Sigstore

Definitions

1. An open-source project providing free, automatic code signing and verification for software artifacts. Uses keyless signing (tied to OIDC identity), a transparency log (Rekor), and a certificate authority (Fulcio). Eliminates the complexity of managing PGP keys. npm, PyPI, and Kubernetes all use Sigstore for package signing.

   In plain English: A free, easy system for digitally signing software so users can verify it hasn't been tampered with.

   Example: "cosign sign the container image with Sigstore — consumers can verify it came from our CI pipeline without managing GPG keys."

Related Terms

• Dependency Confusion
• SBOM
• SLSA
• Code Signing
• JSON Web Signature
• SBOM Analysis
• Docker Security
• Grey Market
• Hardware Implant
• Procurement Security