Skip to content
SPECIFICTION
Get listed

SignPath

signpath.io

Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit signpath.io
Spec score 8.4 #4 of 28 in Code Signing Software

What it is

SignPath provides code signing and software integrity controls for builds and releases. Its format-aware signing covers executables, packages, installers, containers, scripts, manifests, SBOMs, and configuration files. Before trusting a release, it can verify source repositories, branches, build systems, approvals, and CI/CD context. SignPath can produce signed, machine-readable attestations, including SLSA provenance, validation summaries, and signed SBOMs. Listed integrations include plugins and REST API connections for GitHub Actions, GitLab, Jenkins, Azure DevOps, and TeamCity. SignPath says private keys remain in FIPS-compliant hardware security modules and are never exposed or shared. Role-based controls determine who can sign which artifacts and with which certificate. Signing records include the user, file, certificate, policy, and result; reports can be exported, with optional WORM-style log archiving. Deployment options are SaaS, self-hosted, or hybrid. The free Open Source Code Signing plan has eligibility conditions: projects must be actively maintained and released, use an OSI-approved open source license, and have no proprietary components.

Spec sheet

What it does
SignPath verifies software origin, applies development and release policies, signs releases and records proof across the delivery pipeline.Read 15 Oct 2026 · signpath.io
Purpose
SignPath provides code signing and software integrity tools that enforce policies across software builds and releases.Read 29 Sep 2026 · signpath.io
Audience
The company says it serves customers worldwide, from small development teams to large enterprises.Read 29 Sep 2026 · signpath.io
Deployment
SignPath describes its deployment options as SaaS, self-hosted, or hybrid.Read 29 Sep 2026 · signpath.io
Integrations
The company lists plugins and REST API integrations for GitHub Actions, GitLab, Jenkins, Azure DevOps, and TeamCity.Read 29 Sep 2026 · signpath.io
Support
SignPath provides a support portal and lists [email protected] as a contact address.Read 29 Sep 2026 · signpath.io
Headquarters
Vienna, AustriaRead 23 Sep 2026 · signpath.io
Founded
2017Read 23 Sep 2026 · signpath.io
Access controls
Role-based access controls define who can sign which artifacts, when, and with which certificate.Read 29 Sep 2026 · signpath.io
Attestation
SignPath can generate signed, machine-readable attestations including SLSA provenance, validation summaries, and signed SBOMs.Read 29 Sep 2026 · signpath.io
Audit and compliance
The platform logs signing requests with the user, file, certificate, policy, and result, and offers exportable reports and optional WORM-style log archiving.Read 29 Sep 2026 · signpath.io
Auditability
The service keeps audit trails covering signing operations, approvals, artifact information and policy history.Read 15 Oct 2026 · signpath.io
CI/CD integrations
Documented trusted build connectors support Jenkins, GitHub, GitLab, Azure DevOps, TeamCity and AppVeyor.Read 15 Oct 2026 · docs.signpath.io
Company history
LinkedIn states that SignPath was founded in 2017 by RUBICON IT and is headquartered in Vienna.Read 15 Oct 2026 · linkedin.com
Company legal name
The provider is SignPath GmbH, registered in Vienna, Austria.Read 15 Oct 2026 · signpath.io
Company size
LinkedIn lists SignPath GmbH as a privately held company with 51–200 employees.Read 15 Oct 2026 · linkedin.com
Container signing
Container images can be signed through Notation, Cosign, GPG or the REST API, with OCI layout and registry workflows documented.Read 15 Oct 2026 · docs.signpath.io
Crypto providers
Crypto providers expose PKCS#11 on Windows/Linux, Windows KSP and macOS CryptoTokenKit so standard signing tools can use SignPath keys.Read 15 Oct 2026 · docs.signpath.io
Deployment models
SignPath is offered as managed SaaS, self-hosted software or a hybrid deployment.Read 15 Oct 2026 · signpath.io
Documentation scope
The documentation covers certificates, users, projects, artifact configuration, containers, build integrations, provenance, pipeline policies, attestations, PowerShell and crypto providers.Read 15 Oct 2026 · docs.signpath.io
Downloads
Official downloads include Linux and Windows x64 packages, a Windows MSI provider, a Notation plugin and a macOS DMG.Read 15 Oct 2026 · docs.signpath.io
Foundation key custody
For qualifying open-source projects, the Foundation generates and stores the certificate private key in an HSM and provides the service without charge.Read 15 Oct 2026 · signpath.org
