specification: FinOps Framework
specificationVersion: '1.0'
schema: https://www.finops.org/framework/
provider: Sigstore
providerId: sigstore
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Code Signing
  - Security
  - Open Source
  - Public Good
  - FinOps
  - FOCUS
description: FOCUS-aligned FinOps for Sigstore. The public-good service is free and emits no invoice;
  the only FinOps-relevant cost surface is the infrastructure spend incurred when an organization
  self-hosts Fulcio/Rekor or contracts a vendor to operate a dedicated Sigstore instance.
sources:
  - https://docs.sigstore.dev/
  - https://www.sigstore.dev/
alignedWith:
  framework: FinOps Foundation Framework
  frameworkUrl: https://www.finops.org/framework/
  dataSpec: FOCUS
  dataSpecVersion: '1.3'
  dataSpecUrl: https://focus.finops.org/focus-specification/v1-3/
publisherName: Linux Foundation / Open Source Security Foundation (OpenSSF)
serviceCategory: Software Supply Chain Security
billingModel:
  pricingCategory: Free Public Good (self-hosting infra cost only)
  billingFrequency: N/A
  billingCurrency: USD
  chargeCategories: []
focusColumns:
  ServiceName: Sigstore
  ServiceCategory: Software Supply Chain Security
  ProviderName: Sigstore
  PublisherName: Linux Foundation / OpenSSF
  InvoiceIssuerName: Linux Foundation / OpenSSF
  BillingCurrency: USD
meters:
  - name: signing_events
    description: Sigstore signing operations performed; not billed by Sigstore but useful as a sizing
      meter for self-hosted Fulcio capacity planning.
    unit: signing-event
    aggregation: sum
    dimensions:
      - identity_provider
      - workflow
  - name: rekor_log_entries
    description: Transparency log entries written to Rekor; relevant for self-hosted storage sizing.
    unit: entry
    aggregation: sum
    dimensions:
      - log
principles:
  - name: Visibility
    description: For consumers of the public-good service there is no spend to track. For self-hosters,
      visibility comes from the underlying cloud/Kubernetes telemetry of the Fulcio and Rekor deployments.
  - name: Allocation
    description: Self-hosted Sigstore cost is allocated to the platform/security team that operates
      it, with chargeback to consuming teams optional and typically not enforced.
  - name: Optimization
    description: Use the public-good service for low-volume signing where appropriate. For high-volume
      workloads, run a private Fulcio/Rekor and right-size Rekor storage retention rather than over-provisioning
      the public good.
  - name: Accountability
    description: Platform security or supply-chain owners are accountable for self-hosted Sigstore
      infrastructure; consuming teams are accountable for ensuring their CI signs artifacts correctly.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com