SQ20103
Detected reproducibly compiled applications that have not been countersigned for time-stamping.
| priority | CI/CD status | severity | effort | RL level | RL assessment |
|---|---|---|---|---|---|
 | pass | medium | medium | None | None |
About the issue
Digital signatures are applied to applications, packages and documents as a cryptographically secured authenticity record. Signatures verify the origin and the integrity of the object they apply to. For application signatures, or digital code signing, it is recommended to countersign the signatures for time-stamping. Countersigned software components have their signature period validity extended past the signing certificate expiration date. Such signatures are considered valid indefinitely. Reproducibly compiled software should always be countersigned for time-stamping, as the build process eliminates forensic information about the exact time the component was built. Failing to countersign software components may result in application errors and availability outages.
How to resolve the issue
- Consult the certificate authority code signing documentation.
- With Microsoft SignTool, you can specify the trusted remote time-stamping server using the /t or /tr parameter.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes.
For every repository, the chart shows the percentage of projects that triggered the software assurance policy. In other words, it shows how many projects were found to have the specific issue described on this page.
The percentages are calculated from the total amount of packages analyzed:
- RubyGems: 174K
- Nuget: 189K
- PyPi: 403K
- NPM: 2.1M
Recommended reading
- Digital certificates (External resource - Microsoft)
- Security Considerations for Code Signing (External resource: PDF document - NIST)