Sigstore
Sigstore: A focused, free foundation for artifact signing, provenance, and release policy enforcement. Ranked #11 of 24 in Software Supply Chain Security Software by our editors (8.2/10); pricing: Free plan; best for teams standardizing artifact signing and provenance.
At a glance
- Editor score8.2 / 10
- PricingFree plan
- Best forTeams standardizing artifact signing and provenance
- Free planYes
- Paid fromFree
- Founded2021
- Facts checked20 Sep 2026
Where it wins
- Keyless signing uses short-lived identity certificates
- Rekor provides public transparency logging for signed artifacts
- Supports SBOMs, in-toto attestations, and Kubernetes policy enforcement
Where it doesn't
- Focuses on signing and provenance rather than dependency analysis
- Does not provide broad vulnerability management
- Requires teams to assemble project tools into their workflows
Our verdict on Sigstore
Sigstore is an open-source project for improving software supply-chain security through artifact signing and verification. It is designed for development teams, software providers, and platform teams that need to establish provenance for release files, container images, binaries, SBOMs, and other artifacts. The project combines Cosign for signing and verification, Fulcio for short-lived identity-based certificates, Rekor for public transparency logging, and Policy Controller for Kubernetes admission enforcement. Sigstore is free to use and runs across Windows, macOS, Linux, and API-based workflows.
Its strongest fit is a signing and provenance program built around modern CI workflows. Keyless signing through OpenID Connect removes the need for long-lived signing keys, while GitHub Actions, GitHub, and GitLab integrations connect the project to common source-control and automation environments. SBOM signing and storage support, in-toto attestations, and Kubernetes admission policy enforcement extend the workflow from build output to deployment controls. Teams standardizing release verification can use these capabilities as building blocks across their software delivery process.
Sigstore is more focused than a full software supply-chain security suite. Its emphasis is artifact identity, transparency, attestations, and policy gates—not dependency analysis or broad vulnerability management. That makes it a strong choice for teams prioritizing verifiable provenance and signed releases, particularly those comfortable adopting open-source components and integrating them into existing pipelines. Organizations seeking a wider vulnerability-management platform should look for a product with deeper dependency and vulnerability coverage instead.
Your product? Our editors can test Sigstore in depth and publish a review, labelled as paid · from $149/mo →
Sigstore pricing
Sigstore fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Source & repo security | Yes |
| Dependency analysis | Not verified |
| SBOM management | Yes |
| Build provenance | Yes |
| Artifact signing | Yes |
| Provenance attestations | Yes |
| Release policy gates | Yes |
| Deployment | Cloud, Self-hosted |
| Platforms | Windows, macOS, Linux |
| Support | Community, Docs, Tickets |
| Built for | Solo, Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 5 integrations: GitHub, GitLab, GitHub Actions, Google, Microsoft |
| Pricing | Free plan |
| Website | sigstore.dev |
| Facts checked | 20 Sep 2026 |
Sigstore integrations
Sigstore lists 5 integrations on its own site.
- GitHub
- GitLab
- GitHub Actions
- Microsoft
Alternatives to Sigstore
- DevGuardBroad supply-chain security coverage with self-hosted and managed deployment options.9.4
- ChainloopOpen-source evidence management with policy gates and enterprise governance options.9.2
- Anchore EnterpriseDeep SBOM, vulnerability, malware, secrets, and policy controls for hybrid pipelines.9.0
See all Sigstore alternatives →
Also Ranked In
Sigstore is ranked in 2 of our directories.
Used Sigstore? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Sigstore for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Sigstore is listed in our Software Supply Chain Security Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/sigstore/"><img src="https://www.itechguides.com/best/badge/sigstore.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update