Build Integrity & Cryptographic Trust

Now pick what to compare Sigstore Cosign against.

Sigstore Cosign clear

Open a name for its full profile

Sigstore Cosign
Scored
Open Source Security Foundation (OpenSSF) · Open Source · 4 capabilities in this domain · 4.18 / 5
selected
AWS Signer
Capabilities only
Amazon Web Services · Commercial · 3 capabilities in this domain
Compare →
Chainguard Factory
Capabilities only
Chainguard · Commercial · 3 capabilities in this domain
Compare →
Notation (Notary Project)
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 3 capabilities in this domain
Compare →
Tekton Chains
Capabilities only
Continuous Delivery Foundation · Open Source · 3 capabilities in this domain
Compare →
Witness
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 3 capabilities in this domain
Compare →
Azure Trusted Signing
Capabilities only
Microsoft · Commercial · 2 capabilities in this domain
Compare →
Bazel
Capabilities only
Google · Open Source · 2 capabilities in this domain
Compare →
CyberArk Code Sign Manager
Capabilities only
CyberArk · Commercial · 2 capabilities in this domain
Compare →
Keyfactor Signum
Capabilities only
Keyfactor · Commercial · 2 capabilities in this domain
Compare →
SLSA GitHub Generator
Capabilities only
Open Source Security Foundation (OpenSSF) · Open Source · 2 capabilities in this domain
Compare →
Sigstore Fulcio
Capabilities only
Open Source Security Foundation (OpenSSF) · Open Source · 2 capabilities in this domain
Compare →
Sigstore Rekor
Capabilities only
Open Source Security Foundation (OpenSSF) · Open Source · 2 capabilities in this domain
Compare →
diffoscope
Capabilities only
Reproducible Builds Project · Open Source · 2 capabilities in this domain
Compare →
in-toto
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 2 capabilities in this domain
Compare →
melange
Capabilities only
Chainguard · Open Source · 2 capabilities in this domain
Compare →
slsa-verifier
Capabilities only
Open Source Security Foundation (OpenSSF) · Open Source · 2 capabilities in this domain
Compare →
Archivista
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 1 capabilities in this domain
Compare →
Kosli
Capabilities only
Kosli · Freemium · 1 capabilities in this domain
Compare →

In Build Integrity & Cryptographic Trust

melange

Chainguard · Build Integrity & Cryptographic Trust

Close ×

Open SourceCompany

melange is the layer beneath apko: where apko assembles packages into an image, melange produces the packages themselves. A melange build file declares the upstream source, its checksum, the build dependencies and the build steps, and the build runs in an isolated environment so the result depends only on declared inputs. It is how every Wolfi package is built from source rather than repackaged.

Repository ↗

What it does3 capabilities

0 of 3 at full coverage.

Build Provenance AttestationPartialBUILD · level 3 · 15 providers
Reproducible Build VerificationPartialBUILD · level 5 · 5 providers
SBOM GenerationPartialSBOM · level 2 · 28 providers

What it proves15 controls across 10 frameworks

Satisfied through its capabilities, not claimed by the vendor.

S2C2F3 / 25INV-1 REB-1 REB-3
CRA2 / 41Annex I Part I (2)(f) Annex I Part II (1)
SLSA 1.22 / 16Build L1 — Provenance generated and distributed Build L2 — Signed provenance
SSDF 1.12 / 42PS.2.1 PS.3.2
CIS Controls1 / 18CIS 2
CSF 2.01 / 106ID.AM-02
OWASP Top 101 / 10A08:2025
SAMM 2.01 / 90I-SB-2-B
SP 800-204D1 / 11204D-CI-EVIDENCE
Scorecard1 / 20SBOM

What it stops6 techniques · 2 risks

6 techniques countered, 1 of them common

Artifact Tampering After BuildCommon
Build System ImplantRare
SLSA threat D: Build from modified source or parametersSLSA-D
SLSA threat E: Compromised build processSLSA-E
SLSA threat F: Upload of a modified artifactSLSA-F
SLSA threat G: Compromised distribution channelSLSA-G

2 risks reduced

Released artifact does not match reviewed sourceCritical
Cannot determine exposure to a compromised componentHigh

Where it runs2 phases · 1 way to deploy

Capabilities per lifecycle phase

Build3
Release1

How it is delivered

CLI tool

What it unlocks4 activities · reaches level 5

Program activities its capabilities support, reaching level 5. Supporting an activity is not completing it.

Level 1

Generate SBOMs for critical releasesLow effort

Level 2

SBOM for every build in SPDX and CycloneDXLow effort

Level 3

Signed SLSA provenance for every artifactLow effort

Level 5

HermeticHigh effort

How it holds up4 proof points · how it works

Proof points

Hermetic builds with explicitly declared dependencies
Source checksums pinned in the build definition
Signed packages with SBOMs as output
The build system behind every Wolfi package

How it works

A melange YAML file pins the upstream source and its checksum, declares build-time dependencies explicitly, and lists the build pipeline steps. The build executes in an isolated environment with no ambient network or toolchain, so undeclared inputs cannot leak in. Output is a signed APK package with an SBOM, ready for apko to assemble or for a Wolfi repository to publish.

What it costsOpen source (free) · free tier

LicensingOpen source (free)

Priced pernone

BillingFree

Scales withOperating effort only

Total cost

No license cost, but self-support, upgrades, scaling and integration effort must be budgeted as personnel cost.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with

No supported language, standard, integration or named feature recorded.

What else to look at1 alternative · 9 siblings

Open-source alternatives

apkoOpen Source

Same family

Chainguard ActionsCommercial
Chainguard ContainersFreemium · 4.04
Chainguard FactoryCommercial
Chainguard LibrariesCommercial
Chainguard OS PackagesCommercial
Chainguard VMsCommercial
The GuardenerCommercial
WolfiOpen Source
apkoOpen Source

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13