sigstore/sigstore-rs

sigstore-rs is a Rust crate for interacting with sigstore, the open-source project for code signing and verification.

The crate addresses the need for Rust applications to integrate with sigstore's ecosystem. It provides implementations for cosign signing and verification workflows, including verification of signatures stored in registries, verification using provided keys, verification of transparency log bundles from Rekor, and keyless verification using Fulcio Web-PKI. The crate also includes Fulcio integration through an OpenID Connect API and a Fulcio client implementation, a complete Rekor client for transparency log interaction, and a key interface supporting key pair generation, signing, verification, and import/export of keys in PEM and DER formats.

Developers should adopt this crate if they are building Rust applications that need to participate in sigstore workflows. It suits projects requiring cosign-based signing and verification, keyless signing through Fulcio, or integration with Rekor for transparency logging. The crate is still under active development and explicitly not considered stable until a 1.0 release, so it is most appropriate for projects that can tolerate API changes. A known limitation is that the crate does not yet handle verification of attestations.

The project maintains active continuous integration testing. Development is ongoing with regular updates, and the maintainers welcome contributions through a documented contributing process. The crate is published to the Rust package registry with public documentation available.