ediverse

Type to search across standards, messages, tools and glossary.

ediverse Explore the platform

Spotlight PEPPOL BIS Billing 3.0 The EU e-invoicing mandate is here — France Sept 2026, Belgium Jan 2026, Germany 2025.

— 01

Foundations

— 02

Standards

— 03

Flagship messages

— 04

Tools

Sigstore Rekor

On this page

Sigstore Rekor transparency log append-only Merkle.

Definition

Rekor architecture: Backend Trillian (Google open-source verifiable Merkle tree append-only log). Frontend Rekor server (Go REST API). Log entry types: hashedrekord (general digest + signature + public key), intoto (in-toto attestations), tuf (TUF metadata), rfc3161 (RFC 3161 trusted timestamp), helm (Helm chart provenance), jar (Java JAR signatures), rpm (RPM packages), cose (CBOR Object Signing and Encryption). Each entry: UUID, integrated time, log index, body (encoded), Merkle inclusion proof (consistency + inclusion). API: POST /api/v1/log/entries (append entry), GET /api/v1/log/entries/{uuid} (retrieve entry), GET /api/v1/log/proofs (Merkle proofs). Verification: cosign verify queries Rekor for signature presence + verifies Merkle inclusion proof + verifies signature against Fulcio-issued cert + cross-checks OIDC issuer + identity. Public Good Rekor log ~50M+ entries 2024. Tools: rekor-cli CLI, sigstore-go library, integration cosign default.

Origin

Rekor initial release 2021 ; Public Good Rekor Production Linux Foundation 2021 ; backed Trillian Google open-source ; ~50M+ entries 2024 ; private instances Red Hat, Google Cloud, etc.

Example in context

After hypothetical supply chain attack incident: SOC team audits Rekor log via API GET /api/v1/log/entries with filter sha256 of compromised image, verifies chronologically signing entries, detects anomaly unauthorized signing identity not matching expected GitHub Actions identity, traces incident origin via Merkle proofs cryptographic guarantees.