rekor-cli

Upload entry

$ rekor-cli upload --artifact [file] --signature [file.sig] --public-key [key.pub]

$ rekor-cli search --artifact [file]

$ rekor-cli search --email [user@example.com]

$ rekor-cli get --uuid [entry-uuid]

$ rekor-cli get --log-index [12345]

$ rekor-cli verify --artifact [file] --signature [file.sig]

$ rekor-cli loginfo

rekor-cli command [--artifact file] [--signature file] [options]

rekor-cli interacts with Rekor transparency log. Rekor provides tamper-resistant audit trails.
Upload adds signed artifacts to the log. Entries are immutable once recorded.
Search finds entries by artifact, email, or hash. Proves when signatures were created.
Verification checks artifacts against the log. Confirms signature validity and timing.
Log info shows tree size and root hash. Enables verification of log integrity.

upload

Add entry to log.

Search entries.

Retrieve entry.

Verify artifact.

Log information.

Artifact file.

Signature file.

Public key file.

Entry UUID.

Rekor server URL.

Requires network access to Rekor server. Entries are public. Key management separate.

Rekor is part of the Sigstore project, initiated by Google, Red Hat, and others. It provides transparency logging for software supply chain security.

cosign(1), fulcio(1), sigstore(1)