# sigstore/gitsign

Keyless Git signing using Sigstore

Repository: https://github.com/sigstore/gitsign
Canonical: https://ross.abutalabs.com/products/gitsign
Language: Go
License: NOASSERTION
License Family: other
Topics: git, signing, sigstore
Last push: 2026-09-02T21:45:49+00:00

## Health v2 (maintenance only)
Score: 94/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 100, release rhythm 84, longevity 100
- inputs: {"age_days": 1574, "days_push": 0, "days_rel": 28, "gap_med": 55.0, "n_releases_24m": 9}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1123, forks 86 (observed 2026-09-03T02:15:17.861152+00:00)

## What it is
Gitsign is a CLI tool that signs Git commits and tags using Sigstore's keyless signing, backed by your GitHub or other OIDC identity instead of long-lived keys. It integrates with Git as an X.509 signing program and verifies signatures via Sigstore's Fulcio and Rekor infrastructure.

## Use cases
- sign git commits without managing gpg keys
- keyless commit signing with github identity
- verify signed commits in git
- sign git tags with x509 certificates
- improve supply chain security for git repositories
- replace gpg signing with sigstore

## When to choose
- you want commit signing without key management
- your organization uses sigstore for supply chain security
- you prefer OIDC identity-based signing over GPG

## When to avoid
- you need offline signing without internet access
- you must use GPG keys or existing PGP workflows
- your verification tooling does not support x509 signatures

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, cryptography, developer-tools, cli
- domain: security, version-control, developer-tools
- platform: windows, cli, cross-platform
- tags: git-signing, sigstore, keyless-signing, oidc, x509, supply-chain-security, commit-signing, linux, macos

## Member repositories
- sigstore/gitsign (main) score 94

## Provenance
- Observed fields: from GitHub, fetched 2026-09-03T02:15:17.861152+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:41:50.140782+00:00, confidence not recorded.
  - readme: https://github.com/sigstore/gitsign (fetched 2026-09-03T02:15:17.861152+00:00, sha 725e95ab34cd)
- Data as of 2026-08-30T08:39:29.467469+00:00.