What is Azure Artifact Signing?
Azure Artifact Signing (also known as Azure Code Signing or Trusted Signing) is a managed service for signing software artifacts such as container images, binaries, and packages. The service uses Hardware Security Modules (HSMs) for secure key management and enables integration into CI/CD pipelines.
Signed artifacts can be verified by recipients to ensure integrity and provenance.
Core Features
- Container image signing with Notation (CNCF standard)
- HSM-protected key management without own hardware
- Integration with Azure Container Registry (ACR)
- Support for various signature formats
- Audit logging of all signing operations
- RBAC-based access control for signing keys
Typical Use Cases
Container supply chain security: Sign container images before pushing to the registry. Kubernetes can be configured to only deploy signed images.
Software distribution: Sign installation packages and binaries so end users can verify the authenticity of the software.
Compliance requirements: Demonstrable code signing for regulated industries like financial services or healthcare.
Benefits
- No own HSM management required
- Seamless integration with Azure DevOps and GitHub Actions
- Reduced complexity compared to self-hosted solutions
- Centralized management of all signing keys
Frequently Asked Questions
Which artifact types are supported?
Azure Artifact Signing supports container images (OCI format), Windows binaries, NuGet packages, and other formats. The Notation integration enables signing container images according to the CNCF standard.
How are the signing keys protected?
All private keys are stored in FIPS 140-2 Level 2 certified Hardware Security Modules (HSMs). The keys never leave the HSM.
Can I use existing certificates?
For some scenarios, custom certificates can be imported. For container signing, Azure-managed certificates that are automatically renewed are recommended.
How do I verify signed artifacts?
Container images can be verified using the Notation CLI or integrated Kubernetes admission controllers. Public certificates are provided in Azure Key Vault or a trust store.
Integration with innFactory
As a Microsoft Solutions Partner, innFactory supports you with Azure Artifact Signing: implementation in CI/CD pipelines, Kubernetes integration, and supply chain security.
