sigstore

What it is and what it does

Sigstore is a Python implementation of the Sigstore keyless signing protocol, letting you sign and verify files and packages without managing private keys. Instead, it uses OpenID Connect identities to prove your identity to Sigstore's infrastructure, which then issues short-lived signing certificates and records signatures in a transparency log. You can use it as a CLI tool or import it as a Python library to integrate signing and verification into your build and release workflows.

The package wraps Sigstore's core services behind a straightforward API, handling the complexity of OIDC token exchange, certificate lifecycle, and signature verification. The 15 runtime dependencies include cryptography, pydantic, requests, and several Sigstore-specific model and type packages, reflecting its role as a bridge between your code and Sigstore's distributed infrastructure.

Use it for:

• Sign Python package distributions in CI/CD pipelines using ambient credentials without storing private keys
• Verify the authenticity and provenance of downloaded Python packages by checking their Sigstore signatures
• Generate DSSE attestations with SLSA provenance metadata for supply chain integrity verification
• Integrate keyless signing into automated release workflows to prove package authenticity without key management overhead
• Verify signatures from packages signed with Sigstore to ensure they come from trusted, authenticated sources

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Sigstore is a Python tool for generating and verifying keyless signatures on files and Python package distributions using OpenID Connect identities and Sigstore's transparency log infrastructure.

Yes, if you need keyless code signing for Python packages or want to verify Sigstore-signed artifacts. The package is actively maintained, has no known vulnerabilities, supports Python 3.10, 3.11, 3.12, 3.13, and 3.14, and integrates well with CI/CD systems. Install it if supply chain security and keyless identity-based signing align with your workflow; skip it if you prefer traditional key-based signing or have no need for signature verification.

Install

sigstore on PyPI

pip install sigstore

uv add sigstore

poetry add sigstore

Installing sigstore

Before you install

Low friction installation with a pure-Python wheel. Active maintenance with a release 17 days ago. Depends on 15 runtime packages including cryptography, pydantic, and requests—a substantial but standard dependency footprint for a security tool.

License in practice

Permissive license treatment means you can use this in commercial and proprietary projects without copyleft obligations.

Quickstart

pip install sigstore

from sigstore.signing import Signer

signer = Signer.staging()
result = signer.sign_file("file.tar.gz")

Requires Python 3.10 or newer. Signing typically requires an OpenID Connect identity provider or manual OIDC token configuration.

Verify before relying

• Whether the package supports offline verification or requires network access to Rekor transparency log
• Performance characteristics when signing or verifying large files or batch operations
• Compatibility with non-GitHub OIDC providers beyond what the CLI documentation suggests

Package facts

Evidence: sigstore-4.5.0-py3-none-any.whl

Tags

More Security packages