{"adoption": {"forks": 793, "observed_at": "2026-08-28T04:09:40.920757+00:00", "stars": 6247}, "canonical_url": "https://ross.abutalabs.com/products/cosign", "card": {"archived": false, "artifact_type": "cli-tool", "description": "Code signing and transparency for containers and binaries", "domain": ["security", "developer-tools"], "enriched": true, "function": ["security", "cryptography", "cli", "developer-tools"], "health_score": 100, "homepage": null, "language": "Go", "license": "Apache-2.0", "license_family": "permissive", "maturity": "stable", "member_repos": ["sigstore/cosign"], "name": "sigstore/cosign", "platform": ["windows", "go", "cli"], "pushed_at": "2026-08-24T16:29:13+00:00", "repo": "sigstore/cosign", "stars": 6247, "tags": ["code-signing", "container-signing", "sigstore", "oci-registry", "supply-chain-security", "keyless-signing", "transparency-log", "sbom", "containers", "devops", "linux", "macos", "docker", "kubernetes"], "topics": [], "urls": [], "use_cases": ["sign container images in an OCI registry", "verify container image signatures in CI", "sign software artifacts without managing keys", "implement supply chain security for container deployments", "store signatures alongside container images", "sign binaries with a KMS or hardware token", "check transparency log entries for signed artifacts"], "what_it_is": "Cosign is a CLI tool from the Sigstore project for signing and verifying OCI containers and other software artifacts, with support for keyless signing via Fulcio and the Rekor transparency log. It stores signatures in OCI registries and supports KMS, hardware tokens, and bring-your-own PKI.", "when_to_avoid": ["you need general-purpose file encryption rather than signing", "you cannot reach Sigstore services and don't want to manage your own PKI", "you need signing for non-OCI package ecosystems with their own native tooling"], "when_to_choose": ["you need to sign or verify container images or release artifacts", "you want keyless signing backed by a public transparency log", "you need signatures stored directly in your OCI registry", "you are building Kubernetes or CI supply-chain policy enforcement"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/cosign", "repo": "sigstore/cosign", "role": "main", "score": 98}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:09:40.920757+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-29T17:47:09.722258+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "91ee00adef74881ce80369bfc401e6e275b134e8f71ea22e1646196232d25233", "fetched_at": "2026-08-28T04:09:40.920757+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sigstore/cosign"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:09:40.920757+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-29T17:47:09.722258+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "91ee00adef74881ce80369bfc401e6e275b134e8f71ea22e1646196232d25233", "fetched_at": "2026-08-28T04:09:40.920757+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sigstore/cosign"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-29T17:47:09.722258+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "91ee00adef74881ce80369bfc401e6e275b134e8f71ea22e1646196232d25233", "fetched_at": "2026-08-28T04:09:40.920757+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sigstore/cosign"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:09:40.920757+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:09:40.920757+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:09:40.920757+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-29T17:47:09.722258+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "91ee00adef74881ce80369bfc401e6e275b134e8f71ea22e1646196232d25233", "fetched_at": "2026-08-28T04:09:40.920757+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sigstore/cosign"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:09:40.920757+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:09:40.920757+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-29T17:47:09.722258+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "91ee00adef74881ce80369bfc401e6e275b134e8f71ea22e1646196232d25233", "fetched_at": "2026-08-28T04:09:40.920757+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sigstore/cosign"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:09:40.920757+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:09:40.920757+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:09:40.920757+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-29T17:47:09.722258+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "91ee00adef74881ce80369bfc401e6e275b134e8f71ea22e1646196232d25233", "fetched_at": "2026-08-28T04:09:40.920757+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sigstore/cosign"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:09:40.920757+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:09:40.920757+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-29T17:47:09.722258+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "91ee00adef74881ce80369bfc401e6e275b134e8f71ea22e1646196232d25233", "fetched_at": "2026-08-28T04:09:40.920757+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sigstore/cosign"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-29T17:47:09.722258+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "91ee00adef74881ce80369bfc401e6e275b134e8f71ea22e1646196232d25233", "fetched_at": "2026-08-28T04:09:40.920757+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sigstore/cosign"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-29T17:47:09.722258+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "91ee00adef74881ce80369bfc401e6e275b134e8f71ea22e1646196232d25233", "fetched_at": "2026-08-28T04:09:40.920757+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sigstore/cosign"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-29T17:47:09.722258+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "91ee00adef74881ce80369bfc401e6e275b134e8f71ea22e1646196232d25233", "fetched_at": "2026-08-28T04:09:40.920757+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sigstore/cosign"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 99, "longevity": 100, "rhythm": 96}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": [], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 2036, "days_push": 9, "days_rel": 28, "gap_med": 29, "n_releases_24m": 22}, "score": 98, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}