Funding
Nordic9 reported a €5 million Series A led by TIN Capital on December 10, 2024.Read 15 Oct 2026 · nordic9.com
Key protection
Private keys remain in SignPath-managed or customer-managed HSMs; the architecture page states FIPS 140-2 Level 3 compliance.Read 15 Oct 2026 · signpath.io
Key security
SignPath says private keys are stored in FIPS-compliant HSMs and are never exposed or shared.Read 29 Sep 2026 · signpath.io
Limit: API use
SignPath terms allow suspension of API access for abuse or excessive request frequency.Read 15 Oct 2026 · signpath.io
Limit: billing
Paid subscriptions are billed in advance and are stated to be non-refundable.Read 15 Oct 2026 · signpath.io
Limit: public pricing
GetApp lists both Software Integrity Platform and Code Governance without prices, while SignPath directs buyers to request a quote.Read 15 Oct 2026 · getapp.com
Limit: service interruptions
The status history records an August 3, 2026 software-key signing interruption and a June 9, 2026 HSM outage that delayed or timed out signing requests.Read 15 Oct 2026 · docs.signpath.io
Linux requirements
The Cryptoki provider documents Ubuntu 20.04/22.04/24.04 and Red Hat 8/9, OpenSSL and ca-certificates, and rejects OpenSSL 3.0.0-3.0.8.Read 15 Oct 2026 · docs.signpath.io
Malware scanning
Artifacts can be scanned for malware before signing, with signing blocked when policy checks fail.Read 15 Oct 2026 · signpath.io
Nested package signing
The feature set includes automatic handling of nested content such as executables inside installers and DLLs inside archives.Read 15 Oct 2026 · signpath.io
Notable update
The September 10, 2026 Jenkins plugin release stopped publishing unsigned artifacts.Read 15 Oct 2026 · docs.signpath.io
Open-source eligibility
The Foundation requires applicant projects to use an OSI-approved license, contain no proprietary code or malware, and be maintained, released and documented.Read 15 Oct 2026 · signpath.org
OpenAPI documentation
SignPath publishes an OpenAPI definition through its Swagger endpoint at app.signpath.io/Api/swagger.Read 15 Oct 2026 · docs.signpath.io
Pipeline Integrity
Pipeline Integrity checks repositories, branches, build systems and approvals, and restricts which build agents may request signing.Read 15 Oct 2026 · signpath.io
PowerShell module
SignPath provides PowerShell modules and cmdlets such as Submit-SigningRequest and Get-SignedArtifact for Windows, Linux and macOS.Read 15 Oct 2026 · docs.signpath.io
Praise: secure/simple signing
The sole G2 reviewer praised straightforward online code signing, binary-origin tracking and protection against shipping malware.Read 15 Oct 2026 · g2.com
Rating on G2
4.0 out of 5 from 1 review.Read 15 Oct 2026 · g2.com
Rating on GetApp
0 out of 5 from 0 reviews; the listing shows no submitted reviews.Read 15 Oct 2026 · getapp.com
Rating on TrustRadius
0 out of 10 from 0 reviews.Read 15 Oct 2026 · trustradius.com
REST API
The REST API uses bearer tokens at an organization-scoped endpoint and supports artifact submission, hash signing, configuration access and audit-log reading.Read 15 Oct 2026 · docs.signpath.io
Semantic Code Signing
The platform signs only reviewed and policy-compliant artifacts, including executables, installers, containers, scripts and SBOMs.Read 15 Oct 2026 · signpath.io
Signing
Its semantic code signing supports format-aware signing for executables, packages, installers, containers, scripts, manifests, SBOMs, and configuration files.Read 29 Sep 2026 · signpath.io
Software Attestation
SignPath can produce SLSA provenance and compliance evidence for frameworks including the Cyber Resilience Act, NIS2 and DORA.Read 15 Oct 2026 · signpath.io

Plans and prices

Open Source Code Signing Free For open source projects · eligibility conditions apply Read 29 Sep 2026 · signpath.org
Open Source Code Signing Free OSI-approved license · no proprietary code or malware · actively maintained, released and documented project · manual approval for every release Read 15 Oct 2026 · signpath.org
Code Governance Priced on request Pricing not published · quote required Read 15 Oct 2026 · getapp.com
Software Integrity Platform Priced on request Pricing not published · quote required Read 15 Oct 2026 · getapp.com

Every SignPath plan and price →

Strong points and limits

Strong points

  • Supports signing across many artifact formats.
  • Can verify source, build, approval, and CI/CD context.
  • Private keys are stored in FIPS-compliant HSMs.
  • Offers SaaS, self-hosted, and hybrid deployment.

Limits

  • Free plan is limited to eligible open source projects.
  • Eligibility excludes projects with proprietary components.

