Exactly how does code-signing help software publishers?

Question

I've just finished my first ever code-signing for my app, thanks to the help from Jeff Wilcox's blog, with his step-by-step instructions, I was able to finish the whole thing in less than 36 hours. But now I start to wonder why I spent the money, because I just can't see how it helps software publishers:

1. There are hackers out there trying to break the protection mechanism in the program by reverse-engineering and modifying the code. But signing the file doesn't prevent this from happening, they still can modify the file's content at will.

2. Sometimes some anti-virus programs may falsely believe my .exe file contains virus. Signing the file doesn't help with that either.

3. Code-signing can only tell the users that this file comes from me, but they still don't know if I'm a good or bad guy. So it's not helping for the users either.

My conclusion is that code-signing is not designed to help software publishers or users. It only tries to keep track of where a file comes from, if it contains a virus, people'd know who planted it, and that's it! (This is true only when hackers are unable to piggy-back a virus into a signed .exe file.)

My question is: Is my understanding correct? Or did I miss something? Thank you.

Answer 1

Signing confirms the authenticity of the code, i.e. that this is the code you released, and it has not been tampered with along the way. This has nothing to do with silly code protection, it's a protection for users from imposter software — a single byte modification in the image invalidates the signature. Trust is a whole different matter altogether (AV scanners might trust signed executables a bit more than plain unsigned ones, but it's something to discuss with AV vendors).