Confium Keyless

Sign releases without managing keys.

Open Source MaintainersCI/CD TeamsDevOps

Use cases

Keyless signing: no signing keys to manage. Common patterns:

Sign build artifacts at release time using threshold keys held outside CI. Compromising CI does not compromise the signing key.

Sign GitHub release artifacts keylessly using OIDC. No long-lived signing key to manage or compromise.

Generate SLSA-compatible provenance attestations for build artifacts, anchored to a transparency log.

Use GitHub, Google, GitLab, Azure AD, or Okta as the identity provider for short-lived signing certificates.

Produce verifiable attestations linking artifacts to their source, build, and signing ceremony.