SignPath

B tier on Code Signing SoftwareScore 7.2 · #2 of 26

Android app: Not listed
Free plan: Yes
Runs on: api, Linux, Mac, self-hosted, Web, Windows

signpath.io

Summary

SignPath provides code-signing and software-integrity controls for builds and releases. Its format-aware signing covers executables, packages, installers, containers, scripts, manifests, software bills of materials, and configuration files. Before a release is trusted, it can verify details such as the source repository, branch, build system, approvals, and CI/CD context. SignPath can create signed, machine-readable attestations, including SLSA provenance, validation summaries, and signed SBOMs. Integrations include plugins and REST APIs for GitHub Actions, GitLab, Jenkins, Azure DevOps, and TeamCity. SignPath says private keys are held in FIPS-compliant hardware security modules and are never exposed or shared. Role-based controls govern who can sign particular artifacts and with which certificate. Logs record signing requests and can be exported, with optional WORM-style archiving. Deployment options are SaaS, self-hosted, or hybrid. The free Open Source Code Signing subscription is limited to eligible, actively maintained and released projects using an OSI-approved open source license without proprietary components.

Who it is for

SignPath suits development teams that need controls around signing and verifying software releases. Its free option is for qualifying open source projects; deployment choices also include self-hosted and hybrid.

What is good

Signs a broad range of software artifact formats.
Can verify source, build, approvals, and CI/CD context.
Integrates with GitHub Actions, GitLab, Jenkins, Azure DevOps, and TeamCity.
Offers SaaS, self-hosted, or hybrid deployment.

What to know first

Free plan is limited to eligible open source projects.
Eligibility excludes projects with proprietary components.

Verdict

SignPath focuses on controlling artifact signing and release trust, with integrations and deployment options for different pipelines. Check the open-source eligibility conditions if considering its free subscription.

SignPath plans and pricing

All plans

Open Source Code Signing Free For open source projects · eligibility conditions apply signpath.org · 29 Sept 2026

Compared on code signing software

Free plan: Yessignpath.io
Supported targets: Windows PE files, PowerShell, MSI, CAB, catalog, APPX, MSIX, NuGet, Java archives, containers, Linux packages, macOS code, and custom artifactssignpath.io
Certificate provided: Yessignpath.io
Cloud signing: Yessignpath.io
HSM key protection: Yessignpath.io
Trusted timestamping: Yessignpath.io
CI/CD signing: Yessignpath.io
Approval workflows: Yessignpath.io

Facts

Purpose: SignPath provides code signing and software integrity tools that enforce policies across software builds and releases.signpath.io · 29 Sept 2026
Signing: Its semantic code signing supports format-aware signing for executables, packages, installers, containers, scripts, manifests, SBOMs, and configuration files.signpath.io · 29 Sept 2026
Pipeline integrity: The platform can verify source repositories, branches, build systems, approvals, and CI/CD context before trusting a release.signpath.io · 29 Sept 2026
Attestation: SignPath can generate signed, machine-readable attestations including SLSA provenance, validation summaries, and signed SBOMs.signpath.io · 29 Sept 2026
Integrations: The company lists plugins and REST API integrations for GitHub Actions, GitLab, Jenkins, Azure DevOps, and TeamCity.signpath.io · 29 Sept 2026
Key security: SignPath says private keys are stored in FIPS-compliant HSMs and are never exposed or shared.signpath.io · 29 Sept 2026
Access controls: Role-based access controls define who can sign which artifacts, when, and with which certificate.signpath.io · 29 Sept 2026
Audit and compliance: The platform logs signing requests with the user, file, certificate, policy, and result, and offers exportable reports and optional WORM-style log archiving.signpath.io · 29 Sept 2026
Deployment: SignPath describes its deployment options as SaaS, self-hosted, or hybrid.signpath.io · 29 Sept 2026
Support: SignPath provides a support portal and lists [email protected] as a contact address.signpath.io · 29 Sept 2026
Open source eligibility: Free SignPath Foundation subscriptions require an actively maintained, released project using an OSI-approved open source license without proprietary components.signpath.org · 29 Sept 2026
Audience: The company says it serves customers worldwide, from small development teams to large enterprises.signpath.io · 29 Sept 2026