Sigstore
Free keyless code signing for software supply chains.
About
Sigstore is an OpenSSF (Linux Foundation) graduated project that makes code signing usable by eliminating long-lived signing keys. Developers authenticate with an OpenID Connect identity — a GitHub account, a CI workflow, a Google Workspace user — and Sigstore issues short-lived certificates bound to that identity, so the identity itself becomes the trust root instead of a key you have to protect and rotate.
The ecosystem centers on three components: cosign, the CLI for signing and verifying container images, blobs, and attestations; Fulcio, the certificate authority issuing the short-lived certs; and Rekor, an append-only transparency log that records every signing event for public audit. Free public instances are operated for the community, and Sigstore-backed signing is now embedded in mainstream registries including Homebrew, PyPI, and Maven Central. Everything is Apache 2.0 open source; cosign has 6,000+ GitHub stars.
What it can do
- Keyless signing via OIDC with short-lived certificates
- cosign CLI for images, blobs, and attestations
- Rekor transparency log for publicly auditable signatures
- Fulcio certificate authority operated for the public good
- gitsign, sigstore-python, and sigstore-js ecosystem tooling
Setup
Install cosign (brew install cosign), then sign with cosign sign <image> using keyless OIDC mode.
Prerequisites
An OIDC identity (GitHub, Google, or Microsoft account); a container registry or artifact to sign.
Use cases
Works with
Trust score — 9/10
Scored 9/10 (verified tier, metrics-v1). Evidence: Verified via official docs at https://docs.sigstore.dev and sigstore.dev (cosign/Fulcio/Rekor architecture, keyless signing); GitHub sigstore/cosign: 6,367 stars via API 2026-10-15; OpenSSF graduated project (2024); Homebrew/PyPI/Maven Central adoption per ecosystem coverage. License: Apache 2.0.
★ 6,367 GitHub stars
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.