Sigstore Fundamentals

Sigstore helps software producers sign artifacts and helps consumers verify them. It replaces much of the burden of long-lived signing keys with short-lived identity certificates and public transparency records.

The result is evidence about a narrow question:

Did a signer who controlled an expected identity sign these exact bytes, and is the supporting evidence valid?

That evidence does not tell you whether the software is safe. Your verification policy must still decide which identities, issuers, artifacts, and claims are acceptable.

Why Sigstore exists

Traditional code signing can require every project to generate, protect, distribute, rotate, and revoke long-lived signing keys. Those tasks are difficult to run consistently across people and automated build systems.

Sigstore offers an identity-based path. A human or workload authenticates through OpenID Connect. A Sigstore client creates an ephemeral key. Fulcio issues a short-lived certificate that binds the public key to the authenticated identity. Rekor records signing evidence in a transparency log.

The signer does not keep the ephemeral private key. Verifiers receive the identity certificate and the evidence needed to check that signing occurred while the certificate was valid.

Keyless signing is the common name for this flow. The name does not mean that cryptographic keys disappear. It means you do not manage a long-lived signer key.

The main components