Repositories list

• scaffolding

  Public

  sigstore/scaffolding’s past year of commit activity
  Stuff to make standing up sigstore (esp. for testing) easier for e2e/integration testing.

  Go

  •

  Apache License 2.0

  •6969 forks in sigstore/scaffolding•8989 stars in sigstore/scaffolding•99 issues in sigstore/scaffolding•44 pull requests in sigstore/scaffolding•Updated Oct 16, 2026Oct 16, 2026

• gh-action-sigstore-python

  Public
  A GitHub Action for sigstore-python

  securitysupply-chaincodesigning+ 1

  securitysupply-chaincodesigninggithub-actions

  Python

  •

  Apache License 2.0

  •1616 forks in sigstore/gh-action-sigstore-python•7070 stars in sigstore/gh-action-sigstore-python•1212 issues in sigstore/gh-action-sigstore-python•22 pull requests in sigstore/gh-action-sigstore-python•Updated Oct 15, 2026Oct 15, 2026

• gitsign

  Public
  Keyless Git signing using Sigstore

  gitsigningsigstore

  gitsigningsigstore

  Go

  •

  Other

  •8787 forks in sigstore/gitsign•1.1k1.1k stars in sigstore/gitsign•2929 issues in sigstore/gitsign•1111 pull requests in sigstore/gitsign•Updated Oct 15, 2026Oct 15, 2026

• sigstore-python

  Public
  A codesigning tool for Python packages

  pythonsecuritysupply-chain+ 1

  pythonsecuritysupply-chaincodesigning

  Python

  •

  Other

  •102102 forks in sigstore/sigstore-python•335335 stars in sigstore/sigstore-python•5454 issues in sigstore/sigstore-python•1313 pull requests in sigstore/sigstore-python•Updated Oct 15, 2026Oct 15, 2026

• .github

  Public
  Default community health files for the Sigstore organization.

  2828 forks in sigstore/.github•55 stars in sigstore/.github•00 issues in sigstore/.github•11 pull request in sigstore/.github•Updated Oct 15, 2026Oct 15, 2026

• v2-root-signing-staging

  Public
  Staging TUF repository for Sigstore v2 trust root

  Apache License 2.0

  •11 fork in sigstore/v2-root-signing-staging•22 stars in sigstore/v2-root-signing-staging•00 issues in sigstore/v2-root-signing-staging•11 pull request in sigstore/v2-root-signing-staging•Updated Oct 15, 2026Oct 15, 2026

• root-signing

  Public

  sigstore/root-signing’s past year of commit activity
  TUF repository for Sigstore trust root

  Makefile

  •

  Apache License 2.0

  •100100 forks in sigstore/root-signing•134134 stars in sigstore/root-signing•2424 issues in sigstore/root-signing•22 pull requests in sigstore/root-signing•Updated Oct 15, 2026Oct 15, 2026

• root-signing-staging

  Public
  Staging TUF repository for Sigstore trust root

  Apache License 2.0

  •1313 forks in sigstore/root-signing-staging•1111 stars in sigstore/root-signing-staging•88 issues in sigstore/root-signing-staging•11 pull request in sigstore/root-signing-staging•Updated Oct 15, 2026Oct 15, 2026

• sigstore-rekor-types

  Public
  Python models for Rekor's API types

  Python

  •

  Apache License 2.0

  •44 forks in sigstore/sigstore-rekor-types•88 stars in sigstore/sigstore-rekor-types•11 issue in sigstore/sigstore-rekor-types•11 pull request in sigstore/sigstore-rekor-types•Updated Oct 15, 2026Oct 15, 2026

• timestamp-authority

  Public

  sigstore/timestamp-authority’s past year of commit activity
  RFC3161 Timestamp Authority

  Go

  •

  Apache License 2.0

  •6767 forks in sigstore/timestamp-authority•141141 stars in sigstore/timestamp-authority•11 issue in sigstore/timestamp-authority•44 pull requests in sigstore/timestamp-authority•Updated Oct 15, 2026Oct 15, 2026

