# Sigstore Rekor Provenance Verifier

> Sigstore Rekor Provenance Verifier is a paid API for AI agents from sicher.halowerk.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-12).

Searches the Sigstore Rekor transparency log for entries matching an artifact hash and returns signing identity, inclusion time, source repository, and workflow provenance for all matching entries.

## Facts

- Endpoint: POST https://sicher.halowerk.com/v1/provenance-verify?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sigstore-rekor-provenance-verifier-a513873f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_H5jWOW1x8OURt5syuViRu

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sigstore-rekor-provenance-verifier-a513873f -d '<json body>'
```

Example prompt: Can you check the Sigstore Rekor log for this artifact hash sha256:abc123def456... and tell me who signed it, when it was included, and which GitHub Actions workflow produced it?

## When to prefer this

Choose this endpoint when you need to verify software supply chain provenance against the Sigstore Rekor public transparency log — especially for SLSA compliance checks, CI/CD artifact auditing, or confirming that a binary matches a known signed build. Prefer this over generic hash lookups when you need signing identity and workflow attribution, not just malware detection. It is particularly valuable when multiple signers or rebuilds are possible and you need to see all entries rather than just one.

## Known failure modes

- Hash not found in Rekor log — no entries returned, artifact may be unsigned or hash incorrect
- Malformed hash input — 400 error if hash is not a valid SHA-256 or supported digest format
- Rekor API unavailable — upstream timeout or 5xx if Sigstore infrastructure is unreachable
- Partial provenance — entry exists but certificate lacks source repository or workflow fields (older signers or keyless vs key-based signing)
- Rate limiting — repeated rapid calls may be throttled by upstream Rekor API

## How this service works

Searches the Sigstore Rekor log for entries matching an artefact hash and returns what a provenance claim is actually worth: the log index and inclusion time, the signing identity from the certificate, and where available the source repository and workflow reference that produced it. Several entries for one hash are all returned, because a rebuild or a second signer is a fact worth seeing rather than collapsing.

## Output

Returns one or more Rekor log entries matching the artifact hash, each containing: the log index, the UTC inclusion timestamp, the signing certificate identity (subject, issuer), and where available the source repository URL and workflow/job reference that produced the artifact. Multiple entries are returned if the artifact was signed by more than one identity or rebuilt.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "email": {
   "type": "string",
   "maxLength": 200,
   "description": "Search by signer email instead of by hash."
  },
  "limit": {
   "type": "integer",
   "default": 5,
   "maximum": 20,
   "minimum": 1,
   "description": "How many entries to detail."
  },
  "sha256": {
   "type": "string",
   "maxLength": 71,
   "minLength": 64,
   "description": "Artefact SHA-256, with or without the sha256: prefix."
  },
  "log_index": {
   "type": "integer",
   "minimum": 0,
   "description": "Fetch one specific log entry instead of searching."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sigstore-rekor-provenance-verifier-a513873f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sicher.halowerk.com](https://www.zero.xyz/host/sicher.halowerk.com/llms.txt)