A method and apparatus are provided for verifying authenticity of program code for an electronic control unit. In one implementation, a method is provided. According to the method, program code for an the electronic control unit is received. The method may access metadata embedded in the program code. The metadata may identify a source of the program code. The method may further communicate via a network with a server to determine a status of the program code. The method may verify the authenticity of the program code based on the source of the program code and the status.