Code Signing and Verification

Overview

Nefia release binaries are protected with three layers of signing:

1. Ed25519 signatures — detached signatures common to all platforms
2. macOS Developer ID + Notarization — Gatekeeper-compatible signing
3. Windows Authenticode — SmartScreen-compatible DigiCert signing

Verifying Binaries

Verify the Running Binary

nefia verify --self

Verify an Arbitrary Binary

nefia verify /path/to/nefia_linux_amd64
nefia verify ./nefia-agent.exe

Verify Against a Specific Version

nefia verify --self --version v1.2.3

Verification Flow

Verification result:

{
  "status": "pass",
  "file": "/usr/local/bin/nefia",
  "artifact_name": "nefia_darwin_arm64_v1",
  "expected_hash": "sha256:abc...",
  "actual_hash": "sha256:abc...",
  "version": "v1.2.3"
}

Release Manifest

manifest.json contains the SHA-256 hashes of all artifacts included in the release:

{
  "schema_version": 1,
  "version": "v1.2.3",
  "artifacts": {
    "nefia_darwin_arm64_v1": "sha256:...",
    "nefia_linux_amd64_v1": "sha256:...",
    "nefia-agent_windows_amd64.exe": "sha256:..."
  }
}

Signed Artifacts

CI/CD Signing Sequence

1. GoReleaser cross-compiles (darwin/linux/windows x amd64/arm64)
2. Ed25519 signs all binaries → *.sig files
3. rcodesign applies Developer ID signing + Apple Notarization to macOS binaries
4. DigiCert ONE (cloud HSM) applies Authenticode signing to Windows binaries
5. Manifest generation — SHA-256 hashes of all artifacts
6. Manifest signing → manifest.json.sig

Security Specifications