sigstore-python
Radar: Initial
Apache-2.0
A Sigstore client for Python, used for signing and verifying Python package releases.
Sigstore
Specifications it implements
What this tool does to each specification, in the role vocabulary. Follow a standard through to standards.apievangelist.com for what it actually specifies.
| Standard | Role | What that means |
|---|---|---|
| Sigstore | signs |
Using this from an agent
- Interfaces
clilibrary- Install
-
pypi
sigstore - Invoke
python -m sigstore verify identity <artifact> --cert-identity <id> --cert-oidc-issuer <issuer>- Emits
- signature, json
- Runtime
- Needs network Non-deterministic Writes Needs credentials
Where it applies
Jobs this tool actually does, and the surface each one is exercised on.
Verify the Sigstore signatures PyPI publishes for a release.
coding-agentci-pipeline
- Website
- https://pypi.org/p/sigstore
- Repository
- https://github.com/sigstore/sigstore-python
- License
- Apache-2.0 — read from the repository's LICENSE file, verified 2026-08-11
- Stars
- 332 · last commit 2026-08-10
Reading this as an agent? Don't scrape the page — this entry is published as
structured data at
arrow_back
All tools by adoption
/tools.json,
against the tool.schema.json
schema, using the roles.json
vocabulary. Start at /llms.txt.