Deployment witness

This deployment's record manifest is signed and entered in the Sigstore Rekor public transparency log (index 2859218371) - an append-only ledger the registry cannot rewrite.

• checksums.txt - sha256 of every record, the schema, the constitution, and the exports
• checksums.bundle.json - signature, certificate, and inclusion proof
• provenance.txt - commit, workflow run, log index

Verify (no account needed):

cosign verify-blob   --bundle checksums.bundle.json   --certificate-identity-regexp 'github.com/piperoll/registry'   --certificate-oidc-issuer https://token.actions.githubusercontent.com   checksums.txt

About the registry's tamper evidence · registry