Software Artifact Signing and Verification

Cosign is a tool for signing and verifying software artifacts, primarily those stored in OCI-compatible registries such as container images, Helm charts, SBOMs, and Tekton bundles. It supports keyless signing using ephemeral keys and short-lived certificates from the Sigstore public-good infrastructure, associating signatures with an OpenID Connect identity rather than a long-lived cryptographic key. The project provides multiple signing and verification methods, including private keys, key pairs stored in KMS providers like AWS KMS and Azure Key Vault, and hardware security keys. It can sign

Skopeo is an OCI container image manager and registry client designed for inspecting, copying, and signing container images across different registries and storage backends. It enables the manipulation of container images using direct API calls to registries, operating independently of a local container daemon or runtime. The tool provides specialized capabilities for container image mirroring and synchronization, specifically supporting the mirroring of external repositories to internal registries for air-gapped environments. It also functions as a container image signing tool, allowing for

Notary is a project that allows anyone to have trust over arbitrary collections of data

Sparkle is a software update framework for macOS applications. It provides a system for delivering automatic updates using signed archives and RSS-based feeds to notify clients of new software versions. The framework ensures software integrity and authenticity through public-key cryptography, requiring digital signatures for both update archives and release feeds. It includes mechanisms for signing key rotation to maintain the security chain if a private key is lost. To optimize delivery, the project includes tools for generating binary delta updates that ship only the byte-level differences

Skopeo is a command line utility for inspecting, copying, and managing OCI and Docker container images across registries and local storage. It functions as a container image tool and registry manager that performs these operations without requiring a background daemon to be running on the host. The tool specializes in daemonless image manipulation, allowing users to retrieve metadata, manifests, and tags from remote registries without pulling the full image locally. It provides capabilities for mirroring external repositories to internal registries for air-gapped deployments and manages the t

Syft is a software bill of materials generator, container image scanner, and software dependency catalog. It analyzes container images and filesystems to produce comprehensive inventories of installed packages and dependencies in standard formats. Additionally, it serves as a software attestation tool and an SBOM format converter. The project distinguishes itself through the ability to create cryptographically signed attestations for software inventories to ensure provenance and integrity. It also provides the capability to transform software bills of materials between different industry sche

cargo-binstall is a toolchain extension and binary artifact manager designed to install pre-compiled Rust binaries from releases. Its primary purpose is to avoid the time and resource costs associated with compiling software from source by fetching pre-built executables. The tool provides mechanisms for discovering and downloading binaries across different architectures and platforms. It includes capabilities for verifying the authenticity and integrity of downloaded packages using cryptographic signature verification against public keys. The system supports automated installation in continu

xtool is a suite for automating developer services, cross-platform compilation, application deployment, and mobile device orchestration. It provides tools to build Swift packages into application binaries across different operating systems without requiring a full native development environment. The project automates the management of developer accounts and service APIs to handle app registration and security certificates. It includes capabilities for signing application binaries and deploying them directly to physical mobile devices for native testing and validation. The toolset also covers

Tink is a multi-language cryptography library and security toolkit providing secure APIs for data encryption and digital signatures. It functions as a data encryption library and digital signature framework designed to prevent common implementation errors across different platforms and operating systems. The project serves as a cryptographic keyset manager, utilizing JSON for the storage, rotation, and serialization of keys to maintain consistency across various programming languages. It ensures identical cryptographic behavior globally by mapping language-specific libraries to a unified set

This project is a PHP archive distribution system designed for hosting and deploying versioned releases. It functions as an installation tool and distribution manager that handles the downloading of archives from remote repositories or URLs into local project directories. The system ensures installation security by acting as an integrity verifier, validating archives using hash checksums and digital signatures. It includes a version resolver that matches requested constraints against available releases to ensure environment consistency. The project manages resource organization through XML m

electron-builder is a cross-platform build automator and packaging tool for Electron applications. It bundles source code and dependencies into platform-specific installers, portable executables, and app store formats for Windows, macOS, and Linux. The project functions as a distribution pipeline that orchestrates the signing and notarization of binaries to ensure authenticity and bypass security warnings. It also serves as an auto-update orchestrator, preparing application packages and distribution channels to support automatic background software updates. Its capability surface covers the