Home/ Questions/Q 331275
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-12T09:45:34+00:00

I’d like to understand some of the best practices with respect to code signing.

  • 0

I’d like to understand some of the best practices with respect to code signing. We have an Eclipse-based application and think it would be appropriate to sign our plug-ins. This raised a lot of questions:

  • Can/Should the private key be in
    source control?

  • Should we sign the code as part of
    our nightly build process or as part
    of our release process?

  • Should the code be signed
    automatically, or is there a reason
    why that should be a manual step?

My inclination is to say, “Yes”, “Nightly”, and “Automatically”, but I could see an argument for only signing the release products. I might even make the argument that SQA should sign the code after they have verified it, although that would really mess with our release process.

How do other people manage this?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    It depends on how secure you want your private key to be, it might not be something that you want a temporary employee with source access to have full access to.

    At my work, we do the following:

    “Test sign” binaries as part of our daily builds with a checked in key. This requires a test root certificate to be on machines in order to trust the binaries, but they will not be trusted if the bits are deployed outside the company.

    Weekly (and for external releases), we sign with the real key. This is done via a separate, somewhat manual process. Only a few people have access to the key to sign the product.

    • 0