Instead of AWS Signer
AWS Signer alternatives
AWS Signer is a managed service for verifying code integrity and publisher trust across AWS Lambda packages, supported IoT and FreeRTOS firmware, and OCI containers. Lambda checks signatures during deployment, while Notation stores container signatures beside images in registries such as Amazon ECR. Signing profiles are managed through the console, CLI, or API, with certificates and keys handled for Lambda and container workflows. IAM policies control access, and integrations include AWS Certificate Manager, CloudTrail, and Amazon EKS image verification. It runs through API, Linux, macOS, web, and Windows interfaces.
- 1
Cosign
Free plan LinuxMacSelf-hosted+1Free OCI and artifact signing with flexible key choices — Cosign adds keyless Sigstore signing, hardware or KMS keys, OCI storage, attestations, and broad registry and CI integrations.
- 2
OpenPubkey
Free plan APILinuxMac+2OIDC-bound user and workload identity signing — OpenPubkey binds OIDC identities to public keys and issues PK Tokens, supporting Google, GitHub, and other identity providers.
- 3
SignPath
Free plan APILinuxMac+3Policy-controlled signing across software release pipelines — SignPath verifies repositories, branches, builds, approvals, and CI/CD context while signing many formats and producing attestations and SBOMs.
- 4
SignServer
Free plan APILinuxMac+3Self-hosted centralized signing across many use cases — SignServer centrally manages keys for code, containers, firmware, documents, and timestamps, with deployable community packages.
- 5
Notation
Free plan LinuxMacWindowsPortable OCI artifact signing from the command line — Notation is a portable CLI implementing Notary Project specifications, with signatures transferable across registries and disconnected environments.
- 6
Sigstore
Free plan Open source APILinuxMac+3Keyless, publicly auditable supply-chain signing — Sigstore uses ephemeral keys, temporary Fulcio certificates, and Rekor's tamper-resistant public log for many artifact types.
- 7
SignPath Foundation
Free plan APIWebEligible open-source projects needing certificate-backed releases — SignPath Foundation provides certificates through SignPath.io, verifies automated builds, and requires manual approval for every release.
- 8
Bamboo Deploy
Free plan APILinuxMac+2 - 9
Signo
Free plan APILinuxSelf-hosted - 10
Aujas Automated Code Signing Platform
Paid LinuxMacSelf-hosted+2 - 11
Gitsign
Free plan LinuxMacWindows - 12
Keyfactor Platform
Free trial APISelf-hostedWeb - 13
LAAVAT PKI and Signing Platform
Free trial APISelf-hostedWeb - 14
The Update Framework
Free plan - 15
DigiCert Software Trust Manager
Paid APILinuxMac+2 - 16
Signotaur
Free trial Self-hostedWindows - 17
ComSignTrust Secure Code Signing Platform (ASCS)
Paid APIWeb - 18
CyberArk Code Sign Manager - Self-Hosted
Paid APILinuxMac+3 - 19
GoGetSSL Cloud Code Signing
Paid MacWebWindows - 20
Red Hat Trusted Artifact Signer
Paid LinuxMacSelf-hosted+2 - 21
Code Signing Key Management Server (CSKMS)
Paid APISelf-hosted - 22
GaraTrust
Paid Self-hosted - 23
PACE Code Signing Platform
Paid LinuxMacWindows - 24
sslTrus Remote Code Signing Service
Paid LinuxMacWeb+1
Alternatives appeal when you need a different signing scope, identity model, deployment style, or release workflow. AWS Signer is paid, although its plan shows no additional charge for use with several AWS services; related charges may apply, and API actions have account-and-Region quotas without a minimum request rate. Compare whether you need OCI-focused tooling, broader artifact formats, self-hosting, public transparency logs, identity-provider binding, policy checks, attestations, or open-source project eligibility. Also weigh certificate management, key custody, platform coverage, and production controls before switching.