Cosign vs Sigstore
Cosign
github.com
Sigstore
sigstore.devSide by side
| Figure | Cosign | Sigstore |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Web | — | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 2 |
| Spec score · Code Signing Software | 8.5 (#3) | 8.3 (#7) |
| CI integrations | The installation documentation describes use in GitHub Actions and GitLab CI/CD pipelines. | Sigstore provides GitHub Actions for generating signatures and installing Cosign, and documents GitLab CI installation. |
| Integration limitation | Cosign functions were designed for its CLI rather than as an API; the documentation says there are no API stability guarantees and does not recommend Cosign for application integration. | Cosign has no API stability guarantees, does not follow semantic versioning, and is not recommended for application integration because of its dependencies. |
| Purpose | Cosign signs and verifies OCI containers and other software artifacts. | Sigstore is an open source project for improving software supply chain security. |
| Support | The project directs users with issues to open a GitHub issue or ask in its Slack channel. | Community support is provided through Slack and GitHub issues, with repository CODEOWNERS identifying project maintainers. |
Plans
In their own words
Cosign
Cosign is a free tool for signing and verifying OCI container images and other software artifacts. It can store container signatures in an OCI registry and publish generic artifacts through OCI. Supported targets include blobs, binaries, scripts, configuration files, SBOMs, WASM modules, Tekton bundles, eBPF modules, and in-toto attestations whose payloads use DSSE. Its default keyless workflow uses temporary keys held in memory, short-lived certificates from Sigstore’s Fulcio certificate authority, and entries in the Rekor transparency log. Other signing options include hardware and KMS-backed keys, encrypted keypairs generated by Cosign, and user-provided PKI. Cosign supports CI/CD signing, with guidance for GitHub Actions and GitLab CI/CD. Offline verification is possible when the image and signature materials are available locally and a trusted root is supplied. The project describes Cosign as a legacy signing system and recommends Sigstore-go for verification integrations. Its CLI-focused design has no API stability guarantees, and the documentation does not recommend it for application integration.
Sigstore
Sigstore is a free, open source project for signing and verifying software artifacts to improve supply chain security. It supports release files, container images, binaries, software bills of materials, and more. Signatures use temporary keys, so developers do not have to manage signing keys; events are recorded in a tamper-resistant public log for audit. Its components include Cosign, Fulcio, Rekor, OpenID Connect, and Policy Controller. Cosign signs and verifies artifacts and stores signatures in an OCI registry. Fulcio issues temporary certificates to authorized identities, while Rekor keeps signed metadata in a searchable ledger. OpenID Connect authenticates users through providers such as GitHub and Google. The trust root uses The Update Framework and is maintained by five keyholders from different companies and academic institutions. Sigstore provides GitHub Actions, documents GitLab CI installation, and offers official clients for Go, Java, JavaScript, Python, Ruby, and Rust. It supports API, Linux, macOS, Windows, and self-hosted environments. One integration caveat is that Cosign has no API stability guarantees, does not follow semantic versioning, and is not recommended for application integration because of its dependencies.