• model-validation-operator

  Public

  sigstore/model-validation-operator’s past year of commit activity
  Kubernetes controller to validate AI models

  Go

  •

  Apache License 2.0

  •1717 forks in sigstore/model-validation-operator•3131 stars in sigstore/model-validation-operator•1212 issues in sigstore/model-validation-operator•1515 pull requests in sigstore/model-validation-operator•Updated Oct 15, 2026Oct 15, 2026

• rekor-tiles

  Public
  Signature Transparency Log designed for ease of use, low cost, and minimal maintenance

  securitysupply-chainprovenance+ 1

  securitysupply-chainprovenancetransparency-log

  Go

  •

  Apache License 2.0

  •2525 forks in sigstore/rekor-tiles•4949 stars in sigstore/rekor-tiles•2323 issues in sigstore/rekor-tiles•44 pull requests in sigstore/rekor-tiles•Updated Oct 15, 2026Oct 15, 2026

• sigstore-probers

  Public
  Probers for sigstore infrastructure

  Go

  •

  Apache License 2.0

  •1818 forks in sigstore/sigstore-probers•66 stars in sigstore/sigstore-probers•22 issues in sigstore/sigstore-probers•00 pull requests in sigstore/sigstore-probers•Updated Oct 15, 2026Oct 15, 2026

• community

  Public
  General sigstore community repo

  Apache License 2.0

  •5656 forks in sigstore/community•4545 stars in sigstore/community•1616 issues in sigstore/community•22 pull requests in sigstore/community•Updated Oct 14, 2026Oct 14, 2026

• helm-charts

  Public
  Helm charts for sigstore project

  charthelmhelm-charts

  charthelmhelm-charts

  Go Template

  •

  Apache License 2.0

  •110110 forks in sigstore/helm-charts•9494 stars in sigstore/helm-charts•4747 issues in sigstore/helm-charts•1010 pull requests in sigstore/helm-charts•Updated Oct 14, 2026Oct 14, 2026

• sigstore

  Public
  Common go library shared across sigstore services and clients

  gogolangsecurity+ 3

  gogolangsecuritysupply-chaincosignsigstore

  Go

  •

  Apache License 2.0

  •160160 forks in sigstore/sigstore•539539 stars in sigstore/sigstore•22 issues in sigstore/sigstore•44 pull requests in sigstore/sigstore•Updated Oct 14, 2026Oct 14, 2026

• model-transparency

  Public
  Supply chain security for ML

  securitymachine-learningsupply-chain+ 1

  securitymachine-learningsupply-chainsigstore

  Python

  •

  Apache License 2.0

  •6767 forks in sigstore/model-transparency•248248 stars in sigstore/model-transparency•3434 issues in sigstore/model-transparency•1111 pull requests in sigstore/model-transparency•Updated Oct 14, 2026Oct 14, 2026

• terraform-modules

  Public
  Terraform modules for Sigstore cloud infrastructure

  HCL

  •

  Apache License 2.0

  •88 forks in sigstore/terraform-modules•55 stars in sigstore/terraform-modules•11 issue in sigstore/terraform-modules•00 pull requests in sigstore/terraform-modules•Updated Oct 14, 2026Oct 14, 2026

• sigstore-conformance

  Public
  Conformance testing for Sigstore clients

  testsconformancesigstore

  testsconformancesigstore

  Python

  •1919 forks in sigstore/sigstore-conformance•1212 stars in sigstore/sigstore-conformance•2121 issues in sigstore/sigstore-conformance•55 pull requests in sigstore/sigstore-conformance•Updated Oct 14, 2026Oct 14, 2026

• cosign

  Public
  Code signing and transparency for containers and binaries

  Go

  •

  Apache License 2.0

  •825825 forks in sigstore/cosign•6.4k6.4k stars in sigstore/cosign•106106 issues in sigstore/cosign•4848 pull requests in sigstore/cosign•Updated Oct 14, 2026Oct 14, 2026

