/usr/bin/rekor-server

2026-11-08T02:56:47.767Z	DEBUG	app/root.go:176	pprof enabled false
Rekor fulfills the signature transparency role of sigstore's software
	signing infrastructure. It can also be run on its own and is designed to be
	extensible to work with different manifest schemas and PKI tooling

Usage:
  rekor-server [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  help        Help about any command
  serve       start http server with configured api
  version     Prints the version

Flags:
      --attestation_storage_bucket string                        url for attestation storage bucket
      --cleanup-timeout duration                                 grace period for which to wait before killing idle connections (default 10s)
      --client-signing-algorithms strings                        signing algorithm to use for signing/hashing (allowed ecdsa-sha2-256-nistp256, ecdsa-sha2-384-nistp384, ecdsa-sha2-512-nistp521, ed25519, ed25519-ph, rsa-sign-pkcs1-2048-sha256, rsa-sign-pkcs1-3072-sha256, rsa-sign-pkcs1-4096-sha256) (default [ecdsa-sha2-256-nistp256,ecdsa-sha2-384-nistp384,ecdsa-sha2-512-nistp521,ed25519,ed25519-ph,rsa-sign-pkcs1-2048-sha256,rsa-sign-pkcs1-3072-sha256,rsa-sign-pkcs1-4096-sha256])
      --config string                                            config file (default is $HOME/.rekor-server.yaml)
      --enable_attestation_storage                               enables rich attestation storage
      --enable_pprof                                             enable pprof for profiling on port 6060
      --enabled_api_endpoints strings                            list of API endpoints to enable using operationId from openapi.yaml (default [searchIndex,getLogInfo,getPublicKey,getLogProof,createLogEntry,getLogEntryByIndex,getLogEntryByUUID,searchLogQuery])
      --enabled_entry_types strings                              comma-separated list of entry type kinds to enable on the server (e.g. rekord,intoto,dsse,hashedrekord). If unset (default), all types compiled into the binary are enabled. Any kind specified here must be compiled into the binary; unknown kinds will cause startup to fail. (default [hashedrekord,cose,jar,rfc3161,tuf,dsse,rpm,alpine,intoto,rekord,helm])
      --gcp_cloud_profiling.enable_oc_telemetry                  enable Profiler spans in Cloud Tracing & Cloud Monitoring
      --gcp_cloud_profiling.enabled                              enable GCP Cloud Profiling
      --gcp_cloud_profiling.project_id string                    GCP project ID
      --gcp_cloud_profiling.service string                       a name for the service being profiled (default "rekor-server")
      --gcp_cloud_profiling.service_version string               the version of the service being profiled (default "v1.5.2+dirty")
      --graceful-timeout duration                                grace period for which to wait before shutting down the server (default 15s)
  -h, --help                                                     help for rekor-server
      --host string                                              the IP to listen on (default "localhost")
      --http-request-id-header-name string                       name of HTTP Request Header to use as request correlation ID (default "X-Request-Id")
      --keep-alive duration                                      sets the TCP keep-alive timeouts on accepted connections. It prunes dead TCP connections ( e.g. closing laptop mid-download) (default 3m0s)
      --listen-limit int                                         limit the number of outstanding requests
      --log_type string                                          logger type to use (dev/prod) (default "dev")
      --max-header-size byte-size                                controls the maximum number of bytes the server will read parsing the request header's keys and values, including the request line. It does not limit the size of the request body (default 1MB)
      --max_apk_metadata_size uint                               maximum permitted size for apk .SIGN and .PKGINFO files, in bytes; set to 0 for unlimited (default 1048576)
      --max_attestation_size int                                 max size for attestation storage, in bytes (default 102400)
      --max_jar_metadata_size uint                               maximum permitted size for jar META-INF/ files, in bytes; set to 0 for unlimited (default 1048576)
      --max_request_body_size uint                               maximum size for HTTP request body, in bytes; set to 0 for unlimited
      --port uint16                                              Port to bind to (default 3000)
      --publish_frequency uint                                   how often to publish a new checkpoint, in minutes (default 5)
      --read-timeout duration                                    maximum duration before timing out read of the request (default 30s)
      --redis_server.address string                              Redis server address (default "127.0.0.1")
      --redis_server.enable-tls                                  Whether to enable TLS verification when connecting to Redis endpoint
      --redis_server.insecure-skip-verify                        Whether to skip TLS verification when connecting to Redis endpoint, only applicable when 'redis_server.enable-tls' is set to 'true'
