{ "schema": "varexis-index-free-publication-preview/1", "catalogue_version": "ice-05-tranche-61-v1", "route_id": "agentic_reviewed_sigstore_rekor_timestamp_version", "record_id": "VXI-EXT-ICE05-SIGSTORE-REKOR-TIMESTAMP-VERSION-01-v1", "question": "Can Rekor’s signed integrated time be treated as an immutable independently trusted signing timestamp?", "answer": "Sigstore documents that Rekor v1 integratedTime uses Rekor’s internal clock and is not included in the append-only log node, despite being signed. Rekor v2 uses a separate timestamp authority. Timestamp trust must therefore be evaluated by version and evidence type.", "records": [ { "record_id": "VXI-EXT-ICE05-SIGSTORE-REKOR-TIMESTAMP-VERSION-01-v1", "url": "/varexis-index/records/sigstore-rekor-timestamp-version.json", "content_sha256": "78165b63326d053d01351380a1e8c8ff7393e7eb58d622ccbe8d2b55ac623aa1", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-29T01:09:39.613311Z", "record_id": "VXI-EXT-ICE05-SIGSTORE-REKOR-TIMESTAMP-VERSION-01-v1", "record_kind": "external_reference", "title": "Sigstore Rekor timestamp trust and version", "system": "Sigstore", "evidence_family": "vendor_evidence_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Can Rekor’s signed integrated time be treated as an immutable independently trusted signing timestamp?", "near_questions": [ "Is Rekor integratedTime an immutable log timestamp?", "What changes about timestamp trust in Rekor v2?", "Does a signed log time prove independent signing time?", "Which time-source evidence is needed for an attestation?" ], "supported_claims": [ { "claim": "Sigstore documents that Rekor v1 integratedTime uses Rekor’s internal clock and is not included in the append-only log node, despite being signed. Rekor v2 uses a separate timestamp authority. Timestamp trust must therefore be evaluated by version and evidence type.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Do not treat a signed v1 integratedTime as an independently trusted immutable timestamp. Establish the applicable time source and validation policy; no timestamp proves business completion.", "Buyer implementation, live runtime enforcement, settled payment, certification or permission to act are not established.", "No expanded capabilities or licences for existing INDEX executables." ], "public_summary": "Sigstore documents that Rekor v1 integratedTime uses Rekor’s internal clock and is not included in the append-only log node, despite being signed. Rekor v2 uses a separate timestamp authority. Timestamp trust must therefore be evaluated by version and evidence type.", "related_record_ids": [], "source_review": { "source_type": "official_external_documentation", "source_title": "Sigstore: Timestamps", "source_url": "https://docs.sigstore.dev/cosign/verifying/timestamps/", "checked_on": "2026-10-29", "candidate_record_id": "VXI-EXT-ICE05-SIGSTORE-REKOR-TIMESTAMP-VERSION-01-v1", "candidate_record_sha256": "246fb274a8d41017bdc511f807ef3ae0a5a9b6ba0f32b04a86f146698a40fa2d", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "Sigstore documents that Rekor v1 integratedTime uses Rekor’s internal clock and is not included in the append-only log node, despite being signed. Rekor v2 uses a separate timestamp authority. Timestamp trust must therefore be evaluated by version and evidence type.", "required_buyer_context": "Rekor version; Timestamp evidence and trusted authority; Log inclusion evidence; Certificate validity window. Buyer deployment not inspected.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "decision_profile": { "schema": "varexis-vendor-evidence-review/1", "review_status": "documentation_review_only", "checked_on": "2026-10-29", "claim_to_check": "Can Rekor’s signed integrated time be treated as an immutable independently trusted signing timestamp?", "documented_statement": { "status": "documented", "statement": "Sigstore documents that Rekor v1 integratedTime uses Rekor’s internal clock and is not included in the append-only log node, despite being signed. Rekor v2 uses a separate timestamp authority. Timestamp trust must therefore be evaluated by version and evidence type.", "source_ids": [ "sigstore-time" ] }, "review_inference": { "status": "review_inference", "statement": "Review sigstore rekor timestamp trust and version before accepting the buyer claim. The prior record distinguishes certificate expiry from signing-time verification. This question qualifies the timestamp source itself and the material v1/v2 evidence difference. This is a documentation-review judgment, not an observed deployment outcome.", "source_ids": [ "sigstore-time" ] }, "buyer_evidence_required": [ "Rekor version", "Timestamp evidence and trusted authority", "Log inclusion evidence", "Certificate validity window" ], "review_condition": { "status": "varexis_review_policy", "statement": "Do not treat