Go
sigstore/sigstore
Common go library shared across sigstore services and clients
Apache-2.0Oct 21, 2026 · metrics 2.10.0
All tags
Catalogue tag
#sigstore
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
30 records
Go
sigstore/sigstore-go
Go library for Sigstore signing and verification
Apache-2.0Oct 21, 2026 · metrics 2.10.0
crates.io
nolabs-ai/nono
secure multiplexed execution paths for agents - zero trust, zero setup, zero latency.
Apache-2.0Sep 11, 2026 · metrics 2.10.0
Go
kubernetes-sigs/tejolote
A highly configurable build executor and observer designed to generate signed SLSA provenance attestations about build runs.
Apache-2.0Sep 13, 2026 · metrics 2.10.0
npm
sigstore/sigstore-js
Code-signing for npm packages
Apache-2.0Oct 21, 2026 · metrics 2.10.0
Go
sigstore/gitsign
Keyless Git signing using Sigstore
Custom licenseSep 19, 2026 · metrics 2.10.0
Go
carabiner-dev/ampel
🔴🟡🟢 The Amazing Multipurpose Policy Engine (and L)
Apache-2.0Sep 12, 2026 · metrics 2.10.0
crates.io
sigstore/sigstore-rust
Sigstore implemented in Rust for Github v0.3 bundles
Apache-2.0Sep 9, 2026 · metrics 2.10.0
Go
securesign/secure-sign-operator
Kubernetes Operator for deploying and managing Sigstore components like Fulcio, Rekor, TSA, and TUF.
Apache-2.0Sep 19, 2026 · metrics 2.10.0
Go
Nox-HQ/nox
Open-source security scanner with first-class AI app security (prompt injection, embedding leakage, agent over-privilege, MCP hardening). Polyglot AIBOM, SARIF, SBOM. Cosign-signed plugin marketplace. Offline-first, agent-native via MCP.
Apache-2.0Sep 13, 2026 · metrics 2.10.0
Go · npm
CodesWhat/portwing
Security-first remote Docker agent — authenticated Docker API proxy with outbound edge mode, Ed25519 per-request auth, and a cosign-signed, scratch-based supply chain. Drydock-native + generic REST.
AGPL-3.0Sep 9, 2026 · metrics 2.10.0
Go
liatrio/autogov
Unified CLI for software supply-chain governance / verify GitHub artifact attestations, evaluate OPA/Rego policies, generate SLSA Verification Summary Attestations (VSAs), and manage releases.
Apache-2.0Sep 15, 2026 · metrics 2.10.0
PyPI · npm
creatornader/atrib
Verifiable agent actions. Every action becomes signed context for the next. Ed25519 signatures, Merkle log proofs, independently verifiable by anyone.
Apache-2.0Oct 22, 2026 · metrics 2.10.0
npm
getmcpm/cli
MCP security guard + package manager. Block prompt injection, tool poisoning and rug-pulls in Model Context Protocol servers at runtime; trust-scored installs with Sigstore provenance for Claude Desktop, Claude Code, Cursor, VS Code, Windsurf and Gemini CLI. Local, deterministic, no LLM in the loop.
MITOct 22, 2026 · metrics 2.10.0
PyPI
b7n0de/proofbundle
Offline cryptographic receipts for AI evaluation results — Ed25519 + RFC 6962 Merkle + optional SD-JWT. Integrity, not truth
MITSep 13, 2026 · metrics 2.10.0
npm · PyPI
delimit-ai/delimit-mcp-server
The merge gate for AI-written code, with signed, replayable attestation. Works across Claude Code, Codex, Cursor, and Gemini CLI.
MITSep 16, 2026 · metrics 2.10.0
Go
carabiner-dev/bnd
Sign and package attestations in sigstore bundles
Apache-2.0Sep 13, 2026 · metrics 2.10.0
Go
git-pkgs/sigstore
sigstore-go wrapper for verifying attestation bundles against the Sigstore TUF trust root
MITSep 19, 2026 · metrics 2.10.0
crates.io
jdx/packslip
A signed release manifest for vendor binaries
MITSep 18, 2026 · metrics 2.10.0
Go
blairham/stevedore
Release Docker/OCI images the way GoReleaser releases binaries — build, scan, sign, SBOM, provenance, per-image versioning, and monorepo change detection.
MITSep 10, 2026 · metrics 2.10.0
crates.io
pulseengine/sigil
Sigil — Supply chain security for WebAssembly. Embedded signatures, Sigstore keyless signing, SLSA provenance. Part of the PulseEngine toolchain.
No licenseSep 17, 2026 · metrics 2.10.0
Go · PyPI
RudrenduPaul/TenantGuard
Tenant-isolation security scanner for self-hosted multi-tenant AI-agent platforms. SARIF, JSON, and MCP output.
Apache-2.0Sep 8, 2026 · metrics 2.10.0
Packagist
k2gl/dsse
Sign and verify DSSE (Dead Simple Signing Envelope) payloads in PHP.
MITSep 13, 2026 · metrics 2.10.0
Go · npm
pdbethke/corralai
An auditing engine for code you did not write. certify plants faults and runs YOUR suite against each one; review hands the code to a cold agent that must prove every claim with a script corral runs. Each verdict is a signed, hash-linked entry on a git branch any DuckDB queries straight off GitHub.
Custom licenseSep 17, 2026 · metrics 2.10.0
PyPI
astral-sh/sigstore-models
Pydantic-based, protobuf-free data models for Sigstore
MITOct 21, 2026 · metrics 2.10.0
Go · npm
daimoniac/suppline
Self-hosted Kubernetes image intake gateway: mirror → Trivy scan → CEL policy → Sigstore attestations. Admit only what passed.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
npm
dot-skill/skillerr
Open .skill Protocol - a sealed, inspectable package format for AI agent skills. Reference implementation: skillerr.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Go
SVGreg/surfaceguard
Know what you're letting in — scans, signs and verifies what an agent loads. Agent Skills vs the OWASP Agentic Skills Top 10, with SARIF output and a load-time gate.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Go
olelbis/pswg
Small Go password generator CLI with shell-safe mode and signed release artifacts
MITSep 13, 2026 · metrics 2.10.0
npm
mwashburn160/pipeline-builder
Self-hosted platform for deploying and running software factories on AWS: secure delivery pipelines, a signed supply chain, policy-as-code compliance and multi-tenant governance — in minutes, not months.
Apache-2.0Oct 21, 2026 · metrics 2.10.0