Sigstore: open signing for software, with a public log of every signature.

01Definition

Keyless signing, and a public record of it.

Sigstore is an open-source project, run as a public service, that lets software be signed without each developer managing long-lived private keys. A short-lived certificate is issued for an identity, such as a CI workflow, and the signature is recorded in a public transparency log, Rekor.

Anyone can then check that a signature was made by that identity at that time, and that it has been publicly logged.

• Short-lived certificates
• Identity-based signing
• A public transparency log

02Why it matters

Signatures that do not depend on secret keys staying secret forever.

Long-lived signing keys get lost, leaked and forgotten. Sigstore ties signatures to identities and time, and the public log makes it hard to sign something quietly. It is widely used for package and container signing, and GitHub's artifact attestations are signed through it.

For a verdict about a code change, that means a receipt whose signature anyone can check without trusting a private key held by the verifier.

• No long-lived keys to leak
• Signing is publicly visible
• Widely adopted

03In Verify

Planned, through GitHub artifact attestations.

Signed receipts for public repositories are designed to be Sigstore bundles produced by GitHub artifact attestations. This is written and tested in code but not yet live end to end.

Verify is not installable yet.