We put a support bot on weekend shift. Let's get those evil Okta spirits banned!

Just email us at support@signpath.io or create a ticket at support.signpath.io. And kindly let our support bot know where you found that blank mailto-link, thank you! 😉

Cybernews interview with our CEO about code signing and how it relates to software supply chains and current cyber threats cybernews.com/security/stefa…

More on Sunburst: what can we do to prevent this kind of supply chain attacks in the future? about.signpath.io/blog/2020/… Reviews, secure build chains... and SignPath, maybe, to make sure reviews and security are in place before code signing.

Connecting build systems to HSMs is not enough, nor are specialized HSM proxies dressed up as code signing solutions. We need policy management & enforcement, airtight & verifiable integration from source code to build to signing. That's what we do. 4/4

It has happend before, and we've been warned it would only get worse: microsoft.com/security/blog/… 3/4

"What is certain is that the build infrastructure was compromised. In addition, the digital signing system was forced to sign untrusted code. [The possibility] that SolarWinds certificates were used to sign other malicious code [...] should not be excluded." 2/4

Most in-depth SunBurst analysis we've seen so far: blog.reversinglabs.com/blog/… Build systems and code singing are primary targets for suply chain attacks, allowing hackers to "evade millions of dollars of security investment" at their eventual targets. 1/4

While SignPath can help with driver cross-signing, attestation *and* HLK signing, customers express concern about consequences of Microsoft dropping cross-signing for good osr.com/blog/2020/10/15/micr… via @OSRDrivers /cc @vcsjones @clairernovotny

When autocorrect feels the need to remind you that you're German ;-)

Our if you find another cert sponsor, they can provide the cert through a free OSS SignPath subscription. It's then up to them to define policy, they'll be in charge of the cert anyway. After all, certs are less about the cost than the name you put on it.

Yes, for automatic build+release you'd have to split your build script: 1. build unsigned artifact and submit for signing, 2. upload for release (can be triggered by Webhook). That's what we need to automatically verify each build.

Problem: policy mgmt is designed for enterprises, but b/c of huge share of @nuget projects, requires OSS prj buy-in. SignPath.io aims to turn this around by offering real trust to OSS: signature connects the binary to the source repo, not just sbdy's reputation.

Many thanks @clairnovotny! @minter: SSL.com is even a bit cheaper for multi-year certs + you don't get the mess that comes with reseller accounts. You might need an EV cert though: about.signpath.io/code-signi…. No dongles when using SignPath.io

Association with Azure AD seems to be the most they do. No legal ID vetting afaik. (Know how they identify device driver publisher identities for portal signing via AAD? Make them show EV cert.) Even if they did, solution for OSS still required.

Couldn't find it, asked around, all I heard was "it was mentioned in some CAB meeting"

Not on the level they require from CAs afaik, but could be wrong. Dev from my org had no trouble publishing in our name, verification never happened.

You've asked me before. 3 strikes is just a rumour so far.

No, same publisher, individual certs (need to be able to revoke)

Long term any platform owner can choose to take over certificate issuance. What Microsoft definitely does not want to do is individual vetting, which our process does not require.