{"id":19668239,"url":"https://github.com/nsmith5/rekor-sidekick","last_synced_at":"2025-04-29T00:30:29.897Z","repository":{"id":37978350,"uuid":"444229549","full_name":"nsmith5/rekor-sidekick","owner":"nsmith5","description":"🔍 Rekor transparency log monitoring and alerting","archived":false,"fork":false,"pushed_at":"2023-10-02T23:06:00.000Z","size":435,"stargazers_count":27,"open_issues_count":16,"forks_count":6,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-05T11:41:24.303Z","etag":null,"topics":["openpolicyagent","rekor","sigstore"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nsmith5.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-01-03T23:40:24.000Z","updated_at":"2024-10-08T16:42:57.000Z","dependencies_parsed_at":"2023-10-03T04:26:07.190Z","dependency_job_id":"75776a1b-c1f2-4f39-a8d5-6cf0e65c0112","html_url":"https://github.com/nsmith5/rekor-sidekick","commit_stats":null,"previous_names":[],"tags_count":9,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nsmith5%2Frekor-sidekick","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nsmith5%2Frekor-sidekick/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nsmith5%2Frekor-sidekick/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nsmith5%2Frekor-sidekick/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nsmith5","download_url":"https://codeload.github.com/nsmith5/rekor-sidekick/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251410152,"owners_count":21584973,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["openpolicyagent","rekor","sigstore"],"created_at":"2024-11-11T16:34:52.476Z","updated_at":"2025-04-29T00:30:29.631Z","avatar_url":"https://github.com/nsmith5.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 🔍 Rekor Sidekick\n\nRekor Sidekick monitors a Rekor signature transparency log and forwards events\nof interest where ever you like.\n\n```\n                               ┌─────────────────┐\n                               │  Event Policies │\n                               └──────┬───▲──────┘\n                                      │   │\n                             Decision │   │ Should forward entry?\n                                      │   │\n                                      │   │\n                                      │   │                           Outputs\n┌─────────────┐              ┌────────▼───┴───────┐\n│             │              │                    │                ┌────────────┐\n│  Rekor Log  ├──────────────►   Rekor Sidekick   │ ───────────────► Pager Duty │\n│             │              │                    │                └────────────┘\n└─────────────┘ Pull entries └─────────────┬─┬─┬─┬┘\n                                           │ │ │ │                 ┌────────────┐\n                                           │ │ │ └─────────────────► Stdout     │\n                                           │ │ │                   └────────────┘\n                                           │ │ │\n                                           │ │ │                   ┌────────────┐\n                                           │ │ └───────────────────► Loki       │\n                                           │ │                     └────────────┘\n                                           │ │\n                                           │ │                     ┌────────────┐\n                                           │ └─────────────────────► OpenSearch │\n                                           │                       └────────────┘\n                                           │\n                                           │                       ┌────────────┐\n                                           └───────────────────────► ...        │\n                                                                   └────────────┘\n```\n\n## Installation\n\nTo install `rekor-sidekick` grab the latest release from our [Github releases\npage](https://github.com/nsmith5/rekor-sidekick/releases).\n\n### Verifying a release\n\nReleases are signed and can be verified as follows\n\n```bash\nexport VERSION=\"0.1.0\"\nexport ARCH=\"linux_amd64\"\ncurl -sL \"https://github.com/nsmith5/rekor-sidekick/releases/download/v${VERSION}/rekor-sidekick_${VERSION}_${ARCH}.tar.gz\" \u003e rekor-sidekick_${VERSION}_${ARCH}.tar.gz\ncurl -sL \"https://github.com/nsmith5/rekor-sidekick/releases/download/v${VERSION}/checksums.txt\" \u003e checksums.txt\ncurl -sL \"https://github.com/nsmith5/rekor-sidekick/releases/download/v${VERSION}/checksums.txt.sig\" \u003e checksums.txt.sig\n\nexport COSIGN_EXPERIMENTAL=1\ncosign verify-blob --signature $(cat checksums.txt.sig) checksums.txt\n```\n\nThe cosign verification step must output sometime to the affect of\n\n```\nCertificate is trusted by Fulcio Root CA\nEmail: []\nURI: https://github.com/nsmith5/rekor-sidekick/.github/workflows/release.yml@refs/tags/v0.1.0\nIssuer:  https://token.actions.githubusercontent.com\nVerified OK\ntlog entry verified with uuid: \"e530fe7cb3da2ab69535208e54d0c8c63accba35dd75b405c50f23a5093ca712\" index: 1029416\n```\n\n\u003e NB: The URI should having a version tag matchine `VERSION` and the issuer\n\u003e should be https://token.actions.githubusercontent.com.  the tlog entry uuid\n\u003e and index are not important.