A transparency log for the artefact question nobody wanted to answer
For most of the open-source ecosystem's history, a release binary arrived with no verifiable connection to the source code that supposedly produced it. A maintainer ran a build locally, uploaded the result, and users trusted the result implicitly. Sigstore, a Linux Foundation project launched in 2021, is the most serious infrastructure-level attempt to close that gap.
The project bundles three components. Cosign handles signing and verification of container images and other artefacts. Fulcio is a certificate authority that issues short-lived signing certificates tied to an identity verified via an OpenID Connect provider — eliminating the need for maintainers to manage long-lived private keys. Rekor is the public, append-only transparency log into which every signature event is recorded, so that any party can audit whether a certificate was issued and when.
The model matters because it shifts the trust question from "do you trust this maintainer's key management?" to "does this signature record exist in a log no single party controls?" The transparency log design borrows from Certificate Transparency, the mechanism that made fraudulent TLS certificates detectable after the fact.
Adoption arrived at meaningful scale. PyPI announced Sigstore-based provenance attestations in 2024, allowing publishers to attach a verifiable record linking a package to its source repository and build environment. npm had already introduced provenance attestations, with GitHub Actions integration, enabling publishers to generate provenance attestations automatically at release time. Maven Central, the primary repository for Java artefacts, also documented a path to Sigstore-compatible signing as part of its broader security roadmap.
The Sigstore policy documentation describes the project's explicit aim: make signing the default rather than the exception. Historically, signing required GPG key infrastructure that most maintainers found onerous enough to skip entirely; Sigstore's keyless model, built on ephemeral certificates, removes that friction.
What Sigstore cannot do is verify that the source code itself is trustworthy — a point the xz/liblzma incident made plain. Provenance attestation confirms the artefact matches a commit; it does not audit the commit. The plumbing is necessary. It is not sufficient.