Gitsign

At a glance

• Editor score
  7.0 / 10
• Pricing
  Free plan
• Best for
  Free keyless Git commit signing
• Free plan
  Yes
• Paid from
  Free
• Supported targets
  Git commits; Git tags
• Facts checked
  20 Sep 2026

• Where it wins

  • Keyless Git commit and tag signing with OIDC authentication
  • Rekor transparency logs, certificate claims, and trusted timestamping
  • CI token providers for GitHub Actions and Buildkite

• Where it doesn't

  • Supports Git commits and tags rather than broader signing targets
  • Uses a command-line workflow rather than a graphical interface
  • Cloud signing is not supported

Our verdict on Gitsign

Gitsign is an open-source command-line tool for signing and verifying Git commits and tags. It is aimed at developers and engineering teams that want keyless signing through an OIDC identity provider instead of managing long-lived signing keys. The tool supports Windows, macOS, and Linux, and works with Git’s X.509 signing configuration for local repositories and automated environments.

Its signing flow uses short-lived certificates from Fulcio and records signing data in Rekor, with verification based on certificate identity claims. Gitsign supports both offline and online Rekor modes, plus configurable RFC 3161 trusted timestamping. These features give teams a way to inspect signing identity claims and maintain transparency-log records while keeping the workflow centered on Git artifacts. Private Sigstore instances can also be configured instead of the public Sigstore services used by default.

For automation, Gitsign includes CI token providers for GitHub Actions and Buildkite and integrates with OIDC identity providers, Fulcio, and Rekor. The main trade-off is scope: its supported targets are Git commits and Git tags, so teams looking for broader software, file, or cloud-signing workflows should choose a different code-signing product. Gitsign is a strong fit when the requirement is free, open-source, keyless Git signing across developer workstations and CI pipelines; it is less suitable when a graphical interface, cloud signing, or wider artifact coverage is required.

Your product? Our editors can test Gitsign in depth and publish a review, labelled as paid · from $149/mo →

Gitsign pricing

Gitsign fact sheet

Gitsign integrations

Gitsign lists 6 integrations on its own site.

• Git
• GitHub Actions
• Buildkite
• OIDC identity providers
• Fulcio
• Rekor

Alternatives to Gitsign

• SignPathGoverned signing for teams shipping software across diverse artifact formats.9.4
• DigiCert Software Trust ManagerEnterprise signing governance for artifacts, approvals, keys, and release pipelines.9.2
• SignServerA flexible open-source signing server with enterprise controls for production deployments.9.0

See all Gitsign alternatives →

Featured on iTechGuides

Gitsign is listed in our Code Signing Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/gitsign/"><img src="https://www.itechguides.com/best/badge/gitsign.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update