macOS
Homebrewverifiziert · 100%
brew install rekor-clilocal Homebrew formula metadata
brew / Rang 5712
rekor-cli mit Homebrew installieren
Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für rekor-cli in AI-Agent-Workflows.
Installation
Weitere Installationsbefehle
Überblick
Paketzusammenfassung
CLI for interacting with Rekor
Projektlinks
Befehle und Aliase
- rekor-cli
Verlauf
Projektgeschichte und Nutzung
Rekor CLI is the command-line client for Rekor, Sigstore's transparency log for signed software-supply-chain metadata.
Projektgeschichte
Rekor was developed within Sigstore to provide an immutable, tamper-resistant ledger for signed software-supply-chain metadata. It combines a REST API server and transparency log with rekor-cli for submitting and verifying entries.
Rekor reached the stable 1.0 line after several years of pre-1.0 development. Rekor v1 later entered maintenance mode while Sigstore developed a tile-backed Rekor v2 architecture intended to reduce operational complexity and cost.
Adoptionsgeschichte
Rekor became Sigstore's signature-transparency component and provides a public production instance with operational availability commitments. The CLI is distributed as release binaries, container packages, and a Homebrew formula.
Its role in Sigstore placed transparency-log verification in mainstream software-supply-chain workflows, alongside Fulcio certificates and Cosign signing and verification.
Wie es verwendet wird
Maintainers use rekor-cli upload to submit signed artifact metadata. Verifiers use verify to check inclusion, get to retrieve entries, loginfo to validate signed tree information, and search to locate records by artifact, public key, or digest.
The CLI can cache the log's public key in ~/.rekor/rekor.yaml. Artifact signing keys are supplied explicitly to relevant commands and are not stored by Rekor as client credentials.
Warum Paket-Nerds sich dafür interessieren
rekor-cli gives maintainers and verifiers direct access to an append-only software-supply-chain ledger. It exposes upload, verification, retrieval, search, and log-integrity operations that help make artifact-signing events independently auditable.
Zeitleiste
- 2022: Rekor 1.0 established a stable API line and production-ready public service
- v1 era: Rekor served as Sigstore's signature-transparency component
- 2026: Rekor v1 was in maintenance mode while tile-backed Rekor v2 development progressed
Related projects
- Sigstore
- Cosign
- Fulcio
- Certificate Transparency
- Trillian
- Rekor v2 / rekor-tiles
Quellen
Sicherheitslage
Risikostufe: grün
narrow executable package without higher-risk signals.
Risikoklassifikator
grün Risiko · niedrig Konfidenz · appliance
Warum
- narrow executable package without higher-risk signals
Signale
- metadata:no-higher-risk-signals
Installationsverhalten
- In den Formelmetadaten ist kein Homebrew-Post-install-Hook erfasst.
- Homebrew-Bottle-Metadaten sind für 6 Plattformziele verfügbar.
- Build-Metadaten listen 1 Build-Abhängigkeiten.
Empfohlene Prüfung
Prüfe vor unbeaufsichtigter Agent-Nutzung, ob das Tool Klartext-Credentials liest, Remote-Zustand schreibt, Artefakte veröffentlicht oder Plugins ausführt.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Configuration files
Config paths the tool may read or write during local use.
- Unix
~/.rekor/rekor.yaml
Executables
Installierte Executables
| Befehl | Art | Sichtbarkeit | Hinweis |
|---|---|---|---|
rekor-cli | cli | globales Executable |
Aktualität
Version und Aktualität
Diese Signale trennen das Alter der Seitengenerierung, Aktivität des Paketmanagers und Upstream-Release-Vergleich. Versionsrückstand wird nur gemeldet, wenn eine Evidenz-URL und vergleichbare Versionen vorhanden sind.
Seite generiert2026-09-19
Manager-Version1.5.4
Manager aktualisiert2026-09-13
lokale DatenOK
Upstreamaktuell
neueste erkannte Versionv1.5.4
https://github.com/sigstore/rekor
- OKEs wurden keine Aktualitätswarnungen generiert.
Installationsmetadaten
Paketmetadaten
| Paketschlüssel | brew:rekor-cli |
|---|---|
| Version | 1.5.4 |
| Paketmanager | Homebrew |
| Paketmanager-Seite | https://formulae.brew.sh/formula/rekor-cli |
| Homepage | https://docs.sigstore.dev/logging/overview/ |
| Repository | https://github.com/sigstore/rekor |
| Upstream-Dokumentation | https://docs.sigstore.dev/logging/overview/ |
| Lizenz | Apache-2.0 |
| Quellarchiv | https://github.com/sigstore/rekor/archive/refs/tags/v1.5.4.tar.gz |
| Zuletzt aktualisiert | 2026-09-13T07:32:17Z |
| Pulse | updated |
| Build-Abhängigkeiten | go |
| Bottle | verfügbar (auf arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| Homebrew post-install | nicht definiert |
| Dienst | keiner deklariert |
Registry-Fakten
Details aus der Quelldatenbank
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | rekor-cli |
| Version Scheme | 0 |
| Revision | 0 |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
Quellspur
Aus Repository-Daten generiert
Diese Seite wird von av-web aus dem privaten Paket-SQLite-Artefakt bereitgestellt, das scripts/generate-pkg-sqlite.py erstellt.
Combined YAML source
View the package source record on GitHub.
Verwendete Quellen
- Geiger risk classifier
- cross-ecosystem install command graph
- curated configuration and credential file locations
- curated package history
- package relationship graph
- package version freshness
- package-page enrichment
- pkg.so package database
- pkgdb category and tag curation