0Pricing
Cryptology Academy · Lesson

Signatures in the Wild: Code Signing & Email

Explore S/MIME, PGP, and how software is signed for distribution.

Signatures in the Wild: Code Signing & Email is a free Cryptology Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Welcome

Digital signatures protect software distribution and email communication. In this lesson we trace exactly how code signing and email signing work in practice.

macOS Code Signing

Apple Developer certificates contain an RSA/ECDSA public key. Xcode signs each app: signature = Sign(SHA256(app_bundle), dev_private_key). macOS Gatekeeper verifies before launch.

Windows Authenticode

Windows Authenticode signs PE executables. The signature is embedded in the binary. Windows checks the signature chain against Microsoft's trusted root store before execution.

APK Signing (Android)

Android apps are signed with the developer's keystore. APK v2/v3 signing covers the entire file. Google Play requires Play App Signing — Google holds the upload and signing keys.

npm Package Signing

npm now supports provenance attestations: each package includes a SLSA provenance statement signed by GitHub Actions OIDC. Verifies the build pipeline, not just the publisher identity.

Git Signed Commits

git config --global user.signingkey YOUR_KEY_ID git commit -S -m 'signed commit' Signed commits include a PGP/GPG signature of the commit hash. GitHub shows a 'Verified' badge.

S/MIME Email Signing

S/MIME signs email using X.509 certificates from CAs (Comodo, DigiCert, etc.). Outlook and Apple Mail verify signatures automatically. The signature covers headers + body.

PGP/GPG for Email

PGP uses a web of trust instead of CAs. Generate a key pair, upload public key to keyserver. Recipients fetch your key and verify. Used heavily in open-source communities.

DKIM Email Authentication

DKIM signs outgoing email headers with the domain's private key. The public key is published in DNS (TXT record). Receiving servers verify the signature to detect spoofing.

Software Update Signatures

OS update packages include a manifest signed by the vendor. Before applying: download manifest, verify signature, hash each file, compare with manifest. Any mismatch = reject.

Docker Image Signing: Cosign

Sigstore/Cosign signs container images with ECDSA keys stored in a cloud KMS. Signatures are stored in OCI registries. Kubernetes admission controllers can require signed images.

Quick Check

What does DKIM verify about an email?

Recap

Code signing and email signing rely on digital signatures everywhere. Next we study PKI and certificate authorities — the trust infrastructure behind it all.

Frequently asked questions

Is the “Signatures in the Wild: Code Signing & Email” lesson free?

Yes — the full text of “Signatures in the Wild: Code Signing & Email” is free to read here on the web, and the Cryptology Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO.

What will I learn in “Signatures in the Wild: Code Signing & Email”?

Explore S/MIME, PGP, and how software is signed for distribution. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Signatures in the Wild: Code Signing & Email” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. What Is a Digital Signature?
  2. RSA Signatures: Sign & Verify
  3. DSA & ECDSA Signature Schemes
  4. Signatures in the Wild: Code Signing & Email
← Back to Cryptology Academy