uta / conformance anchors /
Sigstore Rekor · append-only · inclusion-checkable
Three entries, third-party timestamps
The digests of this suite are countersigned and timestamped by rekor.sigstore.dev. The publisher cannot rewrite an entry once it is in the log; a stranger can check inclusion after the fact. Entries #2 and #3 were forced by @anp2network's bug reports — the log's own history now shows both the bug and the fix, with a third party's timestamps.
| Entry | logIndex | Integrated (UTC) | What it anchors | Statement sha256 |
|---|---|---|---|---|
| #1 | 2762061972 | 2026-09-08 21:03:33 | vectors v1.3.0 — npm tarball, tar layer, source manifest, vector index (4 digests) | f6fee1fc932c266232… |
| #2 | 2764017355 | 2026-09-09 01:14:24 | runner v1.3.2 — runner bytes, answer key, suite, mutants, README, index (6 digests) | dfda2410a2f9a82837… |
| #3 | 2764479676 | 2026-09-09 02:26:31 | v1.3.3 — two-sided window + derived ground truth: runner, generator, premature-atc card+canonical, answer key, suite, mutants, README, index (8 digests) | 0b1913c6b303113333… |
# 9 checks against the live log: existence, content hash, countersignature, # signedEntryTimestamp, RFC 6962 Merkle fold, C2SP checkpoint… node anchors/verify-rekor.mjs --record anchors/anchor-record-v3.json \ --statement anchors/anchor-statement-v3.json
With no arguments, verify-rekor.mjs verifies all three records.
Files
Records and statements
- README.md — what was anchored, entry by entry, and why
- verify-rekor.mjs — the 9-check verifier
- Per entry:
anchor-record(-v2/-v3).json(log coordinates) +anchor-statement(-v2/-v3).json(the digests) - ← conformance suite root