Sigstore
Shares rank 2 of 3 code signing services by recommenders
Free project for signing software with OIDC identities instead of managed keys, though critics cite reliance on OpenID Connect providers and a centralized database.
Free project for signing software with OIDC identities instead of managed keys, though critics cite reliance on OpenID Connect providers and a centralized database.
10 people gave an opinion
- recommend it
- 5
- criticize it
- 5
- approval share
- 50%
Recommended in 2 of 13 months
- November 2025: not recommended
- December 2025: not recommended
- January 2026: recommended
- February 2026: not recommended
- March 2026: not recommended
- April 2026: recommended
- May 2026: not recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: not recommended
- September 2026: not recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 5 people recommend itNeeds 10 or more, not met.
- 1 recommender for every criticNeeds 2 to 1 or better, not met.
- Recommended in 2 of 13 monthsNeeds 4 or more, not met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Impressive system for attesting builds via OIDC
“Sigstore is very impressive: it's a system by which GitHub can attest via OIDC to various state”
Comment from 1 Jan 2026 in “Blog: PyPI in 2025: A Year in Review” Wish more projects adopted attestation
“This is where attestation/sigstore comes into play. ... I wish more projects would use it.”
Comment from 1 Apr 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan” Respected efforts behind the project
“i like the efforts behind sigstore.dev project”
Comment from 10 Apr 2026 in “The many failures leading to the LiteLLM compromise”
What people warn about
Each mark is one comment
Depends on centralized identity providers
“Asfaload is accountless(keys are identity) while sigstore relies on openid connect, which will tie most user to a mega corp”
Comment from 9 Apr 2026 in “Open Source Security at Astral” “Have they yet eliminated the single points of failure from Sigstore (i.e. the centralized database)?”
Comment from 28 Dec 2025 in “PEP 761 – Deprecating PGP signatures for CPython artifacts (2024)” Messy and below expectations in practice
“identity-based signing schemes like Sigstore are still running behind my expectations”
Comment from 9 Apr 2026 in “Open Source Security at Astral” “the giant mess of sigstore and attestation and weird trusted builds we have today”
Comment from 13 Oct 2026 in “A plea not to use uv-build”
Other code signing services people recommend
The two most recommended other code signing services, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Azure Artifact Signing | 10 | 15 | 40% | 5 | — | — |
| SigstoreThis page | 5 | 5 | 50% | 2 | — | — |
| SignPath | 5 | 0 | 100% | 4 | — | — |
What people said
10 of the 11 comments that mention it, newest first. Each links to the original comment.
“the giant mess of sigstore and attestation and weird trusted builds we have today”
“This is impossible with Sigstore.”
“i like the efforts behind sigstore.dev project”
“identity-based signing schemes like Sigstore are still running behind my expectations”
“Asfaload is accountless(keys are identity) while sigstore relies on openid connect, which will tie most user to a mega corp”
“This is where attestation/sigstore comes into play. ... I wish more projects would use it.”
“Sigstore is very impressive: it's a system by which GitHub can attest via OIDC to various state”
“Fairly certain this just reinvents the wheel with less years of review”
“Have they yet eliminated the single points of failure from Sigstore (i.e. the centralized database)?”
“which to me, is total nonsense”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.