Rekor fulfills the signature transparency role of sigstore's software signing infrastructure. It can also be run on its own and is designed to be extensible to work with different manifest schemas and PKI tooling Usage: rekor-server [command] Available Commands: completion Generate the autocompletion script for the specified shell help Help about any command serve start http server with configured api version Prints the version Flags: --attestation_storage_bucket string url for attestation storage bucket --cleanup-timeout duration grace period for which to wait before killing idle connections (default 10s) --client-signing-algorithms strings signing algorithm to use for signing/hashing (allowed ecdsa-sha2-256-nistp256, ecdsa-sha2-384-nistp384, ecdsa-sha2-512-nistp521, ed25519, ed25519-ph, rsa-sign-pkcs1-2048-sha256, rsa-sign-pkcs1-3072-sha256, rsa-sign-pkcs1-4096-sha256) (default [ecdsa-sha2-256-nistp256,ecdsa-sha2-384-nistp384,ecdsa-sha2-512-nistp521,ed25519,ed25519-ph,rsa-sign-pkcs1-2048-sha256,rsa-sign-pkcs1-3072-sha256,rsa-sign-pkcs1-4096-sha256]) --config string config file (default is $HOME/.rekor-server.yaml) --enable_attestation_storage enables rich attestation storage --enable_pprof enable pprof for profiling on port 6060 --enabled_api_endpoints strings list of API endpoints to enable using operationId from openapi.yaml (default [searchIndex,getLogInfo,getPublicKey,getLogProof,createLogEntry,getLogEntryByIndex,getLogEntryByUUID,searchLogQuery]) --enabled_entry_types strings comma-separated list of entry type kinds to enable on the server (e.g. rekord,intoto,dsse,hashedrekord). If unset (default), all types compiled into the binary are enabled. Any kind specified here must be compiled into the binary; unknown kinds will cause startup to fail. (default [cose,rpm,helm,tuf,hashedrekord,rekord,jar,dsse,alpine,intoto,rfc3161]) --gcp_cloud_profiling.enable_oc_telemetry enable Profiler spans in Cloud Tracing & Cloud Monitoring --gcp_cloud_profiling.enabled enable GCP Cloud Profiling --gcp_cloud_profiling.project_id string GCP project ID --gcp_cloud_profiling.service string a name for the service being profiled (default "rekor-server") --gcp_cloud_profiling.service_version string the version of the service being profiled (default "v1.5.5+dirty") --graceful-timeout duration grace period for which to wait before shutting down the server (default 15s) -h, --help help for rekor-server --host string the IP to listen on (default "localhost") --http-request-id-header-name string name of HTTP Request Header to use as request correlation ID (default "X-Request-Id") --keep-alive duration sets the TCP keep-alive timeouts on accepted connections. It prunes dead TCP connections ( e.g. closing laptop mid-download) (default 3m0s) --listen-limit int limit the number of outstanding requests --log_type string logger type to use (dev/prod) (default "dev") --max-header-size byte-size controls the maximum number of bytes the server will read parsing the request header's keys and values, including the request line. It does not limit the size of the request body (default 1MB) --max_apk_metadata_size uint maximum permitted size for apk .SIGN and .PKGINFO files, in bytes; set to 0 for unlimited (default 1048576) --max_attestation_size int max size for attestation storage, in bytes (default 102400) --max_jar_metadata_size uint maximum permitted size for jar META-INF/ files, in bytes; set to 0 for unlimited (default 1048576) --max_request_body_size uint maximum size for HTTP request body, in bytes; set to 0 for unlimited --port uint16 Port to bind to (default 3000) --publish_frequency uint how often to publish a new checkpoint, in minutes (default 5) --read-timeout duration maximum duration before timing out read of the request (default 30s) --redis_server.address string Redis server address (default "127.0.0.1") --redis_server.enable-tls Whether to enable TLS verification when connecting to Redis endpoint --redis_server.insecure-skip-verify Whether to skip TLS verification when connecting to Redis endpoint, only applicable when 'redis_server.enable-tls' is set to 'true' --redis_server.password string Redis server password --redis_server.port uint16 Redis server port (default 6379) --rekor_server.address string Address to bind to (default "127.0.0.1") --rekor_server.hostname string public hostname of instance (default "localhost") --rekor_server.new_entry_publisher