the open service stack (Fulcio, Rekor, cosign) that made signing free and keyless for open source - short-lived certificates tied to OIDC identities, with every signature logged in a public transparency log.
The shelf: Sigstore centralizes signing trust behind a transparency log; the red box hands anchors to consumers.
Etymology and backstory
launched 2021 by Red Hat, Google, and Purdue's Santiago Torres-Arias orbit under the Linux Foundation, explicitly modeled on Let's Encrypt's playbook: remove the key-management pain that kept developers from signing. The design swap: instead of long-lived keys, prove control of an identity (GitHub account, email) via OIDC, get a minutes-lived certificate, sign once, and let the transparency log (Rekor) make the act auditable forever.
Ecosystem
npm and PyPI attestations, Kubernetes image signing, GitHub artifact attestations - the default signing plumbing of the mid-2020s open-source world.
In codexproof
cited as the ecosystem proof that signing can be made cheap and ubiquitous - and as a contrast on trust topology: Sigstore centralizes trust in its log and CA infrastructure (with transparency as the check); codexproof decentralizes to per-domain anchors chosen per consumer, with revocation freshness as the check. Also a per-cost contrast: their signing events are per-release; codexproof's are per-interrogation, three orders of magnitude more frequent, which is why the ~11us signature budget matters.