Gitsign review
A focused open-source option for keyless Git commit and tag signing.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Gitsign is an open-source command-line tool for signing and verifying Git commits and tags. It is aimed at developers and engineering teams that want keyless signing through an OIDC identity provider instead of managing long-lived signing keys. The tool supports Windows, macOS, and Linux, and works with Git’s X.509 signing configuration for local repositories and automated environments.
Its signing flow uses short-lived certificates from Fulcio and records signing data in Rekor, with verification based on certificate identity claims. Gitsign supports both offline and online Rekor modes, plus configurable RFC 3161 trusted timestamping. These features give teams a way to inspect signing identity claims and maintain transparency-log records while keeping the workflow centered on Git artifacts. Private Sigstore instances can also be configured instead of the public Sigstore services used by default.
For automation, Gitsign includes CI token providers for GitHub Actions and Buildkite and integrates with OIDC identity providers, Fulcio, and Rekor. The main trade-off is scope: its supported targets are Git commits and Git tags, so teams looking for broader software, file, or cloud-signing workflows should choose a different code-signing product. Gitsign is a strong fit when the requirement is free, open-source, keyless Git signing across developer workstations and CI pipelines; it is less suitable when a graphical interface, cloud signing, or wider artifact coverage is required.
Gitsign pros and cons
- Where it wins
- Keyless Git commit and tag signing with OIDC authentication
- Rekor transparency logs, certificate claims, and trusted timestamping
- CI token providers for GitHub Actions and Buildkite
- Where it doesn't
- Supports Git commits and tags rather than broader signing targets
- Uses a command-line workflow rather than a graphical interface
- Cloud signing is not supported
Gitsign fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update