rekor | Sigstore Community Blog

rekor

Rekor v2 GA - Cheaper to run, simpler to maintain

Oct 10, 2025 · Hayden Blauzvern, Google

We are very excited to announce the General Availability of Rekor v2! Rekor v2 is a redesigned and modernized Rekor, Sigstore’s signature transparency log, transitioning its backend to a tile-backed transparency log implementation to simplify maintenance and lower operational costs. Learn more about Rekor v2 in our previous blog post announcing Alpha. We have added support for Rekor v2 upload and verification to Cosign v2.6.0, along with the Go, Python, and Java clients.

Announcing the Sigstore Transparency Log Research Dataset

Aug 15, 2025 · Hayden Blauzvern & Eve Martin-Jones, Google Open Source Security Team

We’re pleased to announce the creation of a new BigQuery public dataset, rekor. The rekor dataset is an easily-queryable mirror of the public good instance of Sigstore’s transparency log, Rekor. As a reminder, signing events are recorded in Rekor, Sigstore’s append-only transparency log. Software consumers rely on cryptographic proofs of log inclusion to verify that software artifacts are recorded to the log. Software producers can verify metadata in the log, verifying that the recorded signature metadata was produced as expected when their identities or keys were used to sign artifacts, using a Rekor monitor.

sigstore rekor transparency-log

Rekor v2 - Cheaper to run, simpler to maintain

Apr 17, 2025 · Hayden Blauzvern, Google

We are very excited to announce the alpha release of Rekor v2! Rekor v2 is a redesigned and modernized Rekor, Sigstore’s signature transparency log, transitioning its backend to a modern, tile-backed transparency log implementation to simplify maintenance and lower operational costs. Major changes include: A new storage backend, replacing Trillian with Trillian-Tessera. Tile-based logs are cheaper to run and easier to deploy, maintain and scale. To learn more about the benefits of tile-based logs, read this blog post A redesigned and simplified API, using the learnings from operating public-good Rekor over the past 2 years Stronger security guarantees that the log remains append-only by integrating witnessing directly into Rekor (To be implemented) For the initial release, we are providing a binary and container for developers.

sigstore rekor transparency

Using rekor-monitor to Scan Your Transparency Logs

Nov 21, 2024 · Linus Sun (Google)

Overview As part of the tool suite within Sigstore that focuses on providing transparency in the software supply chain, Rekor, Sigstore’s signature transparency log, and Fulcio’s certificate transparency log provides discoverability and auditability for signed artifact metadata and code-signing certificates. These immutable read-only logs help secure the software supply chain by making it easier to show what actions have been performed by a compromised identity. A variety of different improvements have recently been integrated into rekor-monitor to make it easier to use.

sigstore rekor-monitor security rekor

Trusted Time in Sigstore

Aug 2, 2023 · Hayden Blauzvern (Google), Meredith Lancaster (GitHub), Héctor Fernández (Chainguard)

Time in Sigstore Time is a critical component of Sigstore. It’s used to verify that a short-lived certificate issued by Fulcio was valid at a previous point, when the artifact was signed. As a reminder, the default signing flow for Sigstore clients includes the following: Signer requests an identity token from an OpenID Connect provider Signer generates an ephemeral keypair Signer sends the public key and identity token to Fulcio, Sigstore’s certificate authority Fulcio issues a short-lived (10 minute expiration) code-signing certificate Signer signs the artifact, and uploads the artifact, the certificate, and signature to Rekor, Sigstore’s transparency log During artifact verification, a client must verify the certificate.

sigstore timestamping rekor

New Sigstore Landscape: Add your signed project

Nov 30, 2022 · sigstore

A Sigstore section was added to the Open Source Security Foundation (OpenSSF)’s Landscape. The aim of the Sigstore Landscape is to show the collection of technologies that make up the project’s growing ecosystem. This gives everyone a great overview of how everything fits together. Landscape Sections The Sigstore Landscape currently has seven different sections. Architecture/Spec Sigstore is a new standard for signing, verifying and protecting software. It can be used to make sure your software is what it claims to be.

sigstore rekor cosign openssf softwaresupplychain

Sigstore November Roundup

Nov 10, 2022 · sigstore

Sigstore GA Sigstore is excited to announce General Availability (GA) for the Rekor transparency log and Fulcio certificate authority public benefit services! The community has been working hard all year to accomplish this milestone, and we are thrilled that open source communities can now confidently rely on Sigstore for production-grade stable services for artifact signing and verification. Read the Full Post by the Technical Steering Committee SigstoreCon Recap SigstoreCon on October 25 in Detroit was Sigstore’s first-ever event and we’re so happy to say that it was a success!

sigstore python sigstorecon ga rekor

Sigstore Announces General Availability for Rekor and Fulcio

Oct 25, 2022 · Priya Wadhwa

Sigstore is excited to announce general availability (GA) for the Rekor transparency log and Fulcio certificate authority public benefit services! The community has been working hard all year to accomplish this milestone, and we are thrilled that open source communities can now confidently rely on Sigstore for production grade stable services for artifact signing and verification. While the Sigstore community has maintained a public instance since early 2021, the services were operated on a best-effort basis and maintainers periodically had to make breaking changes or reset data.

sigstore python sigstorecon ga rekor