Sigstore
A Linux Foundation-supported open-source software signing project that provides a keyless signing mechanism based on OpenID Connect, using a public transparency log (Rekor) to verify software package provenance and integrity, forming critical infrastructure for software supply chain security.
Core Facts
Timeline (last 90 days)
The provenance attestation of an npm package is based on Sigstore, making it traceable which CI pipeline and which commit built the package.
PyPI supports Sigstore-signed Trusted Publishing, letting users verify that a distribution package was indeed produced by the project maintainer's CI pipeline.
Mature tools adopt offline signing, multi-signature, transparency logs (such as Sigstore), and rollback-capable version pinning mechanisms to reduce the supply chain risk brought by self-updating.
Cosign is a container image signing tool provided by the Sigstore project.
cosign is an open-source tool under the Sigstore project, designed specifically for signing, verifying, and attesting OCI container images and artifacts.
The SLSA framework and the Sigstore project are dedicated to providing verifiable provenance attestations for build and release pipelines.
Supply chain security tools such as Sigstore/Cosign natively support signing and verifying OCI Artifacts.
GitHub introduced official signing support for Actions release artifacts (based on the Sigstore/cosign system) in 2022.
GitHub trusted signing (Sigstore/GitHub Attestations) verifies the provenance of release artifacts through cryptographic endorsement, serving as a means of strengthening npm supply chain security.
Protective mechanisms that crates.io is in the process of implementing or has already deployed include mandatory 2FA, immutability guarantees for published versions, and Sigstore-based transparency logs.
9 more timeline events
All Facts (19)
GitHub trusted signing (Sigstore/GitHub Attestations) verifies the provenance of release artifacts through cryptographic endorsement, serving as a means of strengthening npm supply chain security.
75%UnverifiedThe provenance attestation of an npm package is based on Sigstore, making it traceable which CI pipeline and which commit built the package.
50%UnverifiedPyPI supports Sigstore-signed Trusted Publishing, letting users verify that a distribution package was indeed produced by the project maintainer's CI pipeline.
50%UnverifiedMature tools adopt offline signing, multi-signature, transparency logs (such as Sigstore), and rollback-capable version pinning mechanisms to reduce the supply chain risk brought by self-updating.
50%UnverifiedCosign is a container image signing tool provided by the Sigstore project.
50%Unverifiedcosign is an open-source tool under the Sigstore project, designed specifically for signing, verifying, and attesting OCI container images and artifacts.
50%UnverifiedThe SLSA framework and the Sigstore project are dedicated to providing verifiable provenance attestations for build and release pipelines.
50%UnverifiedSupply chain security tools such as Sigstore/Cosign natively support signing and verifying OCI Artifacts.
50%UnverifiedGitHub introduced official signing support for Actions release artifacts (based on the Sigstore/cosign system) in 2022.
50%UnverifiedProtective mechanisms that crates.io is in the process of implementing or has already deployed include mandatory 2FA, immutability guarantees for published versions, and Sigstore-based transparency logs.
50%UnverifiedPromoting software package signing mechanisms can raise the cost of malicious packages impersonating legitimate ones, as even if an attacker registers a typosquatting package name, they cannot forge the signing credentials of the legitimate maintainer.
50%UnverifiedPyPI began supporting Sigstore signatures in 2023.
50%UnverifiedSigstore writes signing records to the public transparency log Rekor, allowing anyone to verify whether a package was built and released by the claimed maintainer in a specific CI environment.
50%UnverifiedSigstore is an open-source project backed by the Linux Foundation, designed to provide a keyless signing mechanism for software packages based on OpenID Connect.
50%UnverifiedIn CI environments, multi-layer verification to reduce dependency poisoning risks can be built by combining tools such as npm audit, package-lock.json hash locking, and Sigstore.
50%UnverifiedSigstore uses a short-lived certificate model in which signers prove their identity to the Fulcio CA via OIDC and obtain a signing certificate valid for only a few minutes.
50%UnverifiedOpen Source Security Foundation（OpenSSF）于2020年成立，推出了Scorecard、Sigstore等工具
50%UnverifiedThe npm ecosystem introduced Sigstore signing support in 2022.
50%UnverifiedThe npm ecosystem introduced Sigstore signing support in 2022, allowing package maintainers to perform keyless signing of published tarballs via OIDC identity federation.
50%