SignPath vs SignServer

SignPath provides code signing and software integrity controls for builds and releases. Its format-aware signing covers executables, packages, installers, containers, scripts, manifests, SBOMs, and configuration files. Before trusting a release, it can verify source repositories, branches, build systems, approvals, and CI/CD context. SignPath can produce signed, machine-readable attestations, including SLSA provenance, validation summaries, and signed SBOMs. Listed integrations include plugins and REST API connections for GitHub Actions, GitLab, Jenkins, Azure DevOps, and TeamCity. SignPath says private keys remain in FIPS-compliant hardware security modules and are never exposed or shared. Role-based controls determine who can sign which artifacts and with which certificate. Signing records include the user, file, certificate, policy, and result; reports can be exported, with optional WORM-style log archiving. Deployment options are SaaS, self-hosted, or hybrid. The free Open Source Code Signing plan has eligibility conditions: projects must be actively maintained and released, use an OSI-approved open source license, and have no proprietary components.

SignServer is a server-side platform that centrally manages signing keys and digitally signs code, documents, and timestamps. One installation can serve several signing workflows, including containers, firmware, IoT, and DevOps use cases. It can connect to CI/CD pipelines, firmware build processes, document workflow engines, identity platforms, and other applications through standard interfaces. Community is available as a Docker container, Helm chart, source code, or GitHub release, and is also listed on SourceForge. Its interfaces include SOAP, HTTP, REST, and the SignClient command-line interface, though Community REST lacks some endpoints. Community is released under LGPL V2.1 or later and is intended for learning, testing, and prototyping rather than production. The maker says it lacks production capabilities such as audit, compliance, SLA, high availability, and security features. Enterprise adds professional support with an SLA, security updates, and maintenance. The Community plan is free; the Enterprise Cloud trial is free for 30 days through AWS or Azure marketplaces. The maker recommends Hardware Security Modules for signing-key storage.