cosign
Code signing and transparency for containers and binaries (by sigstore)
spiffe-vault
Integrates Spiffe and Vault to have secretless authentication (by philips-labs)
| cosign | spiffe-vault | |
|---|---|---|
| 36 | - | |
| 6,002 | 99 | |
| 2.6% | - | |
| 9.6 | 7.2 | |
| 4 days ago | 21 days ago | |
| Go | Go | |
| Apache License 2.0 | MIT License |
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
cosign
Posts with mentions or reviews of cosign.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2026-03-20.
-
Evidence Stores for Supply Chain Security
Solutions like Cosign, in-toto and ShiftLeftCyber's SecureSBOM can be mentioned here.
-
Introduction to Gitless GitOps: A New OCI-Centric and Secure Architecture
Flux uses cosign
-
Top Terraform/OpenTofu tools to Use in 2025
Verifies downloads using cosign and PGP (via gopenpgp), ensuring the integrity and authenticity of tool binaries.
- 1minDocker #13 - Push, build and dockerize with GitHub Actions
-
10 Docker Security Best Practices
SigStore project, including its cosign tool, implements simple signing, storage, and verification of artifacts.
-
Reading the Ruby 3.4 NEWS with professionals (English translation)
RubyGems now supports sigstore.dev, which aims to improve the security of the software supply chain. Sigstore is a series of mechanisms that provide automated signing for the software supply chain. If you pass the file path to a Sigstore Bundle generated using cosign or sigstore-ruby to --attestation, you can upload the Gem signature to RubyGems.
-
Securing CI/CD Images with Cosign and OPA
Cosign: In this context, Cosign from the Sigstore project offers a compelling solution. Its simplicity, registry compatibility, and effective link between images and their signatures provide a user-friendly and versatile approach. The integration of Fulcio for certificate management and Rekor for secure logging enhances Cosign's appeal, making it particularly suitable for modern development environments that prioritize security and agility.
-
An Overview of Kubernetes Security Projects at KubeCon Europe 2023
sigstore is another suite of tools that focuses on attestation and provenance. Within the suite are two tools I heard mentioned a few times at KubeCon: Cosign and Rekor.
-
Spin 1.0 — The Developer Tool for Serverless WebAssembly
Since we can distribute Spin applications using popular registry services, we can also take advantage of ecosystem tools such as Sigstore and Cosign, which address the software supply chain issue by signing and verifying applications using Sigstore's new keyless signatures (using OIDC identity tokens from providers such as GitHub).
-
Iron Bank: Secure Registries, Secure Containers
Use distroless images (which contain only application and its runtime dependencies, and don't include package managers/shells or any other programs you would expect to find in a standard Linux distribution). All distroless images are signed by cosign.
spiffe-vault
Posts with mentions or reviews of spiffe-vault.
We have used some of these posts to build our list of alternatives
and similar projects.
We haven't tracked posts mentioning spiffe-vault yet.
Tracking mentions began in Dec 2020.
What are some alternatives?
When comparing cosign and spiffe-vault you can also consider the following projects:
in-toto-golang - A Go implementation of in-toto. in-toto is a framework to protect software supply chain integrity.
spire - The SPIFFE Runtime Environment
cosign-installer - Cosign Github Action
vault-secrets-operator - Create Kubernetes secrets from Vault for a secure GitOps based workflow.