Project Rekor

Term 0 · 2021 Spring (Mar-May) · 1 project

• CNCF release signing security

  LFX Mentorship · Listed in the official cohort

  @lukehindsSource IssueLFX portal

  Rekor is a new project that provides a secure supply chain transparency log / ledger. The proposed work is to research how CNCF projects could implement cryptographic signing of releases and store those signatures into rekors transparency log. Following this, simple steps and methods should be outlined for how users can gain security guarantees on releases available for download.

  • Scripting
  • Github
  • information security (understand basic application of crypto signing
  • for example GPG).