Keyless Git signing using Sigstore

Software Supply Chain Transparency Log

A Sigstore client written in Python

Our objective is to enable open source maintainers, contributors and end-users to understand and make decisions on the provenance of the code they maintain, produce and use.

The S2C2F Project is a group working within the OpenSSF's Supply Chain Integrity Working Group formed to further develop and continuously improve the S2C2F guide which outlines and defines how to s…

in-toto is a framework to protect supply chain integrity.

A GitHub Action for sigstore-python

Sigstore OIDC PKI

Public Chainguard Images

CodeQL database manager

A collection of liteweight transparency logging tools, compatible with the Sigsum and Omniwitness ecosystems.