OneDot61 works with SignPath on a commercial basis.
Software Supply Chain Attacks are Targeting Your Build Pipeline Not Just Your Code.
When most developers think about software security, they think about the code itself such as input validation, dependency scanning or static analysis. These are important. But some of the most damaging attacks in recent years haven't targeted application code at all. They've targeted the infrastructure used to build and sign it.
The SolarWinds attack didn't compromise the application. It compromised the build process. Attackers inserted malicious code into the CI/CD pipeline, signed it with legitimate credentials, and distributed it to thousands of customers as a trusted software update. By the time anyone noticed, the damage was done. SignPath can help with securing your software supply chain.
Why Code Signing Alone isn't Enough? SignPath Covers the Whole Software Supply Chain.
Code signing was designed to give recipients confidence that software came from a trusted source and hasn't been tampered with. But a signature only proves that the signing key was used. It does not prove that the build process was clean. It does not prove that the pipeline was uncompromised. It does not prove that the artifact matches the source code it claims to represent.
If an attacker gains access to signing credentials through a compromised CI server, an over-permissioned service account, or exposed secrets in a pipeline they can sign anything. The signature becomes meaningless. How do you enforce integrity on code and the supply chain? This is what SignPath can help with.
How Can SignPath Help Enforce Integrity Across the Entire Software Supply Chain?
SignPath addresses this by treating software supply chain security as a policy enforcement problem, not just a signing problem. The platform integrates directly into CI/CD pipelines — Jenkins, GitHub, GitLab, Azure DevOps — and enforces compliance policies at every stage from source through release. Builds are verified against their source, artifacts are signed only when policy conditions are met, and every action is captured in a tamper-evident audit log.
Signing keys are protected through HSM and KMS integration under least-privilege controls, eliminating the exposed credential risk that makes supply chain attacks possible. For development teams, the process is automated and security is enforced without adding friction to the release workflow.
In an environment where more and more organisations have faced a software supply chain attack, the question isn't whether to address this risk, the questions is how quickly you can close the security gap. Do it faster with SignPath.
