Sigstore

Sigstore is a free, open-source foundation for signing software artifacts, authenticating the people or automation that sign them, and recording those events in a public ledger. It suits developers, package maintainers and teams securing releases or build pipelines without maintaining long-lived signing keys. The principal reason to hesitate is Cosign’s lack of API stability, which makes Sigstore a poor fit as an embedded application dependency.

Overview

Founded in 2021, Sigstore addresses software supply-chain security across release files, container images, binaries, software bills of materials and other artifacts. Its model links a signature to an authenticated identity and preserves a searchable, tamper-resistant record of the event. That gives maintainers an auditable release history rather than a signing process that exists only inside their own infrastructure.

OpenID Connect authenticates users through identity providers such as GitHub and Google. Fulcio, the project’s free root certification authority, issues temporary certificates to authorized identities and publishes them in Rekor. Signing keys are ephemeral, so teams avoid the storage and rotation work associated with permanent private keys. The public, identity-linked record is a strength for accountability, but organizations that require signing activity to remain private may prefer a different model.

Key features

Artifact signing and verification

Cosign signs and verifies containers and other artifacts, storing signatures in an OCI registry. The broader Sigstore workflow also covers binaries, release files, SBOMs and provenance attestations, so a project can apply one supply-chain approach across source outputs and deployment packages. It is particularly useful for open-source maintainers and CI pipelines publishing to registries.

Identity and trust

OpenID Connect ties signing to an identity provider, while Fulcio creates short-lived certificates for authorized identities. This removes key-management overhead and makes it clearer which account or workflow authorized a signature. The trust root is managed with The Update Framework and rotated by five keyholders from different companies and academic institutions, adding separation of responsibility to the root-of-trust process.

Transparency and policy

Rekor stores signed metadata in a searchable ledger designed to resist tampering. Developers can audit signing events and use the record when investigating a release. Sigstore also includes Policy Controller technology and supports release policy gates, source and repository security, SBOM management and build provenance. Those controls are valuable when verification must be enforced rather than left to an individual developer’s judgment.

Automation and clients

GitHub Actions can generate signatures and install Cosign, and Sigstore documents GitLab CI installation. Official clients exist for Go, Java, JavaScript, Python, Ruby and Rust. The project describes package managers and registries as primary stakeholders and provides workflows for integrating signing and verification into package tooling. Community help is available through Slack and repository-specific GitHub issues.

Integration caveat

Cosign has no API stability guarantees, does not follow semantic versioning and is not recommended for application integration because of its dependencies. Teams can use it effectively in release tooling and CI, but should avoid treating it as a dependable, frozen library interface inside a product.

Pricing

Sigstore’s Free plan costs free and is free to use for all developers and software providers. It includes artifact signing, provenance attestations, build provenance, SBOM management, release policy gates and source and repository security. There are no paid tiers or published usage quotas in this plan, making it a practical default for individual maintainers, open-source projects and teams standardizing CI signing. The trade-off is that the project’s public-log and identity-based workflow, plus Cosign’s integration limitations, remain part of the operating model rather than an optional enterprise variant.

Platforms

Sigstore supports API, Linux, macOS, self-hosted and Windows environments. That range suits cross-platform development teams and organizations that want to run components in their own infrastructure while connecting them to CI systems and registries.

Who it's for

Choose Sigstore for open-source maintainers, software publishers and DevOps teams that need verifiable signatures and provenance without managing permanent keys. It is a strong match for projects already using GitHub or Google identity, OCI registries, GitHub Actions or GitLab CI, and for organizations willing to make signing events auditable in a public ledger.

Look elsewhere when you need a stable API embedded in an application, private signing records, or a workflow built around long-lived keys and tightly controlled internal identity infrastructure.

Pros and cons

• Pros: Ephemeral keys remove private-key storage and rotation; Fulcio and OpenID Connect connect signatures to authenticated identities; Rekor provides a searchable, tamper-resistant audit trail; coverage spans containers, binaries, release files, SBOMs and provenance; official language clients and CI integrations support automation; the complete offering is free.
• Cons: Cosign offers no API stability guarantees and does not use semantic versioning, so it is unsuitable as a dependable application-integration API; the public, identity-linked ledger may not suit teams that need confidential signing activity; the workflow depends on external identity providers and the project’s component ecosystem.

Alternatives

Cosign is the focused choice when you want a free, open-source CLI for signing and verifying artifacts without a hosted service or stated usage limits. Choose AWS Signer when paid AWS-centered signing fits better, including use with AWS IoT Device Management, Lambda, ECR, EKS or third-party container services without additional usage charges.

OpenPubkey suits teams seeking a free Apache 2.0 reference implementation. SignPath is aimed at eligible open-source projects, while SignPath Foundation offers a free SignPath.io subscription for actively maintained projects meeting its eligibility and licensing conditions. SignServer is worth considering for a freemium deployment with a free Community edition, basic code, document and container signing, and timestamping. Notation is a free Apache 2.0 CLI project for teams wanting a narrower signing tool. Aujas Automated Code Signing Platform is an alternative for organizations evaluating usage-based signing licenses with custom pricing.

For broader category comparisons, see Code Signing Software and Software Supply Chain Security Software.

Verdict

Sigstore is the right choice for developers and software providers that want free, identity-based artifact signing, provenance and public auditability without managing permanent keys. Its integrated trust and transparency model is the main reason to choose it. Look elsewhere if your product needs a stable embedded API or signing events that are not publicly observable.