{"categories":[{"label":"Security","url":"https://skillfed.io/packages/category/security"},{"label":"Cryptography","url":"https://skillfed.io/packages/category/security-cryptography"}],"enrichment":{"capability":"Sigstore is a Python tool for generating and verifying keyless signatures on files and Python package distributions using OpenID Connect identities and Sigstore's transparency log infrastructure.","skillfed_tags":["keyless-signing","supply-chain-security","transparency-log"],"use_cases":["Sign Python package distributions in CI/CD pipelines using ambient credentials without storing private keys","Verify the authenticity and provenance of downloaded Python packages by checking their Sigstore signatures","Generate DSSE attestations with SLSA provenance metadata for supply chain integrity verification","Integrate keyless signing into automated release workflows to prove package authenticity without key management overhead","Verify signatures from packages signed with Sigstore to ensure they come from trusted, authenticated sources"],"what_it_does":"Sigstore is a Python implementation of the Sigstore keyless signing protocol, letting you sign and verify files and packages without managing private keys. Instead, it uses OpenID Connect identities to prove your identity to Sigstore's infrastructure, which then issues short-lived signing certificates and records signatures in a transparency log. You can use it as a CLI tool or import it as a Python library to integrate signing and verification into your build and release workflows.\n\nThe package wraps Sigstore's core services behind a straightforward API, handling the complexity of OIDC token exchange, certificate lifecycle, and signature verification. The 15 runtime dependencies include cryptography, pydantic, requests, and several Sigstore-specific model and type packages, reflecting its role as a bridge between your code and Sigstore's distributed infrastructure.","worth_installing":"Yes, if you need keyless code signing for Python packages or want to verify Sigstore-signed artifacts. The package is actively maintained, has no known vulnerabilities, supports Python 3.10, 3.11, 3.12, 3.13, and 3.14, and integrates well with CI/CD systems. Install it if supply chain security and keyless identity-based signing align with your workflow; skip it if you prefer traditional key-based signing or have no need for signature verification."},"id":"sigstore","links":{"html":"https://skillfed.io/packages/sigstore","md":"https://skillfed.io/packages/sigstore.md","pypi":"https://pypi.org/project/sigstore/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2026-07-28","license_spdx":null,"license_treatment":"permissive","name":"sigstore","python_support":"supports_current","summary":"A tool for signing Python package distributions"},"popularity":{"monthly_downloads":1054956,"position":4434,"tier":"top_5000"},"security":{"n_vulnerabilities":0},"version":"4.5.0"}