Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. Rekor will enable software maintainers and build systems to record signed metadata to an immutable record. Other parties can then query said metadata to enable them to make informed decisions on trust and non-repudiation of an object's life-cycle, based on signed metadata stored within a tamper proof binary (merkle) tree.
Rekor requires a running instance of the [rekor-server](https://github.com/projectrekor/rekor-server).
## Build Rekor CLI
From `rekor/cmd/server`
`go build -o rekor`
## Sign your release
...
...
@@ -45,7 +49,54 @@ The `verify` command sends your public key / signature and artifcate URL to the
You would typically use this command as a means to verify an 'inclusion proof'
in that your artifact is stored within the transparency log.