Side by side

Bamboo Deploy vs Sigstore

Both stand on code signing software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.

Bamboo Deploy

Free plan APILinuxMac+2

Bamboo Deploy combines binary scanning with signing and integrations for developer workflows. Signing is gated behind Premium, and new accounts should expect their sign requests to be reviewed.

Visit Bamboo Deploy

Sigstore

Free plan Open source APILinuxMac+3

Sigstore brings artifact signing, identity authentication and a public transparency log into one project. Cosign's stated integration caveats matter for teams considering it inside an application.

Visit Sigstore

The facts

	Bamboo Deploy	Sigstore
Free plan	Yes	Yes
Open source	Not published	Yes
Runs on	API, Linux, Mac, Web, Windows	API, Linux, Mac, Self-hosted, Web, Windows
Lowest paid plan	Premium: $15 a month	Free or on request
Plans published	1	2
Maker	Not published	Not published
Website	bamboodeploy.com	sigstore.dev
On code signing software	#3 of 28	#1 of 28

Bamboo Deploy: what it does well

Supports EXE, MSI, DLL, MSIX, and APPX files.
Signing uses Authenticode SHA-256 and a Sectigo EV certificate.
Integrates with several CI tools and build environments.
Free tier supports uploads and scans.

What to know first

Signing requires Premium.
New accounts have sign requests reviewed.
High-confidence malicious indicators prevent signing.
Premium is billed $45 every 3 months.

Sigstore: what it does well

Signs and verifies multiple software artifact types.
Uses temporary keys rather than developer-managed keys.
Records signing events in a public tamper-resistant log.
Provides GitHub Actions and documents GitLab CI.
Free to use for developers and software providers.

What to know first

Cosign has no API stability guarantees.
Cosign does not follow semantic versioning.
Cosign is not recommended for application integration.

Alternatives to Bamboo Deploy Alternatives to Sigstore The whole list