sigstore

sigstore (most commonly used through its cosign tool) lets developers sign software artifacts - container images, binaries, release files - and lets anyone else verify those signatures came from the expected source, using short-lived certificates instead of long-term keys a team has to manage and protect. Signing events are recorded in a public, tamper-resistant transparency log.

sigstore is a fit for teams that want to verify the authenticity and integrity of software they build, publish, or consume - a supply-chain security concern distinct from Trivy's vulnerability scanning or Falco's runtime detection (also in this catalog), focused specifically on provenance and signing.