domains / families / security / implementing-code-signing-for-artifacts

implementing-code-signing-for-artifacts

separate

'Implements code signing for build artifacts (binaries, packages, containers)

When to use

• When establishing artifact integrity verification to prevent supply chain tampering
• When compliance requires cryptographic proof that build artifacts are authentic and unmodified
• When distributing software to customers who need to verify publisher identity
• When implementing zero-trust deployment pipelines that reject unsigned artifacts
• When meeting SLSA Level 2+ requirements for provenance and integrity

When not to use

• encrypting artifacts
• container image signing
• source code authentication

Skill page

Source