Code-sign white listing (CSWL)
A system and method for verifying code bundles. One method includes receiving, from a client device, a request for information to verify an authorization of a code bundle, the code bundle associated with a first signed code segment and a second signed code segment. The method further includes generating a list of certificates associated with the code bundle and including a first certificate associated with the first signed code segment and a second certificate associated with the second signed code segment. The method further includes transmitting, to the client device, a message comprising the list of certificates, the list of certificates generated by a code sign management system (CSMS) and associated with the code bundle. The method further includes verifying, from the message causing the client device to verify the code bundle and based on the list of certificates, the code bundle.
1. A method for verifying code bundles, comprising:
receiving, by one or more processors from a client device, a request for information to verify an authorization of a code bundle, the code bundle associated with a first signed code segment from a first developer and signed by the first developer, and a second signed code segment from a second developer and signed by the second developer, the first signed code segment different from the second signed code segment;
generating, by the one or more processors, a list of certificates associated with the code bundle and including a first certificate associated with the first signed code segment and a second certificate associated with the second signed code segment;
transmitting, by the one or more processors and to the client device, a message comprising the list of certificates, the list of certificates generated by a code sign management system (CSMS) and associated with the code bundle, including the first certificate associated with the first signed code segment, and including the second certificate associated with the second signed code segment; and
verifying, by the one or more processors from the message causing the client device to verify the code bundle and based on the list of certificates, the code bundle by verifying the first signed code segment with the first certificate and the second signed code segment with the second certificate.
2. The method of claim 1 , wherein the message further causes the client device to extract a public key associated with the one or more processors from the list of certificates and verify an authentication of the list of certificates.
3. The method of claim 1 , wherein the message causes the client device to verify a digital signature on the code bundle, and wherein the digital signature is separate from the list of certificates.
4. The method of claim 1 , further comprises:
hashing, by the one or more processors, the code bundle using a hash function to generate a hash value of the code bundle.
5. The method of claim 4 , wherein verifying the code bundle based on the list of certificates comprises generating a second hash value based on the list of certificates and comparing the hash value and the second hash value.
6. The method of claim 1 , wherein a digital signature on the code bundle is generated based on a message authentication code (MAC) or a hash-based message authentication code (HMAC), and wherein the digital signature is associated with a time-stamp token (TST).
7. The method of claim 1 , further comprising:
receiving, by the one or more processors and from the first developer, a first identifier to the first certificate associated with the first signed code segment;
receiving, by the one or more processors and from the second developer, a second identifier to the second certificate associated with the second signed code segment; and
updating, by the one or more processors, a database based on the first identifier and the second identifier.
8. A system for verifying code bundles comprising:
a processing circuit comprising memory and one or more processors to:
receive, from a client device, a request for information to verify an authorization of a code bundle, the code bundle associated with a first signed code segment from a first developer and signed by the first developer, and a second signed code segment from a second developer and signed by the second developer, the first signed code segment different from the second signed code segment;
generate a list of certificates associated with the code bundle and including a first certificate associated with the first signed code segment and a second certificate associated with the second signed code segment;
transmit, to the client device, a message comprising the list of certificates, the list of certificates generated by a code sign management system (CSMS) and associated with the code bundle, including the first certificate associated with the first signed code segment, and including the second certificate associated with the second signed code segment; and
verify, from the message causing the client device to verify the code bundle and based on the list of certificates, the code bundle by verifying the first signed code segment with the first certificate and the second signed code segment with the second certificate.
9. The system of claim 8 , wherein the message further causes the client device to extract a public key associated with the one or more processors from the list of certificates and verify an authentication of the list of certificates.
10. The system of claim 8 , wherein the message causes the client device to verify a digital signature on the code bundle, and wherein the digital signature is separate from the list of certificates.
11. The system of claim 8 , the one or more processors further to:
hash the code bundle using a hash function to generate a hash value of the code bundle.
12. The system of claim 11 , wherein verifying the code bundle based on the list of certificates comprises generating a second hash value based on the list of certificates and comparing the hash value and the second hash value.
13. The system of claim 8 , wherein a digital signature on the code bundle is generated based on a message authentication code (MAC) or a hash-based message authentication code (HMAC), and wherein the digital signature is associated with a time-stamp token (TST).
14. The system of claim 8 , the one or more processors further to:
receive, from the first developer, a first identifier to the first certificate associated with the first signed code segment;
receive, from the second developer, a second identifier to the second certificate associated with the second signed code segment; and
update a database based on the first identifier and the second identifier.
15. One or more non-transitory computer-readable storage media having instructions stored thereon that, when executed by at least one processing circuit, cause the at least one processing circuit to:
receive, from a client device, a request for information to verify an authorization of a code bundle, the code bundle associated with a first signed code segment from a first developer and signed by the first developer, and a second signed code segment from a second developer and signed by the second developer, the first signed code segment different from the second signed code segment;
generate a list of certificates associated with the code bundle and including a first certificate associated with the first signed code segment and a second certificate associated with the second signed code segment;
transmit, to the client device, a message comprising the list of certificates, the list of certificates generated by a code sign management system (CSMS) and associated with the code bundle, including the first certificate associated with the first signed code segment, and including the second certificate associated with the second signed code segment; and
verify, from the message causing the client device to verify the code bundle and based on the list of certificates, the code bundle by verifying the first signed code segment with the first certificate and the second signed code segment with the second certificate.
16. The one or more non-transitory computer-readable storage media of claim 15 , wherein the message further causes the client device to extract a public key associated with the one or more processors from the list of certificates and verify an authentication of the list of certificates.
17. The one or more non-transitory computer-readable storage media of claim 15 , wherein the message causes the client device to verify a digital signature on the code bundle, and wherein the digital signature is separate from the list of certificates.
18. The one or more non-transitory computer-readable storage media of claim 15 , having additional instructions stored thereon that, when executed by the at least one processing circuit, cause the at least one processing circuit to:
hash the code bundle using a hash function to generate a hash value of the code bundle, wherein verifying the code bundle based on the list of certificates comprises generating a second hash value based on the list of certificates and comparing the hash value and the second hash value.
19. The one or more non-transitory computer-readable storage media of claim 15 , wherein a digital signature on the code bundle is generated based on a message authentication code (MAC) or a hash-based message authentication code (HMAC), and wherein the digital signature is associated with a time-stamp token (TST).
20. The one or more non-transitory computer-readable storage media of claim 15 , having additional instructions stored thereon that, when executed by the at least one processing circuit, cause the at least one processing circuit to:
receive, from the first developer, a first identifier to the first certificate associated with the first signed code segment;
receive, from the second developer, a second identifier to the second certificate associated with the second signed code segment; and
update a database based on the first identifier and the second identifier.