Side by side
OpenPubkey vs Signo
Both stand on code signing software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan APILinuxMac+2
OpenPubkey links identity-provider-backed identities with signing keys without adding a certificate authority. Consider its current provider support, workload signature requirement, and possible claim exposure when evaluating it.
Visit OpenPubkey Free plan APILinuxSelf-hosted
Choose Signo if your Linux-based CI workflow needs API signing with certificates held on PKCS#11 tokens, along with controls for signees and signing engines. Look elsewhere if you need PDF signing or the other planned capabilities now, rather than as future features.
Visit SignoThe facts
| OpenPubkey | Signo | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Not published |
| Runs on | API, Linux, Mac, Self-hosted, Windows | API, Linux, Self-hosted |
| Lowest paid plan | Free or on request | Not published |
| Plans published | 1 | None |
| Maker | Not published | Not published |
| Website | github.com | github.com |
| On code signing software | #5 of 28 | #9 of 28 |
OpenPubkey: what it does well
- Supports both user and workload identities
- Does not require adding a certificate authority
- Apache 2.0 licensed Linux Foundation project
- Lists multiple compatible identity providers
What to know first
- Current user token support is Google; workload support is GitHub
- Workload identity use cases require GQ signatures
- Public tokens may expose name or email claims
- Repository says the project is being prepared for version 1.0
Signo: what it does well
- Signs files through an HTTP API.
- Supports plain signatures and Authenticode for Windows executables.
- Uses PKCS#11 tokens for hardware-stored certificates.
- Lets administrators assign signees to specific signing engines.
- Supports MySQL or SQLite configuration.
What to know first
- Requires a Linux machine with Node.js 16 or 18 for the quick start.
- A token must be activated by entering its PIN before signing.
- Setup requires an SSL certificate and PKCS#11 module configuration.
Alternatives to OpenPubkey Alternatives to Signo The whole list