sigstore / cosign

Code signing and transparency for containers and binaries

sigstore / rekor

Software Supply Chain Transparency Log

chainloop-dev / chainloop

Agentic SDLC infrastructure. Define guardrails. Collect signals. Enforce continuously. Signed records of what your AI coding agents and CI/CD pipelines did, checked against policies as code, with the loop closed in CI/CD. AI sessions, SBOMs, VEX, SARIF and SLSA provenance, built on Sigstore and in-toto. Apache 2.0.

sigstore / fulcio

Sigstore OIDC PKI

sigstore / gitsign

Keyless Git signing using Sigstore

sigstore / sigstore

Common go library shared across sigstore services and clients