rekor

PDF signing utility supporting GPG and Sigstore (Google, GitHub, Microsoft accounts / keyless OIDC) signatures, multi-party signing, making it easy to sign and verify documents without heavyweight PDF signing stacks, making your PDFs authentic, tamper-proof, fully compatible with regular readers; all while costing zero-dollars to use.

🔮 ✈️ to integrate OPA Gatekeeper's new ExternalData feature with cosign to determine whether the images are valid by verifying their signatures

🔍 Rekor transparency log monitoring and alerting

K8S Operator for Rekor

Sign your artifacts, source code or container images using Sigstore tools, Save the Signatures you want to use, and Validate & Control the deployments to allow only the known Sources based on Signatures, Maintainers & other payloads automatically.

Kubernetes Operator for deploying and managing Sigstore components like Fulcio, Rekor, TSA, and TUF.

OpenALPR-Webhook is a self-hosted web application that accepts Rekor Scout™ POST data allowing longer data retention.

A Falco Plugin for Rekor Transparency Log Server

Sigstore Homebrew Tap

Verifiable Usage Receipts for AI APIs. Cryptographic proof that your token bill is real. Ed25519 + Fulcio signing, RFC 6962 Merkle proofs, Trillian Tessera log, C2SP witness cosigning, Rekor public anchoring, Rust tokenizer verification. No blockchain.

Prevot — verifiable receipts for firmware CVE reproduction (in-toto + Sigstore/Rekor)

Java PoC code to implement sigstore operations equivalent to "cosign sign-blob"

Supply Chain Security does not need to be difficult

Verifiable audit substrate for AI agents — EU AI Act Article 12 ready. Apache 2.0.

A Rekor crawler and monitor

Sign release artifacts with Minisign, verify them, and optionally log signatures to Sigstore Rekor.

Rekor ArgoCD Deployment on OpenShift

Tamper-evident flight recorder for AI agents: hash-chained tool-call ledger, RFC 6962 Merkle checkpoints anchored in Sigstore Rekor, verify CLI, regulator-ready evidence packs.

Vulnerability scanner whose every result is a reproducible, signed claim. Pins the lockfile, the OSV feed, the version comparators, and the exclusions to four digests inside a signed in-toto predicate, so anyone can replay a scan byte for byte, or get a diff naming exactly which input moved.

Pre-dial compliance interlock for the Vonage Voice API: reads the call flow your server is about to serve, runs LTL3 monitors compiled from federal and Georgia telemarketing rules, and blocks the call before the carrier sees it. Fail-closed, hash-chained evidence log sealed to Sigstore Rekor.