sigstore/sigstore is the common Go library holding the code shared across Sigstore's software supply-chain signing services and clients, written for Go developers who build or extend those Sigstore components rather than for end users who simply want to sign an artifact.
What it is
The repository is the common codebase behind Sigstore, an ecosystem for signing and verifying software artifacts. It contains the code shared by Sigstore infrastructure, meaning services such as Fulcio and Rekor, and by Go language clients such as Cosign and Gitsign. Instead of each of those projects carrying its own copy of signing logic, identity handling, and key-store plumbing, they import this single Apache-2.0 licensed library.
The concrete problem it solves is duplication and drift in signing implementations. Any client that needs to sign with an ECDSA, Ed25519, or RSA key, or to produce a DSSE (in-toto) envelope, and any service that needs to check a user's identity through OpenID Connect against Fulcio, would otherwise reimplement that logic separately. This library supplies the signing interface, the Fulcio OpenID Connect client code, and integrations for several key management systems, so the infrastructure and the clients stay consistent with one another.
Key capabilities
- Signing interface with support for ECDSA, Ed25519, and RSA keys, plus DSSE (in-toto) envelopes.
- OpenID Connect client code for Fulcio.
- Key management integrations for AWS Key Management Service, Azure Key Vault, HashiCorp Vault, Google Cloud Platform Key Management Service, and OpenBao.
- Support for OVHcloud KMS through the external plugin at github.com/ovh/sigstore-kms-ovhcloud.
- Fuzz tests maintained in test/fuzz, with the project covered by OSS-Fuzz.
- CII Best Practices badge, showing the project meets the Open Source Security Foundation baseline criteria.
- Security reporting process documented in sigstore/.github SECURITY.md.
Who uses it and how
- Maintainers of Sigstore infrastructure services, including Fulcio and Rekor, import the shared code instead of duplicating it.
- Go client projects such as Cosign and Gitsign depend on the library for their signing and identity behaviour.
- Teams that keep signing keys in a cloud or self-hosted key store rely on the built-in KMS support for AWS KMS, Azure Key Vault, HashiCorp Vault, GCP KMS, OpenBao, or the OVHcloud plugin.
- Developers producing DSSE (in-toto) attestations or verifying identity tokens against Fulcio work through this library indirectly, via the client that imports it.
- Projects that need continuously fuzzed signing code depend on the fuzz suite in test/fuzz.
Getting started
The README gives no install command; it directs developers to example code in the relevant test code for each main code file, since the library is consumed as a Go dependency. For container signing, the README points to cosign instead.
How it compares
Within the Sigstore ecosystem this library sits below the user-facing tools. Fulcio and Rekor are the services, Cosign and Gitsign are the clients, and this repository is the shared layer all of them build on. The README explicitly sends anyone whose goal is container signing to Cosign rather than to this library.
When to use it — and when not to
This is a library for developers building Sigstore-integrated tooling, not a runnable service or a command-line tool; anyone who wants to sign a container or a Git commit should use Cosign or Gitsign, and anyone who wants to operate a certificate authority or transparency log must run Fulcio or Rekor. The README is deliberately narrow, offering no installation instructions and pointing to test files for example usage, so adopters are expected to read the source. Key management is also the adopter's responsibility, because the library supports several KMS backends but does not provision or host keys itself.
