Red Hat Trusted Artifact Signer

Sigstore-based (Fulcio, Rekor, cosign) service for signing and verifying container images, Git commits and other software artefacts on OpenShift

FluffyStack tools

Add to Service Builder Add to Compare Compare with equivalents Explore OpenShift in Treemap Explore security in Honeycomb See OpenShift regions on the World Map See security as a network Score jurisdiction exposure

Documentation Pricing OpenShift website

Jurisdictional exposure

Provider HQ

USRaleigh, USA

Subject to CLOUD Act, FISA-702, DPF

Sovereign option

No sovereign-flagged regions in the catalogue for this service.

Full scorecard for this service →US lens detail →Sovereign cloud coverage map →

Sub-services (4)

Fulcio

Certificate authority issuing short-lived signing certificates from OIDC identities

Rekor

Transparency log recording signing events for verification and audit

cosign and gitsign

Clients for signing container images and Git commits

Timestamp Authority

RFC 3161 timestamping of signatures

Compliance & Certifications

This service is attested for the following frameworks. Always verify with the provider before relying on a specific compliance posture.

GDPR SOC 2 ISO 27001 HIPAA PCI DSS FedRAMP

Equivalent services on other platforms

AWS SignerAWS

Managed code-signing service for IoT firmware, Lambda functions, container images, and freeRTOS OTA payloads — Signer generates and rotates signing keys, then delivers signed artefacts to the target runtime

Pricing

Pricing model:subscription