cosign "Rekor transparency log" upload or entry failed in CI

By Kaveh Alemi·Latchkey

Keyless cosign records each signature in the Rekor transparency log. Signing fails if the upload to Rekor is rejected; verification fails if the expected entry is not found in the log.

What this error means

cosign errors with "uploading to transparency log failed", "rekor ... connection", or on verify "no matching entries" / "entry not found" for the signature.

Error: signing [image]: uploading to transparency log: POST
https://rekor.sigstore.dev/api/v1/log/entries: 500 Internal Server Error

Common causes

Rekor was unreachable or returned an error at sign time

A network block or a transient Rekor outage means the signature was never recorded, so signing aborts.

Verifying against a log that has no matching entry

If the signature was made without a transparency log entry, or against a different Rekor instance, verification finds no entry and fails.

How to fix it

Allow Rekor connectivity and retry

1. Allow outbound access to rekor.sigstore.dev from the runner.
2. Re-run the sign; a transient 5xx from Rekor usually clears on retry.
3. Confirm the entry with cosign verify after signing.

cosign sign --yes ghcr.io/acme/app@sha256:...
cosign verify --certificate-identity-regexp '.*' --certificate-oidc-issuer https://token.actions.githubusercontent.com ghcr.io/acme/app@sha256:...

Point verify at the same log the signature used

If you sign against a private Rekor, verify against the same instance, or set the tlog options consistently on both sides.

cosign verify --rekor-url https://rekor.internal.example.com <flags> <image>

How to prevent it

• Allow outbound access to Rekor from CI runners.
• Verify signatures immediately after signing to catch a missing tlog entry.
• Keep sign and verify pointed at the same Rekor instance.

Frequently asked questions

Related guides

References

• GitHub Actions documentation