Sigstore

Windows · Mac · Linux · Self-hosted · API

Freedom report

Three barsScore 6.5

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely3 of 6 device platforms
DocumentedPlans, terms and facts published

Sigstore is ranked #5 of 26 in code signing software on Freedom251. It runs on API, Linux, macOS, Self-hosted, Windows. There is a free plan.

Sigstore plans and pricing

All plans

Free Free free to use for all developers and software providers linuxfoundation.org · 30 Sept 2026

Compared on code signing software

Free plan: Yes

Best Sigstore alternatives

See all 20

Two bars AWS Signer Free tier No. 1Free6.6 Two bars Cosign Free tier No. 2Free6.6 Two bars SignPath Free tier No. 3Free6.6 Two bars SignServer Free tier No. 4Free6.6 One bar SignPath Foundation Free tier No. 6Free6.4 One bar DigiCert Software Trust Manager Paid plans No. 7—5.7

The record

Purpose: Sigstore is an open source project for improving software supply chain security.
Artifact coverage: Sigstore supports signing and verifying release files, container images, binaries, software bills of materials and more.
Key management: Sigstore generates signatures with ephemeral signing keys, so developers do not need to manage keys.
Transparency: Signing events are recorded in a tamper-resistant public log so developers can audit signing events.
Components: Sigstore combines Cosign, Fulcio, Rekor, OpenID Connect and Policy Controller technologies.
Cosign: Cosign signs and verifies containers and other artifacts and stores signatures in an OCI registry.
Fulcio: Fulcio is a free root certification authority that issues temporary certificates to authorized identities and publishes them in Rekor.
Rekor: Rekor records signed metadata in a searchable ledger that cannot be tampered with.
Identity: Sigstore uses OpenID Connect to authenticate users through identity providers such as GitHub and Google.
Trust root: The Sigstore trust root uses The Update Framework and is maintained through a rotation of five keyholders from different companies and academic institutions.
CI integrations: Sigstore provides GitHub Actions for generating signatures and installing Cosign, and documents GitLab CI installation.
Language clients: Official language clients are available for Go, Java, JavaScript, Python, Ruby and Rust.
Package-manager integration: Sigstore identifies open source package managers as primary stakeholders and describes workflows for integrating signing and verification into package tooling and registries.
Integration limitation: Cosign has no API stability guarantees, does not follow semantic versioning, and is not recommended for application integration because of its dependencies.
Price from: Free

Where it ranks on Freedom251

Best Code Signing Software in 2026#5 of 26
Best Software Supply Chain Security Software in 2026#7 of 23

Is Sigstore yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Sigstore

Sources

docs.sigstore.dev· checked 30 Sept 2026
docs.sigstore.dev/about/tooling/· checked 30 Sept 2026
docs.sigstore.dev/about/security/· checked 30 Sept 2026
docs.sigstore.dev/about/faq/· checked 30 Sept 2026
docs.sigstore.dev/language_clients/language_client_overvi· checked 30 Sept 2026
docs.sigstore.dev/cosign/system_config/integration/· checked 30 Sept 2026
docs.sigstore.dev/about/support/· checked 30 Sept 2026
sigstore.dev· checked 28 Sept 2026
linuxfoundation.org/press/press-release/linux-foundation-an· checked 30 Sept 2026