sigstore/rekor

Health v2 · maintenance only

Adoption not part of the score

1203 stars · 222 forks observed · 2026-09-01

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Rekor is Sigstore's software supply chain transparency log, providing an immutable tamper-resistant ledger for signed build and provenance metadata. It ships a REST API server for validation and storage, plus a CLI for making, verifying, and querying log entries.

Use cases

• record signed provenance metadata for my builds
• verify an artifact has a transparency log inclusion proof
• query the log by public key or artifact digest
• self-host a transparency log for my organization's supply chain
• check whether a container image signature was logged
• achieve non-repudiation for software release artifacts

When to choose

• you need tamper-evident, publicly auditable records of software signing events
• you are adopting Sigstore (cosign) and need the signature transparency component
• you want to verify artifact provenance before trusting a dependency

When to avoid

• you only need private key management or signing without public transparency
• you need a general-purpose database rather than an append-only transparency log
• you want the newer tile-based architecture - consider rekor-tiles (Rekor v2) instead

Facets

service · maturity maintenance

security cryptography search-engine api-framework cli security developer-tools apis windows go self-hosted cloud supply-chain-security transparency-log sigstore provenance software-artifacts merkle-tree trillian devops linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="sigstore/rekor")