← Years 9–10 Digital Systems

Code signing and trusted sources

Code signing adds a digital signature to software so a computer can check it came from the named publisher and has not been changed since it was signed.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 68, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 68

Understanding Code signing and trusted sources in Years 9–10 Digital Systems

What it does: An official publisher website is a trusted source. Files from random mirror sites or pop-up ads may have been changed or may carry malware. This is the result of successful code signing: the signature is valid, so the publisher is confirmed and the file is unchanged since it was signed. A digital signature proves who published the software and that the code has not been altered. It does not promise the software is bug-free. An unsigned or unknown-publisher warning means the computer cannot confirm who made the software. Pause and check the source first. Official sources are more likely to offer genuine, signed software. Links from strangers could lead to fake or tampered copies.

Common mistakes: The check must test the digital signature, not just whether the file exists. A file can exist and still be fake or changed. It should be IF signature_valid(file) THEN. When the hash you calculate matches the published hash, the file has not been changed. The message should be print('File unchanged').

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Code signing and trusted sources to a class →

This module's key terms are also in a printable crossword (Modules 41–69) and word search (Modules 41–79).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
What does code signing let a computer check about a piece of software?
It came from the named publisher and has not been changed since signingIt is free to download and has no bugs
Matches
Warning: Unknown publisher. Click Run anyway.
↓
Ignoring an unsigned software warning. The software has no valid signature, so you cannot tell who made it or whether it was changed. Stop and get it from the official source instead.
Applying
Meanings
Term
Code signing
Meaning
Code signing adds a digital signature to software so a computer can check it came from the named publisher and has not been changed since it was signed.
Practice
installer <- download from official site
Testing
Gaps
IF computedHash publishedHash THEN
Check Answer
Spots
1file <- get(official_site)
2IF file_exists(file) THEN

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Manta Ray' badge — Graceful Coder, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. What does code signing let a computer check about a piece of software?
A. It came from the named publisher and has not been changed since signing ✓
B. It is free to download and has no bugs
A digital signature proves who published the software and that the code has not been altered. It does not promise the software is bug-free.
2. Your computer shows a warning that an app is from an 'unknown publisher'. What is the best response?
A. Stop and check where the app came from before installing ✓
B. Click through the warning because it is probably fine
An unsigned or unknown-publisher warning means the computer cannot confirm who made the software. Pause and check the source first.
3. Which download source is the safest choice for a new app?
A. The official app store or the publisher's own website ✓
B. A link sent by a stranger in a chat message
Official sources are more likely to offer genuine, signed software. Links from strangers could lead to fake or tampered copies.
4. A program has a valid digital signature from its publisher. What does this tell you?
A. The code can never contain any security flaws
B. The code has not been altered since the publisher signed it ✓
A signature shows origin and integrity only. A publisher can still sign software that has flaws, so keep software updated.
5. A website publishes a hash next to its download. How do you verify the file?
A. Check that the file name looks the same as the one on the website
B. Calculate the hash of your downloaded file and check it matches the published one ✓
If the two hashes match, the file is unchanged. If they differ, the file may be corrupted or tampered with, so do not run it.

Match the Pairs

Publisher: Unknown publisher → An unsigned software warning: the installer has no valid digital signature, so the computer cannot confirm who made it or that it is unchanged.
sha256sum setup.exe → Creates a hash of the downloaded file so you can compare it with the hash the publisher published and check the file has not been changed.
Download software only from the official source, where the publisher controls the file. → https://www.mozilla.org/firefox/
A valid digital signature lets the computer check the software came from the named publisher and has not been changed. → Digital signature: Valid | Publisher: Mozilla Corporation
Warning: Unknown publisher. Click Run anyway. → Ignoring an unsigned software warning. The software has no valid signature, so you cannot tell who made it or whether it was changed. Stop and get it from the official source instead.
Hash on download site = Hash from the same site's mirror, so file is safe → Comparing a hash that came from the same untrusted place as the file. An attacker could change both. The hash must come from the official publisher's own website.

Key Term

Code signing
Code signing adds a digital signature to software so a computer can check it came from the named publisher and has not been changed since it was signed.

Fill in the Blanks

1. IF computedHash = publishedHash THEN
Hint: Type the operator that checks whether the two hashes are equal.
2. sha256sum installer.exe
Hint: Type the command that calculates the SHA-256 hash of a downloaded file.
3. IF signatureValid = FALSE THEN warnUser
Hint: Type the Boolean value that means the signature check failed.
4. IF signed = TRUE THEN install(file) ELSE block(file) ENDIF
Hint: Type the keyword for what happens when the software is not signed.
5. IF NOT fromOfficialSite THEN cancel(file)
Hint: Type the Boolean operator that reverses a true or false value.

Spot the Error

Question 1
A file <- get(official_site)
B IF file_exists(file) THEN
C install(file)
D ELSE delete(file)
Line B — The check must test the digital signature, not just whether the file exists. A file can exist and still be fake or changed. It should be IF signature_valid(file) THEN.
Question 2
A published <- 'a3f9'
B actual <- sha256(file)
C IF actual = published THEN
D print('File was changed')
E ELSE print('Do not install')
Line D — When the hash you calculate matches the published hash, the file has not been changed. The message should be print('File unchanged').
Question 3
A app <- open_installer()
B IF app.signed = true THEN
C show_warning()
D cancel_install()
Line B — The unsigned software warning should appear when the app is NOT signed. The condition should be app.signed = false, not true.
Question 4
A trusted <- ['vendor.com']
B site <- 'vendor.com'
C IF site NOT IN trusted THEN
D download(site)
Line C — Downloads should only happen when the site IS in the trusted list of official sources. NOT IN would allow downloads from untrusted sites. It should be IF site IN trusted THEN.
Question 5
A sig <- file.signature
B ok <- verify(file, sig, priv)
C IF ok THEN run(file)
Line B — A signature is checked with the publisher's public key. The private key stays secret with the publisher. It should be verify(file, sig, pub).

Student with a class code? Join your class →