📝 SummarXiv

Abstract

Code signing enables software developers to digitally sign their code using cryptographic keys, thereby associating the code with a specific key. This key is then linked to an identity (e.g., through an identity provider), allowing users to establish trust in the origin of the signature and verify both the code's origin and integrity. However, this code-identity binding is only as trustworthy as the mechanisms enforcing it. State-of-the-art identity-based code signing schemes have a major shortcoming: they fail to provide verifiable information about the context in which a signature is generated. If an identity verification server is compromised or the signing client behaves maliciously, the resulting signature may falsely suggest a trustworthy origin, despite the absence of actual developer intent. To address these issues, we propose a diverse identity verification approach that reduces reliance on a single source of verification and enforces stronger guarantees around the signing process itself. By combining multiple identity signals with verifiable execution environments, our system improves confidence that signatures reflect the intent of a legitimate user, produced under expected conditions. Signing in our DiVerify prototype incurs only a few kilobytes of additional storage - less than 0.4% of the average package size in widely used ecosystems like PyPI, and signing complete in under 100ms on a typical deployment.