A method for ensuring the trustworthiness of software source code (source code), wherein - at least a first software developer (A) and a second software developer (B) for programming the source code are registered (S1), wherein data assigned to the respective software developers (A, B), together with a public signature key (PubA, PubB) belonging to the respective software developer (A, B), are imported into a secure infrastructure (DCUA), - the first software developer (A) signs the source code created by him with his private signature key (PrivA) and the second software developer (B) signs the source code (C1) signed by the first software developer (A) with his private signature key (PrivB) (S2), - the source code (C2) signed by both software developers (A, B) is stored in a source code server (QS) (S3), - a compiling device (CE) arranged in the secure infrastructure (DCUA) - imports the signed source code (C2) from the source code server (QA) into the secure infrastructure (DCUA) (S4), - checks whether the imported source code has been signed with private signature keys (PrivA, PrivB) belonging to the imported public signature keys (PubA, PubB) (S5.1), and - translates the imported source code into executable binary code (S5.2), and - the compiling device (CE) signs the binary code in the secure infrastructure (DCUA) with a private signature key (PrivCE) assigned to the compiling device and exports the signed binary code (C3), together with the public key (PubCE) belonging to the private signature key (PrivCE) of the compiling device, to a binary code server (BS) outside the secure infrastructure (DCUA) and provides same on said server for further use (S6). - at least a first software developer (A) and a second software developer (B) for programming the source code are registered (S1), wherein data assigned to the respective software developers (A, B), together with a public signature key (PubA, PubB) belonging to the respective software developer (A, B), are imported into a secure infrastructure (DCUA), - the first software developer (A) signs the source code created by him with his private signature key (PrivA) and the second software developer (B) signs the source code (C1) signed by the first software developer (A) with his private signature key (PrivB) (S2), - the source code (C2) signed by both software developers (A, B) is stored in a source code server (QS) (S3), - a compiling device (CE) arranged in the secure infrastructure (DCUA) - imports the signed source code (C2) from the source code server (QA) into the secure infrastructure (DCUA) (S4), - checks whether the imported source code has been signed with private signature keys (PrivA, PrivB) belonging to the imported public signature keys (PubA, PubB) (S5.1), and - translates the imported source code into executable binary code (S5.2), and - the compiling device (CE) signs the binary code in the secure infrastructure (DCUA) with a private signature key (PrivCE) assigned to the compiling device and exports the signed binary code (C3), together with the public key (PubCE) belonging to the private signature key (PrivCE) of the compiling device, to a binary code server (BS) outside the secure infrastructure (DCUA) and provides same on said server for further use (S6). <EOS>