specification: API Commons Plans specificationVersion: '0.1' schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/Plans provider: Sigstore providerId: sigstore created: '2026-05-04' # Provenance stamped 2026-08-11: this artifact was written by the API Evangelist # bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35. method: generated modified: '2026-05-05' reconciled: true tags: - Code Signing - PKI - Security - Open Source - Public Good description: Sigstore is a free, open-source software-supply-chain signing service operated as a public-good, non-profit by the Open Source Security Foundation (OpenSSF) under the Linux Foundation. There is no paid tier, no commercial SKU, and no per-call charge for the public Sigstore instances (Fulcio, Rekor, the public-good Cosign workflow). Organizations that need private/dedicated infrastructure typically self-host or use a vendor-operated Sigstore service. sources: - https://docs.sigstore.dev/ - https://www.sigstore.dev/ plans: - id: sigstore-public-good name: Public-Good Service type: freemium description: Free public-good signing and transparency service. Anyone with a supported OIDC identity can sign artifacts via Fulcio and record entries in the Rekor transparency log at no cost. entries: - label: Service Access name: service_access type: flat metric: month limit: -1 timeFrame: month geo: global unit: 1 price: '$0 / free public good' userMultiplied: false elements: - name: Fulcio Certificate Authority - name: Rekor Transparency Log - name: Cosign CLI - name: Open Source Implementation - name: Backed by Linux Foundation / OpenSSF maintainers: - FN: Kin Lane email: kin@apievangelist.com x-canonical: generated: '2026-10-08' vocabulary: all/0-working/economics/plans-canonical.yml models: - subscription units: - period plans: - name: Public-Good Service access: freemium model: subscription model_how: derived units: - period periods: - month