Sigstore

7.1easy start · #5 of 26
in Code Signing Software

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you workyes

Runs on api, Linux, Mac, self-hosted, Windows.

Sigstore is ranked #5 of 26 in code signing software on The Geeks Club. It runs on API, Linux, macOS, Self-hosted, Windows. There is a free plan.

Sigstore plans and pricing

All plans

Free Free free to use for all developers and software providers linuxfoundation.org · 30 Sept 2026

Compared on code signing software

Free plan: Yes

Best Sigstore alternatives

See all 12

SignServer 0 of 4 in the starter kit Lesson 17.9 SignPath 0 of 4 in the starter kit Lesson 27.3 AWS Signer 0 of 4 in the starter kit Lesson 37.2 Cosign 0 of 4 in the starter kit Lesson 47.1 Keyfactor Platform 0 of 4 in the starter kit Lesson 67.0 SignPath Foundation 0 of 4 in the starter kit Lesson 77.0

The record

Purpose: Sigstore is an open source project for improving software supply chain security.
Artifact coverage: Sigstore supports signing and verifying release files, container images, binaries, software bills of materials and more.
Key management: Sigstore generates signatures with ephemeral signing keys, so developers do not need to manage keys.
Transparency: Signing events are recorded in a tamper-resistant public log so developers can audit signing events.
Components: Sigstore combines Cosign, Fulcio, Rekor, OpenID Connect and Policy Controller technologies.
Cosign: Cosign signs and verifies containers and other artifacts and stores signatures in an OCI registry.
Fulcio: Fulcio is a free root certification authority that issues temporary certificates to authorized identities and publishes them in Rekor.
Rekor: Rekor records signed metadata in a searchable ledger that cannot be tampered with.
Identity: Sigstore uses OpenID Connect to authenticate users through identity providers such as GitHub and Google.
Trust root: The Sigstore trust root uses The Update Framework and is maintained through a rotation of five keyholders from different companies and academic institutions.
CI integrations: Sigstore provides GitHub Actions for generating signatures and installing Cosign, and documents GitLab CI installation.
Language clients: Official language clients are available for Go, Java, JavaScript, Python, Ruby and Rust.
Package-manager integration: Sigstore identifies open source package managers as primary stakeholders and describes workflows for integrating signing and verification into package tooling and registries.
Integration limitation: Cosign has no API stability guarantees, does not follow semantic versioning, and is not recommended for application integration because of its dependencies.
Price from: Free

Where it ranks on The Geeks Club

Best Code Signing Software in 2026#5 of 26
Best Software Supply Chain Security Software in 2026#9 of 23

Is Sigstore yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Sigstore

Sources

docs.sigstore.dev· checked 30 Sept 2026
docs.sigstore.dev/about/tooling/· checked 30 Sept 2026
docs.sigstore.dev/about/security/· checked 30 Sept 2026
docs.sigstore.dev/about/faq/· checked 30 Sept 2026
docs.sigstore.dev/language_clients/language_client_overvi· checked 30 Sept 2026
docs.sigstore.dev/cosign/system_config/integration/· checked 30 Sept 2026
docs.sigstore.dev/about/support/· checked 30 Sept 2026
sigstore.dev· checked 28 Sept 2026
linuxfoundation.org/press/press-release/linux-foundation-an· checked 30 Sept 2026