checkId: check.attestation.rekor.connectivity plugin: stellaops.doctor.attestor severity: fail tags: [attestation, rekor, transparency, quick, setup, air-gap]

Rekor Connectivity

This Stella Ops Doctor check confirms that the Attestor can reach the Rekor transparency log that records attestation entries. It is part of the attestation diagnostics surfaced by stella doctor; see the Doctor overview for how checks are run and reported.

What It Checks

Tests connectivity to the Rekor transparency log by sending an HTTP GET request to the log info endpoint ({rekorUrl}/api/v1/log). The Rekor URL is read from configuration (Attestor:Rekor:Url or Transparency:Rekor:Url, defaulting to https://rekor.sigstore.dev). Request timeout is 10 seconds.

Results:

  1. HTTP 2xx success: Pass. Parses the response JSON for treeSize and reports the endpoint, response latency (ms), and current tree size.
  2. HTTP non-2xx: Fail with status code and latency.
  3. Connection timeout (TaskCanceledException): Fail with “Connection timeout (10s)”.
  4. HTTP request exception (DNS failure, SSL error, connection refused): Fail with the exception message.

Evidence collected: Endpoint, Latency (ms), TreeSize, StatusCode, Error.

The check always runs (CanRun returns true) because Rekor connectivity is essential for attestation.

Air-Gap Behavior

When the deployment is sealed by AirGap policy, or STELLAOPS_DOCTOR_OFFLINE_PROFILE=true forces Doctor offline mode, this check returns Skip with airGapSealed=true instead of probing Rekor. The skip is intentional: sealed deployments must not emit outbound traffic to the public transparency log.

Operators should verify the attestation path against a trusted offline Rekor mirror or imported transparency bundle. In Docker Compose and bare-metal deployments, import that material through the offline kit before running release verification workflows.

Why It Matters

Rekor is the transparency log that records attestation entries, providing tamper-evident proof that signatures were created at a specific time. Without Rekor connectivity, the Attestor cannot submit new log entries, and verifiers cannot confirm that attestations were properly logged. In non-air-gapped deployments, Rekor connectivity is a hard requirement for the signing and verification pipeline.

Common Causes

How to Fix

Docker Compose

# Test Rekor connectivity from the attestor container
docker compose -f devops/compose/docker-compose.stella-ops.yml exec attestor \
  curl -s https://rekor.sigstore.dev/api/v1/log | jq .

# Check DNS resolution
docker compose -f devops/compose/docker-compose.stella-ops.yml exec attestor \
  nslookup rekor.sigstore.dev

# Set Rekor URL in environment
# ATTESTOR__REKOR__URL=https://rekor.sigstore.dev

# For sealed environments, import the offline Rekor mirror/bundle first.
# Doctor reports Skip with airGapSealed=true until an online egress path is allowed.

Bare Metal / systemd

# Test Rekor connectivity manually
curl -s https://rekor.sigstore.dev/api/v1/log | jq .

# Check network connectivity
nc -zv rekor.sigstore.dev 443

# Check DNS resolution
nslookup rekor.sigstore.dev

# Check SSL certificates
openssl s_client -connect rekor.sigstore.dev:443 -brief

# Verify Rekor URL configuration
grep -r 'rekor' /etc/stellaops/*.yaml

# For sealed environments, import the offline Rekor mirror/bundle.
stella airgap import --component attestor --artifact rekor-mirror

Kubernetes / Helm

# Test from attestor pod
kubectl exec -it deploy/stellaops-attestor -n stellaops -- \
  curl -s https://rekor.sigstore.dev/api/v1/log | jq .

# Check egress NetworkPolicy
kubectl get networkpolicy -n stellaops -o yaml | grep -A10 egress

# Set Rekor URL in Helm values
# attestor:
#   rekor:
#     url: "https://rekor.sigstore.dev"
#   # For sealed environments, mount the offline-kit Rekor mirror/bundle.
helm upgrade stellaops stellaops/stellaops -f values.yaml

Verification

stella doctor run --check check.attestation.rekor.connectivity