Public ledger · live
Every certificate and finding, in the open
This page shows the public ledger on GitHub, with its GitLab and Codeberg copies. For speed it uses a copy workrr refreshes every 5 minutes, and reads GitHub directly in your browser when that copy is stale or you choose read live. Each certificate links to its entry in Rekor, the public transparency log.
Loading the ledger…
Certificates
Issued certificates and their Rekor entries
Newest first. The artifact name opens the exact certified folder in the publisher's repo; "download .zip" gets the repo at the certified commit, with the artifact in the folder shown under Source. workrr never hosts artifacts. Each Rekor link opens the entry in the public log, and the Certificate column has the signed certificate to check the download with workrr verify.
| Artifact | Source | Level | Issued | Rekor entry | Certifier | Certificate |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Findings
Flagged: checks that failed in a public scan
A finding is what a public scan signs when a security check fails: the rule, the file and line, and the commit. It states facts, not intent: some matches are innocent. Anyone can reproduce one with workrr verify-finding. A new commit is re-scanned automatically, and a fixed one shows its new level. How findings work · disagree with one? Open an issue.
| Artifact | Source | Kind | Failed checks | Signed | Rekor entry | Finding |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Activity
What keeps the ledger honest
monitor re-checks Rekor's checkpoint is append-only, every 5 minutes. discover finds new certificates. ingest verifies and indexes them. anchor timestamps into Bitcoin. All runs are public on GitHub Actions, the GitLab witness's on GitLab pipelines, and a full copy lives on Codeberg.
- Loading…
Don't rely on this page
Audit it yourself
This view only displays what's in the ledger. Real verification happens on your machine:
git clone https://github.com/workrr-trust/ledger && cd ledger
MIRRORS=https://gitlab.com/workrr-trust/ledger.git bash scripts/audit.shThe audit re-verifies every certificate's signature and Rekor inclusion, re-checks that the whole checkpoint chain is append-only, and compares the GitHub and GitLab histories. More ways to verify.