[koalaman]

I only started digging into this space last week, but I think cosign, rekor, and fulcio are not related projects but rather critical components of sigstore. Cosign is the cli for signing and verifying artifacts, Rekor is the transparency log, and Fulcio is the certificate authority.

[klabb3]

As an outsider it's not super appealing to look into a project and immediately be overwhelmed with 3 other projects I've never heard of. Maybe I'm just not the target demographic, or maybe the project is fragmented?

[armchairhacker]

but why not just call it sigstore-cli, sigstore-log, and sigstore-ca?