---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Signature generation during source control commit

# Signature generation during source control commit {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Signature generation during source control commit

This feature enables automatic generation of Code Signing signatures when committing application files to source control from a trusted ServiceNow instance.
Signatures are created inline during the commit process in ServiceNow Studio and are added to the same update set as their corresponding source records.
Both the source records and their signatures are then pushed together to the remote repository, ensuring every committed record is signed.
Show full answer Show less  

## How it works

* During commit, the trusted instance verifies eligibility for signature generation.
* Signatures are generated for each selected record matching a configured signature policy, including attachments and embedded Flow Designer records.
* Each signature is written to the same update set as its source record, so both are committed and pushed together.
* This process ensures that all records committed to source control have accompanying signatures, enabling validation on importing instances.

## Eligibility for signature generation

Signatures are generated during commit only when all these conditions are met:

* The feature is enabled on the instance.
* The instance is opted in to Code Signing via the Code Signing Enterprise plugin.
* The instance is trusted (not protected) and not enforcing signature validation.
* A code signing crypto module with an active signing key exists, established during the Circle of Trust setup.

If these conditions are not met, commits proceed without signature generation and no errors occur, preserving the existing commit flow.

## Considerations for ServiceNow customers

* This feature applies only to records committed through ServiceNow Studio applications.
* Records created directly on the instance require mass signing jobs or the Standalone Signing Tool to generate signatures.
* Records marked for deletion are not signed during commit; any prior signatures are cleaned up by the orphan signature cleanup job.
* Signature generation is independent of signature validation, which is a separate enforcement step on protected instances.

## Practical guidance

To leverage this feature, enable signature generation during commit on your trusted instance and commit application files from ServiceNow Studio as usual. Eligible records will be signed automatically, ensuring that source control commits include their signatures for improved integrity and validation downstream.  
Generate Code Signing signatures automatically when you commit application files to source control from a trusted instance. The signatures are added to the same update set as their source records and are pushed to the remote
repository together.

## Signature generation during commit {#cs-commit-signing__section_overview_commit_signing}

Signature generation during source control commit adds signing as an inline step in the application commit flow. When you commit selected files from an application in ServiceNow Studio, the trusted instance generates a signature for each eligible record. The files then advance to the commit confirmation screen. The source records and their signatures are committed to the same update set and pushed to the remote repository together. A commit can't complete while a signature is missing for a selected record, so every record pushed to the repository has a signature.

Without this feature, records are committed to source control without signatures. Signatures are then generated in a separate step through the mass signing jobs, and they don't travel with the source records. As a result, an
instance that imports the records can't validate them against a signature that was committed alongside them.

## How it works {#cs-commit-signing__section_how_it_works_commit_signing}

During a commit, the trusted instance first verifies that it's eligible to generate signatures. If the instance is eligible, it generates a signature for each selected record that matches a signature configuration, including the
record's attachments and embedded Flow Designer records. Each generated signature is written to the same update set as its source record, so the source records and their signatures are committed together. For example, five selected
records produce five signatures, for a total of ten files to commit.

## Eligibility for signature generation {#cs-commit-signing__section_eligibility_commit_signing}

A trusted instance generates signatures during commit only when all of the following conditions are met:

* The feature is turned on for the instance.
* The instance is opted in to Code Signing, which occurs when the Code Signing Enterprise plugin is installed.
* The instance isn't enforcing signature validation. Signatures can be generated only on a trusted instance, not on a protected instance.
* A code signing crypto module with an active signing key exists, which occurs after you upload the signing certificate during the Circle of Trust guided setup.

{#cs-commit-signing__ul_commit_signing_eligibility}  
Note:  
If an instance isn't eligible, the commit flow runs as it does without the feature. No signatures are generated and no error appears. This behavior keeps the commit flow unchanged for instances that don't use Code Signing.

## Considerations {#cs-commit-signing__section_considerations_commit_signing}

* Signature generation during commit applies to records committed from an application in ServiceNow Studio. To sign records created directly on the instance, use the mass signing jobs or the Standalone Signing Tool.
* Records with a delete action aren't signed during commit. If such a record has a previous signature, that signature isn't included in the update set and is removed by the orphan signatures cleanup job.
* This feature generates signatures. It's works independently of signature validation, which is the separate enforcement step performed on a protected instance.
{#cs-commit-signing__ul_commit_signing_considerations}
* **[Generate signatures when committing to source control](https://www.servicenow.com/docs/GiflZMTi~WEbCGrzlCidMQ)**   
  Turn on signature generation during commit and commit application files from ServiceNow Studio. Eligible records are signed automatically and pushed to the remote repository with their signatures.

**Related tasks**   

* [Generate signatures when committing to source control](https://www.servicenow.com/docs/GiflZMTi~WEbCGrzlCidMQ "Turn on signature generation during commit and commit application files from ServiceNow Studio. Eligible records are signed automatically and pushed to the remote repository with their signatures.")