open-source · since 2020
Sigstore
OpenSSF
An open-source software-signing ecosystem for verifying the provenance and integrity of software artifacts. Its projects include Fulcio, Rekor, Cosign and shared client libraries used in cloud-native software supply chains.
supply-chainsecuritysigningprovenance
desk notes
Verified 2026-08-27 from the project repository, LICENSE and GitHub release API; the JavaScript-rendered project homepage was also opened via its canonical URL. Latest sigstore/sigstore library release at verification: v1.10.9, published 2026-08-03.