Cosign
6.6#4 in code signing softwareFree planFree planLinuxmacOSSelf-hostedWindows
VisitCosign vs OpenPubkey
OpenPubkey
6.6#5 in code signing softwareFree planFree planAPILinuxmacOSSelf-hosted
VisitWhat both publish
| Fact | Cosign | OpenPubkey |
|---|---|---|
| Development status | Cosign is described as a legacy system that should still be used for signing, while Sigstore-go is recommended for verification integrations. | The README says the project is working to get the repository ready for version 1.0. |
| Purpose | Cosign signs and verifies OCI containers and other software artifacts. | OpenPubkey binds user or workload identities to public keys through OpenID Connect, allowing identities to sign messages or artifacts. |
| Security reporting | Sigstore asks vulnerability reporters to email [email protected] and says the Security Response Committee will acknowledge reports within 24 hours. | The security policy asks reporters to email [email protected] privately and says the project does not currently offer bug bounties. |
| Support | The project directs users with issues to open a GitHub issue or ask in its Slack channel. | The project directs feature requests, bug reports, and technical questions to GitHub issues and points users to its OpenSSF Slack channel. |
Cosign plans
- CosignFree
OpenPubkey plans
- OpenPubkeyFree
Pick Cosign if…
Cosign suits open-source package managers and teams that need to sign or verify artifacts in registry and CI/CD workflows. It is less suited to developers seeking a stable API for direct application integration.
Pick OpenPubkey if…
It suits developers and teams who want user or workload identities to sign messages or artifacts using OIDC-based identity. Workload use requires GQ signatures, and public PK Tokens can disclose identity claims.