Sigstore
Use shared libraries and services for keyless software signing and verification.
What’s included for free?
Sigstore's common Go library is ongoing-free under Apache-2.0; public-good services and self-hosted components have no software licence fee.
Where it runs: Self-hosted
Provider information ↗Checked 2026-11-01
Before you use it
Apache-2.0 covers the common library. Fulcio, Rekor, identity providers and hosted service policies are separate.
Provider terms can change. Check current pricing and usage rights before starting a project.