Sigstore Fundamentals

Sigstore is an open source system for signing and verifying software artifacts with short-lived identity certificates and public transparency records. It helps you check who signed exact software content without requiring each signer to maintain a long-lived signing key.

itSoftware supply chain security

Don't Panic — Sigstore Fundamentals

Sigstore lets you sign and verify software artifacts without managing long-lived signing keys. It uses short-lived identity certificates and a public transparency log instead.

The old way of code signing asked every project to generate a private key, protect it forever, distribute the public key, rotate it periodically, and revoke it when things went wrong. That is a lot of administrative overhead to ask of someone who just wants to ship a container image. Sigstore replaces that with identity: you authenticate through an OpenID Connect provider, get a short-lived certificate from Fulcio that binds an ephemeral key to your identity, sign the artifact, and the event lands in Rekor, an append-only transparency log.

The mental model is narrow and that is the point. Sigstore provides evidence about one question: did someone controlling an expected identity sign these exact bytes, with valid supporting evidence? It does not tell you whether the software is safe. It does not inspect source code. It does not remove vulnerabilities. Your verification policy makes the trust decision.

The surprising bit for people coming from traditional code signing: a signature made with an expired certificate remains verifiable forever. Verification does not ask "is this certificate currently valid?" It asks "was the signature logged in Rekor during the certificate's short validity window?" The transparency log's signed timestamp answers that. This is why keyless works at all — validity is anchored to an immutable log entry, not to certificate lifetime.

The flow is the same whether a human or a CI pipeline signs: authenticate, get a certificate, sign, log the evidence, and hand the bundle to whoever needs to verify later. Cosign ties these pieces together into a single tool, and the trust root distributed through The Update Framework anchors both Fulcio and Rekor verification.

Sigstore won the argument about how open-source artifacts should be signed. npm, PyPI, Homebrew, and GitHub itself all build on it. The hard part is not signing — that is a one-line CI change. The hard part is writing verification policy precise enough to matter.

Start with the intro and slides to understand the keyless flow and component relationships. The cheatsheet has the verification checklist you will reference most. The video script walks through the full mental model if you prefer narration.

Don't Panic — Sigstore Fundamentals

Relevant careers