63 lines
2.0 KiB
Markdown
63 lines
2.0 KiB
Markdown
---
|
||
title: "Code Signing"
|
||
type: concept
|
||
tags: [Code-Signing, Software-Supply-Chain, Security, Cryptography, DevOps, OpenText]
|
||
sources:
|
||
- public-cloud-learning-sessions-opentext-thor-platform-flows-20241210-160056-meet
|
||
last_updated: 2026-05-11
|
||
---
|
||
|
||
## Code Signing
|
||
|
||
Code Signing（代码签名）是软件供应链安全的关键机制，通过数字签名确保构建产物的完整性和来源可信，是 Project Thor 供应链安全战略的核心环节。
|
||
|
||
## Code Signing
|
||
|
||
Code Signing is a critical mechanism for software supply chain security that uses digital signatures to ensure the integrity and trustworthiness of build artifacts. It is a core component of Project Thor's supply chain security strategy.
|
||
|
||
## Aliases
|
||
- Code Signing
|
||
- 代码签名
|
||
- 软件签名
|
||
|
||
## Key Facts
|
||
|
||
| 维度 | 说明 |
|
||
|------|------|
|
||
| 目的 | 确保构建产物完整性 + 来源可信 |
|
||
| 位置 | 供应链数据流：Build Farms → Artifactory 之间 |
|
||
| 隶属于 | [[Project-Thor]] 安全与治理支柱 |
|
||
| 关键原则 | 构建产物在交付客户环境前必须经过签名验证 |
|
||
|
||
## 供应链安全中的角色
|
||
|
||
```
|
||
GitLab（源代码）
|
||
↓
|
||
Build Farms（制造流程）
|
||
↓ Code Signing（签名）
|
||
Artifactory（制品仓库）
|
||
↓
|
||
客户环境
|
||
```
|
||
|
||
Arnold Dacan 强调源代码的供应链核心地位，而 Code Signing 则确保从构建到交付的全链路可信赖。
|
||
|
||
## 与 Supply Chain Security 的关系
|
||
|
||
Code Signing 是 [[Supply Chain Security]] 的关键技术手段之一：
|
||
- 确保制品未被篡改（完整性验证）
|
||
- 验证构建来源（身份认证）
|
||
- 防止供应链攻击（如依赖注入、恶意构建）
|
||
|
||
## Connections
|
||
|
||
- [[Code-Signing]] ← security_practice ← [[Project-Thor]]
|
||
- [[Code-Signing]] ← secures ← [[Supply-Chain-Security]]
|
||
- [[Code-Signing]] ← part_of ← 供应链数据流（Build Farms → Artifactory）
|
||
- [[GitLab]] ← provides ← Source → [[Code-Signing]] 验证
|
||
|
||
## Sources
|
||
|
||
- [[public-cloud-learning-sessions-opentext-thor-platform-flows-20241210-160056-meet]]
|