Sign your code.
Signed and verifiable.

ECDSA-P256 signatures with a quantum-seeded nonce, for every commit, artifact, and container image. One CLI command. Every CI/CD pipeline. Sigstore-compatible bundle format. Built for the post-SolarWinds era.

Start Free See the CLI

# Install
pip install quantum-sign-sdk

# Sign your release
$ qsign sign file ./dist/app.tar.gz --key-id KEY_ID
Signed! Signature ID: sig_q7x2m9...

# Anyone can verify
$ qsign verify file ./dist/app.tar.gz --signature-id sig_q7x2m9
VERIFIED -- ECDSA-P256 -- signed 2026-04-01T14:32:01Z

Quickstart

Sign a release in three curl calls against the REST API at https://sign-api.qntyx.io. Authenticate with Authorization: Bearer $QNTYX_KEY.

# 1. Create an API key in your dashboard → API Keys
export QNTYX_KEY="qntyx_sign_…"

# 2. Generate a signing key
curl -X POST https://sign-api.qntyx.io/keys/generate \
  -H "Authorization: Bearer $QNTYX_KEY" -H "Content-Type: application/json" \
  -d '{"name": "release-key"}'

# 3. Sign a release artifact
curl -X POST https://sign-api.qntyx.io/sign/file \
  -H "Authorization: Bearer $QNTYX_KEY" -F "file=@./app-v1.0.tar.gz"

The supply chain is broken

2020

SolarWinds Orion

18,000 organizations received compromised updates. Build artifacts were unsigned or signing was bypassed. Nation-state actors injected malicious code into trusted software.

2024

XZ Utils (CVE-2024-3094)

A backdoor was inserted into a critical compression library over two years of social engineering. The maintainer's GPG key provided zero supply-chain integrity.

Now

Quantum Threat

Harvest-now-decrypt-later attacks are already underway. Classical signatures will be broken by cryptographically relevant quantum computers within this decade.

How it works

Generate Key

ECDSA-P256 key pair with a quantum-seeded (simulated) nonce. Non-deterministic — a unique signature every time.

Sign Artifact

SHA-256 hash + quantum nonce + timestamp. Unique signature every time, even for identical inputs.

Verify Anywhere

Public endpoint. No account needed. Cryptographic proof, not trust.

Drop into any CI/CD pipeline

GitHub Actions

- uses: quantum-code-sign/sign@v1
  with:
    api_key: ${{ secrets.QCS_KEY }}
    key_id: ${{ secrets.KEY_ID }}
    artifact_path: ./dist/app.tar.gz
    sign_commit: true

GitLab CI

include:
  - remote: 'qcs/template'

variables:
  QCS_ARTIFACT_PATH: ./dist/app.tar.gz
  QCS_SIGN_COMMIT: "true"

CircleCI

orbs:
  qcs: quantum-code-sign/sign@0.1

workflows:
  sign:
    jobs:
      - qcs/sign:
          artifact_path: ./dist/app.tar.gz

Sigstore-Compatible Bundle Format

Every signature generates a Sigstore-compatible bundle.

Pricing

Starter

$29 /mo

1 signing key
100 signatures / month
ECDSA-P256 + quantum nonce
Public verification
Community support

Get Started

Professional

$99 /mo

5 signing keys
10,000 signatures / month
ECDSA-P256 signing
Sigstore-compatible bundles
CI/CD integrations
SBOM signing
Email support

Start Free Trial

Enterprise

$299 /mo

Unlimited keys & signatures
ECDSA-P256 signing
Sigstore-compatible bundles
All CI/CD integrations
SBOM signature bundles
SSO / SAML
Dedicated support & SLA

Contact Sales

Sign your code.Signed and verifiable.