Sigstore is an open-source project that makes cryptographic signing of software artefacts — container images, binaries, packages, and SBOMs — as easy as logging in with an email account. It eliminates the complexity of traditional GPG-based signing that has kept software supply chain security out of reach for most teams. In 2026, Sigstore is the emerging standard for supply chain integrity.
Why Software Signing Matters
Software supply chain attacks — where attackers compromise the build process, package registries, or distribution infrastructure to inject malicious code — have become one of the most impactful attack vectors in enterprise security. SolarWinds, Log4Shell exploitation, and XZ Utils backdoor all exploited weaknesses in software distribution trust. Cryptographic signing of software artefacts with verifiable identity provides a defence: consumers can verify that what they received was built by the expected party and has not been tampered with in transit.
Sigstore Architecture
Sigstore is a set of tools and services working together to enable transparent, verifiable software signing:
Sigstore's "keyless" signing model is its key innovation. Instead of generating and managing a long-lived private key (which can be stolen, lost, or forgotten), Sigstore generates an ephemeral key pair, binds it to an OIDC identity token (from GitHub Actions, Google, etc.), and records the short-lived certificate in Rekor. Verification does not require knowing the signer's public key in advance — you verify against the Rekor transparency log and the OIDC identity claim.
Signing Container Images with Cosign
Signing and verifying container images with Cosign in a GitHub Actions CI pipeline:
# GitHub Actions: Sign image after push
- name: Sign the container image
uses: sigstore/cosign-installer@v3
- name: Sign
run: |
cosign sign --yes ghcr.io/myorg/myimage@${{ steps.build.outputs.digest }}
env:
COSIGN_EXPERIMENTAL: 1 # Enables keyless signing
# Verify at deployment time
cosign verify --certificate-identity-regexp="https://github.com/myorg/myrepo" --certificate-oidc-issuer="https://token.actions.githubusercontent.com" ghcr.io/myorg/myimage:latestPolicy Enforcement with Sigstore
Signing is only valuable if unsigned or incorrectly signed images cannot be deployed. Policy enforcement connects Sigstore to your Kubernetes admission control:
| Policy Tool | Description | Best For |
|---|---|---|
| Sigstore Policy Controller | Kubernetes admission webhook enforcing Cosign signature policies | Kubernetes-native enforcement |
| Kyverno | Kubernetes policy engine with Sigstore/Cosign integration | Teams already using Kyverno for policy |
| OPA / Gatekeeper | Open Policy Agent with Cosign signature verification | Complex policy logic requirements |
| Connaisseur | Kubernetes admission controller for image signature validation | Organisations wanting dedicated signing admission control |
Signing SBOMs and Attestations
Sigstore's Cosign supports attaching signed attestations — structured claims about an artefact — alongside the signature. This enables signing SBOMs (Software Bill of Materials), SLSA provenance records, vulnerability scan results, and test results as verifiable claims tied to the artefact's identity:
# Generate and sign SBOM
syft ghcr.io/myorg/myimage:latest -o cyclonedx-json > sbom.json
cosign attest --yes --predicate sbom.json --type cyclonedx ghcr.io/myorg/myimage@$DIGEST
# Verify SBOM attestation
cosign verify-attestation --type cyclonedx --certificate-identity-regexp="..." ghcr.io/myorg/myimage:latest