Transparency log
A transparency log is a public, append-only Merkle-tree ledger (the Certificate-Transparency model formalized in RFC-6962) where a signed checkpoint plus an inclusion proof lets anyone verify an entry landed, without trusting the log's operator. Caisson's audit-worm package submits each audit-chain anchor to Sigstore's Rekor v2 log over ed25519ph, then verifies the resulting receipt fully offline against the embedded checkpoint key.
In code
export function verifyRekorReceipt(
receipt: TransparencyReceipt,
anchorBytes: Uint8Array,
): RekorVerifyResult {
// ...embedded log key parsed from receipt.logPublicKey (DER SPKI)...
const cp = parseCheckpoint(receipt.checkpoint);
if (cp === null) return fail("checkpoint envelope is malformed");
if (cp.origin !== receipt.origin) {
return fail("checkpoint origin does not match the receipt origin");
}
// (1) find the log's own signature line (keyHash-bound) and verify it.
const expectKeyHash = sha256(
new TextEncoder().encode(cp.origin),
Uint8Array.of(0x0a, 0x01),
rawLogPub,
).subarray(0, 4);
const ownSig = cp.sigLines.find(
(s) =>
s.name === cp.origin &&
s.blob.length === 68 &&
bytesEqual(s.blob.subarray(0, 4), expectKeyHash),
);
if (ownSig === undefined) return fail("no matching log checkpoint signature");
if (!edVerify(null, cp.signedText, logKey, ownSig.blob.subarray(4))) {
return fail("checkpoint signature did not verify");
}
// (2) RFC-6962 inclusion proof against the VERIFIED checkpoint root + tree size.
const leafHash = sha256(Uint8Array.of(LEAF_PREFIX), leaf);
if (!verifyInclusion(BigInt(receipt.logIndex), cp.treeSize, leafHash, proof, cp.rootHash)) {
return fail("inclusion proof does not reconstruct the checkpoint root");
}
// (3) leaf digest must equal SHA-512(anchorBytes) under SHA2_512 — binds THIS receipt to THIS anchor.
const leafData = leafBodySchema.parse(
JSON.parse(new TextDecoder().decode(leaf)),
).spec.hashedRekordV002.data;
if (leafData.algorithm !== "SHA2_512") {
return fail("leaf digest algorithm is not SHA2_512");
}
const expectedDigestB64 = createHash("sha512").update(anchorBytes).digest("base64");
if (!safeEqualFixed(leafData.digest, expectedDigestB64)) {
return fail("leaf digest does not match SHA-512 of the current anchor bytes");
}
return { ok: true, logIndex: receipt.logIndex };
}How it holds
Two independent proofs compose, both required
verifyRekorReceipt fails closed unless BOTH hold: the log's checkpoint signature verifies against the receipt-embedded Ed25519 key (the log attests a root), and an RFC-6962 inclusion proof reconstructs that exact root from the leaf (the entry is under that root). Either check alone would be forgeable; together they aren't.
The receipt is self-contained, it outlives its shard
Rekor shards retire roughly every six months and v2 dropped online proof retrieval, but WORM receipts are retained for years. So the receipt snapshots the checkpoint-signing key and origin at submit time and verifies with zero network and no TUF freshness check, a years-old receipt against a since-retired shard still verifies.
Never a hardcoded shard, never a non-ed25519ph signer
resolveWriteUrl reads the write URL from a deployment-supplied SigningConfig and asserts https at call time; RekorAnchorLog's constructor throws if the injected signer's algorithm isn't exactly "ed25519ph" (hashedrekord rejects plain Ed25519). Both are runtime refusals, not documentation.
Public egress requires an explicit, unforgeable opt-in
RekorAnchorLog's constructor throws unless it receives a branded IrreversiblePublicityOptIn, which only irreversiblePublicityOptIn() can mint, and only by echoing the exact PUBLICITY_ACKNOWLEDGEMENT string. A public-log submission can't happen by default or by accident.