How to use this reference
Identify the expected publisher or workload and its issuer, document which certificate authority and log are trusted, and assign responsibility for detecting unexpected signing events. Trace the trust boundary from identity issuer through certificate and artifact to the consumer’s acceptance policy.
Before reading
- Basic hashes and digital signatures
- Familiarity with CI and workload identity
Context and limits
- A compromised identity issuer or certificate authority can issue unauthorized certificates. Transparency makes misuse detectable only when someone monitors the logs.
- Signing is not a code-quality assessment; consumers still need an acceptance policy.
Sources and provenance
- Security Model Sigstore · reviewed 2026-10-12
Record reviewed 2026-10-12. Snapshot cb017eaea66e. Open the complete JSON contract.