sigstore/cosign
Code signing and transparency for containers and binaries observed · 2026-08-28
Health v2 · maintenance only
98/100
- Activity 99
- Release rhythm 96
- Longevity 100
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.
- gap_med: 29
- age_days: 2036
- days_rel: 28
- days_push: 9
- n_releases_24m: 22
Adoption not part of the score
6247 stars · 793 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded
Cosign is a CLI tool from the Sigstore project for signing and verifying OCI containers and other software artifacts, with support for keyless signing via Fulcio and the Rekor transparency log. It stores signatures in OCI registries and supports KMS, hardware tokens, and bring-your-own PKI.
Use cases
- sign container images in an OCI registry
- verify container image signatures in CI
- sign software artifacts without managing keys
- implement supply chain security for container deployments
- store signatures alongside container images
- sign binaries with a KMS or hardware token
- check transparency log entries for signed artifacts
When to choose
- you need to sign or verify container images or release artifacts
- you want keyless signing backed by a public transparency log
- you need signatures stored directly in your OCI registry
- you are building Kubernetes or CI supply-chain policy enforcement
When to avoid
- you need general-purpose file encryption rather than signing
- you cannot reach Sigstore services and don't want to manage your own PKI
- you need signing for non-OCI package ecosystems with their own native tooling
Facets
cli-tool · maturity stable
security cryptography cli developer-tools security developer-tools windows go cli code-signing container-signing sigstore oci-registry supply-chain-security keyless-signing transparency-log sbom containers devops linux macos docker kubernetes
1 source
- readme: https://github.com/sigstore/cosign · fetched 2026-08-28 · 91ee00adef74
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| sigstore/cosign | main | 98 |
For agents
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem