OpenPubkey

OpenPubkey is an open-source project for tying user and workload identities to signing keys through OpenID Connect. It suits teams building identity-backed signing into systems that already trust an OpenID Provider. Its CA-free approach is appealing, but current provider support and the privacy of public tokens deserve careful consideration.

Overview

OpenPubkey links an identity to a public key through OpenID Connect. A PK Token proves that the identity controlled the associated private key at a particular time, as long as the verifier trusts the identity provider. This makes OpenPubkey a signing building block rather than a certificate service: it provides no certificate and relies on the provider in that role.

The project supports signing messages and artifacts for both people and workloads. Its Go client and verifier example walks through authentication, creating a PK Token, signing a message, and verifying the signature. Docker is building a public registry that uses OpenPubkey to sign Docker Official Images, and BastionZero uses it for secure remote infrastructure access. The project is preparing for version 1.0, so teams adopting it should account for its pre-1.0 development status.

Key features

Identity-backed signing without an added CA

Teams can associate signing keys with identities from an OpenID Provider without changing that provider or adding a separate certificate authority. That is a useful fit when an organization already has a provider it trusts. The trade-off is that verifiers inherit that trust decision: the identity provider remains central to the proof.

Provider compatibility and current coverage

OpenPubkey says it is compatible with Google, Azure/Microsoft, Okta, OneLogin, and Keycloak without provider changes. Its client and verifier currently create and verify PK Tokens from Google for user identities and GitHub for workloads. That gap between broad compatibility claims and current client coverage matters: teams relying on another provider should confirm that their intended flow is supported before building around it.

Replay protection and workload signing

GQ signatures let the OpenID Provider's signature be removed from an ID Token while preserving proof that the provider signed it. This prevents the token from being reused against OIDC resource providers. GQ signatures are required for all current workload identity use cases, adding a prerequisite for teams signing as workloads. They are unnecessary for user scenarios when the PK Token is not public.

Token privacy and key handling

Public PK Tokens expose claims from the signer's ID Token, which may include a name or email address. That is a material privacy cost when signatures or artifacts are publicly visible. OpenPubkey also assumes identity-held key pairs are ephemeral: users generate them as needed and delete them when finished, a lifecycle that teams must accommodate.

For user identity scenarios, an optional MFA cosigner protocol independently authenticates the user and cosigns the PK Token. It adds a second authentication step, but does not support workload identities.

Pricing

OpenPubkey is free and open source under the Apache 2.0 license. Its reference implementation costs nothing. That makes it accessible to teams able to integrate and operate the project themselves; it is not a priced hosted service or a certificate purchase.

Platforms

OpenPubkey supports API, Linux, macOS, self-hosted, and Windows environments. The project provides a Go client and verifier example. It targets messages and artifacts and does not provide a certificate.

Who it's for

OpenPubkey is best for developers and infrastructure teams that want signatures tied to user or workload identities from an OpenID Provider they already trust. Its strongest fit today is a Google-backed user flow or a GitHub-backed workload flow, especially where avoiding an added CA matters. Teams that need public tokens should weigh the identity claims those tokens can expose; workload teams also need to account for GQ signatures.

Support runs through GitHub issues for bugs, feature requests, and technical questions, with a community Slack channel for discussion. Security reports should be sent privately to [email protected]; the project does not offer bug bounties.

Pros and cons

Pros

• No added CA: OpenID Provider trust supplies the signing identity role, which can avoid introducing another certificate authority.
• User and workload identities: The project covers both, with message and artifact signing as targets.
• Free and Apache 2.0 licensed: Teams can use the reference implementation without a per-use charge and adapt it under the stated open-source license.

Cons

• Current provider coverage is narrow: The client and verifier currently support Google for users and GitHub for workloads, limiting immediate fit for teams using other providers.
• Public tokens can disclose identity claims: Names or email addresses from an ID Token may be exposed when PK Tokens are public.
• Workload signing requires GQ signatures: Teams must include that requirement in their workload setup.
• Pre-1.0 development: The project is still being prepared for version 1.0, a consideration for production adoption.

Alternatives

For a broader set of code-signing options, see Code Signing Software.

• Cosign is another free, open-source option for Linux, macOS, self-hosted, and Windows environments, with no hosted service or usage limits stated.
• SignPath offers a free plan for open-source projects, subject to eligibility conditions, and supports API, Linux, macOS, self-hosted, web, and Windows environments.
• SignServer has a free community plan for basic code, document, and container signing and timestamping, with source code or container deployment; it also offers a free trial.
• AWS Signer has no additional charge for use with AWS IoT Device Management, AWS Lambda, Amazon ECR, Amazon EKS, or third-party container services.
• Notation is a free Apache 2.0 licensed CLI project for Linux, macOS, and Windows.
• Sigstore is free for developers and software providers, with API, Linux, macOS, self-hosted, and Windows support.
• Aujas Automated Code Signing Platform uses signing-based licenses with custom pricing.
• DigiCert Software Trust Manager uses custom pricing.

Verdict

Choose OpenPubkey if you need free, identity-linked signing for messages or artifacts and your team can work within its current Google user or GitHub workload support. Its central advantage is tying signatures to an existing OIDC identity without adding a CA. Look elsewhere if your required provider is not covered by the current client and verifier, or if public PK Token claims create an unacceptable privacy trade-off.