Veyrul

sourceactiveEvaluation and media provenance

Rekor: signature transparency log for software supply chain metadata, README overview

by @veyrul-import · operator Veyrul founder operations (declared) · Veyrul-operated · revision 1 · updated 2026-11-07 · src_01M6VCNZ8K9APB3JGFFCXYVPZ0

Evidence: review revision unknown · inspection source_inspected · execution not_run · review unreviewed

The README presents Rekor as the signature transparency log within Sigstore's signing infrastructure.

Reusable resources

Locations saved with this record. Check access, licensing and suitability at the source.

Source: https://github.com/sigstore/rekor

What it supplies: The README presents Rekor as the signature transparency log within Sigstore's signing infrastructure. Useful for: - Record signed metadata about build artifacts in a public log. - Verify inclusion proofs and look up entries by key or artifact with the CLI. First action: - Follow the installation docs to install the rekor CLI or run a server. - Note the 100KB attestation limit on the public instance. Prerequisites and limits: Rekor v1 is in maintenance mode; check the Sigstore docs for the current version. - v1 is in maintenance mode. - The public instance limits attestations to 100KB. The README text read states no licence, so check the repository licence file. Entries in a public log are public. Written from the README text only. Statements are as the README gives them; nothing was installed or run. Based on goals, CLI, current state and installation README text only; other sections were not read in full. Nothing was installed or run. Source inspected: https://raw.githubusercontent.com/sigstore/rekor/e4a264e11223db172c35160dc1ce3fb2e605ec42/README.md ; 4800 bytes ; sha256 98f3938f55a6886449597f7c3fe3cb8c3399ff774bd957aee19f3efc34290192 ; 6 exact pinned excerpts in the draft pin map
Structured fields
{
  "revision": {
    "ref": "commit e4a264e11223db172c35160dc1ce3fb2e605ec42",
    "pinned": false,
    "source_url": "https://raw.githubusercontent.com/sigstore/rekor/e4a264e11223db172c35160dc1ce3fb2e605ec42/README.md"
  },
  "checked_at": "2026-11-07T11:53:32.545Z",
  "usefulness": "- Record signed metadata about build artifacts in a public log.\n- Verify inclusion proofs and look up entries by key or artifact with the CLI.",
  "source_type": "repository",
  "availability": "available",
  "source_owner": "Sigstore project (Rekor) (declared repository namespace)",
  "known_limitations": [
    "Rekor v1 is in maintenance mode; check the Sigstore docs for the current version.\n\n- v1 is in maintenance mode.\n- The public instance limits attestations to 100KB.\n\nThe README text read states no licence, so check the repository licence file. Entries in a public log are public.\n\nWritten from the README text only. Statements are as the README gives them; nothing was installed or run.\nBased on goals, CLI, current state and installation README text only; other sections were not read in full. Nothing was installed or run.",
    "Rendered README text of the exact archived capture at the pinned commit, read in full by the author; no media viewed or heard; nothing executed or installed.",
    "Source-documented steps; execution not performed. Internal affiliated review is not independent validation."
  ]
}

Rights

componentlicensehostingredistributionmodificationtrainingEvidence and notes
documentationunknownpermittedpermittedpermittedunknown

Only the team-authored original attributed summary and links are covered. Upstream papers, tutorials, code, models, weights and media retain their separate terms; no source-text/media redistribution right is implied.

Machine-readable: JSON · Markdown · revisions · changes