outputs across the supply chain.
Build Provenance
Attestations that explain how a signed artifact was produced.
Package Hijacking
Attacks that publish malicious versions under a trusted name.
Software Supply Chain Attack
How unsigned or weakly signed software enables large-scale compromise.
Public Key Infrastructure (PKI)
The certificate ecosystem that underpins many code-signing identities.
Frequently asked questions
What is code signing in simple terms?
The publisher seals the software with a private key. Your device checks the seal with the matching public certificate before trusting the install or update.
Does a valid signature mean the software is safe?
No. It means integrity and claimed origin at signing time. Malware can be signed with stolen keys or by compromised publishers.
Where is code signing used?
OS drivers, desktop installers, mobile apps, browser extensions, container images, and some firmware/update channels.
What is timestamping in code signing?
A trusted timestamp lets signatures remain verifiable after the signing certificate expires, as long as it was valid when the signature was created.
Should signing keys live on developer laptops?
Avoid that. Prefer hardware security modules, cloud KMS, or ephemeral signing in locked-down CI with strong identity controls.
How does code signing differ from HTTPS?
HTTPS authenticates a server and protects transport. Code signing authenticates an artifact itself so trust survives download mirrors and offline distribution.
What happens if a signing certificate is revoked?
Clients that check revocation should reject newly validated signatures. Existing installs may still run; incident response must rotate keys and re-sign clean releases.
References
Explore authoritative guidance and frameworks related to code signing.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.