Skip to content

Sigstore Rekor

Rekor is a transparency log used in the Sigstore software-signing ecosystem. It records signed software supply-chain events in a publicly inspectable log; the surrounding Sigstore workflow commonly connects those events to issuer or workload identity.

What it does well

  • It is purpose-built for software artifacts, provenance, and supply-chain inspection.
  • It provides an append-only log and inclusion-oriented evidence for consumers of signing events.
  • Identity-aware workflows help verifiers ask who or what performed a signing operation, rather than only when a hash was observed.

Trust, privacy, and operational model

The relevant identity, issuer, log operator, and verification configuration are part of the trust model. Rekor log witnessing or checkpoint co-signing concerns log consistency; it is distinct from a quorum signature on every individual Witness attestation.

Entries can expose artifact metadata, identities, and workflow identifiers even when artifact bytes are not uploaded. Operators or adopters must choose the appropriate hosted or self-managed services and protect the surrounding signing credentials and policy.

Difference from Witness

Witness accepts a SHA-256 hash without an account or wallet and obtains a configured witness threshold over the attestation. Rekor's center of gravity is software transparency and identity-backed signing evidence. Witness does not provide Rekor's software ecosystem, and Rekor is not a drop-in replacement for Witness's accountless per-attestation quorum model.

When to use it instead

Use Rekor when the primary requirement is software-supply-chain transparency, artifact provenance, and integration with identity-backed signing workflows.