Record when signing took place.
A trusted timestamp records the time associated with a signature. It is distinct from the current validity dates of the signing certificate.
Use the supported timestamp method.
Choose the timestamp service and algorithm supported by your signing tool, certificate provider and target platform. Check the signing output for timestamp errors.
Verify the final artifact.
Verify both the signature and the timestamp after the signing command completes. Validation behavior can depend on revocation status, platform rules and certificate trust.
Build a repeatable check.
- Sign the intended final artifact
- Attach a supported timestamp
- Check the verification output
- Retain release records for the signed file