Software Trust API

DigiCert® Software Trust Manager API lets you automate code signing operations, manage signing keys and certificates, scan software for vulnerabilities, and enforce secure release workflows for your software supply chain.

What you can do

• Manage signing keys: Create and manage keypairs in FIPS-compliant HSMs for secure code signing operations.
• Sign code and artifacts: Execute cryptographic signing operations for binaries, containers, packages, and scripts.
• Scan software: Analyze software releases for security vulnerabilities and open-source license compliance issues.
• Control release workflows: Define release windows with approval gates and signature limits to enforce secure development practices.
• Rotate keys: Automate key rotation schedules to maintain cryptographic hygiene and compliance.
• Monitor operations: Query audit logs and signature logs to track all signing activities and key usage.

Authentication

Keypairs and signing

Software Trust Manager stores private keys in FIPS 140-2 Level 3 certified HSMs so your cryptographic material never leaves secure storage.

Keypair types

• Standard keypairs: RSA, ECDSA, or EdDSA keys for signing binaries, documents, and artifacts
• GPG keypairs: GNU Privacy Guard keys for package signing (RPM, DEB, etc.) and cryptographic operations

Signing workflow

1. Create or import a keypair using /api/v1/keypairs or /api/v1/gpg-keypairs endpoints.
2. Generate a certificate for the keypair (for standard keypairs) or use existing GPG identity.
3. Call the sign endpoint /api/v1/keypairs/{keypair_id}/sign with your hash or data.
4. Receive the signature to attach to your artifact.

Certificate hierarchies

Software Trust Manager allows you to create custom certificate hierarchies for code signing certificates.

Hierarchy workflow

Hierarchies define the chain of trust for issued certificates. Create a hierarchy specifying root and intermediate CA certificates, then associate certificate profiles with that hierarchy. Certificates generated through those profiles will chain to your custom PKI.

Hierarchy states

• Pending: Hierarchy created but awaiting approval.
• Approved: Hierarchy is active and can be used for certificate issuance.
• Suspended: Hierarchy temporarily inactive; no new certificates can be issued.
• Locked: Hierarchy configuration is locked to prevent modifications.

Release windows

Release windows provide governance and approval controls for software releases, enforcing secure development practices.

What is a release window?

A release window is a time-bound approval gate that controls when and how much code can be signed. It combines the following metrics:

• Time boundaries (start and end dates)
• Signature limits (maximum number of signing operations)
• Approval requirements (who must approve before signing)
• Associated resources (scans, keypairs, certificates)

Release window workflow

1. Create a release window with defined parameters and resource mappings.
2. Request approval from designated approvers.
3. Once approved, the window becomes active.
4. Signing operations are allowed within the window’s constraints.
5. Close the release window when the release cycle completes.

Software scans

Software Trust Manager integrates with FOSSA to provide security and compliance scanning for software releases.

Scan capabilities:

• Vulnerability detection in dependencies
• Open-source license compliance checking
• Software composition analysis (SCA)
• Integration with release windows for approval workflows

Scans can be associated with release windows to ensure that only validated, secure software releases proceed to signing. Use /api/v1/scans endpoints to retrieve scan results and /api/v1/release-windows/{release_window_id}/map-resources to associate scans with release windows.

Teams and access control

Teams provide fine-grained access control for signing resources. They also enable delegation and separation of duties. Team-based access allows you to:

• Organize users into teams with specific responsibilities.
• Map resources (keypairs, certificates, release windows) to teams.
• Control which teams can access which signing assets.
• Enforce multi-person approval for sensitive operations.

Use /api/v1/teams endpoints to create teams and map resources. Multi-person approval requests ensure that critical operations require consensus from more than one authorized individual.

Roles and permissions

Assigned roles determine a user’s permissions. Roles are manager-specific and provide a granular permission structure.

Use the /account/api/v1/role endpoint to see available roles for Software Trust Manager:

curl -X GET https://demo.one.digicert.com/account/api/v1/role?application_code=secure_software_manager \
  -H "x-api-key: USER_API_TOKEN" \
  -H "Content-Type: application/json" | jq '.'

Important considerations

• Private keys never leave the HSM. All signing operations occur within FIPS-certified hardware security modules. Keypair export requires approval workflows and is only available in specific scenarios.
• Keypair suspension is immediate. Suspending a keypair prevents all signing operations immediately. Use suspension when you suspect key compromise or need to temporarily halt signing.
• Certificate profiles define issuance parameters. Before generating certificates, configure certificate profiles that specify validity periods, key usage, and extended key usage attributes.
• Release windows enforce governance. Use release windows to control signing operations during development cycles. Signature limits prevent runaway signing and enforce controlled release practices.
• GPG keypairs require special handling. GPG keypairs are managed separately from standard keypairs. Use /api/v1/gpg-keypairs endpoints and note that GPG keyring operations use different formats.
• Audit logging is comprehensive. All signing operations, key operations, and approval actions are logged. Use /api/v1/audit-log and /api/v1/signatures endpoints to maintain complete audit trails.

Common operations