rekor_monitor_nyu_sscs 4.0

A Python monitor for Sigstore's Rekor transparency log.

Python Rekor Monitor

This is a python monitor for Sigstore's transparency log, Rekor. This project was developed as part of NYU's Software Supply Chain Security class.

Installation & Requirements

You may either run git clone on this repository or download the latest release in Releases.

Please use pip install -r requirements.txt to install the dependencies on requirements.txt.

The python version used for this project is 3.13.2. Older versions may still work but might cause some issues.

Usage

This program performs 3 main functions.

1. Fetches the latest checkpoint on the Rekor transparency log
2. Verifies an inclusion of an entry to the transparency log.
3. Verifies the integrity of transparency log at any point of time.

First, to create an entry in the Rekor log, you must sign an artifact using Sigstore Cosign.

1. Create an artifact file that you wish to sign.
2. Install sigstore Cosign.
3. Sign your artifact using sigstore. You may do this by running cosign sign-blob <your-artifact> --bundle <your-artifact.bundle> More documentation on cosign can be found here: https://docs.sigstore.dev/cosign/signing/signing_with_blobs/

To skip this step, you may alternatively use the artifact.md and artifact.bundle files for the next steps.

Fetching the latest checkpoint

python main.py --checkpoint

Verifying inclusion for your entry

python main.py --inclusion <log-index> --artifact <your-artifact>

This command verifies the inclusion of your log entry. The log index can be found in your bundle file created by Cosign.

Verifying consistency of the Rekor log

python main.py --consistency --tree-id <tree-id> --tree-size <tree-size> --root-hash <root-hash>

This command verifies that the checkpoint you provide is consistent with the latest checkpoint. The tree-id, tree-size and root-hash fields can be found in any checkpoint of the log, fetched by --checkpoint.

Acknowledgements

The program is built on top of starter code from this template: https://github.com/mayank-ramnani/python-rekor-monitor-template