OpenPubkey

OpenPubkey is a free, Apache 2.0 project for identity-backed signing of messages and artifacts. It suits teams building around OpenID Connect, especially those willing to work with its current provider coverage and ephemeral keys. Its appeal is signing without a separate certificate authority; workload use has a specific signature requirement.

Overview

OpenPubkey connects an OIDC identity to a public key. A PK Token proves that the identity controlled the associated private key at a particular time, as long as the verifier trusts the identity provider. That makes it a signing building block, not a certificate service: OpenPubkey provides no certificate and relies on the identity provider in the CA role.

It supports user and workload identities, with messages and artifacts as targets. The Go client and verifier example walks through authentication, PK Token creation, signing, and verification. Docker is building a public registry that uses OpenPubkey to sign Docker Official Images, and BastionZero uses it for secure remote infrastructure access.

Key features

Identity-backed signing

OpenPubkey is designed to use existing OIDC identity providers without requiring changes to them or adding a certificate authority. That is useful for teams whose signing workflows can rely on their provider's identity and trust model. It is not a substitute for evaluating which providers verifiers trust.

Provider coverage and replay protection

The project says Google, Azure/Microsoft, Okta, OneLogin, and Keycloak are compatible in principle. Current client and verifier support is narrower: Google for users and GitHub for workloads. Teams counting on another provider should treat that gap as a practical constraint rather than assume the broader compatibility claim means it is currently supported.

GQ signatures allow the provider's signature to be stripped from an ID Token while preserving proof of that signature. This prevents the token from being used against OIDC resource providers. GQ signatures are required for all current workload identity uses; they are unnecessary for user scenarios where the PK Token is not public.

Privacy and key handling

A public PK Token exposes claims from the signer's OIDC ID Token, potentially including a name or email address. That makes public workload artifacts a poor fit when those claims should not be disclosed. OpenPubkey assumes identity-held key pairs are ephemeral: users generate them as needed and delete them when finished.

User identity flows can optionally use an MFA cosigner protocol that independently authenticates the user and cosigns the PK Token. It is unsupported for workload identities, so it does not extend that extra assurance to those scenarios.

Pricing

OpenPubkey costs free. The free OpenPubkey plan is open source under Apache 2.0 and provides a reference implementation. There are no paid tiers to weigh against that offer; the trade-off is adopting the project and its current provider and workload requirements rather than buying a packaged signing service.

Platforms

OpenPubkey supports API, Linux, macOS, Windows, and self-hosted use. Its Go client and verifier make it a fit for teams integrating signing in software workflows, rather than readers seeking a hosted certificate product.

Who it's for

It is a strong candidate for developers and infrastructure teams that already use OIDC, need identity-linked signatures on messages or artifacts, and can work with Google for user identities or GitHub for workloads. The no-added-CA approach is valuable when an existing identity provider can anchor verifier trust.

Look elsewhere if your use case requires a certificate, current support for a different identity provider, public tokens without exposed identity claims, or workload use without GQ signatures. The repository is being prepared for version 1.0, so teams that need a mature release should weigh that status. Feature requests, bug reports, and technical questions go through GitHub issues, with a community Slack channel also provided. Security reports are requested privately by email, and the project offers no bug bounty.

Pros and cons

Pro: Binds identity and key through OIDC without adding a CA, which can avoid a separate trust authority in existing OIDC environments.

Pro: Supports both user and workload identities and targets messages and artifacts, with Docker and BastionZero illustrating distinct uses.

Con: Current client and verifier support is Google for users and GitHub for workloads, despite the broader compatibility claim.

Con: Public PK Tokens can reveal name or email claims, and every current workload use requires GQ signatures.

Con: Ephemeral key handling puts generation and deletion on users, and the project is still preparing for version 1.0.

Alternatives

For broader code-signing comparisons, see Code Signing Software.

SignServer is a better fit for teams seeking a freemium signing option with basic code, document, container signing, and timestamping, delivered as source code or a container.

SignPath suits eligible open-source projects looking specifically for its free Open Source Code Signing plan.

AWS Signer is worth considering when signing is used with AWS IoT Device Management, Lambda, ECR, EKS, or third-party container services, where the plan states no additional charge.

Cosign is an alternative free, open-source choice if a project wants software with no hosted service or usage limits stated.

Aujas Automated Code Signing Platform offers signing-based licenses on a pay-as-you-use basis.

DigiCert Software Trust Manager is a paid option for readers prepared to talk to an expert about pricing.

Notation is another free Apache 2.0 CLI project to consider.

CyberArk Code Sign Manager - Self-Hosted is a paid self-hosted alternative.

Verdict

Choose OpenPubkey if you want identity-backed signing for messages or artifacts and can anchor trust in OIDC, with Google user or GitHub workload support fitting your needs. Its strongest reason to choose is that it does this without adding a certificate authority. Look elsewhere if you need a certificate, broader current provider coverage, or public tokens that do not expose identity claims.