string URL for pub/sub queue to send messages to when new entries are added to the log. Ignored if not set. Supported providers: [gcppubsub] --rekor_server.publish_events_json Whether to publish events in CloudEvents JSON format. Applies to all enabled event types. --rekor_server.publish_events_protobuf Whether to publish events in Protobuf wire format. Applies to all enabled event types. --rekor_server.signer string Rekor signer to use. Valid options are: [awskms://keyname, azurekms://keyname, gcpkms://keyname, hashivault://keyname, memory, tink, ]. Memory and file-based signers should only be used for testing. (default "memory") --rekor_server.signer-passwd string Password to decrypt signer private key --rekor_server.signer.gcpkms.retries uint Number of retries for GCP KMS requests --rekor_server.signer.gcpkms.timeout uint sets the RPC timeout per call for GCP KMS requests in seconds, defaults to 0 (no timeout) --rekor_server.tink_kek_uri string Key encryption key for decrypting Tink keyset. Valid options are [aws-kms://keyname, gcp-kms://keyname] --rekor_server.tink_keyset_path string Path to encrypted Tink keyset, containing private key to sign log checkpoints --scheme string listener scheme for the API; 'http' or 'https'. Set 'https' to serve TLS (default "http") --search_index.mysql.conn_max_idletime duration maximum connection idle time --search_index.mysql.conn_max_lifetime duration maximum connection lifetime --search_index.mysql.dsn string DSN for index storage using MySQL --search_index.mysql.read.max_idle_connections int maximum idle connections retained in the index read pool --search_index.mysql.read.max_open_connections int maximum open connections in the index read pool; 0 for unlimited --search_index.mysql.write.max_idle_connections int maximum idle connections retained in the index write pool --search_index.mysql.write.max_open_connections int maximum open connections in the index write pool; 0 for unlimited --search_index.storage_provider string Index Storage provider to use. Valid options are: [redis, mysql]. (default "redis") --socket-path string the unix socket to listen on (default "/var/run/todo-list.sock") --tls-ca string the certificate authority file used to verify client certificates for mutual TLS on the API listener --tls-certificate string the certificate file to use for serving TLS on the API listener --tls-cipher-suites strings allowed cipher suites for the API listener (comma-separated); applies to TLS 1.2 only and has no effect on TLS 1.3, whose suites are fixed by Go. Empty keeps the Go default. Allowed values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 --tls-host string the IP to listen on (default "localhost") --tls-keep-alive duration sets the TCP keep-alive timeouts on accepted connections. It prunes dead TCP connections ( e.g. closing laptop mid-download) (default 3m0s) --tls-key string the private key file (without passphrase) to use for serving TLS on the API listener --tls-listen-limit int limit the number of outstanding requests --tls-min-version string minimum TLS version for the API listener (1.2 or 1.3) (default "1.3") --tls-port uint16 the port to serve TLS on for the API listener; defaults to a random port when unset --tls-read-timeout duration maximum duration before timing out read of the request (default 30s) --tls-write-timeout duration maximum duration before timing out write of the response (default 30s) -t, --toggle Help message for toggle --trace-string-prefix string if set, this will be used to prefix the 'trace' field when outputting structured logs --trillian_log_server.address string Trillian log server address (default "127.0.0.1") --trillian_log_server.grpc_default_service_config string JSON string used to configure gRPC clients for communicating with Trillian --trillian_log_server.port uint16 Trillian log server port (default 8090) --trillian_log_server.sharding_config string path to config file for inactive shards, in JSON or YAML --trillian_log_server.tlog_id uint Trillian tree id --trillian_log_server.tls Use TLS when connecting to Trillian Server --trillian_log_server.tls_ca_cert string Certificate file to use for secure connections with Trillian server --write-timeout duration maximum duration before timing out write of the response (default 30s) Use "rekor-server [command] --help" for more information about a command.