Fulcio: free certificate authority for code signing with OIDC identities, README overview
The README presents Fulcio as a free CA that binds short-lived signing certificates to OIDC identities.
Reusable resources
Locations saved with this record. Check access, licensing and suitability at the source.
- commit 24deee31680022186e823592f8a2d760841fe043 · source_revision · · availability: unknown
- Fulcio: free certificate authority for code signing with OIDC identities, README overview · repository · · availability: available (checked 2026-11-07)
Source: https://github.com/sigstore/fulcio
What it supplies: The README presents Fulcio as a free CA that binds short-lived signing certificates to OIDC identities.
Useful for: - Sign code or artifacts with a certificate tied to an email-style identity.
- Verify the public instance trust chain through the TUF root.
First action: - Fetch the trust bundle and verify it with the Sigstore TUF root using go-tuf.
- Use Sigstore client tools such as cosign for signing.
Prerequisites and limits: Verification needs the go-tuf tool, which needs Go to install.
- Certificates last 10 minutes, so signing evidence relies on a transparency log.
- Verification of the chain is manual as described.
The README text read states no licence, so check the repository licence file. The public instance is described as free to use with a 99.5 availability objective.
Written from the README text only. Statements are as the README gives them; nothing was installed or run.
Based on opening, public instance, trust verification and release README text only; other sections were not read in full. Nothing was installed or run.
Source inspected: https://raw.githubusercontent.com/sigstore/fulcio/24deee31680022186e823592f8a2d760841fe043/README.md ; 7132 bytes ; sha256 2349c49c1aa726be012f988285a5a4e12d6e41d99f4487e8c1ee9727fea350df ; 5 exact pinned excerpts in the draft pin map
Structured fields
{
"revision": {
"ref": "commit 24deee31680022186e823592f8a2d760841fe043",
"pinned": false,
"source_url": "https://raw.githubusercontent.com/sigstore/fulcio/24deee31680022186e823592f8a2d760841fe043/README.md"
},
"checked_at": "2026-11-07T11:53:33.562Z",
"usefulness": "- Sign code or artifacts with a certificate tied to an email-style identity.\n- Verify the public instance trust chain through the TUF root.",
"source_type": "repository",
"availability": "available",
"source_owner": "Sigstore project (Fulcio) (declared repository namespace)",
"known_limitations": [
"Verification needs the go-tuf tool, which needs Go to install.\n\n- Certificates last 10 minutes, so signing evidence relies on a transparency log.\n- Verification of the chain is manual as described.\n\nThe README text read states no licence, so check the repository licence file. The public instance is described as free to use with a 99.5 availability objective.\n\nWritten from the README text only. Statements are as the README gives them; nothing was installed or run.\nBased on opening, public instance, trust verification and release README text only; other sections were not read in full. Nothing was installed or run.",
"Rendered README text of the exact archived capture at the pinned commit, read in full by the author; no media viewed or heard; nothing executed or installed.",
"Source-documented steps; execution not performed. Internal affiliated review is not independent validation."
]
}Rights
| component | license | hosting | redistribution | modification | training | Evidence and notes |
|---|---|---|---|---|---|---|
| documentation | unknown | permitted | permitted | permitted | unknown | Only the team-authored original attributed summary and links are covered. Upstream papers, tutorials, code, models, weights and media retain their separate terms; no source-text/media redistribution right is implied. |