sigstore/fulcio

Fulcio is a free-to-use certificate authority that issues short-lived code signing certificates bound to OpenID Connect identities.

The tool solves the problem of establishing trust for code artifacts by issuing certificates tied to OIDC identities such as email addresses. Rather than requiring developers to manage long-lived keys, Fulcio issues certificates valid for only ten minutes, reducing the window of exposure if credentials are compromised. The approach leverages existing identity providers through OIDC, eliminating the need for separate key infrastructure while maintaining cryptographic proof of identity at signing time.

Fulcio suits projects and organizations that want to implement code signing without managing a public key infrastructure. It is particularly valuable for open-source ecosystems and CI/CD pipelines where developers may not have established key management practices. The tool is offered as a public instance with a stated availability SLO, making it accessible to projects of any size. The project provides Certificate Maker, a companion tool for creating Fulcio-compliant certificate chains that supports multiple KMS providers including AWS, Google Cloud, Azure, and HashiCorp Vault, allowing organizations to run private instances if needed. All issued certificates are published to a Certificate Transparency log, enabling auditors to monitor for misuse or misconfiguration.

The project maintains a public instance in general availability with documented API stability guarantees following semantic versioning. Development activity shows active maintenance of the core gRPC and HTTP APIs, with ongoing work to support multiple KMS backends and certificate chain configurations. The team actively documents security considerations and encourages community auditing through the Certificate Transparency log. Communication occurs through dedicated Slack channels and the broader sigstore community repository.