- Home
- Code Signing Software
- Sigstore
Sigstore
What it is
Sigstore is a free, open-source project for signing and verifying software artifacts as part of supply chain security. It covers release files, container images, binaries, software bills of materials and other artifacts. Rather than requiring developers to manage signing keys, it uses temporary keys and records signing events in a tamper-resistant public log for auditing. Its components include Cosign, Fulcio, Rekor, OpenID Connect and Policy Controller. Cosign signs and verifies artifacts, keeping signatures in an OCI registry; Fulcio issues temporary certificates to authorized identities, and Rekor stores signed metadata in a searchable ledger. OpenID Connect authenticates users through providers such as GitHub and Google. The trust root uses The Update Framework and is maintained by five keyholders from different organizations. Sigstore provides GitHub Actions, documents GitLab CI installation and offers official clients for Go, Java, JavaScript, Python, Ruby and Rust. It supports API, Linux, macOS, Windows and self-hosted environments. Community help is available through Slack and GitHub issues.
For and against
For
- Signing keys are ephemeral, avoiding key management by developers.
- Signing events enter a tamper-resistant public log.
- Official clients cover six programming languages.
- GitHub Actions and GitLab CI guidance are available.
Against
- Cosign has no API stability guarantees.
- Cosign does not follow semantic versioning.
- Cosign is not recommended for application integration.
The verdict
Sigstore brings artifact signing, identity authentication and public audit records into one project. Teams considering direct application integration should account for the stated Cosign caveats.
Who it suits
Sigstore suits developers and software providers who need to sign and verify artifacts or incorporate those workflows into package tooling, registries or CI. It is also relevant to teams that want public records of signing events for auditing.
Plans and prices
Public-good Sigstore service
Public Fulcio certificate authority · Public Rekor transparency log · Public OIDC issuer
Read 15 Oct 2026 · sigstore.dev
Free
free to use for all developers and software providers
Read 30 Sep 2026 · linuxfoundation.org
On the record
- API coverage
- The documented API policy covers Fulcio and Rekor client APIs, Cosign features, the sigstore client library and the cosign OCI library.docs.sigstore.dev · read 15 Oct 2026
- API stability
- Sigstore classifies interfaces as Experimental, Beta or Generally Available, with best-effort deprecation notice periods of zero, two months or six months respectively.docs.sigstore.dev · read 15 Oct 2026
- Artifact coverage
- Sigstore supports signing and verifying release files, container images, binaries, software bills of materials and more.docs.sigstore.dev · read 30 Sep 2026
- CI integrations
- Sigstore provides GitHub Actions for generating signatures and installing Cosign, and documents GitLab CI installation.docs.sigstore.dev · read 30 Sep 2026
- Components
- Sigstore combines Cosign, Fulcio, Rekor, OpenID Connect and Policy Controller technologies.docs.sigstore.dev · read 30 Sep 2026
- Cosign
- Cosign is the command-line tool for signing and verifying containers and other artifacts, with signatures stored alongside artifacts in OCI registries.docs.sigstore.dev · read 15 Oct 2026
- Custom infrastructure
- Cosign can be configured to use privately operated Fulcio, Rekor, certificate-transparency and timestamp services with custom trust roots.docs.sigstore.dev · read 15 Oct 2026
- Documentation
- The project publishes user quickstarts, component documentation, developer documentation, certificate-authority material and troubleshooting guidance.docs.sigstore.dev · read 15 Oct 2026
- Ephemeral keys
- Its signing workflow uses short-lived or ephemeral keys, reducing the need for developers to manage persistent private keys.openssf.org · read 15 Oct 2026
- Fulcio
- Fulcio is a free certificate authority that issues temporary certificates to authenticated identities and publishes certificate information through Rekor.docs.sigstore.dev · read 15 Oct 2026
- GitHub Actions integration
- Sigstore publishes a Python signing action and a Cosign installer action for CI workflows.github.com · read 15 Oct 2026
- Governance
- Sigstore is operated as a public-good, nonprofit project within the Open Source Security Foundation ecosystem.openssf.org · read 15 Oct 2026
- Identity
- Sigstore uses OpenID Connect to authenticate users through identity providers such as GitHub and Google.docs.sigstore.dev · read 30 Sep 2026
- Independent company profile
- LinkedIn describes Sigstore as a London-based nonprofit public-good signing service with 2–10 employees and a 2021 founding year.linkedin.com · read 15 Oct 2026
- Independent ecosystem evidence
- The Linux Foundation said Sigstore had been used by projects including Kubernetes and received support from Chainguard, Cisco, HPE, Google, Red Hat and VMware in 2021.linuxfoundation.org · read 15 Oct 2026
- Independent usage evidence
- GitHub documents Sigstore Policy Controller deployment with two Helm charts and OCI-attached Sigstore Bundles for image attestations.docs.github.com · read 15 Oct 2026
- Integration limitation
- Cosign has no API stability guarantees, does not follow semantic versioning, and is not recommended for application integration because of its dependencies.docs.sigstore.dev · read 30 Sep 2026
- Keyless verification
- Verification checks the artifact signature, certificate identity, Sigstore trust root and Rekor inclusion proof together.docs.sigstore.dev · read 15 Oct 2026
