Metadata-Version: 2.1
Name: rekor-monitor-jacksonqu
Version: 4.0.1
Summary: Verify your software using trusted supply chains.
Home-page: https://github.com/JacksonQu/Software-Supply-Chain-Security-Assignment1
Author: JacksonQu
Author-email: 200074quhaoning@gmail.com
Requires-Python: >=3.10,<4.0
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Requires-Dist: autodocstrings (>=0.1.3,<0.2.0)
Requires-Dist: bandit (>=1.7.10,<2.0.0)
Requires-Dist: black (>=24.10.0,<25.0.0)
Requires-Dist: flake8 (>=7.1.1,<8.0.0)
Requires-Dist: mypy (>=1.13.0,<2.0.0)
Requires-Dist: pylint (>=3.3.1,<4.0.0)
Requires-Dist: pytest (>=7.1.2,<8.0.0)
Requires-Dist: pytest-cov (>=5.0.0,<6.0.0)
Requires-Dist: requests (>=2.28.1,<3.0.0)
Requires-Dist: ruff (>=0.7.0,<0.8.0)
Project-URL: Repository, https://github.com/JacksonQu/Software-Supply-Chain-Security-Assignment1
Description-Content-Type: text/markdown

# Python Rekor Monitor

Verify your software using trusted supply chains.

## Description

This repository uses `Rekor API`, a tool that helps improve security in software supply chains by providing immutable records of software build metadata. This repository includes code that interacts with Rekor's API and verifies the consistency using transparency logs.

## Installation

1. Clone the repository:

```bash
git clone https://github.com/JacksonQu/Software-Supply-Chain-Security-Assignment1.git
cd Software-Supply-Chain-Security-Assignment1/
```

2. (Optional) Create a virtual environment:

```bash
python -m venv venv
source venv/bin/activate
```

3. Install dependencies:

```bash
pip install cryptography requests
```

## Usage

- Fetch a checkpoint of Rekor transparency log.

```bash
python main.py -c
```

- Verify the artifact signature.

```bash
python main.py --inclusion {logIndex} --artifact {filepath}
```

- Verify merkle tree consistency.

```bash
python main.py --consistency --tree-id {treeID} --tree-size {treeSize} --root-hash {hash}
```

## Reference

- Fork from [mayank-ramnani/python-rekor-monitor-template](https://github.com/mayank-ramnani/python-rekor-monitor-template)

- [Rekor API Sepc](https://www.sigstore.dev/swagger/#/)