• sigstore-ruby

  Public
  Pure-ruby implementation of sigstore verification

  Ruby

  •

  Apache License 2.0

  •1313 forks in sigstore/sigstore-ruby•2828 stars in sigstore/sigstore-ruby•66 issues in sigstore/sigstore-ruby•1414 pull requests in sigstore/sigstore-ruby•Updated Oct 14, 2026Oct 14, 2026

• fulcio

  Public
  Sigstore OIDC PKI

  Go

  •

  Apache License 2.0

  •191191 forks in sigstore/fulcio•889889 stars in sigstore/fulcio•4040 issues in sigstore/fulcio•44 pull requests in sigstore/fulcio•Updated Oct 14, 2026Oct 14, 2026

• github-sync

  Public
  Pulumi GitHub Sync for sigstore

  automationpulumisigstore

  automationpulumisigstore

  Go

  •

  Apache License 2.0

  •44 forks in sigstore/github-sync•88 stars in sigstore/github-sync•00 issues in sigstore/github-sync•11 pull request in sigstore/github-sync•Updated Oct 13, 2026Oct 13, 2026

• policy-controller

  Public
  Go

  •

  Other

  •8080 forks in sigstore/policy-controller•182182 stars in sigstore/policy-controller•6565 issues in sigstore/policy-controller•2626 pull requests in sigstore/policy-controller•Updated Oct 13, 2026Oct 13, 2026

• cosign-installer

  Public
  Cosign Github Action

  cosign

  cosign

  Apache License 2.0

  •6767 forks in sigstore/cosign-installer•213213 stars in sigstore/cosign-installer•1010 issues in sigstore/cosign-installer•66 pull requests in sigstore/cosign-installer•Updated Oct 13, 2026Oct 13, 2026

• sigstore-blog

  Public
  Codebase for blog.sigstore.dev

  CSS

  •

  Apache License 2.0

  •2121 forks in sigstore/sigstore-blog•77 stars in sigstore/sigstore-blog•33 issues in sigstore/sigstore-blog•55 pull requests in sigstore/sigstore-blog•Updated Oct 13, 2026Oct 13, 2026

• sigstore-rust

  Public
  Sigstore implemented in Rust for Github v0.3 bundles

  ocipackage-managementcosign+ 1

  ocipackage-managementcosignsigstore

  Rust

  •

  Apache License 2.0

  •1414 forks in sigstore/sigstore-rust•2929 stars in sigstore/sigstore-rust•66 issues in sigstore/sigstore-rust•11 pull request in sigstore/sigstore-rust•Updated Oct 13, 2026Oct 13, 2026

• rekor-monitor

  Public
  Log monitor for Rekor to verify immutability and monitor entries

  Go

  •

  Apache License 2.0

  •3535 forks in sigstore/rekor-monitor•5858 stars in sigstore/rekor-monitor•99 issues in sigstore/rekor-monitor•99 pull requests in sigstore/rekor-monitor•Updated Oct 13, 2026Oct 13, 2026

• sigstore-js

  Public
  Code-signing for npm packages

  javascriptsecuritynode+ 2

  javascriptsecuritynodesupply-chaincodesigning

  TypeScript

  •

  Apache License 2.0

  •4848 forks in sigstore/sigstore-js•185185 stars in sigstore/sigstore-js•77 issues in sigstore/sigstore-js•1717 pull requests in sigstore/sigstore-js•Updated Oct 13, 2026Oct 13, 2026

• rekor

  Public
  Software Supply Chain Transparency Log

  securitysupply-chainprovenance+ 1

  securitysupply-chainprovenancetransparency-log

  Go

  •

  Apache License 2.0

  •226226 forks in sigstore/rekor•1.2k1.2k stars in sigstore/rekor•6868 issues in sigstore/rekor•55 pull requests in sigstore/rekor•Updated Oct 13, 2026Oct 13, 2026