Metadata-Version: 2.1
Name: rekor-monitor
Version: 4.0.1
Summary: An auditing system for Sigstore signatures
Author: Nate Lavoy
Author-email: nl2587@nyu.edu
Requires-Python: >=3.13,<4.0
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.13
Requires-Dist: cryptography (>=43.0.3,<44.0.0)
Requires-Dist: jsonschema (>=4.23.0,<5.0.0)
Requires-Dist: pre-commit (>=4.0.1,<5.0.0)
Requires-Dist: requests (>=2.32.3,<3.0.0)
Description-Content-Type: text/markdown

# Rekor Monitor

An auditing system for Sigstore signatures.

## Project Description

Rekor Monitor provides tools for verifying inclusion and consistency of log entries in the Sigstore Transparency Log (`rekor`). It helps ensure the integrity of signed artifacts using Cosign and Rekor.

## Installation

You can install Rekor Monitor directly from PyPI:

```bash
pip install rekor-monitor
```

## Using the Code

1. **Fetch the Latest Checkpoint:**

   Retrieve the latest checkpoint from the Rekor server with:

   ```bash
   rekor-monitor -c

2. **Verifying Log Inclusion:**

   To confirm that a specific log entry exists in the transparency log and verify the artifact's signature stored in Rekor:

   ```bash
   rekor-monitor --inclusion <logIndex> --artifact <artifactFilePath>
   ```
- Replace <logIndex> with the index of the log entry.

- Replace <artifactFilePath> with the path to your artifact file.

3. **Verifying Checkpoint Consistency:**

   To ensure an older checkpoint is consistent with the current Rekor checkpoint:

   ```bash
   rekor-monitor --consistency --tree-id <treeID> --tree-size <treeSize> --root-hash <rootHash>
   ```

- Replace <treeID> with the ID of the Merkle tree.

- Replace <treeSize> with the size of the previous tree.
   
- Replace <rootHash> with the root hash of the previous checkpoint.

