https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/tags/rekor/Recent content in Rekor onHugo -- gohugo.ioen-USSat, 20 Aug 2022 08:49:31 +0000https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/open-source/sigstore/rekor/an-introduction-to-rekor/Sat, 20 Aug 2022 08:49:31 +0000https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/open-source/sigstore/rekor/an-introduction-to-rekor/An earlier version of this material was published in the Rekor chapter of the Linux Foundation Sigstore course. Rekor stores records of artifact metadata, providing transparency for signatures and therefore helping the open source software community monitor and detect any tampering of the software supply chain. On a technical level, it is an append-only (sometimes called “immutable”) data log that stores signed metadata about a software artifact, allowing software consumers to verify that a software artifact is what it claims to be.https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/open-source/sigstore/rekor/how-to-install-rekor/Sat, 20 Aug 2022 08:49:31 +0000https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/open-source/sigstore/rekor/how-to-install-rekor/An earlier version of this material was published in the Rekor chapter of the Linux Foundation Sigstore course. Follow this tutorial for an overview of how to install rekor-cli. To install the Rekor command line interface (rekor-cli) with Go, you will need Go version 1.16 or greater. For Go installation instructions, see the official Go documentation. If you have Go installed already, you can check your Go version via this command.https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/open-source/sigstore/rekor/how-to-query-rekor/Sat, 20 Aug 2022 08:49:31 +0000https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/open-source/sigstore/rekor/how-to-query-rekor/An earlier version of this material was published in the Rekor chapter of the Linux Foundation Sigstore course. Rekor is the transparency log of Sigstore, which stores records of artifact metadata. Before querying Rekor, you should have the rekor-cli installed, which you can achieve by following the “How to Install the Rekor CLI” tutorial. In order to access the data stored in Rekor, the rekor-cli requires either the log index of an entry or the UUID of a software artifact.https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/open-source/sigstore/rekor/how-to-sign-and-upload-metadata-to-rekor/Sat, 20 Aug 2022 08:49:31 +0000https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/open-source/sigstore/rekor/how-to-sign-and-upload-metadata-to-rekor/An earlier version of this material was published in the Rekor chapter of the Linux Foundation Sigstore course. This tutorial will walk you through signing and uploading metadata to the Rekor transparency log, which is a project of Sigstore. In order to follow along, you’ll need the rekor-cli installed, which you can accomplish by following the “How to Install the Rekor CLI” tutorial. We will use SSH to sign a text document.https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/open-source/sigstore/rekor/install-a-rekor-instance/Sat, 20 Aug 2022 08:49:31 +0000https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/open-source/sigstore/rekor/install-a-rekor-instance/An earlier version of this material was published in the Rekor chapter of the Linux Foundation Sigstore course. While individual developers may not generally need to set up their own instance of Rekor, it may be worthwhile to set up your own local instance in order to further understand how Rekor works under the hood. We will have multiple terminal sessions running to set up the Rekor server. You may want to use a tool such as tmux to keep terminal sessions running in the background within the same window.