Knowledge check

Code signing: proving who shipped a binary, and what it can't prove

8 questions testing what you just read — no login, no tracking, just immediate feedback.

Question 1 of 8

What does a valid code signature actually prove?

Question 2 of 8

Why does a signed 2 GB installer carry a signature no larger than a signed 2 KB script, with the same key?

Question 3 of 8

What does an RFC 3161 timestamp add to a code signature?

Question 4 of 8

A signing key leaks. Why is the certificate's revocation recorded as effective from the time of compromise rather than simply 'now' or 'from issuance'?

Question 5 of 8

Since June 2023, where must the private key of a publicly trusted code-signing certificate be kept?

Question 6 of 8

What is the maximum validity for a publicly trusted code-signing certificate issued after 1 March 2026?

Question 7 of 8

An attacker controls a company's build server, but the signing key sits in a well-protected HSM. What's the remaining risk?

Question 8 of 8

In Sigstore's keyless signing, what replaces the long-lived signing key?

0 / 8 answered