Who it suits

SignPath suits development teams that need policy-controlled signing and verification across software builds and releases. The free plan is for qualifying open source projects; deployment options also include self-hosted and hybrid setups.

SignPath in depth

Read the full write-up

Overview

SignPath is a code-signing and software-integrity platform for teams that need release approval to depend on how software was built as well as on the artifact itself. It suits organizations with CI/CD pipelines and defined signing policies; qualifying open-source projects have a free option. The main reason to choose it is the combination of format-aware signing, build checks and audit records.

Key features

Signing and release controls

SignPath supports Windows PE files, PowerShell, MSI, CAB, catalog files, APPX, MSIX, NuGet, Java archives, containers, Linux packages, macOS code and custom artifacts. Its format-aware signing also covers scripts, manifests, SBOMs and configuration files. A certificate, cloud signing, HSM key protection, trusted timestamping and CI/CD signing are included capabilities. That breadth is useful for teams releasing across multiple formats, though a team that only needs a basic signing utility may not need the additional policy layer.

Before trusting a release, SignPath can check its source repository, branch, build system, approvals and CI/CD context. Role-based access controls define who can sign which artifacts, when and with which certificate. This lets teams put release rules around their build process rather than treating signing as an isolated final step.

Attestations and audit

The platform can generate signed, machine-readable attestations, including SLSA provenance, validation summaries and signed SBOMs. It logs signing requests with the user, file, certificate, policy and result; exportable reports and optional WORM-style log archiving support teams that need a durable record of release decisions. SignPath says private keys are held in FIPS-compliant HSMs and are never exposed or shared.

Integrations and deployment

Plugins and REST API integrations are listed for GitHub Actions, GitLab, Jenkins, Azure DevOps and TeamCity. Deployment options are SaaS, self-hosted or hybrid, giving organizations a choice in how they run the platform. Support is available through a support portal, with [email protected] as a contact address.

Pricing

The Open Source Code Signing plan costs nothing and includes a certificate, cloud signing, HSM key protection, trusted timestamping, CI/CD signing and approval workflows. It is intended for open-source projects, not unrestricted free use: a project must be actively maintained and released, use an OSI-approved open-source license, and contain no proprietary components. That makes it a practical option for eligible projects, but not a general free tier for commercial teams.

SignPath's pricing model is free. No paid plan price or separate seat or usage quota is established here, so teams that do not qualify for the open-source plan should confirm commercial terms directly before choosing it.

Platforms

SignPath supports API, Linux, macOS, self-hosted, web and Windows. The self-hosted and hybrid deployment choices matter for organizations that do not want SaaS to be their only operating model.

Who it's for

SignPath is best suited to teams that need signing authority tied to CI/CD context, approvals and traceable release evidence, particularly where many artifact formats or compliance records are involved. Qualifying open-source maintainers can use the free plan. A team looking only for a narrow signing command, without policy and audit needs, may find a simpler tool more appropriate.

Pros and cons

Pros: Format-aware signing spans common Windows, Linux, macOS, container and custom artifacts, reducing the need to handle each release format as a separate case.

Pros: Build-context checks, role-based controls and approval workflows let organizations connect signing permission to release policy.

Pros: Signed attestations and detailed request logs give teams evidence about how releases were validated and signed.

Cons: The free plan is restricted to actively maintained, released open-source projects meeting license and component conditions, so proprietary teams cannot treat it as a free starting tier.

Cons: Its policy, attestation and audit capabilities may be more than a team needs if the requirement is only basic artifact signing.

Alternatives

Code Signing Software is the broader category for comparing tools in this space.

Choose SignServer if a freemium option with basic code, document and container signing plus timestamping, delivered from source or as a container, better fits your needs. OpenPubkey is a free, Apache 2.0-licensed reference implementation for readers seeking that kind of open-source project. AWS Signer may suit readers whose signing use is with the AWS services covered by its no-additional-charge terms.

Cosign is a free open-source choice with no hosted service or usage limits stated. Aujas Automated Code Signing Platform offers signing-based licenses with custom pricing. DigiCert Software Trust Manager is a paid alternative with custom pricing. Notation is an Apache 2.0-licensed CLI project, while Sigstore is free to use for developers and software providers.

Verdict

Choose SignPath if your release process needs policy-controlled signing, build-context validation and an audit trail in one platform. Its breadth and controls are compelling for governed CI/CD releases, but the free plan's open-source eligibility rules rule it out for many commercial teams, and teams needing only basic signing may prefer a narrower tool.

Verdict

SignPath brings signing policies, pipeline checks, attestations, and audit records together for software releases. Its free option has specific open-source eligibility requirements.

Where Specifiction places it

Alternatives to SignPathAll alternatives →