Metadata-Version: 2.4
Name: hcot-cli
Version: 0.1.1
Summary: Hybrid Chain of Trust (HCoT) – software supply chain verification
Home-page: https://github.com/Cloudexpert-JQ/hcot
Author: Jamshir Qureshi
Author-email: llmaideveloper@gmail.com
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Topic :: Security
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Requires-Python: >=3.8
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: cryptography>=41.0.0
Requires-Dist: requests>=2.25.0
Dynamic: author
Dynamic: author-email
Dynamic: classifier
Dynamic: description
Dynamic: description-content-type
Dynamic: home-page
Dynamic: license-file
Dynamic: requires-dist
Dynamic: requires-python
Dynamic: summary

# 🔗 HCoT CLI – Hybrid Chain of Trust

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![PyPI version](https://badge.fury.io/py/hcot-cli.svg)](https://badge.fury.io/py/hcot-cli)
[![Python 3.8+](https://img.shields.io/badge/python-3.8+-blue.svg)](https://www.python.org/downloads/)

**HCoT CLI** is a free, open‑source command‑line tool that implements the **Hybrid Chain of Trust (HCoT)** framework – a unified pre‑deployment security architecture for software supply chains.

> 📄 **Peer‑reviewed paper:**  
> Qureshi, J. (2025). *A Secure and Integrated Approach to Software Code and Docker Image Signing: Introducing the Hybrid Chain of Trust (HCoT) Algorithm*.  
> *International Journal of Artificial Intelligence and Machine Learning*, 5(2), 16–22.  
> DOI: [10.51483/IJAIML.5.2.2025.16-22](https://doi.org/10.51483/IJAIML.5.2.2025.16-22)

## 🚀 Why HCoT?

Software supply chain attacks increased **742% in the last three years** (Sonatype, 2025). HCoT addresses this by:

- ✅ **Cryptographic verification** (SHA‑256 + RSA signatures)
- ✅ **Tamper‑evident blockchain log** (append‑only, chained hashes)
- ✅ **Real‑time vulnerability scanning** (via OSV API)
- ✅ **Policy enforcement** (registries, signatures, CVSS thresholds)
- ✅ **Docker image support** (layer inspection + integrity check)

## 📦 Installation

```bash
pip install hcot-cli
