← All use cases

GitHub Release Signing

Sign GitHub release artifacts keylessly using OIDC. No long-lived signing key to manage or compromise.

Implemented by

Confium Keyless

Sign releases without managing keys.

→ Product overview

Relevant to

Open Source Maintainer

Sign releases without managing keys.

→ Audience overview

How to evaluate

  1. 1. Read the relevant product overview

    Start with the product pages above for the architectural model.

  2. 2. Run the quickstart

    Each product page has a 5-minute quickstart that runs locally.

  3. 3. Read the spec

    Specs at /specs/PRODUCTS cover the protocol details.

  4. 4. Talk to us

    Open a Discussion on GitHub tagged `evaluation-help`.

Related use cases

CI/CD Signing

Sign build artifacts at release time using threshold keys held outside CI. Compromising CI does not compromise the signing key.

Artifact Provenance

Generate SLSA-compatible provenance attestations for build artifacts, anchored to a transparency log.

OIDC-Based Keyless Signing

Use GitHub, Google, GitLab, Azure AD, or Okta as the identity provider for short-lived signing certificates.

Supply Chain Attestation

Produce verifiable attestations linking artifacts to their source, build, and signing ceremony.