Implementing Code Signing

name: implementing-code-signing description: >- Implement code signing for software integrity verification including GPG signing, Authenticode (Windows), codesign (macOS), sigstore/cosign for containers, and CI/CD pipeline integration for automated signing workflows. domain: cybersecurity subdomain: cryptography tags: - code-signing - authenticode - gpg - sigstore - cosign - software-integrity - supply-chain - notarization version: "1.0" author: defconxt license: AGPL-3.0 metadata: mitre-attack: ["T1553.002"]

Implementing Code Signing

Overview

Code signing cryptographically binds identity to software artifacts, ensuring integrity and authenticity. This skill covers signing executables, scripts, container images, and git commits across platforms, with CI/CD automation for supply chain security.

Prerequisites

Key Concepts

GPG Signing

# Generate a signing key
gpg --full-generate-key --expert
# Select: ECC (sign only), Curve 25519, 2y expiry

# List signing keys
gpg --list-secret-keys --keyid-format=long

# Sign a file (detached signature)
gpg --armor --detach-sign --output file.sig file.tar.gz

# Verify a signature
gpg --verify file.sig file.tar.gz

# Sign a git commit
git commit -S -m "Signed commit"

# Sign a git tag
git tag -s v1.0.0 -m "Release v1.0.0"

# Verify git signatures
git log --show-signature -1
git tag -v v1.0.0

Windows Authenticode

# Sign with osslsigncode (cross-platform)
osslsigncode sign -certs cert.pem -key key.pem \
  -n "Application Name" -i https://example.com \
  -ts http://timestamp.digicert.com \
  -h sha256 -in app.exe -out app-signed.exe

# Verify Authenticode signature
osslsigncode verify -in app-signed.exe

# PowerShell (on Windows)
# Set-AuthenticodeSignature -FilePath app.exe -Certificate $cert -TimestampServer "http://timestamp.digicert.com"

# Verify with signtool (Windows SDK)
# signtool verify /pa /v app-signed.exe

macOS Code Signing

# Sign with codesign
codesign --sign "Developer ID Application: Name (TEAMID)" \
  --timestamp --options runtime app.app

# Verify signature
codesign --verify --verbose=2 app.app

# Notarize with Apple
xcrun notarytool submit app.zip --apple-id dev@example.com \
  --team-id TEAMID --password "@keychain:AC_PASSWORD" --wait

# Staple notarization ticket
xcrun stapler staple app.app

Container Image Signing (cosign)

# Generate a cosign keypair
cosign generate-key-pair

# Sign a container image
cosign sign --key cosign.key registry.example.com/app:v1.0

# Verify a container image
cosign verify --key cosign.pub registry.example.com/app:v1.0

# Keyless signing with OIDC (sigstore)
cosign sign registry.example.com/app:v1.0

# Verify keyless signature
cosign verify --certificate-identity dev@example.com \
  --certificate-oidc-issuer https://accounts.google.com \
  registry.example.com/app:v1.0

# Sign with SBOM attachment
cosign attest --predicate sbom.json --key cosign.key \
  registry.example.com/app:v1.0

CI/CD Integration

# GitHub Actions — sign container on push
- name: Sign container image
  run: |
    cosign sign --key env://COSIGN_KEY \
      ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}
  env:
    COSIGN_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
    COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}

Workflow

1. Generate — Create signing keys with appropriate algorithm
2. Secure — Store private keys in HSM, KMS, or CI secret store
3. Integrate — Add signing step to build pipeline
4. Timestamp — Always use a timestamp server for long-term validity
5. Verify — Add verification gates in deployment pipeline
6. Rotate — Plan key rotation with overlapping validity periods

Verification

References

• Sigstore Documentation
• GnuPG Manual
• Apple Code Signing Guide
• Microsoft Authenticode