Signing Workflows

Explore different code signing workflows supported by QCecuring.

Digest-Based Signing

Digest-based signing is the recommended and most secure workflow. Clients compute a cryptographic hash (digest) locally and submit only the digest to the signing API. The platform signs the digest using HSM-protected keys and returns the signature for local attachment to the artifact.

Why use it:

• Minimizes transfer of sensitive or large artifacts
• Works with large binaries and CI/CD pipelines
• Keeps private keys inside HSM/KMS boundaries

Basic Steps

1. Compute digest locally (SHA-256 example):

openssl dgst -sha256 -binary myapp.exe > digest.bin
base64 digest.bin > digest.txt

2. Submit digest to the API:

curl -X POST https://api.example.com/api/v1/sign/digest \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"digest":"<base64-digest>", "algorithm":"sha256", "metadata": {"filename":"myapp.exe"}}'

3. Platform signs the digest using HSM and returns a signature (and optional RFC 3161 timestamp token).

4. Attach signature to the artifact using platform-specific tools (jarsigner/signtool) or bundle the signature with metadata.

Best Practices

• Always use binary digest (not hex string) and a well-defined encoding (base64 recommended).
• Verify signature locally after receiving it to ensure correct algorithm and chain.
• Use timestamping to preserve signature validity beyond certificate expiry.

Asynchronous Signing

For high-volume or non-blocking pipelines, use asynchronous signing. The API accepts the digest request and returns immediately with a request identifier; workers process the job in the background and update status when completed.

Flow

1. Client POSTs digest → API responds with 202 Accepted and { "requestId": "abc123" }.
2. Worker services dequeue jobs and call HSM to sign digests.
3. Client polls /api/v1/sign/requests/{requestId} to obtain final status (QUEUED, PROCESSING, SIGNED, FAILED).

Example request:

curl -X POST https://api.example.com/api/v1/sign/digest -H "Authorization: Bearer $TOKEN" -d '{"digest":"<base64>","async":true}'
# Response: {"requestId":"abc123"}

# Poll
curl https://api.example.com/api/v1/sign/requests/abc123 -H "Authorization: Bearer $TOKEN"
# Response: {"status":"SIGNED","signature":"...","timestamp":"..."}

Operational notes

• Monitor queue depth and worker latency; scale workers based on queue metrics.
• Use dead-letter queues for persistent failures and implement idempotency tokens to avoid double processing.

Quorum Approvals

Quorum approvals add human oversight to sensitive signing operations. Policies can require N approvals from an approver group before the request is signed.

Flow

1. Client submits digest marked as requiring approval.
2. Platform marks request PENDING_APPROVAL and notifies approvers.
3. Approvers review metadata and approve/reject via the portal or API.
4. Once threshold reached, the request is queued for signing and processed by workers.

Example approver API

• POST /api/v1/approvals/{id}/approve — Approve a pending request
• GET /api/v1/approvals/{id} — View approval status

Best practices

• Define approver groups with clear separation of duties.
• Keep audit trails for approvals and require justification/comments for sensitive approvals.