Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. Rekor will enable software maintainers and build systems to record signed metadata to an immutable record. Other parties can then query said metadata to enable them to make informed decisions on trust and non-repudiation of an object's life-cycle, based on signed metadata stored within a tamper proof binary (merkle) tree.
Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. Rekor will enable software maintainers and build systems to record signed metadata to an immutable record. Other parties can then query said metadata to enable them to make informed decisions on trust and non-repudiation of an object's life-cycle. For more details visit the [rekor website](https://rekor.dev)
## Build Rekor CLI
The Rekor project provides a restful API based server for validation and a transparency log for storage. A CLI application is available to make and verify entries, query the transparency log for inclusion
proof, integrity verification of the transparency log or retrieval of entries by either public key or artifact.
From `rekor/cmd/cli`
For more details on setting up a server, [visit the following link](https://rekor.dev/get_started/server/)
`go build -o rekor`
For details on CLI usage, [visit the following link](https://rekor.dev/get_started/client/)
## Sign your release
If you're interesting in integration with rekor, we have an [OpenAPI swagger editor](https://rekor.dev/swagger/)
Before using rekor, you are required to sign your release. For now we use GPG
(we plant to extend to other signing formats in the foreseeable future)
A public instance of rekor can be found at [api.rekor.dev](https://rekor.dev/api/v1/log/)
> Note that the flags `--artifact`, `--signature`, and `--public-key` can either be a path to a file on the local filesystem or be a publically accessable URL. For example `--artifact https://example.com/releases/latest/my_project.tar.gz`
### Verify Proof of Entry
The `verify` command queries the Rekor transparency log to verify the inclusion of an entry.
rekor-server_1 | 2020-12-16T17:06:22.613Z INFO app/serve.go:55 Loading support for pluggable type 'rekord'
rekor-server_1 | 2020-12-16T17:06:22.614Z INFO app/serve.go:56 Loading version '0.0.1' for pluggable type 'rekord'
rekor-server_1 | 2020-12-16T17:06:22.624Z INFO restapi/server.go:231 Serving rekor server at http://[::]:3000
```
Rekor allows customized manifests (which term them as types), [type customization is outlined here](https://github.com/projectrekor/rekor/tree/main/pkg/types).