sigstore 开源项目推荐（488 个）

sigstore /gitsign

Keyless Git signing using Sigstore

sno-ai /mda

MDA开放规范-面向代理文档的Markdown超集。一个.mda源代码可编译为直接访问的SKILL.md、AGENTS.md、MCP-SERVER.md和CLAUDE.md。通过类型化依赖图、脚注关系和Sigstoreanchored签名验证了SON架构。适用于agentskills.io和AAIF运行时。

sigstore /sigstore

Common go library shared across sigstore services and clients

sse-secure-systems /connaisseur

An admission controller that integrates Container Image Signature Verification into a Kubernetes cluster

letsseal /letsseal

用于证明任意文件真实、未被篡改且已封存的开放标准。

sigstore /model-transparency

Supply chain security for ML

sigstore /sigstore-rs

An experimental Rust crate for sigstore

konflux-ci /konflux-ci

Trusted builds made easy! A cloud-native software factory for building, testing, and releasing trusted software artifacts

Goldziher /ai-rulez

Author, generate, validate and govern AI agent rules, skills, plugins and MCP configuration across 52 coding assistants. Review with verified model evidence, evaluate skills, lock and sign dependencies, and publish bundles. CLI, MCP server and Go API.

mkbhardwas12 /pwned-deps

Is your lockfile pwned? 5-second scan of npm/PyPI/Maven/Cargo/Go/RubyGems lockfiles for compromised packages — OSV + curated campaign feed, --min-age cooling-off gate, exit 4 when a scan is incomplete. SLSA L3, Sigstore-signed feed.

stacklok /sigstore-the-hard-way

sigstore the hard way!

sigstore /sigstore-go

Go library for Sigstore signing and verification

argoproj-labs /argocd-interlace

Enabling Software Supply Chain Security Capabilities in ArgoCD

arsbr /Veritensor

面向 AI 产物的防病毒工具与 RAG 防火墙。静态分析工具，扫描模型和 Notebook 中的 RCE，扫描数据集和 RAG 文档中的数据投毒、PII 和提示注入。保障你的 AI 供应链安全。

signed-page /pdf

PDF 签名工具，支持 GPG 和 Sigstore（Google、GitHub、Microsoft 账户 / 无密钥 OIDC）签名、多方签名，无需重型 PDF 签名栈即可轻松签署和验证文档，让你的 PDF 真实、防篡改，并完全兼容普通阅读器；同时使用成本为零。

sigstore /cosign-gatekeeper-provider

🔮 ✈️ to integrate OPA Gatekeeper's new ExternalData feature with cosign to determine whether the images are valid by verifying their signatures

kubernetes-sigs /tejolote

A highly configurable build executor and observer designed to generate signed SLSA provenance attestations about build runs.

sigstore /helm-sigstore

Plugin for Helm to integrate the sigstore ecosystem

GoogleCloudPlatform /k8s-aibom

Know what AI is actually running in your clusters. An unprivileged Kubernetes controller that inventories models, runtimes, agents, and RAG components at runtime - emitting CycloneDX 1.6 ML-BOMs with evidence, confidence tiers, and Sigstore-verified model signatures

policylabs /ampel

🔴🟡🟢 The Amazing Multipurpose Policy Engine (and L)