Side by side
Cosign vs Sigstore
Both stand on code signing software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan LinuxMacSelf-hosted+1
Cosign offers several signing approaches and supports a broad range of artifact workflows, including offline verification when the required materials are local. Its legacy status and lack of API stability guarantees matter for teams considering it as an application integration.
Visit Cosign
Free plan Open source APILinuxMac+3
Sigstore brings artifact signing, identity authentication and a public transparency log into one project. Cosign's stated integration caveats matter for teams considering it inside an application.
Visit SigstoreThe facts
| Cosign | Sigstore | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Yes |
| Runs on | Linux, Mac, Self-hosted, Windows | API, Linux, Mac, Self-hosted, Web, Windows |
| Lowest paid plan | Free or on request | Free or on request |
| Plans published | 1 | 2 |
| Maker | Not published | Not published |
| Website | github.com | sigstore.dev |
| On code signing software | #4 of 28 | #1 of 28 |
Cosign: what it does well
- Signs and verifies OCI containers and many other artifact types.
- Supports keyless, hardware, KMS, and user-provided PKI signing.
- Can verify offline with local materials and a trusted root.
- Provides CI guidance for GitHub Actions and GitLab.
What to know first
- Documentation describes Cosign as a legacy signing system.
- No API stability guarantees; application integration is not recommended.
- Key generation is limited to ECDSA-P256, with SHA256 hashes for specified signing methods.
- Keyless signing may publish identity information in public logs.
Sigstore: what it does well
- Signs and verifies multiple software artifact types.
- Uses temporary keys rather than developer-managed keys.
- Records signing events in a public tamper-resistant log.
- Provides GitHub Actions and documents GitLab CI.
- Free to use for developers and software providers.
What to know first
- Cosign has no API stability guarantees.
- Cosign does not follow semantic versioning.
- Cosign is not recommended for application integration.
Alternatives to Cosign Alternatives to Sigstore The whole list