This article was accepted into the corpus but its outbound wikilinks were never NER-processed — typical at the deepest BFS hop or when the run's entity cap was reached. No expansion funnel to show.
| Notarization (software) | |
|---|---|
| Name | Notarization (software) |
| Title | Notarization (software) |
| Developer | Various vendors and platform providers |
| Released | 2000s–present |
| Language | Multilingual |
| Operating system | Cross-platform |
| Genre | Code signing, software distribution, runtime verification |
| License | Proprietary and open source |
Notarization (software) is a process and set of tools used to verify and attest that a software artifact originates from a published author and has not been tampered with since signing. It combines cryptographic code signing mechanisms, timestamping, and centralized or federated attestation services to provide runtime and distribution trust signals for end users and automated systems. Major implementations are provided by technology companies and standards bodies to integrate with ecosystems such as desktop operating systems, package managers, and cloud platforms.
Notarization integrates practices from Public key infrastructure, X.509, Cryptographic hash function usage, and timestamp authorities such as those referenced by RFC 3161 to provide non-repudiable assertions about software artifacts. It often complements digital signature schemes used by vendors like Microsoft Corporation, Apple Inc., and Google LLC and standards from organizations such as Internet Engineering Task Force and European Union Agency for Cybersecurity. The model bridges distribution channels like App Store (iOS), Microsoft Store, and software supply chains exemplified by npm, PyPI, and Maven Central.
Notarization addresses threats identified in incidents such as the SolarWinds cyberattack and supply chain compromises affecting ecosystems like OpenSSL and Log4j. Use cases span code distribution for macOS, Windows, and Linux distributions, enforcement in continuous integration pipelines using systems like Jenkins, GitHub Actions, and GitLab CI/CD, and verification in infrastructure orchestration tools including Kubernetes and Terraform. Enterprises adopt notarization to comply with procurement frameworks such as NIST Special Publication 800-161 and regulatory regimes exemplified by GDPR when software provenance impacts auditability.
Typical notarization workflows involve build systems, cryptographic key management, and attestation services. A developer or build pipeline creates an artifact and produces a signature using a private key stored in hardware tokens like YubiKey or in cloud KMS services from Amazon Web Services, Microsoft Azure, or Google Cloud Platform. The signed artifact is submitted to an attestation service—examples include Apple Notary Service for macOS apps, vendor-run services for Windows Defender Application Control, and community projects like Sigstore—which verifies signatures, runs static and dynamic analysis, and returns a notarization record or ticket. Timestamping authorities and transparency logs inspired by Certificate Transparency record assertions to enable later verification by clients such as package managers and operating systems.
Notarization relies on trust anchors such as root certificates from Mozilla Foundation's CA program, Let's Encrypt, or enterprise PKI deployments like those based on Microsoft Active Directory Certificate Services. Model variations include centralized attestation (single vendor authority), federated models (trust brokers and registries), and transparency-based approaches like Rekor from the Linux Foundation's projects. Threat models address key compromise, supply chain poisoning, and replay attacks; mitigations incorporate hardware-backed keys from Trusted Platform Module chips, short-lived signing keys, and multi-signature schemes inspired by Threshold cryptography. Verification logic often mirrors standards from ISO/IEC 27001 for information security management and risk frameworks such as NIST Cybersecurity Framework.
Platform vendors provide integrated notarization offerings: Apple Inc. maintains a notarization pipeline for macOS binaries and iOS-related artifacts; Microsoft Corporation integrates code signing and attestation into Windows kernel mode signing and Windows Store submissions; Google LLC enforces APK and App Bundle verification through Google Play and Android signing schemes. Open-source and community initiatives include Sigstore components like Fulcio and Rekor, and package-specific solutions for ecosystems such as npm and RubyGems. Cloud providers embed notarization into container registries like Docker Hub, Google Container Registry, and Amazon ECR with supply chain provenance features compatible with OCI specifications.
Notarization intersects with intellectual property and liability regimes where provenance affects warranty and indemnity. Jurisdictions referencing digital signature laws such as the eIDAS Regulation in the European Union or the Electronic Signatures in Global and National Commerce Act in the United States influence admissibility and evidentiary weight of notarized artifacts. Procurement standards from bodies like ISO and auditing frameworks used by DOD contractors incorporate artifact attestation for secure software development lifecycle requirements including NIST SP 800-53 controls. Organizations often define internal policies aligning notarization records with incident response processes guided by FIRST and MITRE ATT&CK.
Critiques of notarization highlight centralization risks when single vendors or authorities control attestation, as discussed in analyses of certificate authority compromises and debates in forums involving EFF and OpenSSF. Operational challenges include key management complexity, developer friction in continuous delivery environments such as DevOps toolchains, and scalability concerns for large registries like npm with millions of packages. Transparency mechanisms can mitigate but not eliminate risks: attackers exploiting build environment vulnerabilities or social engineering remain problematic in incidents studied by CISA and academic research from institutions like MIT and Carnegie Mellon University.
Category:Software security