Install & Compatibility
Where this runs
tested against v0.0.18 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.910 runs
installs and imports cleanly · install 0.0s · import 0.000s · 31.5MB
glibcpy 3.10–3.910 runs
installs and imports cleanly · install 3.6s · import 0.000s · 31MB
30MB installed
● package 30MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
Rekord
✓ from rekor_types import Rekord
✗ from sigstore_rekor_types.models.rekord import Rekord
Hashedrekord
✓ from rekor_types import Hashedrekord
ProposedEntry
✓ from rekor_types import ProposedEntry
This quickstart demonstrates how to instantiate core Pydantic models provided by `sigstore-rekor-types`, specifically `HashedRekord` which is a primary entry type in Rekor v2, and a generic `LogEntry` structure. This library focuses purely on data models, not client interaction with the Rekor API itself. For full client functionality (uploading, verifying), integrate with `sigstore-python`.
import datetime
from sigstore_rekor_types.models.hashedrekord import HashedRekord, HashedRekordSchema
from sigstore_rekor_types.models.log_entry import LogEntry
from sigstore_rekor_types.models.rekord import RekordObj, RekordObjSchema, RekordObjSignature, RekordObjSignaturePublicKey, RekordObjSignatureData
# Example of creating a HashedRekord object (a common Rekor v2 type)
# Note: This library provides models, not client functionality to upload to Rekor.
# For a full client, see sigstore-python.
try:
hashed_rekord_content = HashedRekordSchema(
apiVersion='0.0.1',
kind='hashedrekord',
spec=HashedRekord(
signature=RekordObjSignature(
content='base64encodedsignature==',
format='minisign',
publicKey=RekordObjSignaturePublicKey(
content='base64encodedpublickey=='
)
),
data=RekordObjData(
hash=RekordObjHash(
algorithm='sha256',
value='a' * 64 # Example SHA256 hash
)
)
)
)
print("HashedRekord object created successfully:")
print(hashed_rekord_content.model_dump_json(indent=2))
# Example of a generic LogEntry structure, often returned by Rekor
example_log_entry = LogEntry(
apiVersion="1.0.0",
kind="hashedrekord",
spec=hashed_rekord_content.spec.model_dump(mode='json'), # embed the spec
uuid="some-unique-uuid",
integratedTime=int(datetime.datetime.now(datetime.timezone.utc).timestamp()),
logID="some-log-id",
logIndex=12345,
body="base64encodedlogentrybody==",
verification=None
)
print("\nExample LogEntry object (often retrieved from Rekor):")
print(example_log_entry.model_dump_json(indent=2))
except Exception as e:
print(f"Error creating models: {e}")
Debug
Known issues
breakingRekor v2 introduces significant breaking changes by removing many older entry types. Only `hashedrekord` and `dsse` entry types are supported in Rekor v2. Other types like `intoto`, `rekord` (generic), `helm`, `tuf`, `rfc3161`, `jar`, `rpm`, `cose`, and `alpine` are no longer supported.fixReview your Rekor entry types and migrate to `HashedRekord` or `DSSE` if targeting Rekor v2. Consult `sigstore-rekor-types` changelog for specific model version compatibility.
affects: Rekor API v2.0.0 and above. Impact on `sigstore-rekor-types` depends on whether the specific model versions target v1 or v2.
gotchaThis library provides *only* the Python data models for Rekor's API. It does not include client-side functionality for interacting with the Rekor transparency log (e.g., uploading entries, querying).fixFor full Rekor client functionality, including signing, uploading, and verification, use the `sigstore-python` library, which integrates these models with API interaction logic.
affects: All versions
deprecatedRekor v1 is now in maintenance mode, and users are strongly encouraged to transition to Rekor v2. Rekor v1 will eventually be frozen, disallowing new entry uploads with a one-year advance notice.fixPlan to migrate your Rekor integrations to use Rekor v2 and ensure your `sigstore-rekor-types` models are compatible with the v2 API. Monitor Sigstore announcements for the v1 freezing timeline.
affects: Rekor API v1.x (and corresponding models if specific to v1)
Upgrade
Version history
0.0.18latest on PyPI · released Nov 22, 2024
Audit
Dependencies
pydanticrequiredProvides the base models for API types and data validation.