Build Integrity & Cryptographic Trust

Now pick what to compare Sigstore Rekor against.

Sigstore Rekor clear

Open a name for its full profile

Sigstore Cosign
Scored
Open Source Security Foundation (OpenSSF) · Open Source · 4 capabilities in this domain · 4.18 / 5
Compare →
AWS Signer
Capabilities only
Amazon Web Services · Commercial · 3 capabilities in this domain
Compare →
Chainguard Factory
Capabilities only
Chainguard · Commercial · 3 capabilities in this domain
Compare →
Notation (Notary Project)
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 3 capabilities in this domain
Compare →
Tekton Chains
Capabilities only
Continuous Delivery Foundation · Open Source · 3 capabilities in this domain
Compare →
Witness
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 3 capabilities in this domain
Compare →
Azure Trusted Signing
Capabilities only
Microsoft · Commercial · 2 capabilities in this domain
Compare →
Bazel
Capabilities only
Google · Open Source · 2 capabilities in this domain
Compare →
CyberArk Code Sign Manager
Capabilities only
CyberArk · Commercial · 2 capabilities in this domain
Compare →
Keyfactor Signum
Capabilities only
Keyfactor · Commercial · 2 capabilities in this domain
Compare →
SLSA GitHub Generator
Capabilities only
Open Source Security Foundation (OpenSSF) · Open Source · 2 capabilities in this domain
Compare →
Sigstore Fulcio
Capabilities only
Open Source Security Foundation (OpenSSF) · Open Source · 2 capabilities in this domain
Compare →
Sigstore Rekor
Capabilities only
Open Source Security Foundation (OpenSSF) · Open Source · 2 capabilities in this domain
selected
diffoscope
Capabilities only
Reproducible Builds Project · Open Source · 2 capabilities in this domain
Compare →
in-toto
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 2 capabilities in this domain
Compare →
melange
Capabilities only
Chainguard · Open Source · 2 capabilities in this domain
Compare →
slsa-verifier
Capabilities only
Open Source Security Foundation (OpenSSF) · Open Source · 2 capabilities in this domain
Compare →
Archivista
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 1 capabilities in this domain
Compare →
Kosli
Capabilities only
Kosli · Freemium · 1 capabilities in this domain
Compare →

In Build Integrity & Cryptographic Trust

Kosli

Kosli · Build Integrity & Cryptographic Trust

Close ×

FreemiumCompany

Kosli attests artifacts, test results and approvals from pipelines and monitors runtime environments to show what is running and whether it was compliant.

What it does3 capabilities · 2 at full coverage

2 of 3 at full coverage.

Artifact Chain-of-Custody TracingFullBUILD · level 4 · 4 providers
Automated Evidence CollectionFullGRC · level 3 · 8 providers
Continuous Compliance MonitoringPartialGRC · level 3 · 9 providers

What it proves12 controls across 6 frameworks

Satisfied through its capabilities, not claimed by the vendor.

CSF 2.04 / 106GV.OV-03 ID.AM-08 ID.IM-01 RS.AN-07
SSDF 1.14 / 42PO.3.3 PO.4.2 PS.3.1 PS.3.2
AICM1 / 18A&A
CIS Controls1 / 18CIS 4
SAMM 2.01 / 90G-PC-3-B
SP 800-204D1 / 11204D-CI-EVIDENCE

What it stops1 risk

1 risks reduced

Control failures and framework non-compliance go unnoticedMedium

Where it runs5 phases · 2 ways to deploy

Capabilities per lifecycle phase

Build2
Release2
Deploy1
Operate2
Monitor1

How it is delivered

CLI toolSaaS

What it unlocks3 activities · reaches level 5

Program activities its capabilities support, reaching level 5. Supporting an activity is not completing it.

Level 4

Continuous compliance with automated evidenceMedium effort
Verify provenance and attestations before promotionMedium effort

Level 5

Full chain of custody for every artifactHigh effort

How it holds up

Not assessed yet: no strengths, limits or evaluation scores. 47 of 340 products carry an assessment and 29 are scored.

What it costsOpen core or freemium · free tier

LicensingOpen core or freemium

Priced perfree tier plus paid tiers

BillingSubscription

Scales withFeature tier, users or usage beyond the free tier

Total cost

Start free; enterprise needs such as SSO, audit logs and policy often require the paid tier.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with

No supported language, standard, integration or named feature recorded.

What else to look at

No alternative, competitor or family sibling is modeled for it.

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13