Alternatives to Red Hat Trusted Artifact Signer

CodeSign suits organizations that need controlled signing within build, release, or DevOps workflows.

Cosign suits teams signing or verifying software artifacts, including open-source package managers and CI/CD workflows.

SignPath

SignPath suits development teams that need policy-controlled signing and verification across software builds and releases.

DigiCert Software Trust Manager

It suits development and delivery teams that need signing controls across software releases, including teams working on firmware, devices, and operational technology.

OpenPubkey suits developers working with OIDC-based user or workload identities who need identities associated with signing keys for messages or artifacts.

Sigstore

Sigstore suits developers and software providers who need to sign and verify artifacts, including package managers integrating signing workflows.

CyberArk Code Sign Manager - Self-Hosted

This self-hosted product suits organizations that need to govern code-signing key use across signing clients and require approval workflows, auditing, or HSM key protection.

Keyfactor Platform

It suits PKI, security, infrastructure, and DevOps teams that need certificate visibility, lifecycle controls, and automation across environments.

Notation suits developers and CI/CD teams that need to sign OCI images or other OCI artifacts and keep signatures portable across registries.

SignServer

Community suits people learning, testing, or prototyping signing workflows.

SignPath Foundation

It suits qualifying open-source projects that need signed releases and can meet the manual approval, role, and multi-factor authentication requirements.