What is Sigstore?
Sigstore is an open-source project for signing, verifying, and protecting software. It makes software supply chain security accessible by providing keyless signing — no GPG keys to manage.
Sigstore Components
- Cosign: Sign and verify container images. Keyless signing via OIDC (GitHub, Google identity).
- Rekor: Immutable transparency log of all signing events.
- Fulcio: Issues short-lived signing certificates tied to OIDC identity.