What does code signing prove, and why does it matter for software that is downloaded from the internet?

It proves who published the code and that it has not been changed since it was signed; it does not prove the code is safe.

The publisher hashes the program or script and signs the hash with a code-signing private key. Before running it, the operating system checks the signature against the publisher's certificate:

• Origin: the certificate names the publisher, vouched for by a CA.
• Integrity: any modification after signing, such as malware inserted on a download mirror, breaks the signature.

Unsigned software offers neither. A popular open-source tool re-hosted with a trojan inside looks exactly like the original. That is the attack code signing defeats, and why systems warn about or block unsigned executables, drivers and scripts.

The limits: a signature says who, not whether it is benign. Stolen signing keys have been used to sign malware (Stuxnet's drivers carried valid signatures from stolen certificates). And trust is relative: a certificate from a private company CA is trusted only inside that company; for public distribution the certificate must come from a CA in everyone's trust store.

Go deeper:

• Wikipedia: Code signing — how it works, timestamping, and misuse with stolen keys.