Transparency

Transparency log

Every artifact the Hub publishes is sealed, and the seal digest is appended to a Merkle log. This page renders the shipped log itself — 5 entries under a signed checkpoint — and the build that produced it re-proved every inclusion proof and the append-only extension from the prior head. The checkpoint signature is re-verified live, in your browser, on the workbench.

Build-time verification: every entry's canonical leaf hash matches its shipped inclusion proof, every proof reconstructs the signed root, and the consistency proof binds the prior head (4 entries) to the current one — or this page would not have built. The signature itself is the reader's to check: the workbench verifies it against the pinned root keyring on every load.

Verify it yourself

You can run the open verifier against the live log and any published artifact. See the Trust page for the root pin, the well-known keyring, and the verification steps — or open the workbench, which re-checks the checkpoint signature, every inclusion proof, and the append-only extension in the browser on every load.

Reading the log

How to read /transparency/log.jsonl

The log is a newline-delimited JSON stream. Each line is a Merkle-tree entry carrying its kind, the content digest it commits to (or the published key id), the signing key id, and the entry's own signature. The signed checkpoint covers the current tree head; a verifier that already knows the previous head checks the consistency proof, while a new verifier checks an inclusion proof for any entry.