> Markdown version of https://docs.laavat.io/democlient/setup/ from the LAAVAT PKI and Signing Platform documentation. All pages: https://docs.laavat.io/llms.txt

# Setup

Python 3.9 or newer is required.

## Install from PyPI (recommended)

```bash
python3 -m venv .venv
source .venv/bin/activate
pip install signing-tool
signing-tool --version
```

This installs the `signing-tool` and `config-init` commands.

## Verifying the download

Releases are published on PyPI with [PEP 740 digital attestations](https://docs.pypi.org/attestations/)
signed via [Sigstore](https://www.sigstore.dev/) — verifiable proof that an
artifact was built and published by LAAVAT's official pipeline. To verify a
downloaded artifact:

```bash
pip install pypi-attestations
python3 -m pypi_attestations verify pypi \
    --repository https://gitlab.com/laavat/laavat-product/architecture/dist \
    pypi:signing_tool-<version>-py3-none-any.whl
```

A successful verification confirms provenance (who built it, from which
repository). It is not a substitute for your own security review of the code.

## Install from the release archive

If you received the reference client as a release archive instead:

```bash
unzip LAAVAT-reference-client-vx.x.x.zip
cd LAAVAT-reference-client-vx.x.x
make install
source clients/python3/.venv/bin/activate
signing-tool --version
```