> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/fleet-intel/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/fleet-intel/_mcp/server.

# Reports

On the **Reports** tab, you can run reports on
your inventory and on errors reported in your fleet. When you select a
report, you can specify a time range, Compute Zone, and Node Group, or use the **Filter Machines by Tag**
option. Node Group and Compute Zone are optional; machines can
also be filtered by [Tags](/groups-tags#tags).

You can download the inventory report as a CSV file using the button
in the upper right. Use the **Edit report** button to change the report
selection criteria.

## Signed Inventory Reports

In addition to standard CSV downloads, Fleet Intelligence can provide
**signed inventory reports** — cryptographically signed by NVIDIA so that
any third party can verify the report has not been tampered with and was
generated by the NVIDIA Fleet Intelligence service. Signed reports are
suited for regulatory compliance, audits, and supply-chain verification
workflows.

A signed report is delivered as a `.zip` archive containing two files:

* The inventory data as a `.csv` file.
* A Sigstore-format signature bundle (`.sig.bundle`) that covers the
  full CSV payload and the generation timestamp.

The signature can be verified with the open-source [cosign](https://github.com/sigstore/cosign) tool directly.

### Downloading a Signed Report

In the Fleet Intelligence dashboard, navigate to the **Reports** tab
and select the **Inventory Report** option. Generate the Inventory Report
as usual. When you click **Download**, you will be prompted to choose between
an unsigned `csv` file and a signed report `zip` archive.

![Downloading a Signed Report.](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/fleet-intel.docs.buildwithfern.com/fd3caccd2739c7b28aca94f12537473b2ef0e55c612ebfcd37dd6c7934739e91/_dot_dot_/docs/assets/images/SignedReportDownload.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260806%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260806T180249Z&X-Amz-Expires=604800&X-Amz-Signature=fc99725355fb8016607b1bf929b4f5b845c8c468bb672d0b3809018aa1841770&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

Extract the archive to obtain the `.csv` and `.sig.bundle` files
before verifying.

### Verifying a Signed Report

#### Third-Party Verification with Cosign

Because the signature bundle uses the [Sigstore](https://www.sigstore.dev/) format, anyone with the `cosign` tool and
the NVIDIA Fleet Intelligence public key can independently verify a
report. Cosign v3.0.0 or newer is required — v3 introduced the bundle
format used for signing and changed several flag defaults; earlier versions
will reject the bundle.

Download the NVIDIA Fleet Intelligence public key (PEM format) from the
Fleet Intelligence API endpoint at
[https://api.fleet-intelligence.nvidia.com/.well-known/signing-key.pub](https://api.fleet-intelligence.nvidia.com/.well-known/signing-key.pub):

```bash
cosign verify-blob \
   --key signing-key.pub \
   --bundle <report>.sig.bundle \
   --insecure-ignore-tlog \
   <report>.csv
```

A successful verification prints `Verified OK`.

Why **--insecure-ignore-tlog**?
NVIDIA does not publish report signatures to a public transparency log.
The flag's name is misleading: with this
flag set, verification remains cryptographically sound for our threat
model and should not be misread as a security concern.

What "Verified OK" means
If verification passes, the user has cryptographic proof that:

* NVIDIA Fleet Intelligence produced these exact CSV bytes.
* They have not been altered since signing.

### Key Rotation Model

Key rotations should occur rarely and only in the event of a compromised key.

Under the current key rotation model, NVIDIA only provides the latest key.
Any report signed with a historical key continues to verify with
the historical key, but new reports are signed by the current key. Customers
will be notified of key rotation and should take the following actions:

1. Re-download the same report from the API — the system regenerates
   byte-identical CSV bytes (deterministic regeneration is a design constraint)
   with a fresh signature under the new key.
2. Re-fetch the public key from
   [https://api.fleet-intelligence.nvidia.com/.well-known/signing-key.pub](https://api.fleet-intelligence.nvidia.com/.well-known/signing-key.pub).
3. Re-run the verification command.

Customers should re-download immediately on receiving a rotation notice and
re-issue the artifact to any concerned parties. Anyone encountering a failed
verification should ask the NVIDIA customer for a refreshed copy before
concluding the report is forged.

Exercise caution when verifying signed reports.
Always confirm that you are using the latest public key.

### Installing Cosign

Install `cosign` on the system where you want to perform third-party
verification. For Linux and macOS installation, instructions are
available at [https://github.com/sigstore/cosign](https://github.com/sigstore/cosign). For Windows, see below.

**Windows**

Choose one of the following methods.

*PowerShell (direct download)*:

```powershell
Invoke-WebRequest `
    -Uri "https://github.com/sigstore/cosign/releases/latest/download/cosign-windows-amd64.exe" `
    -OutFile "cosign.exe"
```

*WinGet*:

```powershell
winget install Sigstore.Cosign
```

*Scoop*:

```powershell
scoop install cosign
```

After installation, confirm `cosign` is available:

```bash
cosign version
```