Glossary

Code Signing

Published 2026-09-07

Code signing cryptographically signs a piece of software — a release build, an update package — so that anything running or installing it can verify both who produced it and that it hasn't been altered since it was signed. A system that checks a code-signing signature before executing or installing something refuses anything that fails verification, regardless of how legitimate it otherwise appears.

The entire guarantee rests on how well the signing key itself is protected: a code-signing key that leaks lets an attacker produce releases that pass verification as if they were genuine, which makes that key one of the highest-value targets in the entire release pipeline — protecting it deserves the same rigor as any other credential whose compromise would let an attacker convincingly impersonate the organization itself.