uta / conformance anchors /
Sigstore Rekor · append-only · inclusion-checkable
Five entries, third-party timestamps
The digests of this suite are countersigned and timestamped by rekor.sigstore.dev. The publisher cannot rewrite an entry once it is in the log; a stranger can check inclusion after the fact. Entries #2, #3 and #5 were forced by @anp2network's bug reports — the log's own history now shows both the bug and the fix, with a third party's timestamps.
| Entry | logIndex | Integrated (UTC) | What it anchors | Statement sha256 |
|---|---|---|---|---|
| #1 | 2762061972 | 2026-09-08 21:03:33 | vectors v1.3.0 — npm tarball, tar layer, source manifest, vector index (4 digests) | f6fee1fc932c266232… |
| #2 | 2764017355 | 2026-09-09 01:14:24 | runner v1.3.2 — runner bytes, answer key, suite, mutants, README, index (6 digests) | dfda2410a2f9a82837… |
| #3 | 2764479676 | 2026-09-09 02:26:31 | v1.3.3 — two-sided window + derived ground truth: runner, generator, premature-atc card+canonical, answer key, suite, mutants, README, index (8 digests) | 0b1913c6b303113333… |
| #4 | 2771735480 | 2026-09-09 17:24:25 | revocation registry MNR-CRL-1.0 — CRL full file, signed payload hash, registry key (3 digests; roadmap v5.1.5) | 954649a60531f7d1… |
| #5 | 2787622029 | 2026-09-10 21:52:48 | v1.4.0 — anp2 round 3: adversarial two-bound distribution, generated mutation sweep (113 mutants, 21 classified survivors), Rekor-in-the-loop verifier, 5-surface answer key (11 digests) | ca1e2b6c69d620f378… |
| #6 | 2795106183 | 2026-09-11T15:38:34Z | The release chain: persistent Ed25519 release identity + release statement r1 (counter 1, v1.5.0) — rollback resistance. Verify: verify-artifact.mjs --release | ac565b1cd30678b6e7e71fda693e69ec… |
| #7 | 2795233758 | 2026-09-11T15:49:43Z | The r1→r2 ADVANCE: release 2 chained to release 1 (higher log index, grown tree) — a supersession you can prove, not a rewrite. Verify: verify-artifact.mjs --release | 4d5f5db5c40ed0997440… |
# the log in the ACTUAL verification path — digest from Rekor, not the hub: node anchors/verify-artifact.mjs https://www.marketnow.site/uta/conformance/score-runner.mjs # or the whole suite, digest chain re-rooted at the live entry #5 first: node runner-tests/runner-tests.mjs --rekor # the anchor itself — 9 checks against the live log: node anchors/verify-rekor.mjs --record anchors/anchor-record-v5.json \ --statement anchors/anchor-statement-v5.json
With no arguments, verify-rekor.mjs verifies all records; verify-artifact.mjs <any-file> checks any artifact's bytes against the Rekor-rooted pins.
Files
Records and statements
- README.md — what was anchored, entry by entry, and why
- verify-rekor.mjs — the 9-check verifier
- verify-artifact.mjs — Rekor-in-the-loop: any artifact, any origin, digest from the entry
- Per entry:
anchor-record(-v2/-v3/-v4/-v5).json(log coordinates) +anchor-statement(-v2/-v3/-v4/-v5).json(the digests) - ← conformance suite root