Azure Learning

code-signing

Properties2
tagsdevops, security, signing, integrity, supply-chain
aliasescode signing, digital signature, Authenticode, trusted publisher, integrity signing

2 min read

Code signing

What it is

Code signing is the practice of digitally signing software artifacts (executables, packages, scripts, firmware) with a private key to guarantee who published it (authenticity) and that it wasn’t tampered with since signing (integrity). A valid signature means a trusted signer produced the artifact and it arrived unchanged.

Why it exists

Users and systems can’t trust software just because it “came from somewhere.” Attackers routinely inject malicious code into builds or repackage legitimate software. Signing lets clients verify the author and integrity of an artifact before running/installing it — reducing runtime prompts (fewer “unknown publisher” warnings), enabling build provenance, and blocking tampered droppers in the supply chain.

Key ideas

  • Public/private key pair — the publisher signs with its private key; anyone verifies with the corresponding public certificate.
  • Certificate authority (CA) — the certificate is issued by a trusted CA; trust chains back to it (e.g. code-signing certs with an EV/OV identity).
  • Hashing — the signer hashes the content and signs the hash; any change to the artifact breaks verification → signals tampering.
  • Known in Windows as Authenticode (PE/signing); package managers (NuGet, MSIX, APK) and OSes also validate signatures.
  • Azure Trusted Signing — Azure service that issues/renews signing certificates (with identity and Audit management) so pipelines don’t have to hold long-lived certs.

How it fits

Adds end-to-end integrity to the software supply chain: code is analyzed by SAST/SCA (correctness/security), then signed to lock in the verified artifact before it ships — a hard security control feeding a compliance gate on release. Complements build-artifact integrity/provenance in CI.

Exam notes

  • Signing solves authenticity (who) + integrity (tamper-proof) — memorized.
  • Private key signs; public key verifies; the certificate must trace to a trusted CA.
  • Windows Authenticode; EV certs = strong identity for code signing; Azure Trusted Signing is the managed modern option.
  • Contrast with encryption: signing is for integrity/authenticity (not secrecy of content).

Diagram

dev-sec-ops · compliance-gate · build-artifact · static-analysis

📘 Source: Microsoft Learn — Code Signing

Graph View

Backlinks