# sigstore/rekor

Software Supply Chain Transparency Log

Repository: https://github.com/sigstore/rekor
Canonical: https://ross.abutalabs.com/products/rekor
Homepage: https://sigstore.dev
Language: Go
License: Apache-2.0
License Family: permissive
Topics: supply-chain, provenance, security, transparency-log
Last push: 2026-08-31T11:36:53+00:00

## Health v2 (maintenance only)
Score: 95/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 100, release rhythm 86, longevity 100
- inputs: {"age_days": 2268, "days_push": 2, "days_rel": 13, "gap_med": 52.0, "n_releases_24m": 13}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1203, forks 222 (observed 2026-09-01T02:14:06.757030+00:00)

## What it is
Rekor is Sigstore's software supply chain transparency log, providing an immutable tamper-resistant ledger for signed build and provenance metadata. It ships a REST API server for validation and storage, plus a CLI for making, verifying, and querying log entries.

## Use cases
- record signed provenance metadata for my builds
- verify an artifact has a transparency log inclusion proof
- query the log by public key or artifact digest
- self-host a transparency log for my organization's supply chain
- check whether a container image signature was logged
- achieve non-repudiation for software release artifacts

## When to choose
- you need tamper-evident, publicly auditable records of software signing events
- you are adopting Sigstore (cosign) and need the signature transparency component
- you want to verify artifact provenance before trusting a dependency

## When to avoid
- you only need private key management or signing without public transparency
- you need a general-purpose database rather than an append-only transparency log
- you want the newer tile-based architecture - consider rekor-tiles (Rekor v2) instead

## Facets
- artifact type: service
- maturity: maintenance
- function: security, cryptography, search-engine, api-framework, cli
- domain: security, developer-tools, apis
- platform: windows, go, self-hosted, cloud
- tags: supply-chain-security, transparency-log, sigstore, provenance, software-artifacts, merkle-tree, trillian, devops, linux, macos, docker

## Member repositories
- sigstore/rekor (main) score 95

## Provenance
- Observed fields: from GitHub, fetched 2026-09-01T02:14:06.757030+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:20:51.154332+00:00, confidence not recorded.
  - readme: https://github.com/sigstore/rekor (fetched 2026-09-01T02:14:06.757030+00:00, sha 43c71bc8479c)
  - homepage: https://sigstore.dev (fetched 2026-08-29T12:28:05.264409+00:00, sha 3c7f86b8dc9c)
- Data as of 2026-08-30T08:39:29.467469+00:00.