How SolarWinds Busted Up Our Assumptions About Code Signing

Changes injected into a software build pipeline or continuous integration (CI) process will be included in the signed final product, altogether defeating the purpose of the signature.