manifest signing

Why It Matters

Manifest signing is crucial for maintaining application integrity in environments where external parties may have access to or influence over the delivery of application resources. Without signing, attackers could modify manifest files to redirect users, inject malicious code, or alter app behavior.

In production environments, signed manifests prevent unauthorized changes to critical application metadata, such as app icons, names, or service worker registration paths. This is especially important for PWAs, where manifest files are used to define installability and offline capabilities. By ensuring manifest integrity, developers protect against supply chain attacks and maintain trust with end users.

How It Works

Manifest signing typically involves cryptographic techniques to create a digital signature for a manifest file. The signature is generated using a private key and validated using a corresponding public key. The process includes several key steps:

• The manifest file is serialized into a standardized format, often JSON.
• A cryptographic hash is computed over the manifest content to create a unique fingerprint.
• The hash is encrypted using a private key to produce a digital signature.
• The signature is embedded within the manifest or stored separately as a detached signature.
• When the manifest is loaded, the browser or runtime validates the signature using the public key to ensure integrity and authenticity.

Browser support for manifest signing is still evolving, with current implementations primarily focused on service worker contexts and secure delivery mechanisms. The signature verification process is usually automatic when the manifest is fetched by the browser, and failures result in manifest rejection.

Quick Reference

Basic Example

A basic example of manifest signing involves creating a signed manifest file that can be validated by a browser or runtime environment. This demonstrates the core concept of embedding a signature within a manifest.

{
  "name": "Secure App",
  "short_name": "Secure",
  "start_url": "/",
  "display": "standalone",
  "signature": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
}

This example shows a manifest with a signature field. The signature field contains a base64-encoded JWT token that represents the digital signature. In practice, this signature would be generated using a cryptographic library and validated by the browser during manifest loading.

Production Example

A production-ready manifest signing implementation includes proper cryptographic handling, secure key management, and validation procedures. This example demonstrates a more realistic approach to signing and validating manifests.

const crypto = require('crypto');
const fs = require('fs');

function signManifest(manifestPath, privateKeyPath) {
  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
  const manifestString = JSON.stringify(manifest);
  const signature = crypto
    .createSign('RSA-SHA256')
    .update(manifestString)
    .sign(fs.readFileSync(privateKeyPath), 'base64');
  
  manifest.signature = signature;
  return JSON.stringify(manifest, null, 2);
}

function validateManifest(manifestPath, publicKeyPath) {
  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
  const manifestString = JSON.stringify(manifest);
  const signature = manifest.signature;
  delete manifest.signature;
  
  return crypto
    .createVerify('RSA-SHA256')
    .update(manifestString)
    .verify(fs.readFileSync(publicKeyPath), signature, 'base64');
}

This production example shows a complete signing and validation workflow. It handles key management, cryptographic signing, and verification. The implementation is suitable for environments where manifest integrity is critical, such as enterprise applications or PWAs that require strong security guarantees.

Common Mistakes

• Using weak hash algorithms such as MD5 or SHA-1, which are vulnerable to collision attacks and should be avoided for security-critical applications.
• Storing private keys insecurely, such as in version control systems or public repositories, which exposes signing capabilities to attackers.
• Ignoring signature validation in production environments, which defeats the purpose of manifest signing and leaves applications vulnerable.
• Using unsigned manifests in production, especially in contexts where manifest integrity is required, such as service workers or PWA installations.
• Not implementing proper error handling for signature validation failures, which can cause silent failures or unexpected application behavior.

Security And Production Notes

• Always use strong cryptographic algorithms such as RSA-SHA256 or ECDSA-SHA256 for manifest signing to ensure resistance against known attacks.
• Store private keys securely using hardware security modules or secure key management systems to prevent unauthorized signing operations.
• Implement signature validation in all environments where manifests are loaded, not just development or staging.
• Use HTTPS for manifest delivery to prevent man-in-the-middle attacks that could alter signed content during transit.
• Regularly rotate signing keys and maintain a key management policy to handle key compromise or expiration scenarios.

Related Concepts

Manifest signing is closely related to several security and development concepts:

Service Worker registration involves loading and validating manifest files to enable app installation and background functionality. Manifest signing ensures that these files have not been tampered with during delivery.

Progressive Web Apps rely on manifest files to define installation capabilities and user experience behaviors. Signed manifests help ensure that PWA installations are not compromised.

Content Security Policy (CSP) works alongside manifest signing to control which resources can be loaded by an application, providing an additional layer of security.

Code signing is a broader concept that includes manifest signing, where digital signatures are used to verify the integrity and origin of software components.

Secure delivery protocols such as HTTPS and certificate pinning are complementary to manifest signing, ensuring that signed manifests are delivered securely.

Further Reading

• MDN Web Docs
• WHATWG HTML Standard
• Web App Manifest
• Service Workers
• Service Worker API