Everything about code signing and how not to use it
summary
Explains the actual signing flow: file hashed locally, hash sent to a signing tool which calls Azure Key Volt to produce a signature and timestamp; timestamp preserves validity after expiry and helps revocation handling. Shows failures like a private key on admin share, exported PFX files and the myth that non‑exportable keys are safe (tools can extract them). Demonstrates EV certificates generated in the Key Volt HSM so private keys never leave the vault, and a Sampler CI pipeline that automates signing and works end‑to‑end.
AI-written summary · about
chapters (11)
- 0:00Code signing introduction
- 3:10PowerShell execution policy myths
- 6:43What code signing does
- 13:48Local signing demos lessons
- 17:21Code signing mistakes
- 20:35Azure Key Vault signing basics
- 27:37HSM for asset protection
- 31:56Certificate inventory monitoring
- 34:22Code signing in Azure DevOps
- 45:03Secure signing dos and don'ts
- 47:25Q&A
related talks
33mDemystify Modern Signing: Keys, Certs, and Envelopes
15mDemystifying Digital Signatures
27mNo Keys? No Problem: Why You Can Trust Sigstore Signatures
17mWhose Sign Is It Anyway?
34m"Keyless" Code Signing Without Fulcio
59mProtecting Encryption Keys with Azure Key Vault
57mProtecting Encryption Keys with Azure Key Vault
22mDemystifying Code Signing