Menu
AppViewX AVX ONE Code Signing Datasheet
Fast, Reliable, and Secure Code Signing with AVX ONE
Code signing is a critical step in the software development cycle that helps protect software, build end-user trust, and maintain brand reputation.
The AppViewX AVX ONE Solution
Simplify and Secure Code Signing with AVX ONE
AppViewX AVX ONE Code Signing is a fast, reliable, and secure code signing solution built to protect the integrity of code, containers, software, and firmware. With a centralized and integrated approach, AVX ONE simplifies code signing for DevOps and streamlines security.
AVX ONE Code Signing seamlessly integrates with native signing tools, CI/CD pipeline and workflows to empower DevOps teams to securely sign code faster and more freely. Security teams can rest assured with full visibility and policy-driven control over private key storage and access.
Why AppViewX AVX ONE Code Signing
Secure
Seamless
Controlled
- Strong and compliant private key protection
- Integrated and seamless code signing at speed and scale
- Centralized visibility and policy-control
Challenges
- Code signing is a critical step in the software development cycle that helps protect software, build end-user trust, and maintain brand reputation.
However, traditional code signing processes, tools, and key storage options remain a significant challenge for organizations, creating operational and security risks. Private keys, which are at the heart of code signing, must be securely protected to ensure compliance and prevent private key theft or misuse.
Despite this, inadequate private key storage continues to expose organizations to serious code signing attacks, software supply chain weaknesses and data breaches. Further, ad hoc code signing processes and siloed tools complicate code signing for DevOps, impacting their efficiency and effectiveness. Security teams also struggle to monitor and control signing keys, access, and code signing events across distributed development teams.
AppViewX AVX ONE Code Signing Features
Strong Private Key Protection
- Private keys generated and stored securely in FIPS 140-2 certified HSMs (CA/B Forum compliant) to prevent key compromises
- Connects seamlessly and directly to FIPS-compliant cloud-based or on-premises HSMs for secure signing
- Flexibility to opt for on-premises HSMs, secure cloud HSMs or code signing as a service
- Application support for all standard asymmetric cryptographic algorithms, such as RSA, ECDSA, and DSA
- Readiness to support Post-Quantum Cryptography algorithms once they are enabled by the HSM
Integrated Code Signing
- Seamless integrations with multiple CAs (public and private CAs) and HSMs
- Integration with DevOps toolchains, CI/CD tools, and workflows, such as GitHub, GitLab, Jenkins, Bitbucket, and Azure DevOps
- Custom PKCS#11 & CSP interfaces that directly integrate with popular signing tools like Jarsigner, SignTool (etc.) for flexibility and compatibility
Centralized Code Signing
- Centralized service that makes signing easy and seamless for distributed development teams
- Central control for security teams to manage key and certificate access, monitor code signing events across the enterprise, and enforce policies
- Flexible code signing service that allows signing from native signing tools, CI/CD pipeline, API workflows, and directly from the AVX ONE Code Signing console
- Detailed audit logs and reports to track and monitor different files signed, time of signing, timestamping usage, and the certificate and key used for signing
- Support for client-side hashing to enable fast, reliable and efficient signing
- Flexible deployment options - on-premises and SaaS
Robust Policy and Compliance Engine
- Automated policy enforcement for users and code signing, including key usage permissions, approvals, key expiry, CA type, key size, signing algorithm type etc.
- User authentication and authorization through role-based access control to eliminate unauthorized signing
- Secure timestamping to ensure long term validity of code signing digital signatures
- Support for various certificate authorities, algorithms, and compliance frameworks to ensure industry and regulatory compliance
Versatile File Support
- Code signing support for a wide range of file types, including Windows applications, libraries, OCX files, kernel drivers, Apple software, Microsoft Office VBA objects, JAR files, .air or Centralized Code Signing .airi files, containers, and Android APK files
