Code Signing is the process of putting a signature on executables and patches to prove it is genuine, and to prevent attackers from injecting malicious code into end-user's systems.

learn more… | top users | synonyms

6
votes
1answer
149 views

Centralized key management for IOS and Android Code Signing

What is the best way for an enterprise to manage code signing certificates? The default seems to be that Apple and Android keys get stored by each developer on their machines. I see systems like ...
1
vote
1answer
47 views

Why is a .jar signature still valid if a file has been added to the jar?

I was reading the man page for the jarsigner tool that ships with the JDK. This line surprised me: A verification is still considered successful if none of the files that were in the JAR file when ...
0
votes
1answer
22 views

How to share EV Code Signing Certificate with USB token with other developers?

I got the Extended Validation Code Signing Certificate from Global Sign https://www.globalsign.com/en/code-signing-certificate/ They sent over a USB Token which I installed the certificate to ... or ...
3
votes
0answers
78 views

How does a Sign tool work?

My basic understanding of how a sign tool works is: Load the zip-file (may be exe, jar, ddl, apk, etc.) which has to be signed to its memory (cache memory of the sign tool). Verify it and unzip the ...
2
votes
0answers
15 views

Signtool validation fails when signing and validating are done in different machines

I am signing an exe from a machine using a cer file. Then when I validate the EXE using the signtool.exe from the same machine, it succeeds. But when I try to validate it using the same .cer installed ...
2
votes
0answers
91 views

Why did Google sign every auxiliary app inside “Google Chrome.app” (OS X version) except for one?

$ codesign -dvv /Applications/Google\ Chrome.app/Contents/Versions\ /46.0.2490.80/Google\ Chrome\ Framework.framework/Resources/app_mode_loader.app/ /Applications/Google Chrome.app/Contents/Versions\ ...
1
vote
0answers
16 views

Has “Unit Test Bundles” on iOS or Mac been an attack vector?

In the current beta version of XCode, for the first time, you are required to sign your "Unit Test Bundle". Current beta version being 8.0. I was wondering if this is a bug that they will fix, or ...
1
vote
0answers
103 views

What Key Usage values are required to support Code Signing?

I have a .pfx that I want to use to sign a Clickonce app. However, on trying to do so, Visual Studio gives me "The selected certificate is not valid for code signing." When I go to certmgr.msc and ...
1
vote
0answers
53 views

How to Verify the Integrity of the BlackBerry Momentics IDE Download for Linux

I am currently setting up development environments for BB10 apps on Linux workstations. BlackBerry provides their Momentics IDE for free from (https://developer.blackberry.com/native/downloads/). The ...
1
vote
0answers
70 views

Certificate advice for deploying code-signed software as a 3rd party vendor

I am in the process of developing an application for an organization, and am looking for a sanity check on my strategy, especially given the the nature of the SuperFish nonsense that was exposed. The ...
0
votes
0answers
15 views

Digital Signature on a Passive RFID tag with small-ish memory constraints

I'm pretty new to the crypto and security worlds and I'm looking for some guidance. Briefly, my project involves Widgets (physical items that need to be authenticated) and Gadgets (physical machines ...
0
votes
0answers
36 views

Validate Code Signing Root Certificate Offline

I am developing a library distributed as a Windows DLL to be called by 3rd party executables. I expect the calling EXE to be digitally signed and need to verify that. I have no control over the ...
0
votes
0answers
64 views

Signed an executable; appears as unsigned on VMs?

I signed my binary with a certificate issued by GoDaddy. It seems that myself and everyone I could get to test it for me confirms that it is indeed signed (much like signtool verify) However, when I ...