OpenPubkey
6.6#5 in code signing softwareFree planFree planAPILinuxmacOSSelf-hosted
VisitOpenPubkey vs SignPath
What both publish
| Fact | OpenPubkey | SignPath |
|---|---|---|
| Integrations | The project identifies Docker as using OpenPubkey to sign Docker Official Images and BastionZero as using it for secure remote infrastructure access. | The company lists plugins and REST API integrations for GitHub Actions, GitLab, Jenkins, Azure DevOps, and TeamCity. |
| Purpose | OpenPubkey binds user or workload identities to public keys through OpenID Connect, allowing identities to sign messages or artifacts. | SignPath provides code signing and software integrity tools that enforce policies across software builds and releases. |
OpenPubkey plans
- OpenPubkeyFree
SignPath plans
- Open Source Code SigningFree
- Code GovernancePriced on request
- Software Integrity PlatformPriced on request
Pick OpenPubkey if…
It suits developers and teams who want user or workload identities to sign messages or artifacts using OIDC-based identity. Workload use requires GQ signatures, and public PK Tokens can disclose identity claims.
Pick SignPath if…
SignPath suits development teams that need controls around signing and verifying software releases. Its free option is for qualifying open source projects; deployment choices also include self-hosted and hybrid.