Cosign vs OpenPubkey
Cosign
github.comOpenPubkey
github.comSide by side
| Figure | Cosign | OpenPubkey |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Code Signing Software | 8.5 (#3) | 8.3 (#6) |
| Development status | Cosign is described as a legacy system that should still be used for signing, while Sigstore-go is recommended for verification integrations. | The README says the project is working to get the repository ready for version 1.0. |
| Purpose | Cosign signs and verifies OCI containers and other software artifacts. | OpenPubkey binds user or workload identities to public keys through OpenID Connect, allowing identities to sign messages or artifacts. |
| Security reporting | Sigstore asks vulnerability reporters to email [email protected] and says the Security Response Committee will acknowledge reports within 24 hours. | The security policy asks reporters to email [email protected] privately and says the project does not currently offer bug bounties. |
| Support | The project directs users with issues to open a GitHub issue or ask in its Slack channel. | The project directs feature requests, bug reports, and technical questions to GitHub issues and points users to its OpenSSF Slack channel. |
Plans
In their own words
Cosign
Cosign is a free tool for signing and verifying OCI container images and other software artifacts. It can store container signatures in an OCI registry and publish generic artifacts through OCI. Supported targets include blobs, binaries, scripts, configuration files, SBOMs, WASM modules, Tekton bundles, eBPF modules, and in-toto attestations whose payloads use DSSE. Its default keyless workflow uses temporary keys held in memory, short-lived certificates from Sigstore’s Fulcio certificate authority, and entries in the Rekor transparency log. Other signing options include hardware and KMS-backed keys, encrypted keypairs generated by Cosign, and user-provided PKI. Cosign supports CI/CD signing, with guidance for GitHub Actions and GitLab CI/CD. Offline verification is possible when the image and signature materials are available locally and a trusted root is supplied. The project describes Cosign as a legacy signing system and recommends Sigstore-go for verification integrations. Its CLI-focused design has no API stability guarantees, and the documentation does not recommend it for application integration.
OpenPubkey
OpenPubkey binds a user or workload identity established through OpenID Connect to a public key, so the identity can sign messages or artifacts. A PK Token represents control of an OIDC identity and its related private key at a particular time, provided the verifier trusts the identity provider. The project lists Google, Azure/Microsoft, Okta, OneLogin and Keycloak as compatible without changes to those providers; however, its client and verifier currently create and verify tokens from Google for users and GitHub for workloads. Current workload identity use requires GQ signatures. For user identity, they are unnecessary when the PK Token is not public. GQ signatures allow the identity provider’s signature to be stripped from an ID Token while preserving proof of that signature, preventing use against OIDC resource providers. OpenPubkey says it needs no additional certificate authority because the OpenID Provider fulfills that role. Public PK Tokens can reveal claims from an OIDC ID Token, potentially including a name or email address. The project is free under the Apache 2.0 license and is a Linux Foundation project; its repository says it is being prepared for version 1.0. The project directs technical questions to GitHub issues and offers a community Slack channel.