BS ISO/IEC 17960:2015 pdf download-Information technology — Programming languages, their environments and system software interfaces — Code signing for source code.
6.3 Hash code A digital signature shall be generated on the source code using the private key of the originator. The signature technique to be used shall be one of those specified in ISO/IEC 9796-3 or ISO/IEC 14888. Generation of a signature using one of the techniques specified involves the use of a hash-function to compute a hash code of the source code. The preferred hash-function to be used shall be the Secure Hash Algorithm-256 (SHA-256), as specified in ISO/IEC 10118-3; alternatively another hash-function specified in ISO/IEC 10118-3 could be used. The recipient shall then use the originator’s public key to verify that the source code file has not been altered since it was digitally signed so that the history of the source can be traced back to the first signed version. 6.4 Initial code signing The initial signing of a source code file may be in any format such as a snapshot or a changeset. If a changeset is used, it should be based on an empty file. 6.5 Modifying signed previous versions Sufficient information shall be recorded in a signed version to allow the source code file and digital signature of the signed previous version to be recovered. This allows the series of modifications from one version to the next, which can be thought of as encapsulations, to be reversed one at a time. The information contained in each encapsulation shall contain sufficient revision control information in order to recreate the previous version. Once an encapsulation is reversed, the recipient shall be able to use the digital signature of the encapsulated version to verify its integrity. A mechanism shall allow for the recreation of the most recently signed version of the source code. It is implementation-defined whether intermediate unsigned versions can also be recreated by this mechanism. 6.6 Revision format This International Standard is not prescriptive as to which format shall be used to create or track revisions.