SignPath

Overview

SignPath is a code-signing platform that ties release trust to build context, artifact type, and approval rules. It suits teams with CI/CD pipelines and controlled releases, as well as eligible open-source projects seeking free signing.

Its distinguishing strength is the combination of format-aware signing and policy checks, rather than signing artifacts as an isolated final step. Teams that need only a basic signing utility may find that broader control layer unnecessary.

Key features

Signing across formats

SignPath supports Windows PE files, PowerShell, MSI, CAB, catalog files, APPX, MSIX, NuGet, Java archives, containers, Linux packages, macOS code, and custom artifacts. Its semantic signing also covers scripts, manifests, SBOMs, and configuration files. A provided certificate, cloud signing, trusted timestamping, and CI/CD signing make it a broad fit for teams shipping across platforms; that breadth matters less for projects with a single, simple signing need.

Build policy and access

Before a release is trusted, SignPath can verify its source repository, branch, build system, approvals, and CI/CD context. Role-based controls determine who can sign which artifacts, when, and with which certificate. This lets teams align signing authority with release policy, but is more control than a lightweight workflow may require.

Attestations and audit trail

SignPath can produce signed, machine-readable attestations, including SLSA provenance, validation summaries, and signed SBOMs. Signing requests are logged with the user, file, certificate, policy, and result; exportable reports and optional WORM-style log archiving help teams retain records. Private keys are stored in FIPS-compliant HSMs and are never exposed or shared, according to SignPath.

Integrations and deployment

Plugins and REST API integrations are listed for GitHub Actions, GitLab, Jenkins, Azure DevOps, and TeamCity. SaaS, self-hosted, and hybrid deployment options give teams a choice in how they operate the service. The range of options is useful across different pipeline and deployment needs, though buyers should choose based on their own operational requirements.

Pricing

The Open Source Code Signing plan costs free. It includes a certificate, cloud signing, HSM key protection, trusted timestamping, CI/CD signing, and approval workflows, with support for the listed artifact targets. It is specifically for open-source projects, not a general free tier: SignPath Foundation subscriptions require an actively maintained, released project under an OSI-approved license, without proprietary components. Projects outside those conditions should not assume they qualify.

SignPath's pricing model is free, and the stated plan is free; no paid plan is included in the available choices. The free offer's eligibility restriction is the central limitation for teams evaluating cost.

Platforms

SignPath supports API, Linux, macOS, self-hosted, web, and Windows. Its deployment options are SaaS, self-hosted, or hybrid.

Who it's for

SignPath is a strong match for organizations that want signing decisions governed by build provenance, approvals, and artifact-specific permissions, especially teams already using one of its listed CI/CD integrations. Eligible open-source maintainers can benefit from the free subscription. It is less compelling for teams that only need a basic signer or for proprietary projects expecting to use the free plan.

Pros and cons

• Pros: Broad artifact coverage, including custom artifacts, supports varied release outputs.
• Pros: Build-context verification and role-based signing rules connect release trust to how software was produced and approved.
• Pros: HSM-protected keys, signed attestations, and detailed signing logs support security and traceability requirements.
• Cons: The free plan is limited to qualifying open-source projects, excluding proprietary use.
• Cons: Teams seeking only basic signing may not need its policy, attestation, and audit capabilities.

Alternatives

For a broader shortlist, see Code Signing Software.

• Cosign is a free option for open-source software with no hosted service or usage limits stated; consider it when a simpler free signing choice fits better.
• SignServer has a free Community plan for basic code, document, and container signing and timestamping, with source-code or container deployment; choose it when those core capabilities suit the need.
• AWS Signer has a no-additional-charge option for use with specified AWS services and third-party container services; it may suit workflows centered on those services.
• Sigstore is free to use for all developers and software providers; consider it when that broad free availability is the priority.
• DigiCert Software Trust Manager is an alternative with custom pricing.
• SignPath Foundation offers a free subscription for eligible open-source projects with maintenance, release, and license conditions; compare its eligibility requirements with SignPath's.
• Red Hat Trusted Artifact Signer is another option with custom pricing.
• Bamboo Deploy has a Premium plan at $15 a month, billed $45 every 3 months, for up to 50 apps and 1GB cloud hosting; consider it if those deployment limits and terms match the need.

Verdict

Choose SignPath if your team needs artifact signing governed by build context, approvals, and auditable release records, or if your open-source project qualifies for its free plan. Look elsewhere if you need a basic signer without that policy layer or if your proprietary project requires a free subscription.