Also known as: artifact signing · binary signing
Code signing is the practice of cryptographically signing software artifacts so that recipients can verify who produced them and confirm the code has not been altered since signing.
A signature proves integrity and origin, not safety. Signed malware is entirely possible when a signing key is stolen or the signer is themselves malicious, which is why stolen code-signing certificates are valuable on criminal markets.
Modern approaches such as Sigstore reduce the operational burden by replacing long-lived private keys with short-lived certificates tied to an identity provider, and by recording signatures in a public transparency log.
Software Supply Chain Security
Software supply chain security is the practice of verifying the integrity and provenance of every component, tool, and process that contributes to a piece of software, from source dependencies through the build system to distribution.
SLSA
SLSA (Supply-chain Levels for Software Artifacts) is a security framework that defines graduated levels of build integrity, describing increasingly rigorous requirements for how software artifacts are produced and verified.
Reproducible Build
A reproducible build is one where compiling the same source code with the same environment always produces a byte-for-byte identical binary, allowing anyone to independently verify that a distributed binary genuinely corresponds to its published source.
Certificate Authority
A certificate authority (CA) is a trusted organisation that issues digital certificates binding a cryptographic public key to a verified identity, such as a domain name, enabling encrypted and authenticated connections.