Code Signing
Code signing is the practice of using a cryptographic digital signature to prove the author or publisher of software and to verify that the code has not been altered since it was signed.
Code signing applies a digital signature to software artifacts such as binaries, packages, container images, or scripts. The publisher signs the artifact with a private key, and anyone can use the corresponding public key or certificate to confirm both authenticity (who produced it) and integrity (that it has not been modified since signing).
Mechanically, the signing process hashes the artifact and encrypts that hash with the publisher's private key; verification recomputes the hash and checks it against the decrypted signature. Trust in the signer's identity is usually established through a certificate authority or, in modern software supply chains, through keyless signing approaches that bind signatures to verified identities and record them in a transparency log.
For developers, code signing prevents attackers from distributing tampered or impersonated software and enables operating systems, package managers, and deployment systems to enforce that only trusted, unmodified artifacts run. It is a core building block of a secure software supply chain, complementing provenance and integrity verification.