Query transparency log

This is a short handbook on querying rekor (transparency log).

Set image

We can follow the steps from this section to set the image. Let's ensure the IMAGE variable is set.

echo $IMAGE

Rekor-cli with tlog index

In this guide, we discussed keyless signing. After signing the artifact by logging into one of the OIDC providers, we can see a tlog entry in the output.

COSIGN_EXPERIMENTAL=1 cosign sign $IMAGE
...
tlog entry created with index: 7403797
...

We can use that tlog index to query the rekor instance and verify signature of the artifact uploaded to rekor.

rekor-cli get --log-index 7403797

Rekor-cli with email

We can list all the objects signed by a specific person/entity.

rekor-cli search --email [email protected]

We can use the above UUIDs to gather more information on the signatures/artifacts uploaded to the transparency log.

Rekor-cli with shasum of hashed rekor object

In the output, you will find the sha256sum of the hashed rekor object. We can even use that sha value to query the transparency log.

rekor-cli get --log-index 7403797 --format json | jq -r '.Body.HashedRekordObj.data.hash.value'

Once we have the sha value from above, we can search the transparency log for instances of it.

shasumrekor=$(rekor-cli get --log-index 7403797 --format json | jq -r '.Body.HashedRekordObj.data.hash.value')
rekor-cli search --sha $shasumrekor

Curl request

This is covered in detail in the upload artifacts to public rekor section.

Rekor-cli with UUID

This is covered in detail as part of the upload artifacts to public rekor section.

Rekor-cli with artifact

This is covered in detail as part of the upload artifacts to public rekor section.