SQ20114
Detected malformed or damaged digital signatures.
| priority | CI/CD status | severity | effort | RL level | RL assessment |
|---|---|---|---|---|---|
 | fail | high | low | 2 | tampering: fail Reason: malformed signatures detected |
About the issue
Digital signatures are applied to applications, packages and documents as a cryptographically secured authenticity record. Signatures verify the origin and the integrity of the object they apply to. To validate the package integrity, the digital signature itself must be verified first. This ensures the signature is intact and there were no attempts to tamper with the data it contains. When signatures can't be successfully parsed and validated, there are two possible reasons. Either the signature got damaged during network transport, or there was an attempt to tamper with its contents. Discerning between the two is impossible without manually inspecting the affected packages.
How to resolve the issue
- Inspect the software package for malicious software supply chain tampering.
- If there is no evidence of tampering, re-sign and re-publish the software component.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes.
For every repository, the chart shows the percentage of projects that triggered the software assurance policy. In other words, it shows how many projects were found to have the specific issue described on this page.
The percentages are calculated from the total amount of packages analyzed:
- RubyGems: 174K
- Nuget: 189K
- PyPi: 403K
- NPM: 2.1M
Recommended reading
- Digital certificates (External resource - Microsoft)
- Go below the surface on tampering: The trouble with software integrity validation (ReversingLabs blog)