      --redis_server.password string                             Redis server password
      --redis_server.port uint16                                 Redis server port (default 6379)
      --rekor_server.address string                              Address to bind to (default "127.0.0.1")
      --rekor_server.hostname string                             public hostname of instance (default "localhost")
      --rekor_server.new_entry_publisher string                  URL for pub/sub queue to send messages to when new entries are added to the log. Ignored if not set. Supported providers: [gcppubsub]
      --rekor_server.publish_events_json                         Whether to publish events in CloudEvents JSON format. Applies to all enabled event types.
      --rekor_server.publish_events_protobuf                     Whether to publish events in Protobuf wire format. Applies to all enabled event types.
      --rekor_server.signer string                               Rekor signer to use. Valid options are: [awskms://keyname, azurekms://keyname, gcpkms://keyname, hashivault://keyname, memory, tink, <filename containing PEM-encoded private key>].
                                                                 Memory and file-based signers should only be used for testing. (default "memory")
      --rekor_server.signer-passwd string                        Password to decrypt signer private key
      --rekor_server.signer.gcpkms.retries uint                  Number of retries for GCP KMS requests
      --rekor_server.signer.gcpkms.timeout uint                  sets the RPC timeout per call for GCP KMS requests in seconds, defaults to 0 (no timeout)
      --rekor_server.tink_kek_uri string                         Key encryption key for decrypting Tink keyset. Valid options are [aws-kms://keyname, gcp-kms://keyname]
      --rekor_server.tink_keyset_path string                     Path to encrypted Tink keyset, containing private key to sign log checkpoints
      --scheme strings                                           the listeners to enable, this can be repeated and defaults to the schemes in the swagger spec (default [http])
      --search_index.mysql.conn_max_idletime duration            maximum connection idle time
      --search_index.mysql.conn_max_lifetime duration            maximum connection lifetime
      --search_index.mysql.dsn string                            DSN for index storage using MySQL
      --search_index.mysql.max_idle_connections int              maximum idle connections
      --search_index.mysql.max_open_connections int              maximum open connections
      --search_index.storage_provider string                     Index Storage provider to use. Valid options are: [redis, mysql]. (default "redis")
      --socket-path string                                       the unix socket to listen on (default "/var/run/todo-list.sock")
      --tls-ca string                                            the certificate authority certificate file to be used with mutual tls auth
      --tls-certificate string                                   the certificate file to use for secure connections
      --tls-host string                                          the IP to listen on (default "localhost")
      --tls-keep-alive duration                                  sets the TCP keep-alive timeouts on accepted connections. It prunes dead TCP connections ( e.g. closing laptop mid-download) (default 3m0s)
      --tls-key string                                           the private key file to use for secure connections (without passphrase)
      --tls-listen-limit int                                     limit the number of outstanding requests
      --tls-port int                                             the port to listen on for secure connections, defaults to a random value
      --tls-read-timeout duration                                maximum duration before timing out read of the request (default 30s)
      --tls-write-timeout duration                               maximum duration before timing out write of the response (default 30s)
  -t, --toggle                                                   Help message for toggle
      --trace-string-prefix string                               if set, this will be used to prefix the 'trace' field when outputting structured logs
      --trillian_log_server.address string                       Trillian log server address (default "127.0.0.1")
      --trillian_log_server.grpc_default_service_config string   JSON string used to configure gRPC clients for communicating with Trillian
      --trillian_log_server.port uint16                          Trillian log server port (default 8090)
      --trillian_log_server.sharding_config string               path to config file for inactive shards, in JSON or YAML
      --trillian_log_server.tlog_id uint                         Trillian tree id
      --trillian_log_server.tls                                  Use TLS when connecting to Trillian Server
      --trillian_log_server.tls_ca_cert string                   Certificate file to use for secure connections with Trillian server
      --write-timeout duration                                   maximum duration before timing out write of the response (default 30s)

Use "rekor-server [command] --help" for more information about a command.