What is Software Integrity?

Understanding Software Integrity

Software integrity is the assurance that a software application is authentic, unaltered, and operates exactly as its developer intended, free from unauthorized modification, tampering, or hidden malicious code. It confirms that the code a user runs is genuinely the code that was built and published, throughout development, distribution, and execution.

Software integrity is enforced primarily through cryptographic verification. Developers sign their code or installers with a private key (code signing), and the operating system or runtime validates the signature against a trusted certificate before allowing execution, proving both origin and that nothing changed since signing. Hash values such as SHA-256 let users verify downloads, while runtime integrity checks, secure boot, and reproducible builds extend assurance into installation and execution.

Software integrity matters because compromised software is one of the most damaging attack vectors. If an attacker can alter a trusted application or its update channel, they distribute malware to every user under the cover of legitimacy, the essence of a supply-chain attack. Integrity controls also defend against tampered patches, trojanized installers, and unauthorized modification of running code. Without them, users have no way to distinguish a legitimate program from a weaponized counterfeit.

For example, in a software supply-chain attack, adversaries inserted malicious code into a vendor's build pipeline so the tampered update was signed with the vendor's own certificate and pushed to thousands of customers. Strong software integrity practices, reproducible builds that detect unexpected changes, hardened signing infrastructure, and customer-side verification of artifact hashes, are designed to catch exactly this kind of alteration before the code is trusted and run.