Fulcio

Fulcio is Sigstore’s certificate authority for code signing. It issues short-lived certificates bound to an OpenID Connect (OIDC) identity, which is what lets Cosign sign software without long-lived keys.

To learn how Fulcio issues certificates and how it fits into Sigstore, read What is Fulcio? in Supply Chain Security 101. The pages in this section show you how to generate and inspect Fulcio certificates.