1# Code Signature
2
3## Introduction
4
5The code signature component implements the code signing mechanism of OpenHarmony, which provides validity check and integrity protection for apps in runtime, eliminating execution of malicious code on devices and malicious tampering of app code by attackers.
6
7Architecture of the code signature component
8
9![](figures/codesign_en.png)
10
11The code signature component provides the following functions:
12
13- Trusted certificate management: imports the device certificate and local code signing certificate and validates the certificate chain and its trusted source.
14- Code signing enabling: provides APIs in user mode to enable code signing of apps or code files during installation.
15- Local code signing: runs the signing service on the device and provides interfaces to sign local code (e.g. native code generated by the AOT).
16- Code attribute setting: provides APIs for setting the code owner ID and initializing the XPM region.
17
18## Directory Structure
19
20```
21/base/security/code_signature
22├── interfaces                   # Interface layer
23│   └── innerkits                #
24│       ├── code_sign_attr_utils # APIs for setting code signing attributes
25│       ├── code_sign_utils      # APIs for enabling code signing
26│       ├── common               # Common basic capacities
27│       └── local_code_sign      # APIs for local code signing
28├── services                     # Service layer
29│    ├── key_enable              # Certificate initialization
30│    └── local_code_sign         # Local code signing service
31├── test                         # Test cases
32│    ├── fuzztest                # Fuzz test cases
33│    └── unittest                # Unit test cases
34└── utils                        # Common basic capabilities
35```
36
37## Usage
38### Available APIs
39
40| **API**| **Description**|
41| --- | --- |
42| int32_t EnforceCodeSignForApp(const EntryMap &entryPath, const std::string &signatureFile); | Enforces code signing for HAPs.|
43| int32_t EnforceCodeSignForApp(const std::string &path, const EntryMap &entryPathMap, FileType type); | Enforces code signing for HAPs.|
44| int32_t EnforceCodeSignForFile(const std::string &path, const ByteBuffer &signature); | Enforces code signing for files.|
45| int32_t EnforceCodeSignForAppWithOwnerId(std::string ownerId, const std::string &path, const EntryMap &entryPathMap, FileType type); | Enforces code signing for HAPs with the owner ID.|
46| int ParseOwnerIdFromSignature(const ByteBuffer &sigbuffer, std::string &ownerID); | Parses the owner ID from the signature.|
47| int32_t EnableKeyInProfile(const std::string &bundleName, const ByteBuffer &profileBuffer); | Trusts a developer certificate.|
48| int32_t RemoveKeyInProfile(const std::string &bundleName); | Revokes a trusted developer certificate.|
49| int32_t InitLocalCertificate(ByteBuffer &cert); | Initializes a local code signing certificate.|
50| int32_t SignLocalCode(const std::string &filePath, ByteBuffer &signature); | Signs the local code.|
51| int32_t SignLocalCode(const std::string &ownerID, const std::string &filePath, ByteBuffer &signature); | Signs the local code with the owner ID.|
52| int InitXpm(int enableJitFort, uint32_t idType, const char *ownerId); | Initializes XPM related resources(XPM region, JitFort, OwnerId).|
53| int SetXpmOwnerId(uint32_t idType, const char *ownerId); | Sets an owner ID.|
54
55### Usage Guidelines
56
57[hapsigner User Guide](https://gitee.com/openharmony/developtools_hapsigner/blob/master/README.md)
58
59## Repositories Involved
60
61**[developtools\_hapsigner](https://gitee.com/openharmony/developtools_hapsigner/blob/master/README.md)**
62
63**[kernel_linux_common_modules](https://gitee.com/openharmony/kernel_linux_common_modules)**
64
65**[third\_party\_fsverity-utils](https://gitee.com/openharmony/third_party_fsverity-utils/blob/master/README.md)**
66