Metadata-Version: 2.1
Name: supply-chain-rekor-monitor
Version: 4.0.0
Summary: This project can be used to verify inclusion of artifacts, whether a correct signature is present, or verify consistency in regards to the Rekor transparency logs.
License: Apache 2.0
Author: cp-57
Author-email: 109479938+cp-57@users.noreply.github.com
Requires-Python: >=3.9,<4.0
Classifier: License :: Other/Proprietary License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Requires-Dist: autodocstrings (>=0.1.3,<0.2.0)
Requires-Dist: bandit (>=1.7.10,<2.0.0)
Requires-Dist: black (>=24.10.0,<25.0.0)
Requires-Dist: cryptography (>=43.0.3,<44.0.0)
Requires-Dist: flake8 (>=7.1.1,<8.0.0)
Requires-Dist: jsonschema (>=4.23.0,<5.0.0)
Requires-Dist: mypy (>=1.13.0,<2.0.0)
Requires-Dist: pylint (>=3.3.1,<4.0.0)
Requires-Dist: pytest (>=8.3.3,<9.0.0)
Requires-Dist: pytest-cov (>=6.0.0,<7.0.0)
Requires-Dist: requests (>=2.32.3,<3.0.0)
Requires-Dist: ruff (>=0.7.3,<0.8.0)
Description-Content-Type: text/markdown

Project Description
This program verifies inclusion of artifact entries in a public transparency log, Rekor. 
It also can verify that the correct signature is present in the transparency log or verify the consistency 
between older and latest checkpoints. 


Usage Instructions
python3 main.py --inclusion 123456789 --artifact artifact.md

python3 main.py --consistency --tree-id TREE_ID --tree-size TREE_SIZE --root-hash ROOT_HASH

Installation Steps
git clone https://github.com/cp-57/supply-chain-security.git

Dependencies
This program relies on the following libraries:
- argparse: for parsing command-line arguments
- cryptography: for handling public key extraction and signature verification
- requests: for interacting with Rekor's api

