Rekor

Rekor is a transparency log. It's an immutable ledger & is the source of truth for all the signing information.

There are multiple ways to set up this transparency ledger.

• Upload artifacts to public rekor
• Upload artifacts to private rekor
• Query transparency log
• Compare the signatures uploaded to registry and transparency log