Keyless signing works like this: the signer creates an ephemeral key pair, proves an identity through OIDC (a GitHub Actions workflow, a Google or Microsoft account), receives a Fulcio certificate valid for 10 minutes that binds the key to that identity, signs the artifact, uploads the signature to Rekor and discards the key. Verification checks the certificate chain against the Sigstore root, the identity and issuer the verifier expects, and the log inclusion proof or signed timestamp that shows signing happened while the certificate was valid.
Results travel as a Sigstore bundle (media type application/vnd.dev.sigstore.bundle.v0.3+json) containing the certificate, signature or DSSE envelope and transparency-log evidence; trust roots are distributed with TUF. Rekor v2, a tile-based log, reached general availability in 2025. Users include npm provenance, PyPI attestations, Homebrew, Kubernetes releases, container images signed with cosign and GitHub artifact attestations.
The security decision moves from "which key?" to "which identity?": verifiers must pin both the certificate identity (for example a workflow path) and the OIDC issuer, or any Sigstore user's signature would pass. The Sigstore bundle verifier checks a bundle locally against the expected identity.