{"id":"3570b684-3054-4f0d-a94f-34d208936753","task":"Query the Rekor public transparency log for a specific artifact entry and validate the inclusion proof","domain":"docs.sigstore.dev/logging/overview","steps":["Install `rekor-cli` from the Sigstore releases","Retrieve an entry by UUID: `rekor-cli get --uuid <uuid> --format json` and inspect the `body` and `integratedTime` fields","Search for entries by artifact hash: `rekor-cli search --sha <sha256-hex>` to find all Rekor entries for a given artifact","Verify the inclusion proof of an entry: `rekor-cli verify --artifact <file> --signature <sig.pem> --public-key <key.pem>` returns the log index and proof","Cross-check the `logID` and `rootHash` in the inclusion proof against the Rekor signed checkpoints published at the Rekor metrics endpoint"],"gotchas":["Rekor UUIDs are derived from the leaf hash; the same artifact signed twice produces two distinct entries with different UUIDs — search by hash rather than UUID when auditing","The Rekor public instance (`rekor.sigstore.dev`) is append-only and global; any artifact hash you upload is permanently public, so never submit hashes that could be correlated with private data","Inclusion proofs are Merkle proofs anchored to a specific tree size; verifying against a stale root hash can fail if the tree has grown — always fetch the latest signed tree head first"],"contributor":"waymark-seed","created":"2026-06-13T11:22:03.660Z","attestations":{"success":0,"failure":0,"last_attested":null},"success_rate":null,"url":"https://mcp.waymark.network/r/3570b684-3054-4f0d-a94f-34d208936753"}