Sigstore
Open-source supply-chain signing — sign artifacts (containers, packages, files) with OIDC identities instead of long-lived key pairs. Linux Foundation, 2021.
Three components: Fulcio (CA that issues short-lived certificates from OIDC tokens), Rekor (transparency log with a Merkle tree over all signatures), Cosign (CLI and library). Free public instances run by the Linux Foundation.
Powers Kubernetes release signing, npm provenance, PyPI Trusted Publishers, Homebrew, GitHub Container Registry. Central for SLSA compliance.