--- id: sigstore version: "4.5.0" license: unclear license_treatment: permissive maintenance: active --- # sigstore — A tool for signing Python package distributions License: permissive · Maintenance: active · Downloads: 1.1M/mo ## What it is and what it does Sigstore is a Python implementation of the Sigstore keyless signing protocol, letting you sign and verify files and packages without managing private keys. Instead, it uses OpenID Connect identities to prove your identity to Sigstore's infrastructure, which then issues short-lived signing certificates and records signatures in a transparency log. You can use it as a CLI tool or import it as a Python library to integrate signing and verification into your build and release workflows. The package wraps Sigstore's core services behind a straightforward API, handling the complexity of OIDC token exchange, certificate lifecycle, and signature verification. The 15 runtime dependencies include cryptography, pydantic, requests, and several Sigstore-specific model and type packages, reflecting its role as a bridge between your code and Sigstore's distributed infrastructure. Use it for: - Sign Python package distributions in CI/CD pipelines using ambient credentials without storing private keys - Verify the authenticity and provenance of downloaded Python packages by checking their Sigstore signatures - Generate DSSE attestations with SLSA provenance metadata for supply chain integrity verification - Integrate keyless signing into automated release workflows to prove package authenticity without key management overhead - Verify signatures from packages signed with Sigstore to ensure they come from trusted, authenticated sources ## Worth the install? AI-flagged interpretation of the facts above — verify before relying. Sigstore is a Python tool for generating and verifying keyless signatures on files and Python package distributions using OpenID Connect identities and Sigstore's transparency log infrastructure. Yes, if you need keyless code signing for Python packages or want to verify Sigstore-signed artifacts. The package is actively maintained, has no known vulnerabilities, supports Python 3.10, 3.11, 3.12, 3.13, and 3.14, and integrates well with CI/CD systems. Install it if supply chain security and keyless identity-based signing align with your workflow; skip it if you prefer traditional key-based signing or have no need for signature verification. ## Install pip install sigstore uv add sigstore poetry add sigstore ## Installing sigstore Before you install: Low friction installation with a pure-Python wheel. Active maintenance with a release 17 days ago. Depends on 15 runtime packages including cryptography, pydantic, and requests—a substantial but standard dependency footprint for a security tool. License in practice: Permissive license treatment means you can use this in commercial and proprietary projects without copyleft obligations. Quickstart: pip install sigstore from sigstore.signing import Signer signer = Signer.staging() result = signer.sign_file("file.tar.gz") Requires Python 3.10 or newer. Signing typically requires an OpenID Connect identity provider or manual OIDC token configuration. Verify before relying: - Whether the package supports offline verification or requires network access to Rekor transparency log - Performance characteristics when signing or verifying large files or batch operations - Compatibility with non-GitHub OIDC providers beyond what the CLI documentation suggests ## Package facts - License: not declared (permissive) - Python support: supports_current - Install friction: low - Maintenance: active - Downloads: 1.1M/month (top 5,000 on PyPI) - Known vulnerabilities: none known ## Tags keyless code signing, package signature verification, sigstore python cli, oidc identity signing, cryptographic attestation, supply chain security, transparency log integration, keyless-signing, supply-chain-security, transparency-log [View on SkillFed](https://skillfed.io/packages/sigstore) · [View on PyPI](https://pypi.org/project/sigstore/)