Side by side
OpenPubkey vs Sigstore
Both stand on code signing software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan APILinuxMac+2
OpenPubkey links identity-provider-backed identities with signing keys without adding a certificate authority. Consider its current provider support, workload signature requirement, and possible claim exposure when evaluating it.
Visit OpenPubkey
Free plan Open source APILinuxMac+3
Sigstore brings artifact signing, identity authentication and a public transparency log into one project. Cosign's stated integration caveats matter for teams considering it inside an application.
Visit SigstoreThe facts
| OpenPubkey | Sigstore | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Yes |
| Runs on | API, Linux, Mac, Self-hosted, Windows | API, Linux, Mac, Self-hosted, Web, Windows |
| Lowest paid plan | Free or on request | Free or on request |
| Plans published | 1 | 2 |
| Maker | Not published | Not published |
| Website | github.com | sigstore.dev |
| On code signing software | #5 of 28 | #1 of 28 |
OpenPubkey: what it does well
- Supports both user and workload identities
- Does not require adding a certificate authority
- Apache 2.0 licensed Linux Foundation project
- Lists multiple compatible identity providers
What to know first
- Current user token support is Google; workload support is GitHub
- Workload identity use cases require GQ signatures
- Public tokens may expose name or email claims
- Repository says the project is being prepared for version 1.0
Sigstore: what it does well
- Signs and verifies multiple software artifact types.
- Uses temporary keys rather than developer-managed keys.
- Records signing events in a public tamper-resistant log.
- Provides GitHub Actions and documents GitLab CI.
- Free to use for developers and software providers.
What to know first
- Cosign has no API stability guarantees.
- Cosign does not follow semantic versioning.
- Cosign is not recommended for application integration.
Alternatives to OpenPubkey Alternatives to Sigstore The whole list