Account settings

Keypair profile

Keypair profiles simplify keypair generation by preconfiguring values for all keypair options. For further profile controls by implement Teams. Keypair profiles are only enforced when enabled on your account.

To activate keypair profiles, tick the box; to deactivate keypair profiles, untick the box.

Key rotation

Key rotations allow you to set up a cycle that rotates 2-10 keys and certificates. This enhances security, automatically changing keys after a pre-determined period of time and after each signing so that you do not have multiple consecutive signings using the same key and certificate.

To activate key rotation, tick the box; to deactivate them, untick the box.

User selection

Enabling this feature allows you to assign individual users to a keypair.

To activate user selection, tick the box; to deactivate them, untick the box.

User group selection

Enabling this feature allows you to assign user groups to a keypair.

To activate user group selection, tick the box; to deactivate them, untick the box.

Dynamic key

When you create a dynamic keypair, you establish the parameters of your keypairs. Every 15 minutes, the dynamic keypair and certificate will be deleted and generate a new keypair and certificate using the same parameters as a replacement. This ensures that each signature is unique and adds an additional layer of security.

To activate dynamic keys, tick the box; to deactivate them, untick the box.

Keypair type

Select the format based on the specific requirements of your system or application using the certificate. Many systems and software libraries can handle both formats, so the choice often comes down to compatibility and the need for human readability.

Algorithms

Add or remove the following algorithms that users are allowed to choose from when creating a keypair:

Production key storage

Add or remove the following storage options that user's are allowed to choose from when creating production keys:

Comparison matches required

Comparing releases allows you to confirm that multiple releases have matching code and ensure that no bad actors or software has injected malicious code into your releases. Enter a value between 2 and 6 to set the required amount of matches required when completing a release comparison.

Enable keypair types for releases

Select or deselect the following types of keypairs that user's are allowed to assign to a release:

Release purpose

Select how you would like to use your release workflow:

Block signing if the CI/CD status fails

If the release purpose includes threat detection, select if you want to prevent signing if the threat detection scan status fails:

Restrict threat detection scans to releases

Threat detection scans tied to a release triggers the approval process, whereas scans completed outside of a release do not require approval.

All

Select this checkbox to include all the metadata below when signing.

Checksum after signature

Enabling this option generates and stores a checksum (a hash value) of the signed file after the code signing process. The checksum provides a way to verify the integrity of the file after it has been signed.

Checksum before signature

Enabling this option generates and stores a checksum before the code signing process. It can serve as a baseline for verifying the file's integrity before it was signed.

Digest algorithm

Enabling this option specifies the cryptographic hash algorithm used to create the hash value (checksum) for the file.

File location

Enabling this option includes the specific the location or path where the signed file should be saved after the code signing process is completed.

File name

Enabling this option allows you to configure the name of the signed file to determines what the signed file will be named once the signing process is done.

Signing tool

Enabling this option includes information about the tool or software used for code signing. It may include details about the version of the signing tool, its issuer, or other relevant information.

Timestamp

Enabling this option includes a timestamp in the digital signature. The timestamp indicates when the signature was applied to the file. It helps ensure the validity of the signature even if the certificate used for signing expires.

Timestamp URL

Enabling timestamping allows you to specify the URL of the timestamping authority or service that provides the timestamp. Timestamps are used to prove that the signature was applied at a particular time, which is important for long-term verification.

L0

Selecting this option disables RL levels and uses the default L5 scanning criteria.

L1

Selecting this option is suitable for CI/CD. The Threat detection scan will only fail under the most extreme conditions such as detection of:

L2

The Threat detection scan will fail under the conditions of L1, as well as:

L3

Selecting this option is suitable for automated software build process that occurs on a daily basis because it will catch the most severe issues prior to release. The Threat detection scan will fail under the conditions of L1, L2, as well as:

L4

Threat detection scan will fail under the conditions of L1, L2, L3, as well as:

L5 (default)

Selecting this option is recommended for software releases because it is the most secure level. Threat detection scan will fail under the conditions of L1, L2, L3, L4, as well as: