rekor-monitor 4.0.1

An auditing system for Sigstore signatures

Rekor Monitor

An auditing system for Sigstore signatures.

Project Description

Rekor Monitor provides tools for verifying inclusion and consistency of log entries in the Sigstore Transparency Log (rekor). It helps ensure the integrity of signed artifacts using Cosign and Rekor.

Installation

You can install Rekor Monitor directly from PyPI:

pip install rekor-monitor

Using the Code

1. Fetch the Latest Checkpoint:

   Retrieve the latest checkpoint from the Rekor server with:

   rekor-monitor -c
   

2. Verifying Log Inclusion:

   To confirm that a specific log entry exists in the transparency log and verify the artifact's signature stored in Rekor:

   rekor-monitor --inclusion <logIndex> --artifact <artifactFilePath>
   

• Replace with the index of the log entry.

• Replace with the path to your artifact file.

3. Verifying Checkpoint Consistency:

   To ensure an older checkpoint is consistent with the current Rekor checkpoint:

   rekor-monitor --consistency --tree-id <treeID> --tree-size <treeSize> --root-hash <rootHash>
   

• Replace with the ID of the Merkle tree.

• Replace with the size of the previous tree.

• Replace with the root hash of the previous checkpoint.