Cosign
6.6#4 in code signing softwareFree planFree planLinuxmacOSSelf-hostedWindows
VisitCosign vs Sigstore
What both publish
| Fact | Cosign | Sigstore |
|---|---|---|
| CI integrations | The installation documentation describes use in GitHub Actions and GitLab CI/CD pipelines. | Sigstore provides GitHub Actions for generating signatures and installing Cosign, and documents GitLab CI installation. |
| Integration limitation | Cosign functions were designed for its CLI rather than as an API; the documentation says there are no API stability guarantees and does not recommend Cosign for application integration. | Cosign has no API stability guarantees, does not follow semantic versioning, and is not recommended for application integration because of its dependencies. |
| Purpose | Cosign signs and verifies OCI containers and other software artifacts. | Sigstore is an open source project for improving software supply chain security. |
| Support | The project directs users with issues to open a GitHub issue or ask in its Slack channel. | Community support is provided through Slack and GitHub issues, with repository CODEOWNERS identifying project maintainers. |
Cosign plans
- CosignFree
Sigstore plans
- FreeFree
- Public-good Sigstore serviceFree
Pick Cosign if…
Cosign suits open-source package managers and teams that need to sign or verify artifacts in registry and CI/CD workflows. It is less suited to developers seeking a stable API for direct application integration.
Pick Sigstore if…
Sigstore suits developers and software providers seeking signing and verification workflows for software artifacts. It may also be relevant to package managers integrating signing into their tooling or registries.