OpenSSF project
Sigstore
A free, identity-based artefact-signing service backed by a public transparency log so anyone can verify who built what.
How each persona uses Sigstore
Software Developer / Maintainer Developer
Adopts Sigstore to cryptographically sign artifacts and ensure their integrity early in the release process.
Open Source Professional (OSPO) OSPO
Standardizes on keyless signing (Sigstore) across the enterprise to eliminate the overhead of managing long-lived cryptographic keys.
Security Engineer / Architect Security
Validates the transparency log to audit the provenance and authenticity of software components used in production.
CI/CD DevOps & Tooling Integrator DevOps
Deploys Sigstore to enable identity-based (keyless) signing via OIDC, eliminating the risk of compromised long-lived build secrets and automating artifact verification in the pipeline.
Package & Repository Manager Package Manager
Integrates Sigstore natively into the package registry to automatically verify incoming artifact signatures and display provenance to users.
Executive / End-User Consumer Executive
Verifies cryptographic signatures as trust signals to confirm artifact integrity post-release.
Problems Sigstore helps with
Artefact Signing & Verification Signing
Provides keyless, identity-based signing backed by a public transparency log so anyone can verify who built what.
Build & Provenance Integrity Build Integrity
Records signatures in a transparency log, making artefact provenance independently auditable downstream.