GStars
    sigstore

    sigstore/cosign

    Code signing and transparency for containers and binaries

    backend
    Go
    Apache-2.0
    6.4K stars
    839 forks
    62 GitHub watchers
    Updated Nov 5, 2026
    View on GitHub

    Build with Backblaze B2

    SDKs, agent skills, IDE extensions, and reference pipelines from Backblaze Labs. All open source.

    Explore Backblaze Labs

    Loading star history...

    Where it stands

    Rank, growth pace and release cadence relative to everything GStars tracks.

    1 release in the last 90 days, the latest 16 days ago, with 255 contributors on GitHub.

    Use Cases & Benefits

    • Provides code signing and verification for OCI containers and other artifacts using keyless and key-based methods integrated with transparency logs.
    • Enables secure, transparent, and registry-native signature storage without requiring external signature services, supporting wide registry compatibility and hardware tokens.
    • Use for signing and verifying container images in CI/CD pipelines to ensure image integrity and provenance before deployment.
    • Use for distributing and validating generic OCI artifacts like binaries, WASM, eBPF modules, and Tekton bundles with cryptographic signatures.
    • Use for offline or air-gapped environment verification of signed container images and artifacts using locally stored signatures and bundles.

    Should you depend on it?

    License terms, project hygiene and risks, from GitHub metadata and GStars' snapshots.

    License

    Apache 2.0

    Permissive: commercial use, modification and redistribution are allowed with attribution; includes an explicit patent grant from contributors.

    Community files

    • README: present
    • Contributing guide: present
    • Code of conduct: present

    Watch-outs

    No watch-outs from GStars' checks.

    General guidance from repository metadata, not legal advice. How we score

    From the README

    Signing OCI containers (and other artifacts) using Sigstore!

    Cosign aims to make signatures invisible infrastructure.

    Cosign is developed as part of the sigstore project. We also use a slack channel! Click here for the invite link.

    For Homebrew, Arch, Nix, GitHub Action, and Kubernetes installs see the installation docs.

    For Linux and macOS binaries see the GitHub release assets.

    Excerpt from the sigstore/cosign README on GitHub (Apache-2.0 license). © its authors.Read the full README on GitHub

    Daily snapshots

    Stars gained per day, and how forks and open issues moved, from GStars' daily snapshots

    Aug 27: +12

    +203 stars over 82 days across 8 snapshot days; best day +12 on Aug 27.

    Forks

    839+53

    Open issues

    145-17

    Compared with peers in Backend

    Fastest-growing repositories GStars tracks in this cohort for the week of Nov 1, by 7-day star growth

    View category →
    sigstore/cosign compared with Backend repositories by stars, 7-day star growth, health score and last release
    RepositoryStars+7dHealthLast release
    anthropics/skills187.8K+2.9K15—
    DuarteSantos8/openGym19.7K+2.4K602 days ago
    shiyu-coder/Kronos47.0K+2.3K16—
    NationalSecurityAgency/ghidra98.2K+2.3K6414 days ago
    microsoft/VibeVoice56.0K+1.1K29—
    sigstore/cosign6.4K—6416 days ago
    Category median56.0K+2.3K29—
    Compare cosign with skills, openGym, Kronos →

    Discover Repositories

    Search across tracked repositories by name or description