Home / Knowledge hub / Code signing
Knowledge hub
Code signing
Signing software so users and systems can check who released it and that it is intact.
What it means
Code signing is the practice of adding a digital signature to software. The publisher signs a file with a private key. Anyone holding the matching public key or certificate can check that the file came from that publisher and has not been changed since.
It answers two questions at install time: who released this, and is it the same file they released. It says nothing about whether the code is safe. A signed program can still contain a flaw or even harmful code if the signer meant it, or lost control of the key.
Why it matters
Operating systems, app stores and update systems use signatures to decide what to trust. An unsigned installer triggers warnings that cost you customers. A signed update is how a product tells its users that this update is really from you.
The signing key is therefore worth a lot. If an attacker steals it, they can ship harmful software that looks like yours, and every customer's system will accept it. For companies that ship software or plug-ins, protecting this key is a core security task.
How it shows up
Where you meet it: installers, mobile apps, browser extensions, packages and container images. Keep the private key in a hardware module or a managed key service, limit who and what can sign, and sign only in a controlled build. Use timestamps so signatures stay valid after certificates expire.
The big mistake is signing without checking. A signature does nothing until something verifies it. Make your update client and your deployments verify before they run anything. Newer tools such as Sigstore sign with short-lived credentials so there is no long-lived key to steal. See image signing for containers.
Questions people ask
Code signing, answered
Does a signed file mean the software is safe?
No. It means the file came from the holder of the key and has not been altered. The holder may still have shipped a flaw, or been compromised.
Signing proves origin and integrity, not quality.
What happens if a signing key is stolen?
The attacker can sign software that appears to come from you. You must revoke the certificate, replace the key, and tell customers.
Keeping keys in hardware or a managed service makes theft much harder.
Why does a signature need a timestamp?
Certificates expire. A trusted timestamp shows the file was signed while the certificate was still valid, so the signature keeps working later.
Without it, old releases can start to fail checks.
Is code signing the same as HTTPS?
No. HTTPS protects data in transit between a browser and a server. Code signing protects a file after it has been downloaded or copied.
They solve different problems, and both use certificates and keys.
Do we need to sign our web app?
A web app delivered from your server does not use code signing in the same way. Signing matters for installers, apps, extensions, packages and images.
Subresource integrity covers scripts loaded by a page.
Sources
Where this comes from
Related
Terms that sit next to this one
Digital signature
A value that proves who produced data and that it has not changed since.
Image signing
Signing container images so a cluster only runs ones your pipeline produced.
Hardware security module (HSM)
A tamper-resistant device that holds keys and does cryptography inside it.
Build provenance
A signed record of where, when and how a piece of software was built.
Subresource integrity
A hash check that stops a tampered third-party script or stylesheet from loading.
Who vouches for this release?
A signature proves where software came from, not whether the running app is safe. Cyberlop tests the deployed application and proves each flaw with a request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.