pkg.soopen package index

brew / rank 4675

Install sigstore with Homebrew

Codesigning tool for Python packages. Version 4.5.0 via Homebrew; verified 2026-09-13.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install sigstore

local Homebrew formula metadata

overview

Package summary

Codesigning tool for Python packages

Commands and aliases

  • sigstore

history

Project history and usage

sigstore-python is a Python command-line tool and library for generating and verifying Sigstore signatures, including signatures for Python package distributions.

Project history

sigstore-python was created as the Python client for the broader Sigstore software-signing ecosystem. It combines a command-line program with an importable API for keyless signing and verification using OpenID Connect identities, Fulcio certificates, and Rekor transparency records.

Adoption history

The project provides an official GitHub Action and supports ambient identities from CI and cloud environments, making it suitable for automated release pipelines as well as local signing. It is particularly relevant to Python packaging because the documentation explicitly covers signing Python distributions.

How it is used

Users run sigstore sign to create a signature bundle for an artifact and sigstore verify commands to validate bundles against expected identities. Signing can use ambient CI credentials, an interactive OAuth flow, or an explicitly supplied identity token.

Why package nerds care

sigstore-python gives Python users and package maintainers a native implementation of Sigstore's keyless signing model. It replaces long-lived signing keys with short-lived identity-bound certificates and records signing events in a public transparency service.

Timeline

  • 2022: Early public sigstore-python releases established Python-native keyless signing and verification.
  • 2023: The project expanded its documented CI integration and official GitHub Action workflow.
  • 2025: The 4.x series introduced substantial client and trust-configuration API changes.

Related projects

  • Related official Sigstore projects include Fulcio, Rekor, Cosign, sigstore-go, and the Sigstore client specifications.

security posture

No protected-tool coverage found yet

No matching local secret-handling manifest was found for sigstore. Package metadata is still published here so future coverage has a stable package URL.

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 6 platform targets.
  • Installs with 5 runtime dependencies.
  • Build metadata lists 2 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
sigstorecliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-09-19
manager version4.5.0
manager updated2026-09-13
local dataok
upstreamnot checked
latest detectednot detected

https://github.com/sigstore/sigstore-python

install metadata

Package metadata

Package keybrew:sigstore
Version4.5.0
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/sigstore
Homepagehttps://github.com/sigstore/sigstore-python
Repositoryhttps://github.com/sigstore/sigstore-python
LicenseApache-2.0
Source archivehttps://files.pythonhosted.org/packages/18/e0/279419065e2d7102413605b3456122adbbccbc42e010b499c7b882fc01f8/sigstore-4.5.0.tar.gz
Last updated2026-09-13T02:34:55Z
Pulseupdated
Dependenciescertifi, cryptography, openssl@3, pydantic, python@3.14
Build dependenciespkgconf, rust
Bottleavailable (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namesigstore
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Related tools

  • openssl@3Runtime dependency declared by Homebrew.
  • python@3.14Runtime dependency declared by Homebrew.
  • pkgconfBuild dependency declared by Homebrew.
  • rustBuild dependency declared by Homebrew.

Same workflow

  • cosignShares pkgdb curated category or tags: cli, security, sigstore, software-supply-chain, supply-chain-security.
  • safetyShares pkgdb curated category or tags: cli, python, security, software-supply-chain, supply-chain-security.
  • rekor-cliShares pkgdb curated category or tags: cli, security, sigstore, software-supply-chain, supply-chain-security.
  • poutineShares pkgdb curated category or tags: cli, security, software-supply-chain, supply-chain-security.
  • cyclonedx-pythonShares pkgdb curated category or tags: cli, python, security, software-supply-chain.
  • notationShares pkgdb curated category or tags: cli, security, software-supply-chain, supply-chain-security.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • cross-ecosystem install command graph
  • curated package history
  • package relationship graph
  • package version freshness
  • package-page enrichment
  • pkg.so package database
  • pkgdb category and tag curation