Sigstore

Sigstore is an open-source project under the Open Source Security Foundation (OpenSSF) that gives every software producer a free, automated way to sign their artifacts — containers, binaries, attestations, SBOMs — and every consumer a way to verify those signatures against a public transparency log. It removes the single biggest historical obstacle to ubiquitous signing: long-lived private keys.

In practice, Sigstore is three cooperating services plus a client: Fulcio issues short-lived certificates tied to an OIDC identity, Rekor appends every signing event to a tamper-evident transparency log, and Cosign is the command-line client that producers and verifiers actually run.

For thirty years, code signing was the default security control nobody used — because managing private keys across thousands of CI pipelines was operationally impossible. Sigstore replaces key management with identity management, and CI systems already know how to do identity. The result: signing is now free, automatic, and verifiable, which is the precondition for treating unsigned artifacts as suspicious by default.

Every major standard coming out of SLSA, CRA, and the US executive order on software supply chain security assumes the existence of something like Sigstore. In 2026, it is essentially the default answer.