Tech riderRev. 29 Sept 2026

SignPath

Ch 027.4of 26 Code Signing Software

1Runs onAPI, Linux, Mac, self-hosted, Web, Windows
2CostsFree plan
3Supported targetsWindows PE files, PowerShell, MSI, CAB, catalog, APPX, MSIX, NuGet, Java archives, containers, Linux packages, macOS code, and custom artifacts
4Certificate providedYes
5Cloud signingYes
6HSM key protectionYes
7Trusted timestampingYes
8CI/CD signingYes

8 lines stated Written from the maker's own pages: signpath.io, signpath.org

Visit site Alternatives

Overview

SignPath is ranked #2 of 26 in code signing software on Specifiction. It runs on API, Linux, macOS, Self-hosted, Web, Windows. There is a free plan.

SignPath plans and pricing

All plans

Open Source Code Signing Free For open source projects · eligibility conditions apply signpath.org · 29 Sept 2026

Compared on code signing software

Free plan: Yessignpath.io
Supported targets: Windows PE files, PowerShell, MSI, CAB, catalog, APPX, MSIX, NuGet, Java archives, containers, Linux packages, macOS code, and custom artifactssignpath.io
Certificate provided: Yessignpath.io
Cloud signing: Yessignpath.io
HSM key protection: Yessignpath.io
Trusted timestamping: Yessignpath.io
CI/CD signing: Yessignpath.io
Approval workflows: Yessignpath.io

Facts

Purpose: SignPath provides code signing and software integrity tools that enforce policies across software builds and releases.signpath.io · 29 Sept 2026
Signing: Its semantic code signing supports format-aware signing for executables, packages, installers, containers, scripts, manifests, SBOMs, and configuration files.signpath.io · 29 Sept 2026
Pipeline integrity: The platform can verify source repositories, branches, build systems, approvals, and CI/CD context before trusting a release.signpath.io · 29 Sept 2026
Attestation: SignPath can generate signed, machine-readable attestations including SLSA provenance, validation summaries, and signed SBOMs.signpath.io · 29 Sept 2026
Integrations: The company lists plugins and REST API integrations for GitHub Actions, GitLab, Jenkins, Azure DevOps, and TeamCity.signpath.io · 29 Sept 2026
Key security: SignPath says private keys are stored in FIPS-compliant HSMs and are never exposed or shared.signpath.io · 29 Sept 2026
Access controls: Role-based access controls define who can sign which artifacts, when, and with which certificate.signpath.io · 29 Sept 2026
Audit and compliance: The platform logs signing requests with the user, file, certificate, policy, and result, and offers exportable reports and optional WORM-style log archiving.signpath.io · 29 Sept 2026
Deployment: SignPath describes its deployment options as SaaS, self-hosted, or hybrid.signpath.io · 29 Sept 2026
Support: SignPath provides a support portal and lists [email protected] as a contact address.signpath.io · 29 Sept 2026
Open source eligibility: Free SignPath Foundation subscriptions require an actively maintained, released project using an OSI-approved open source license without proprietary components.signpath.org · 29 Sept 2026
Audience: The company says it serves customers worldwide, from small development teams to large enterprises.signpath.io · 29 Sept 2026