ยังไม่มีหน้านี้ในภาษาของคุณ คุณกำลังอ่านข้อความภาษาอังกฤษ
Glossary
Code signing
Code signing is a signature on a program that names its publisher and shows that the bytes have not changed since.
What a signature actually says
A signature binds a file to a certificate, and the certificate names whoever obtained it from an authority the system already trusts. Change one byte afterwards and the signature stops matching.
That is the whole claim. It says who, and it says unchanged since then, and it says nothing at all about what the program does once it is running.
How a file gets signed
The order matters more than the tooling, and it is the same on every platform that has a gate of its own.
Each step leaves something a machine can check later without asking anyone, which is why verification still works with the network unplugged.
- 1
The publisher gets a certificate
An authority checks the company or the person and issues a certificate tied to a private key.
- 2
The key sits in hardware
Publicly trusted signing keys have lived on hardware tokens or inside a signing service since 2023.
- 3
The file is signed and timestamped
A timestamp from a trusted source keeps the signature verifiable after the certificate expires.
- 4
The system checks it at launch
It walks the chain of trust, then compares the stored hashes against the file in front of it.
What you see at a first launch
The gate is different on each system, and so is the amount of work it puts on the person opening the file.
The wording moves from one release of a system to the next, while the shape of the answer stays where it is.
| System | Signed and known | Unsigned |
|---|---|---|
| macOS | Opens after the download check | A refusal, then a trip to Privacy and Security to allow it by hand |
| Windows | A named publisher inside the prompt | A blue reputation screen, with the button hidden behind More info |
| Linux | Repository packages are verified by the package manager | A downloaded image or archive meets no such gate at all |
Which gate this machine would show
These two lines are read in your browser on this page and name the system underneath it.
Whichever gate you meet at a first launch belongs to that system, not to the file you downloaded.
เครื่องของคุณ ณ ตอนนี้
- Platform
- กำลังวัดบนเครื่องของคุณ
- Browser line
- กำลังวัดบนเครื่องของคุณ
อ่านในเบราว์เซอร์ของคุณและแสดงที่นี่ ไม่มีการส่งข้อมูลไปที่ใด
Signed is not the same as safe
Certificates have been stolen from real publishers and bought by people who registered a company for the purpose. Signed malware is an old and steady genre.
What a signature buys is accountability. A certificate can be revoked, and every copy already signed under it stops being trusted at once.
Often confused with
Three neighbours stand close enough to this one that the words get swapped in conversation, usually by people selling something.
Encryption
A signature leaves the file readable to anyone. It proves origin, while encryption hides content.
A checksum on a download page
A hash proves the file matches that page. A signature travels inside the file and names a publisher an authority checked.
Notarization
An extra step Apple performs after the signing is done, and it has its own page here.
What this does not do
- It does not say the program is safe. A signature names a publisher and makes no claim about what the code does when it runs.
- It does not survive an edit. One changed byte and verification fails, which is the point, and also why a patched copy of anything loses its signature.
- It does not hold on its own. A certificate expires, and only a timestamp taken at the moment of signing keeps older files verifying afterwards.
- It does not look the same everywhere. Linux leans on signatures over a whole repository rather than on a signature carried inside each file.
Check it
Each line here is a command you can run on your own machine, against any program you already have.
- What macOS says about an app you already installed
- codesign --display --verbose=2 /Applications/<any app>
- What the gate itself answers about that app
- spctl --assess --type execute --verbose /Applications/<any app>
- Where the quarantine mark shows up on a download
- xattr -l ~/Downloads/<a file you downloaded>
- The same question asked on Windows
- Get-AuthenticodeSignature <file> | Format-List
Questions
- Is a signed app safe to run?
- Traceable rather than safe. The signature tells you which publisher an authority checked, and nothing about how the code behaves.
- Why does an unsigned app sometimes open on a Mac anyway?
- The gate applies to files that arrive carrying the quarantine mark from a browser or a mail client. A file built on the machine itself never picks that mark up.
- What is Authenticode?
- The Windows form of code signing. The signature lives inside the executable, and the publisher name in the prompt is read out of it.
- Does signing cost money?
- Yes. A certificate is bought from an authority and renewed on a term, and the private key has to be kept in hardware or in a signing service.
- Can a signature be taken back?
- It can. An authority revokes the certificate, and systems then stop trusting what was signed under it, including files already sitting on disk.
The macOS step that comes after
Apple looks at a signed build before a machine that has never seen it will open it quietly.