Public instance

A public instance of Rekor can be found at rekor.sigstore.dev. The public instance offers an SLO of 99.9% availability and is monitored by an oncall team.

Auditing the Public Instance

Rekor is built on top of a verifiable data structure. Auditors can monitor the log for consistency, meaning that the log remains append-only and entries are never mutated or removed. Verifiers can also monitor the log for their identities. Learn more about transparency logs here, and about binary transparency here.

There are few options for auditing and monitoring the Rekor log. We've built a monitor that runs on GitHub Actions, Rekor monitor. Follow the instructions to set up a new repository and use the provided reusable workflow to audit the log. You can also monitor the log for specified identities, though this feature is a work in progress and supports a limited set of identities and entry types.

You can also run omniwitness to audit the log, built by the team who created Trillian, which provides Rekor's verifiable log.