Problem view

Artefact Signing & Verification

Proving who produced an artefact and confirming it has not been altered in transit, ideally without the burden of managing long-lived signing keys.

5 OpenSSF projects and publications help with Signing, each with a one-sentence note on how. Prefer another way in? Browse by role →

gittuf

Signs Git metadata and maintains a verifiable reference state log so source history can be authenticated downstream.

Full breakdown

Extends identity-based signing and verification to ML models of any format, so consumers can confirm who produced the weights.

Full breakdown

Cryptographically signs repository metadata so clients can verify content has not been tampered with in transit.

Full breakdown

Relies on signed attestations over components, so the bill of materials itself becomes cryptographically verifiable.

Full breakdown

Provides keyless, identity-based signing backed by a public transparency log so anyone can verify who built what.

Full breakdown