sigstore
Software supply chain security toolkit for signing, verifying, and recording the provenance of software artifacts, container images, and releases.
- Actively maintained
- Foundation-backed
- Well documented
- Permissive license
Overview
sigstore (most commonly used through its cosign tool) lets developers sign software artifacts - container images, binaries, release files - and lets anyone else verify those signatures came from the expected source, using short-lived certificates instead of long-term keys a team has to manage and protect. Signing events are recorded in a public, tamper-resistant transparency log.
sigstore is a fit for teams that want to verify the authenticity and integrity of software they build, publish, or consume - a supply-chain security concern distinct from Trivy's vulnerability scanning or Falco's runtime detection (also in this catalog), focused specifically on provenance and signing.
Why it's in this catalog
Catalog rating: ★★★★☆ (4/5)
The standard toolchain for software artifact signing and supply-chain security.
- Mature
- Foundation-governed
- Categories
- DevOps
- Languages
- Go
- License
- Apache-2.0
Related Projects
Cilium
Apache-2.0eBPF-based networking, security, and observability platform for Kubernetes that replaces traditional networking components with kernel-level performance.
Actively maintained
- DevOps
etcd
Apache-2.0Distributed, consistent key-value store that Kubernetes itself uses to store all cluster state, and a reliable building block for other distributed systems.
Actively maintained
- DevOps
Open Policy Agent (OPA)
Apache-2.0General-purpose, CNCF-graduated policy engine for enforcing authorization, compliance, and configuration rules as code across microservices, APIs, Kubernetes, and CI pipelines.
Actively maintained
- DevOps
cert-manager
Apache-2.0Automates issuing, renewing, and managing TLS certificates for Kubernetes applications, eliminating manual certificate handling.
Actively maintained
- DevOps
Spotted an error? Suggest an edit on GitHub.