Rekor

Rekor operates as a Write-Once-Read-Many (WORM) data store. Once an entry is recorded in the log, it cannot be modified, deleted, or reordered without detection. This is enforced through a cryptographically verifiable Merkle Tree structure, where each new entry strengthens the integrity of all previous entries by incorporating their hashes into a new root hash. Any attempt to retroactively alter a historical record would invalidate the entire tree structure, making tampering mathematically evident to any auditor.

Rekor enables offline and online verification of the inclusion and consistency of entries without requiring trust in the log operator. It achieves this through:

• Inclusion Proofs: Verifies that a specific entry exists within the log.
• Consistency Proofs: Verifies that a newer version of the log is a valid extension of an older version, preventing a malicious operator from forking the history. These proofs are lightweight and can be generated and verified by any client, ensuring that the monitoring of software supply chain integrity is not centralized.

Every entry in Rekor is assigned a verified timestamp, providing a critical property of non-repudiation. This proves that a software artifact existed and was signed before a specific moment, which is essential for:

• Vulnerability Response: Determining if a build occurred before or after a vulnerability was disclosed.
• Compliance Audits: Demonstrating to regulators that a specific artifact was the one approved for deployment at a given time. The timestamp is integrated into the log's Merkle Tree, making it immutable and globally verifiable.

The primary function of Rekor is to act as a public, community-operated audit log. By making the act of signing transparent, it enables a 'trust but verify' model for the entire open-source ecosystem. A user running a container image can check Rekor to confirm:

• The signature was valid at the time of signing.
• The signing identity matches the expected publisher.
• The artifact has not been signed by an unexpected or malicious actor. This global visibility deters malicious signing and enables rapid detection of compromised identities.

An append-only, cryptographically verifiable ledger that records digital signatures and certificates. Rekor is the reference implementation. The log uses a Merkle tree structure where each entry is hashed and combined with previous entries, making retroactive tampering computationally infeasible. Key properties:

• Append-only: Entries cannot be deleted or modified
• Publicly auditable: Anyone can verify inclusion proofs
• Gossip protocol: Logs can cross-validate each other

A cryptographically signed statement asserting a verifiable fact about a software artifact. In the context of model registries, attestations can certify:

• The training dataset provenance and preprocessing steps
• Results of bias and fairness evaluations
• Vulnerability scan outcomes on model dependencies
• Compliance with specific regulatory frameworks Rekor stores these attestations immutably, creating a permanent audit trail for every model version.

A paradigm that binds a signature to a workload identity rather than a long-lived private key. Using OIDC tokens and Fulcio-issued ephemeral certificates, keyless signing eliminates the operational burden of key rotation and storage. Rekor records every ephemeral certificate, ensuring that even short-lived credentials leave a permanent, auditable record. This is critical for automated CI/CD pipelines signing model artifacts.