Metadata-Version: 2.1
Name: sdg8193_rekor
Version: 0.1.0
Summary: A command-line tool for querying and verifying entries in a Rekor transparency log. This tool allows you to fetch log entries, verify inclusion proofs, and check the consistency of the log's Merkle tree.
License: MIT
Author: Samuel Greenwald
Author-email: sdg8193@nyu.edu
Requires-Python: >=3.10,<4.0
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Requires-Dist: cryptography (>=46.0.3,<47.0.0)
Requires-Dist: requests (>=2.32.3,<3.0.0)
Description-Content-Type: text/markdown

# Python Rekor Verifier

A command-line tool for querying and verifying entries in a Rekor transparency log. This tool allows you to fetch log entries, verify inclusion proofs, and check the consistency of the log's Merkle tree.

## Description

This project provides a client to interact with a Rekor server (e.g., `https://rekor.sigstore.dev`).

Key features include:
- Fetching log entries by index.
- Verifying artifact signatures against public keys from log entries.
- Performing inclusion proof verification to confirm an entry is in the log.
- Verifying consistency between an old and new tree state.

## Installation

1.  Clone the repository:
    ```bash
    git clone https://github.com/sdg8193/Software-Supply-Chain-HW-1.git
    cd python-rekor-monitor-template
    ```

2.  Install the required dependencies:
    ```bash
    pip install poetry
    poetry install
    ```

## Usage

The tool is operated via the command line.

### Get Latest Checkpoint

Fetch the latest signed tree head (checkpoint) from the Rekor server.
```bash
python main.py --checkpoint
```

### Verify Inclusion

Verify that an artifact is included in the log at a specific index. You need the log index and the path to the original artifact.

```bash
python main.py --inclusion <LOG_INDEX> --artifact <PATH_TO_ARTIFACT>
```

**Example:**
```bash
python main.py --inclusion 12345 --artifact ./my-file.txt
```

### Verify Consistency

Verify that a previously known checkpoint is consistent with the latest checkpoint. You need the `treeID`, `treeSize`, and `rootHash` from the old checkpoint.

```bash
python main.py --consistency --tree-id <TREE_ID> --tree-size <OLD_TREE_SIZE> --root-hash <OLD_ROOT_HASH>
```

**Example:**
```bash
python main.py --consistency --tree-id 238498... --tree-size 1000 --root-hash abcdef123...
```

### Debug Mode

For more verbose output for any command, use the `--debug` or `-d` flag.
```bash
python main.py --checkpoint --debug
```

