OPENSSF-SIGSTORE

OpenSSF Sigstore OSS signing suite + public good infra.

Definition

OpenSSF Sigstore project structure: (1) Sub-projects: Cosign (signing CLI), Fulcio (Certificate Authority), Rekor (transparency log), policy-controller (Kubernetes admission controller verify signatures), Gitsign (Git commits signing), Sigstore Python (Python SDK), Sigstore Go (Go SDK), Sigstore TypeScript (Node.js SDK). (2) Governance: OpenSSF Sigstore TAG (Technical Action Group) governs roadmap + technical decisions, Linux Foundation neutral hosting (vs Google Inc. ownership early days). (3) Public Good Infrastructure: sigstore.dev hosted instances Fulcio + Rekor + OAuth providers (GitHub OIDC + Google Identity + Microsoft) freely usable globally by OSS projects, Linux Foundation funded operation. (4) Trust Roots: sigstore-tuf-root TUF (The Update Framework) repository contains trusted Fulcio + Rekor public keys + verification policies, distributed via Sigstore TUF endpoints. (5) Ecosystem partners: GitHub (sigstore-github-tooling), npm (npm provenance attestations powered Sigstore 2024+), PyPI (similar adoption emerging), AWS Signer (private Sigstore option), Azure (Notation alternative). Adoption metrics: ~90% supply chain signing OSS 2024 (vs Notation ~5% + GPG signatures legacy ~5%), ~100M+ artifacts signed/year Public Good Sigstore.

Origin

Sigstore originally Google + Red Hat + Purdue University collaboration 2020-2021 ; donated OpenSSF + Linux Foundation 2021 ; Sigstore CNCF Sandbox 2022 + Incubating 2023.

Example in context

npm registry (Node.js packages) integrates OpenSSF Sigstore for npm provenance attestations 2024: when publishing npm package via npm publish --provenance, npm CLI uses Sigstore Cosign keyless OIDC GitHub Actions signing, attestation stored Sigstore Rekor + linked npm package on registry, end users can verify provenance via npm install --foreground-scripts.

Related terms

• Sigstore Cosign — core tool.