Sigstore made code signing usable by deleting long-lived keys

Open-source signing had a usability trap: long-lived keys had to be created, protected, rotated, published and trusted. The Linux Foundation's 2021 announcement said very few open-source projects signed release artifacts, largely because key management and verification were too hard.

Sigstore's clever move was to make identity and transparency do the work. A maintainer or CI system proves an OIDC identity to Fulcio, receives a short-lived certificate, signs once, discards the private key, and leaves a public Rekor entry that verifiers can audit later.

That changed signing from a private secret-handling ritual into a public evidence trail. The project is backed by OpenSSF under the Linux Foundation and remains free and open source, with tooling for releases, containers, binaries, SBOMs and attestations.

Replace key custody with logged identity

Ephemeral keys removed the operational burden that kept maintainers from signing releases.

OIDC reused identities developers and CI systems already had instead of creating another account system.

Rekor made signing events publicly auditable, so trust was not hidden in a README or keyserver.

Free public-good infrastructure made adoption cheap for small open-source projects.

A security standard spreads faster when it removes the hardest ceremony instead of asking every maintainer to become a key-management expert.

Sigstore became a core software-supply-chain building block. Its pattern now connects with Cosign, Fulcio, Rekor, SBOMs and in-toto attestations, giving package consumers a verifiable origin trail without forcing maintainers to protect permanent signing keys.