sigstore/gitsign

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1123 stars · 86 forks observed · 2026-09-03

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Gitsign is a CLI tool that signs Git commits and tags using Sigstore's keyless signing, backed by your GitHub or other OIDC identity instead of long-lived keys. It integrates with Git as an X.509 signing program and verifies signatures via Sigstore's Fulcio and Rekor infrastructure.

Use cases

• sign git commits without managing gpg keys
• keyless commit signing with github identity
• verify signed commits in git
• sign git tags with x509 certificates
• improve supply chain security for git repositories
• replace gpg signing with sigstore

When to choose

• you want commit signing without key management
• your organization uses sigstore for supply chain security
• you prefer OIDC identity-based signing over GPG

When to avoid

• you need offline signing without internet access
• you must use GPG keys or existing PGP workflows
• your verification tooling does not support x509 signatures

Facets

cli-tool · maturity active

security cryptography developer-tools cli security version-control developer-tools windows cli cross-platform git-signing sigstore keyless-signing oidc x509 supply-chain-security commit-signing linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="sigstore/gitsign")