Code Signing: When & Why?

Question

If you search for code signing online you will get a plethora of hits regarding where to go to get your code signed with a digital cert, but no articles or documentation on when you should get your code signed or why this might be necessary. So I pose these questions:

• What use cases exist where a developer or a development team want/need to have their code signed?
• What types of code can/should be signed? JavaScript? Java? C++? Are there different types of codesigning for each language/platform?
• Is the code signed as raw source or the compiled binary?

Thanks in advance.

Answer 1

I suppose theoretically any code in any language can be signed, either as the source but more commonly the compiled binary.

Main use case that comes to mind with me is with Mobile applications (Android for this instance). You have to sign the code before publishing. You also have to keep the key store file so if you make any updates to the application and want to upload it you sign it with the same key. This is because Android checks a number of things when upgrading an application the main one being that the code signing is the same for the old and new, which as long as the key store file and its password is kept secret enough, proves it came from the same source. If someone were to modify the code in some way, the signing verification would fail.

In a nutshell signing code lets the end user / machine know where the code came from. And in the case of upgrading makes it difficult/impossible to modify code and have others download it.

Apple goes nuts with code signing for iOS and I don't fully grasp all the details but you have to get the certificates (yes more than 1) from Apple and sign with them. If you want to put the app on a testing device you need yet another certificate to sign with and install it on the device, other wise you have to get it on the App Store (subject to Apple's approval) where they probably sign it with some private key for iOS devices to know its Apple approved.

Answer 2

every time you need to ensure that code is from trusted source and no one modifies it (signing usually comes with checksum). it's very common. programming libraries, software distribution, software upgrades. when you need to patent the code you should sign it and get a trusted timestamp. when you create a bank and give access to it through internet, you send your webpages to the users via SSL = you are encrypting and signing them. and probably many many more

Answer 3

What use cases exist where a developer or a development team want/need to have their code signed?

Digital signatures mean different things on different platforms. If you're writing Windows desktop software then the biggest initial benefit of signing your executables is to get rid of that nasty "Unknown Publisher" warning that Windows has been showing users since Windows XP SP2. On other platforms (Some mobile, Java, Flash, Office VBA Macros etc) signed code is required in order to elevate permissions.

You can make a Windows program self-check its own digital signature to make sure it is valid, which means the EXE hasn't changed at all since it was signed. Most use that as another layer of protection against malware and piracy.

Check out this too : http://blog.ksoftware.net/2011/07/what-is-authenticode/

What types of code can/should be signed? JavaScript? Java? C++? Are there different types of codesigning for each language/platform?

In theory it is possible to digitally sign any document but most of the time when people are talking about code signing they're talking about MS Authenticode (attaching digital signatures to any PE format file (EXE, DLL, COM, etc) or signing executables for OSX/iOS.

There are different types of signing on different platforms but most will use the same certificate.

Is the code signed as raw source or the compiled binary?

In most contexts, a binary.