Standards-to-Surface Artifact

This repository contains the artifact for the paper:

Standards-to-Surface: A Comprehensive Evaluation of Windows Code-Signing (Non)Compliance

The artifact is submitted for the NDSS 2027 Artifact Evaluation Available badge. It contains the source code, supporting scripts, and labeled certificate dataset used in the paper's large-scale study of code-signing certificate compliance and Windows client-side verification behavior.

Contents

The artifact contains three top-level directories:

• CSLint/
• AuthentiCheck/
• Cert_Dataset/

CSLint/

CSLint/ contains the source code of CSLint, a certificate linting tool extended from ZLint for evaluating code-signing certificate compliance.

• CSLint/code/ contains the CSLint source tree. It follows the ZLint project structure and includes the command-line frontend, lint registry, utility code, test data, integration test infrastructure, and code-signing certificate lints.
• CSLint/cslint_specific_lints.md documents the 31 additional CSLint lints introduced beyond ZLint. These lints capture code-signing-specific requirements and differences between code-signing certificate requirements and TLS certificate requirements.
• CSLint/instruction.md provides basic setup and usage instructions for building and running CSLint.

AuthentiCheck/

AuthentiCheck/ contains the source code and scripts for AuthentiCheck, the framework used to evaluate how different Windows verification surfaces handle PE samples signed by non-compliant certificates.

• cert_clone_gen3.py performs certificate cloning, certificate-chain reconstruction, and sample re-signing.
• auto_test_framework/ contains scripts for automating checks across nine verification surfaces studied in the paper.
• utils/ contains helper scripts for preparing roots, exporting trusted roots, downloading samples, and supporting the automation workflow.
• instruction.md provides basic setup and usage instructions for AuthentiCheck.

Cert_Dataset/

Cert_Dataset/ contains the labeled dataset of non-compliant code-signing certificates identified by CSLint and used in the paper.

• original_leaf_certs/ contains the original leaf certificates before cloning.
• cloned_leaf_certs/ contains the cloned counterparts generated for AuthentiCheck experiments.
• cslint_leaf_error.txt records certificates that triggered CSLint errors and the specific lint entries triggered by each certificate.
• cslint_leaf_warn.txt records certificates that triggered CSLint warnings and the specific lint entries triggered by each certificate.
• cert2sample.csv records mappings between certificates and their associated signed samples.

The dataset contains 44,924 non-compliant certificates after merging and deduplicating the error and warning sets described in the artifact appendix.

License

See LICENSE for licensing terms. CSLint is extended from ZLint and retains upstream ZLint copyright and Apache License notices where present.