a signed v1 integratedTime as an independently trusted immutable timestamp. Establish the applicable time source and validation policy; no timestamp proves business completion." }, "unknowns": "Buyer configuration, effective authority, complete usage and final business outcomes were not inspected.", "unknown_finding": { "status": "unknown", "statement": "Buyer configuration, effective authority, complete usage and final business outcomes were not inspected." }, "evidence_sources": [ { "source_id": "sigstore-time", "url": "https://docs.sigstore.dev/cosign/verifying/timestamps/", "final_url": "https://docs.sigstore.dev/cosign/verifying/timestamps/", "captured_at_utc": "2026-10-29T00:50:21.050964+00:00", "status": 200, "content_type": "text/html; charset=UTF-8", "bytes": 61729, "sha256": "1382b0f27c83468fef0603ab77974c854142643a97530a69964b91e475c42e04", "title": "Sigstore: Timestamps", "hash_basis": "SHA-256 of captured HTTP response body bytes", "checked_on": "2026-10-29", "capture_status": 200, "claim_review_completed": true, "reviewed_sections": [ "Rekor v1", "Rekor v2" ], "version_context": "Rolling official documentation captured 2026-10-29; exact response hash is pinned, not a stable vendor release. Verify the deployed API/version and account feature availability. ", "rights_review": "Original factual paraphrase and attributed source metadata only. Captured documentation and code remain private; no source prose, examples, images or vendor marks are redistributed. No licence to vendor software or buyer assurance is granted." } ], "observed_deployment": false, "commercial_reliance_boundary": "Source documentation supports only the stated boundary. Existing licensed checkers analyse supported supplied declarations; they do not query these providers, verify live systems, settle payments or certify compliance.", "paid_value": { "decision_context": "Review sigstore rekor timestamp trust and version before accepting the buyer claim. The prior record distinguishes certificate expiry from signing-time verification. This question qualifies the timestamp source itself and the material v1/v2 evidence difference.", "free": "Complete review, practical questions, source references and limitations; freely accessible and locally saveable.", "single_request": "Unavailable for this publication-only record; historical saved retrieval remains unchanged.", "evidence_receipt": "Unavailable for this publication-only record; no new paid retrieval entitlement.", "excluded": [ "Fresh vendor research", "Live provider inspection", "Runtime enforcement or certification", "Expanded executable schemas or licences", "Native Coupa, Stripe Issuing, GitLab or Sigstore validation" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck the source and applicable API, account and configuration before current reliance. No monitoring or fresh research is included.", "specific_watch": "Rekor v1;Rekor v2" }, "buyer_relevance": "Review sigstore rekor timestamp trust and version before accepting the buyer claim. The prior record distinguishes certificate expiry from signing-time verification. This question qualifies the timestamp source itself and the material v1/v2 evidence difference.", "refusal_conditions": [ "Do not treat a signed v1 integratedTime as an independently trusted immutable timestamp. Establish the applicable time source and validation policy; no timestamp proves business completion.", "Do not infer buyer deployment conformance or successful business outcomes from source documentation." ] }, "niche": { "niche_id": "ice05-audit", "label": "Audit, Provenance & Evidence Accountability", "classification_id": "audit", "classification_label": "Audit, Provenance & Evidence Accountability", "topic_id": "audit", "buyer_intent": "Review sigstore rekor timestamp trust and version before accepting the buyer claim. The prior record distinguishes certificate expiry from signing-time verification. This question qualifies the timestamp source itself and the material v1/v2 evidence difference.", "comparison_role": "supplementary_discovery" }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#sigstore-rekor-timestamp-version", "machine_readable_record": "/varexis-index/records/sigstore-rekor-timestamp-version.json" } } ], "access": { "mode": "exact_http_only", "payment_required": false, "purchase_url": null, "mcp_preview_available": false, "paid_saved_retrieval_available": false, "natural_language_search_qualified": false }, "boundary": "Catalogue additions are available free through the exact HTTP JSON links below. Enhanced natural-language discovery is not yet qualified for these records. They are outside MCP search, MCP preview and paid saved retrieval. No search qualification, executable capability or entitlement is added.", "content_sha256": "ae862180e973a0230f7551ff192c6db9fd2ff66455690beef09defd37abe2a26" }