OpenPubkey
6.6#5 in code signing softwareFree planFree planAPILinuxmacOSSelf-hosted
VisitOpenPubkey vs Sigstore
What both publish
| Fact | OpenPubkey | Sigstore |
|---|---|---|
| License | OpenPubkey is a Linux Foundation project released under the Apache 2.0 license. | Sigstore projects are required to use the Apache License 2.0 and include a compatible dependency-license check. |
| Purpose | OpenPubkey binds user or workload identities to public keys through OpenID Connect, allowing identities to sign messages or artifacts. | Sigstore is an open source project for improving software supply chain security. |
| Support | The project directs feature requests, bug reports, and technical questions to GitHub issues and points users to its OpenSSF Slack channel. | Community support is provided through Slack and GitHub issues, with repository CODEOWNERS identifying project maintainers. |
OpenPubkey plans
- OpenPubkeyFree
Sigstore plans
- FreeFree
- Public-good Sigstore serviceFree
Pick OpenPubkey if…
It suits developers and teams who want user or workload identities to sign messages or artifacts using OIDC-based identity. Workload use requires GQ signatures, and public PK Tokens can disclose identity claims.
Pick Sigstore if…
Sigstore suits developers and software providers seeking signing and verification workflows for software artifacts. It may also be relevant to package managers integrating signing into their tooling or registries.