cosign "Rekor transparency log" upload or entry failed in CI

By Kaveh Alemi·Latchkey

Keyless cosign records each signature in the Rekor transparency log. Signing fails if the upload to Rekor is rejected; verification fails if the expected entry is not found in the log.

What this error means

cosign errors with "uploading to transparency log failed", "rekor ... connection", or on verify "no matching entries" / "entry not found" for the signature.

cosign

Error: signing [image]: uploading to transparency log: POST
https://rekor.sigstore.dev/api/v1/log/entries: 500 Internal Server Error

Common causes

Rekor was unreachable or returned an error at sign time

A network block or a transient Rekor outage means the signature was never recorded, so signing aborts.

Verifying against a log that has no matching entry

If the signature was made without a transparency log entry, or against a different Rekor instance, verification finds no entry and fails.

How to fix it

Allow Rekor connectivity and retry

Allow outbound access to rekor.sigstore.dev from the runner.
Re-run the sign; a transient 5xx from Rekor usually clears on retry.
Confirm the entry with cosign verify after signing.

Terminal

cosign sign --yes ghcr.io/acme/app@sha256:...
cosign verify --certificate-identity-regexp '.*' --certificate-oidc-issuer https://token.actions.githubusercontent.com ghcr.io/acme/app@sha256:...

Point verify at the same log the signature used

If you sign against a private Rekor, verify against the same instance, or set the tlog options consistently on both sides.

Terminal

cosign verify --rekor-url https://rekor.internal.example.com <flags> <image>

Make the gate meaningful

Fail the build on the severity you actually intend to block, and set it explicitly. A scanner that reports without failing is documentation, not a gate.
Scan the artifact you ship, not the source tree. A vulnerability in a base image will not appear in a source scan.
Pin the scanner version and its database snapshot for reproducibility, then update deliberately; a floating database turns an unrelated push into a red build.
Give the job a way to record accepted risk, or people will disable the gate rather than triage it.

How to prevent it

Allow outbound access to Rekor from CI runners.
Verify signatures immediately after signing to catch a missing tlog entry.
Keep sign and verify pointed at the same Rekor instance.

Frequently asked questions

What causes cosign "Rekor transparency log" upload or entry failed in CI?

There are 2 common causes: rekor was unreachable or returned an error at sign time and verifying against a log that has no matching entry. A network block or a transient Rekor outage means the signature was never recorded, so signing aborts.

How do I fix cosign "Rekor transparency log" upload or entry failed in CI?

There are 2 fixes depending on which cause you have: allow rekor connectivity and retry and point verify at the same log the signature used. Work through them in order, since the first is the most common.

What does cosign "Rekor transparency log" upload or entry failed in CI actually mean?

cosign errors with "uploading to transparency log failed", "rekor ...

How do I stop cosign "Rekor transparency log" upload or entry failed in CI happening again?

Allow outbound access to Rekor from CI runners. The prevention section lists 3 changes that keep it from recurring.

References

GitHub Actions documentation