Sigstore

Sigstore is an open-source project and emerging standard for signing, verifying, and proving the provenance of software artifacts. Backed by the Open Source Security Foundation, it removes the traditional burden of managing long-lived signing keys by issuing short-lived certificates tied to an existing identity, then recording every signature in a public transparency log.

• Keyless signing - Developers sign using an OIDC identity (a Google, GitHub, or corporate login) rather than holding and protecting private keys.
• Short-lived certificates - Fulcio issues ephemeral certificates that exist only long enough to sign, shrinking the window for key compromise.
• Transparency log - Rekor records signatures in a tamper-evident, publicly auditable log so anyone can verify what was signed and when.
• Provenance and attestations - It integrates with SLSA and in-toto to attach verifiable build provenance to artifacts.

In API operations, Sigstore matters most in the delivery pipeline behind the API: signing the container images, SDKs, and CLI binaries a provider ships so consumers can verify they are running authentic, untampered code. As software supply-chain attacks and agent-driven toolchains raise the stakes, keyless signing with a public log is one of the cheaper, more machine-verifiable trust signals a producer can add — a supply-chain complement to runtime signals like security.txt.