Resources · 112
Software updates: verify a signer identity change
Decide whether a signed artifact still matches the approved producer, build process and release.
· 2 min
What this guide helps achieve
- Define expected identities
- Check the file and provenance
- Handle change without automatic trust
Quick check
- Versioned policy and approval owner.
- Report linking digest, identity and provenance.
- Installation decision and exception history.
Step-by-step method
- 01
Define expected identities
Before inspecting the new package, record the approved producer, key or certificate identity, issuer and build process. Bind expectations to the software and an already trusted confirmation channel. The artifact under review must not be the sole source of its own acceptance policy.
Versioned policy and approval owner.
- 02
Check the file and provenance
Match the received file’s digest to the attestation subject. Verify the signature against the intended trust roots, then expected identity, builder and parameters. A cryptographically valid signature from a different identity does not satisfy the service policy.
Report linking digest, identity and provenance.
- 03
Handle change without automatic trust
Test an announced rotation, unexpected issuer, missing signature and different file. Hold the artifact when the new identity is unconfirmed. Record approval and a fallback; a signature does not prove absence of vulnerabilities.
Installation decision and exception history.
Acceptance case to reproduce
Fictional example: these inputs describe no customer or observed result.
View case inputs
{
"signature_valid": true,
"digest_matches": true,
"expected_signer": "approved-publisher",
"observed_signer": "different-publisher",
"expected": "hold_for_independent_confirmation"
}Expected decision
Fictional example: the digest matches and the signature is valid, but the observed signer differs from the approved signer. Installation remains on hold pending independent confirmation of the change.
Your acceptance workbook
Record observations against this guide’s criteria. A record is not certification.
The workbook does not save automatically. Export before leaving.
Filters do not limit exports. Actions include issues and unreviewed criteria.
Import replaces current observations after your confirmation.
Management indicators
| Indicator | What it measures | First action |
|---|---|---|
| Reconciled artifacts | Files linked to a verified attestation | Count the version actually received |
| Unresolved changes | Unapproved identities or parameters | Do not turn them into implicit approvals |
Common pitfalls
Frequently asked questions
Are a matching digest and valid signature enough?
No. Also compare identity and build conditions with approved expectations. Artifact authenticity does not establish functional safety.
Official references
References consulted: . The method and worksheet propose checks to adapt to your context; they do not constitute certification.
Continue exploring
Related analysis
