Sigstore

Open source

Open source framework for signing and verifying software artifacts using short-lived certificates.

Pricing: free
License: open-source
Open source: Yes

Editorial review

Sigstore has not yet been editorially reviewed. User reviews and published field data below are unaffected — we say so rather than implying an editorial verdict.

Facts & attributes

Every value carries its evidence state. “—” means unknown — never a silent default (P-02).

Identity · Taxonomy

Documentation(HTTPS URL): https://docs.sigstore.devVerified
Tags(open-source;cloud-native): code signing, supply chain security, transparency log, keyless signing, OpenSSFVerification pending

Pricing · Licensing

License model(proprietary;open-source;source-available;dual-license): open-sourceVerification pending
Pricing model(free;subscription;usage;seat;asset;transaction;revenue-share;perpetual;custom): freeVerified
Source repository(HTTPS URL): https://github.com/sigstore/cosignVerified
SPDX license IDs(Apache-2.0;MIT): Apache-2.0Verified

Features · Product · Fit

Core capabilities(authoring;automation;analytics): Securely sign and verify release files, container images, binaries, and SBOMs, Signatures generated with ephemeral keys so there is no need to manage keys, Fulcio certificate authority associating artifacts with an identity, Rekor tamper-resistant transparency log recording signing events, Cosign client for signing, Language clients for Go, Java, JavaScript, Python, Ruby, and RustVerification pending

Api · Integrations · Ecosystem

API available(true/false): trueVerification pending

Audience · Use · Case

Best for(Neutral editorial summary): Developers signing and verifying release files, containers, binaries and SBOMs with ephemeral keys and transparency logsVerification pending
Primary use cases(build;monitor;automate): Container image signing, Release file verification, SBOM signing, Git commit signingVerification pending

Lifecycle · Versioning

Maintenance status(active;maintenance;deprecated;EOL;archived): activeVerification pending

User reviews

Review policy

No published reviews yet.