sigstore を Homebrew でインストール

プロジェクトリンク

• ホームページ
• パッケージマネージャページ

コマンドとエイリアス

• sigstore

プロジェクトの歴史

sigstore-python was created as the Python client for the broader Sigstore software-signing ecosystem. It combines a command-line program with an importable API for keyless signing and verification using OpenID Connect identities, Fulcio certificates, and Rekor transparency records.

採用の歴史

The project provides an official GitHub Action and supports ambient identities from CI and cloud environments, making it suitable for automated release pipelines as well as local signing. It is particularly relevant to Python packaging because the documentation explicitly covers signing Python distributions.

使われ方

Users run sigstore sign to create a signature bundle for an artifact and sigstore verify commands to validate bundles against expected identities. Signing can use ambient CI credentials, an interactive OAuth flow, or an explicitly supplied identity token.

パッケージ好きにとっての重要性

sigstore-python gives Python users and package maintainers a native implementation of Sigstore's keyless signing model. It replaces long-lived signing keys with short-lived identity-bound certificates and records signing events in a public transparency service.

タイムライン

• 2022: Early public sigstore-python releases established Python-native keyless signing and verification.
• 2023: The project expanded its documented CI integration and official GitHub Action workflow.
• 2025: The 4.x series introduced substantial client and trust-configuration API changes.

Related projects

• Related official Sigstore projects include Fulcio, Rekor, Cosign, sigstore-go, and the Sigstore client specifications.

ソース

• https://github.com/sigstore/sigstore-python/blob/main/CHANGELOG.md
• https://sigstore.github.io/sigstore-python/
• https://sigstore.github.io/sigstore-python/installation/
• https://sigstore.github.io/sigstore-python/signing/