Digital signatures have expanded
beyond just email.
Code signing is a method of using a digital signature
to ensure the source integrity of the programming code.
Code signing is the process
of digitally signing executables and scripts
to confirm the software was written by the author,
and it guarantees the code has not been altered or corrupted
since it was digitally signed.
The process employs the use of cryptographic hashes
to validate the authenticity and integrity of the code.
Code signing works just like digitally signing an email,
with a code developer's private key
is going to be used to encrypt the hash digest
of the finished executable file or script
as a mean of providing non-repudiation for that code
and to prove it was actually released by the developer
and has not changed since it was signed by the developer.
Now, code signing relies upon the digital signature
of a compiled program file
or the source code that's being distributed.
For example, if we create a mobile application
to offer through the App Store,
our installer file must be code signed.
Every developer has to register with Apple or Google
to receive a private key.
Just as in the email example,
the application file is going to be hashed,
and that hash is encrypted
using the developer's private key.
By code signing the file,
the software is said to have come from a trusted source.
That being said, just because a piece of code is signed
doesn't mean it guarantees the code is of high quality.
Code signing is just a validation
that the original developer
was ready to distribute the code as it is
and that code has not been changed
since the code was signed.
For example, if the developer's workstation was hacked into,
an attacker inserted code into the source code repository
prior to it being signed,
it could actually contain malicious code
or a backdoor into it and still be code signed.
Just look at the 2020 SolarWinds attack
where a APT was able to insert malicious code
into the SolarWinds source code.
Then when the company compiled the code, signed it,
and distributed it to its customers,
they all became infected.
Code signing is considered a good control to implement,
but it is not a foolproof solution
as code signing only provides as much security
as an organization that actually signed that code.