English 
Tiếng ViệtCI/CD produces immutable release candidate
Software, container and firmware signing
CODE · DIGITAL TRUST PRODUCT / SOLUTION PROFILE
QuantumSafe Code & Firmware Signing
Controlled pilot
Protect software, container and device release chains with governed signing and long-lived verification.
CUSTOMER PROBLEM
Protect software, container and device release chains with governed signing and long-lived verification.
Software and device releases may remain trusted for years. Compromised signing keys or quantum-vulnerable verification paths can undermine the entire supply chain.
Controlled pilot
- Portfolio class
- Digital trust product / solution profile
- Public profile
- 2026.07
- Version rule
- Confirmed in quotation / release record
PRODUCT-SPECIFIC IMPLEMENTATION FLOW
How QuantumSafe Code & Firmware Signing operates from input to evidence.
CI/CD, artifact repositories, HSM, SBOM systems, device update and verification paths. Signed release corpus, approval logs, key-rotation tests and verifier compatibility report.
Policy engine verifies provenance and approvals
Secure Boot and OTA update trust chains
Signing service resolves protected release key
Offline or HSM-backed signing keys
HSM signs artifact and manifest
Maker-checker and release approval
Repository publishes signed package and SBOM
SBOM/provenance linkage
Device or platform verifies before install
Key rotation, revocation and emergency recovery
NAMED COMPONENTS AND RESPONSIBILITIES
What QuantumSafe Code & Firmware Signing contains and what each component does.
The descriptions below state concrete technical behaviour rather than generic support language.
Software, container and firmware signing
Signs executable packages, containers, firmware images and release manifests using profiles matched to each platform and verifier.
Secure Boot and OTA update trust chains
Builds trust chains for Secure Boot and OTA updates, including root rotation, rollback protection, anti-rollback counters and recovery images.
Offline or HSM-backed signing keys
Keeps release keys offline or in HSM custody, separates production from test keys and prevents CI workers from accessing private material.
Maker-checker and release approval
Requires maker-checker approval with release identity, source commit, build provenance, vulnerability state and target environment before signing.
SBOM/provenance linkage
Links the signature to SBOM, provenance attestation, build metadata and release ticket so the artifact can be traced to its approved source.
Key rotation, revocation and emergency recovery
Defines compromise response, emergency revocation, replacement-key rollout and legacy-verifier strategy before a signing key is activated.
- Release approval workflow
- Offline or protected signing keys
- Firmware/secure-boot migration path
CI/CD, artifact repositories, HSM, SBOM systems, device update and verification paths.
On-premises trust service
CA, signing, TSA or release components run in a customer-controlled trust boundary with protected keys.
Dedicated private platform
Service components run in a dedicated private-cloud or appliance topology with HSM/QSCD integration.
Coexistence migration
Classical and target profiles are introduced in phases with relying-party testing, evidence and rollback gates.
- Signed release corpus, approval logs, key-rotation tests and verifier compatibility report.
- Version and configuration manifest for: CI/CD, artifact repositories, HSM, SBOM systems, device update and verification paths.
- Negative, failure and recovery tests for “Repository publishes signed package and SBOM” and “Device or platform verifies before install”.
- Signed acceptance record, accountable owner, published limitations and next review date.
STANDARDS & PROFILES
- Code-signing and firmware-signing profiles
- Secure Boot / OTA trust chains
- SBOM / provenance concepts
- HSM-backed release controls
PRODUCT-SPECIFIC BOUNDARIES
Conditions that must remain true for QuantumSafe Code & Firmware Signing.
These points come from the product profile, not from a shared disclaimer.
NEXT STEP
Define a controlled pilot: QuantumSafe Code & Firmware Signing
Select one application, exact versions, measurable acceptance criteria and rollback.