About Sigstore
Sigstore is a set of open source tools for signing software and checking who signed it. It is aimed at open source maintainers and at anyone who depends on other people's software.
What it does
Sigstore tools attach signatures to build outputs, such as container images or release files, and let others verify those signatures later. Short-lived certificates reduce the need to store long-term signing keys. A public transparency log records signatures so they can be found and checked.
Key features
- Signs software artifacts such as container images
- Verifies signatures before software is used
- Uses short-lived certificates instead of long-term keys
- Records signatures in a public transparency log
- Lets you host your own log
Who it's for
Sigstore suits open source maintainers, developers who publish packages, and security teams that want to check the chain of custody for their dependencies. It also applies to closed source software.
Pricing and good to know
The tools are open source and free to use. Cosign, one of the main projects, is on GitHub under the Apache-2.0 license. Keyless signing relies on an identity provider login, so decide which identities you trust before relying on signatures.
Highlights
- Signs software artifacts such as container images
- Verifies signatures before software is used
- Uses short-lived certificates instead of long-term keys
- Records signatures in a public transparency log
- Lets you host your own log
