Sigstore
An open-source project providing a standard way to sign, verify, and protect software artifacts without managing long-term cryptographic keys.
Related Terms
Code Signing
The process of digitally signing executables and software packages to verify the author's identity and ensure the code hasn't been altered or corrupted since signing.
Provenance
Metadata that describes the origin, creation process, and supply chain journey of a software artifact, enabling verification of its authenticity and integrity.
Software Supply Chain
The full lifecycle and pipeline involved in developing, building, packaging, distributing, and deploying software—including dependencies, tools, infrastructure, and people.