\n\nFinally, hash the release and make sure it matches what you see in `checksums.txt`\n\n```\n# Authorized checksums\ncat checksums.txt\n\n# Received checksum. Should be in the list of checksums above.\nsha256sum rekor-sidekick_${VERSION}_${ARCH}.tar.gz\n```\n\n## Usage\n\n`rekor-sidekick` requires a rekor server, alert policies and alert outputs to\nbe configured. A basic example configuration looks like the following:\n\n```yaml\n# config.yaml\nserver: https://rekor.sigstore.dev\nlogging:\n  level: error\npolicies:\n- name: alert-on-my-email\n  description: |\n    Alert when an x509 cert with subject email:me@example.com is used\n    so sign an entry\n  body: |\n    package sidekick\n\n    import future.keywords.in\n\n    default alert = false\n\n    alert {\n      encodedCert := input.spec.signature.publicKey.content\n      certs := crypto.x509.parse_certificates(encodedCert)\n      emailAddresses := certs[0].EmailAddresses\n      \"me@example.com\" in emailAddresses\n    }\n\noutputs:\n  stdout:\n    enabled: true\n```\n\nLaunch `rekor-sidekick` by pointing to the config file\n\n```\nrekor-sidekick --config /path/to/config.yaml\n```\n\n## Configuration\n\nRekor Sidekick uses a single configuration file with three important sections:\n\n- `server` to point to the Rekor server you want to monitor,\n- `policies` to specify which entries you want to alert on, and,\n- `outputs` to specify where you want to send your alerts\n\nThe `etc` directory contains sample configurations.\n\n## Environment variables\n\nConfiguration can also be set using environment variables. They map 1:1 to\nconfiguration fields in the configuration file so that e.g\n`.outputs.stdout.enabled` cooresponds to the\n`REKOR_SIDEKICK_OUTPUTS_STDOUT_ENABLED` environment variable.\n\n### Writing Alert Policies\n\nPolicies are written using the\n[Rego](https://www.openpolicyagent.org/docs/latest/policy-language/) policy\nlanguage. Some things to remember when writing your policies for Rekor\nSidekick:\n\n- The package name on the policy _must_ be `sidekick`\n- Rekor sidekick evalutes the variable `alert` so set it to true in your policy\n  if you want to alert on an event\n- The base64 decoded contents of the `.[].body` field in a rekor log entry are\n  what Rekor sidekick evaluates as input\n\nThe best approach to debugging / evalutationg policy is to grab an example log\nentry\n\n```\nexport UUID=\u003c\u003c your example uuid here \u003e\u003e\ncurl -X GET -H \"Accept: application/json\" https://rekor.sigstore.dev/api/v1/logs/entries/${UUID} | jq .[].body | base64 -d\n```\n\nPaste that data into the [Rego playground](https://play.openpolicyagent.org/)\nand iterate on your policy until it behaves how you want.\n\n\u003e NB: you can use `print(x)` to evaluate some data and print to the browser console\n\n### Outputs\n\n**stdout**\n\nThe `stdout` driver prints alerts to the console in JSON format. To enable add\nthe following to your config\n\n```diff\noutputs:\n+ stdout:\n+   enabled: true\n```\n\n**Cloud Events**\n\nThe `cloudevents` driver emits [cloud events](https://cloudevents.io). An\nexample of how to configure this output is below.\n\n```diff\noutputs:\n+  cloudevents:\n+    sourceID: instance-a\n+    http:\n+      url: http://example.com:1234\n```\n\nThe `sourceID` fields configures the event source. The resulting event source\nin this case would be `github.com/nsmith5/rekor-sidekick:instance-a`. The event\ntype is `rekor-sidekick.policy.violation.v1`. The `http.url` field configures\nan HTTP destination for your emitted events.\n\nTODO(vaikas): Update with example consumer after #27 goes in.\n\n**Pager Duty**\n\nThe `pagerduty` driver emits [Pager Duty](https://pagerduty.com) events. To\nconfigure Rekor Sidekick to alert to Pager Duty you'll need\n\n- An _API token_. This ca be fetched at _Integrations_ \u003e _API Access keys_.\n- An _Integration Key_. This ca be fetched at _Automation_ \u003e _Event Rules_ \u003e\n  _Your rule set_ \u003e _View_ \u003e _Integration Key_\n\nConfigure the driver as follows:\n\n```diff\noutputs:\n+  pagerduty:\n+    apitoken: \u003c\u003c api token \u003e\u003e\n+    integrationKey: \u003c\u003c integration key \u003e\u003e\n+    severity: error\n```\n\nThe severity can be one of `critical`, `warning`, `error`, or `info`.\n\n**OpenSearch**\n\nThe `opensearch` driver logs to [OpenSearch](https://opensearch.org/docs/latest/). To\nconfigure Rekor Sidekick to push to OpenSearch you'll need\n\n- A _Username_ and _Password_ (only basic auth is supported at this time).\n- A _Server_. E.g. `https://localhost:9200`.\n- An _Index_. E.g. `rekor-log`, to push the events into. (The entry guid will be the `_id`)\n- Optionally an _Insecure_ flag if you need to disable TLS validation. \n\nConfigure the driver as follows:\n\n```diff\noutputs:\n+ opensearch:\n+   server: https://0.0.0.0:9200\n+   insecure: true\n+   index: rekor-all\n+   username: admin\n+   password: admin\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnsmith5%2Frekor-sidekick","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnsmith5%2Frekor-sidekick","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnsmith5%2Frekor-sidekick/lists"}