rekor-cli

Rekor-cli is a command line tool used for interacting with the Rekor project. It provides a simple way to perform various operations related to software supply chain security. Rekor is an open-source project developed by the CNCF (Cloud Native Computing Foundation) to verify the provenance of software components and detect any tampering in the supply chain. With rekor-cli, you can submit software artifacts to Rekor's transparency log, which provides an immutable record of all submissions. It supports multiple types of evidence, including SPDX files, in-toto attestations, and SLSA metadata. Using rekor-cli, you can also query the transparency log to verify the integrity of software components by providing their cryptographic hashes. Rekor-cli offers functionality to verify signatures on attestations and export the transparency log in various formats, such as JSON and CSV. It allows you to search for specific submissions or retrieve the latest information about an artifact. Rekor-cli is a powerful tool that helps developers ensure the security and trustworthiness of the software components they use.