Rekor is a transparency log that provides an immutable, tamper-resistant ledger for recording and verifying metadata generated throughout a software project's supply chain.
Rekor addresses the need for verifiable, non-repudiable records of software artifacts and their provenance. It works by accepting signed metadata submissions through a REST API, storing them in an immutable transparency log, and allowing any party to query the log to verify inclusion proofs and check the integrity of recorded entries. This enables software maintainers and build systems to create auditable records of their supply chain activities, while consumers can verify the authenticity and lifecycle of artifacts they depend on.
Rekor is suitable for organizations that need to demonstrate supply chain transparency and integrity, particularly those building or distributing software at scale. It works well as a standalone service but is designed as part of sigstore's broader software signing infrastructure. The project supports extensibility for different manifest schemas and PKI tooling, making it adaptable to various workflows. A public instance is available with a 99.5% availability SLO and 24/7 operational support, though it enforces a 100KB attestation size limit; organizations with larger requirements can run their own instance.
The project is in a transitional phase, with the current v1 maintained in stable mode while active development focuses on a new architecture. The upcoming v2 redesign uses tile-based logs and a modernized version of Trillian to improve operational efficiency and reduce maintenance burden. The codebase is written in Go and documented through official sigstore documentation, with the v1 API following semantic versioning to ensure stability for production workloads.
