Sigstore

Input—per 1M tokens

Output—per 1M tokens

Context—tokens

WeightsClosed

About

Sigstore is ranked #4 of 25 in code signing software on Inferse. It runs on API, Linux, macOS, Self-hosted, Windows. There is a free plan.

Compared on code signing software

Free plan: Yessigstore.dev

Facts

Purpose: Sigstore is an open source project for improving software supply chain security.docs.sigstore.dev · 30 Sept 2026
Artifact coverage: Sigstore supports signing and verifying release files, container images, binaries, software bills of materials and more.docs.sigstore.dev · 30 Sept 2026
Key management: Sigstore generates signatures with ephemeral signing keys, so developers do not need to manage keys.docs.sigstore.dev · 30 Sept 2026
Transparency: Signing events are recorded in a tamper-resistant public log so developers can audit signing events.docs.sigstore.dev · 30 Sept 2026
Components: Sigstore combines Cosign, Fulcio, Rekor, OpenID Connect and Policy Controller technologies.docs.sigstore.dev · 30 Sept 2026
Cosign: Cosign signs and verifies containers and other artifacts and stores signatures in an OCI registry.docs.sigstore.dev · 30 Sept 2026
Fulcio: Fulcio is a free root certification authority that issues temporary certificates to authorized identities and publishes them in Rekor.docs.sigstore.dev · 30 Sept 2026
Rekor: Rekor records signed metadata in a searchable ledger that cannot be tampered with.docs.sigstore.dev · 30 Sept 2026
Identity: Sigstore uses OpenID Connect to authenticate users through identity providers such as GitHub and Google.docs.sigstore.dev · 30 Sept 2026
Trust root: The Sigstore trust root uses The Update Framework and is maintained through a rotation of five keyholders from different companies and academic institutions.docs.sigstore.dev · 30 Sept 2026
CI integrations: Sigstore provides GitHub Actions for generating signatures and installing Cosign, and documents GitLab CI installation.docs.sigstore.dev · 30 Sept 2026
Language clients: Official language clients are available for Go, Java, JavaScript, Python, Ruby and Rust.docs.sigstore.dev · 30 Sept 2026
Package-manager integration: Sigstore identifies open source package managers as primary stakeholders and describes workflows for integrating signing and verification into package tooling and registries.docs.sigstore.dev · 30 Sept 2026
Integration limitation: Cosign has no API stability guarantees, does not follow semantic versioning, and is not recommended for application integration because of its dependencies.docs.sigstore.dev · 30 Sept 2026
Support: Community support is provided through Slack, and users can also open GitHub issues in the relevant repository.docs.sigstore.dev · 30 Sept 2026