Code signing - simple & secure (and free for Open Source)
Joined July 2017
- Tweets28
- Following0
- Followers54
- Likes8
Cybernews interview with our CEO about code signing and how it relates to software supply chains and current cyber threats cybernews.com/security/stefa…
More on Sunburst: what can we do to prevent this kind of supply chain attacks in the future? about.signpath.io/blog/2020/…
Reviews, secure build chains... and SignPath, maybe, to make sure reviews and security are in place before code signing.
Most in-depth SunBurst analysis we've seen so far: blog.reversinglabs.com/blog/…
Build systems and code singing are primary targets for suply chain attacks, allowing hackers to "evade millions of dollars of security investment" at their eventual targets. 1/4
It has happend before, and we've been warned it would only get worse: microsoft.com/security/blog/… 3/4
While SignPath can help with driver cross-signing, attestation *and* HLK signing, customers express concern about consequences of Microsoft dropping cross-signing for good osr.com/blog/2020/10/15/micr… via @OSRDrivers /cc @vcsjones @clairernovotny
Hey friends, @PaketManager is looking for a sponsor of a new code certificate. Please help out! github.com/fsprojects/Paket/…
Yes, for automatic build+release you'd have to split your build script: 1. build unsigned artifact and submit for signing, 2. upload for release (can be triggered by Webhook). That's what we need to automatically verify each build.
My code signing cert expires in July. Costs $500/yr to renew. Used it on my open-source NuGet packages for a year b/c the cert was free and I was curious about how to do signing. As no one asked for it in the first place, I don't see a reason to renew the cert. Thoughts?
Or, to phrase this another way, is anyone out there actually using @nuget package signing verification (aka trust boundaries)?
Relevant posts:
haacked.com/archive/2019/04/…
devblogs.microsoft.com/nuget…
docs.microsoft.com/en-us/nug…
Problem: policy mgmt is designed for enterprises, but b/c of huge share of @nuget projects, requires OSS prj buy-in. SignPath.io aims to turn this around by offering real trust to OSS: signature connects the binary to the source repo, not just sbdy's reputation.
There's a rundown of some options here:
codesigncert.com/
Sectigo is currently the cheapest at $75/yr.
@SignPathIO is another option and they host a signing service so you don't have to worry about the cert.
Many thanks @clairnovotny! @minter: SSL.com is even a bit cheaper for multi-year certs + you don't get the mess that comes with reseller accounts. You might need an EV cert though: about.signpath.io/code-signi…. No dongles when using SignPath.io
Not on the level they require from CAs afaik, but could be wrong. Dev from my org had no trouble publishing in our name, verification never happened.