Release notes for CodeSign Secure v3.1.0 (product version 3.01).
Release date: 09 May 2024. API version 3.01. Tested for deployment on Windows Server 2016 and Windows Server 2019; signing tested on Windows 10 and Windows 11.
| Area | Change |
|---|---|
| HSM health | HSM health is checked with the PKCS#11 mechanism, in line with industry standards and with more concrete results. The status is recorded in real time and cached for a period. |
| Key renewal | New, optional key renewal: after a certificate expires, a new certificate with the same key is generated for the same duration. |
| Team Management | New feature that restricts the use of a certificate and its private key to the members of a team. Team members can use only the certificates in their team, and only a Project Manager can assign certificates to a team. |
| Role-based access control | More than 30 System Admin permission options and five distinct roles, so each user gets exactly the access needed for code-signing operations. |
| Client reporting | Tracks the client systems that use the EC KSP for code signing, so auditors can see which systems perform signing. |
| Reproducible Build | Confirms build integrity: the same source code always produces the same binary with the same build environment and configuration, so a signed binary can be traced to the developer’s intended source code. |
| Build verification | Detects tampering with cryptographic hashes. If the verified hash doesn’t match the expected value, the signed binary may have been manipulated. |
| User interface | Redesigned for readability, filtering, and responsiveness. Caching across all routes for faster page loads, clear alerts for both successful and failed actions, and an options icon on each table, including an option to show all rows on one page. |
Release 3.01 raised the REST API version to 3.01 and added endpoints for registering users through Azure AD, setting a certificate’s key usage for reproducible builds, checking HSM health with the PKCS#11 mechanism, creating and listing teams, adding a certificate to several teams at once, the client report, and signing projects. Every current endpoint is listed in the API Reference.
| Defect in 3.0 | Fix in 3.01 |
|---|---|
| A user couldn’t register a new user or edit system permissions based on the appropriate roles. | User Management is fixed. You can onboard a new user through Azure AD, assign roles to the user, and manage role-based access control. |
| During signing, the certificate details API was called repeatedly, which increased the signing time. | The certificate details are cached in the EC KSP, which speeds up signing. |
| The main URL was hard-coded in the frontend JavaScript file. | All hard-coded values were removed and moved to the configuration file. |