Method, system and apparatus for delayed production code signing for heterogeneous artifacts
AssigneeIntel Corporation
InventorMateusz Bronk
Life of this patent
Estimating the term…
Abstract
The disclosed embodiments enable applying production nature to a software signature post-build (or even post-release), where the signature type is determined by the existence of a production-signed intermediate CA certificate—either hosted in the cloud (for pure release immutability), or re-ingested into the package (if certain modification are allowed). This allows a so-called deferred issuance of the product release. Even if the CA certificate is to be reinserted into the package, this modification likely affects only the delivery shell (e.g., installer) and may not require format-specific binary changes of, possibly heterogeneous, artifacts therein.
Claims24
A method to delay production code signing for a software package, the method comprising:
- generating a transient code signing key pair (TKP) and a transient intermediate code Certificate Authority (CA) key pair (CKP);
- issuing a transient code signing CA Certificate for the TKP (TCACert), wherein the TCACert is signed with a CKPPriv;
- signing each code artifact in a signing session with a TKPpriv;
- embedding a TCAcert in the software package;
- approving production release of a production version of the software package;
- delay-issuing a CKPcert by using a product root CA public key;
- and
- publishing a CKPcert;
- wherein publishing CKPcert further comprises publishing the CKPcert at a pre-defined location pointed-to by TCAcert embedding.
A non-transitory machine-readable medium including instructions which when executed on a processor cause the processor to implement operations comprising:
- generate a transient code signing key pair (TKP) and a transient intermediate code Certificate Authority (CA) key pair (CKP);
- issue a transient code signing CA Certificate for the TKP (TCACert), wherein the TCACert is signed with a CKPPriv;
- sign each code artifact in a signing session with a TKPpriv;
- embed a TCAcert in the software package;
- approve production release of a production version of the software package;
- delay-issue a CKPcert by using a product root CA public key;
- and
- publish a CKPcert at a pre-defined location pointed-to by TCAcert embedding;
- wherein the instructions, when cause the processor to delay production code signing for a heterogeneous artifacts of a pre-production version of a software package.
A system comprising:
- a processor circuitry;
- and
- a memory circuitry to communicate with the processor circuitry, the memory circuitry comprising instructions to delay production code signing for a heterogeneous artifacts of a pre-production version of a software package by directing the processor circuitry to:
- generate a transient code signing key pair (TKP) and a transient intermediate code CA key pair (CKP);
- issue a transient code signing CA Certificate for the TKP (TCACert), wherein the TCACert is signed with a CKPPriv;
- sign each code artifact in a signing session with a TKPpriv;
- embed a TCAcert in the software package;
- approve production release of a production version of the software package;
- delay-issue a CKPcert by using a product root CA public key;
- and
- publish a CKPcert at a pre-defined location pointed-to by TCAcert embedding.
Dependencies are inferred from the claim text.