Rekor - Cryptographic software release ledger
summary
Rekor claims a cryptographic, immutable append-only ledger for software releases (merkle tree roots, inclusion proofs) built as an Apache‑2 server, CLI and public prototype with a REST/OpenAPI surface. It validates manifests (artifact hash, signature, public key), accepts x509, GPG and minisign, uses Trillian for scale and plans OIDC-issued, short-lived x509 via OIDC to avoid long-lived keys. Project is 4–5 months old, has Red Hat/Purdue/Google contributors, runs a live soft‑launch instance, and supports audits, monitoring and a deprecation log.
AI-written summary · about
chapters (32)
- 0:00Intro
- 1:08Software supply chain
- 3:13Red Hat
- 3:49Merkle trees
- 5:00Certificate transparency
- 9:37Software signing transparency
- 11:58Project signing transparency
- 12:32Tails
- 16:12SixStore
- 16:31Recall
- 18:29Tree
- 19:49Entities
- 20:19Signin types
- 20:44REST API
- 21:28Project contributors
- 22:25Project evolution
- 23:12Package managers
- 24:03No private keys
- 24:29Certificates
- 26:17Time Gap
- 28:04Sign Publish
- 28:26Key Transparency
- 28:52Key Discovery
- 29:15X509 Certificate
- 29:46Signature Transparency
- 30:19Trust
- 31:52Trust Policy
- 32:37Verify Package
- 32:59Depreciation Log
- 34:52Website
- 35:58Questions
- 38:29When you get hacked
related talks
23mSoftware Supply Chain Integrity with Sigstore
01h 27mSupply Chain Security Tooling
32mState of the Art Supply Chain Security
28mIdentity-based Trust - Till Death Do We Part?
31mOmniBOR: Bringing the Receipts for Supply Chain Security
33mSo You Want to Run Your Own Sigstore: Recommendations for a Secure Setup
40mRegisters: Systems of Record with Guaranteed Integrity
40mSigstore: How We Started, Where We Are, Where We are Headed