Artifact/Container Signing & Verification Tools (Sigstore)

Ranking methodology

In development — no version effective yet.

Decision archetype: technical · Scores are category-relative (P-01) and commercial relationships never affect rank (P-04).

Filters

Filters apply to structured facts only. Tools lacking a fact don't match its filter (P-02).

NotationThe Notary Project

Open source

Open source tool and specification for signing and verifying container artifacts.

Open source

Open source framework for signing and verifying software artifacts using short-lived certificates.

Open source

Open source framework for protecting software supply chain integrity through attestations.