Package integrity is confidence that a software package remains unchanged from its trusted build or release through delivery. Digital signatures can help establish who produced a package and whether it has been modified; cryptographic hashes let defenders compare a file with a trusted reference. These checks are only useful when the signing keys or reference values themselves come from a trustworthy source.
Integrity matters because attackers may tamper with software in a build system, update channel, or distribution package, causing users to receive malicious code disguised as a legitimate release. A suspect package does not, by itself, prove that it was installed or executed. Defenders should verify the package’s source and signature or hash, preserve relevant files and update records, and investigate any installation separately. This helps distinguish a delivery-chain risk from a confirmed compromise of a system.