In the software supply chain, signing and verifying code helps keep malicious code out of your environment. From SignServer Community release 5.11, you can digitally sign Debian packages.
If you are not familiar with code signing, it is the process of digitally signing code, executables, scripts, and software update packages to confirm the creator of the code and to be able to validate that the code has not been manipulated or unintentionally corrupted since it was signed.
SignServer is a server-side code signing software that supports multiple code signing formats. In the SignServer Community Edition, you can sign Open PGP and Debian packages, for example.
About OpenPGP signing
OpenPGP is commonly used for Open-Source software projects and packaging software for Linux environments. The SignServer OpenPGP signer can sign arbitrary data and produce an OpenPGP (RFC 4880) detached signature in binary or ASCII form or a cleartext signature.
About Debian Package Signing
Debian is a popular and freely available operating system. A wide range of organizations use the Debian operating system, and the system is also known for being an effective packaging system. SignServer supports the signing of Debian packages using the dpkg-sig format and OpenPGP. The key management operations are the same as the generic OpenPGP Signer in SignServer.
From previously being exclusively available to SignServer Enterprise Edition users, the Debian dpkg-sig Signer is now also available in SignServer Community 5.11. Read more in the release notes.
How to set it up in SignServer
Configuring your Debian package signer or OpenPGP signer in SignServer is easy. Your applications can access the Debian or OpenPGP signer via an integration directly to the web services web interface or via the SignServer SignClient. The signing functionality is also available to users via a web interface. Users and applications are always authenticated, and all log files are signed to ensure proper audit and logging functionality.
Neither the Debian package signing nor the OpenPGP signing format uses X.509 certificates. However, in SignServer, the Debian and OpenPGP signing operations are handled as any other code signing operation. A Hardware Security Module (HSM) is recommended to store the private key and execute the signing operation.
Get Started with OpenPGP or Debian Package Signing
Do you want to try signing your OpenPGP or Debian packages with SignServer? Here is how to get started:
- Deploy SignServer Community, see Quick Start Guide – Start SignServer Container.
- Configure OpenPGP or Debian signing, see Code Signing Technical How-to.
