Package Signing.

Applying a cryptographic signature to a software package so that consumers can verify the publisher's identity and that the artifact has not been altered after release. It belongs to the Application Security category of cybersecurity.

Applying a cryptographic signature to a software package so that consumers can verify the publisher's identity and that the artifact has not been altered after release.

Package signing binds an artifact (binary, library, container image, OS package, language module) to the publisher's cryptographic identity. Verifiers compare the signature against the expected key, certificate, or transparency log entry before installing or running the package. Common ecosystems include Sigstore Cosign for OCI images and language packages, GPG-signed Linux distribution packages, Authenticode on Windows, codesign on macOS/iOS, and Maven Central with PGP. Modern practice favours short-lived keys and OIDC-based identities (Sigstore) over long-lived offline keys, plus transparency logs (Rekor) for public auditability. Signing is complementary to SBOMs, SLSA provenance, and reproducible builds: it answers "who shipped this and is it intact?" while the others answer "what is in it and how was it made?".

Defences for Package Signing typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Code signing, Artifact signing.