3 ms·

I only started digging into this space last week, but I think cosign, rekor, and fulcio are not related projects but rather critical components of sigstore. Cos

I only started digging into this space last week, but I think cosign, rekor, and fulcio are not related projects but rather critical components of sigstore. Cosign is the cli for signing and verifying artifacts, Rekor is the transparency log, and Fulcio is the certificate authority.

klabb3 4y ago
As an outsider it's not super appealing to look into a project and immediately be overwhelmed with 3 other projects I've never heard of. Maybe I'm just not the target demographic, or maybe the project is fragmented?
armchairhacker 4y ago
but why not just call it sigstore-cli, sigstore-log, and sigstore-ca?