sigstore
also: Cosign, Fulcio, Rekor
Sigstore is an open-source project providing keyless code signing and verification infrastructure, allowing developers to sign software artifacts without managing long-lived cryptographic keys.
Sigstore eliminates the complexity and risk of traditional key management by using OIDC (OpenID Connect) identity providers to authenticate developers, then issuing short-lived signing certificates automatically. This makes signing as simple as running a command with your existing GitHub, GitLab, or Google credentials.
The project consists of three main components: Cosign for signing and verifying container images and artifacts, Fulcio for issuing ephemeral certificates, and Rekor a transparency log that records all signing events publicly, enabling auditability without requiring a central key server.
Example: Instead of managing PGP keys, a developer can sign a container image with cosign sign --keyless ghcr.io/myorg/myimage:latest, which automatically handles authentication and signing, then anyone can verify it with cosign verify [email protected] ghcr.io/myorg/myimage:latest.