Countersign · JSON · audit · track records

External anchors

The head of the receipt hash chain is timestamped by an independent RFC 3161 authority (freetsa.org, falling back to Sectigo's public time-stamping service when FreeTSA refuses, tf-1) and written to the public Sigstore Rekor transparency log at most every 6 hours, or sooner once 50 new receipts accrue (ac-1; never when the head is unchanged; if the TSA or Rekor request fails, the next anchor follows after 60 min once the head moves, pa-1). After a head is anchored, nobody (including this service) can rewrite history before it without the audit and the anchors disagreeing.

Current head: #14703 2bbbd6678a031a1f8f615dad56d68168e3b9980733f39df7a4f8362c451812ca

Latest signed tree head (ml-1, RFC 6962)

tree_size 14703 · root_hash 2b2fa201485a9130ef32901268642e501f6a6ec5ee9d95c94fb87a7520ef59d7
signed 2026-11-04T08:03:37+00:00 by ledger key c39c3374decce909 · head receipt #14703

signed tree head (JSON) · inclusion proof for any receipt: https://countersign.signalry.ai/v1/log/inclusion?receipt=<receipt id> (linked from every receipt row on /r) · consistency from an anchored tree: https://countersign.signalry.ai/v1/log/consistency?first=<tree_size>. Since ml-2 each anchor also records the signed tree head at the anchored receipt and writes countersign-merkle-root:<tree_size>:<root_hash> to Rekor.

Anchors

Verify it yourself

TSA (RFC 3161): curl -s https://countersign.signalry.ai/v1/anchors/<id>/tsr -o a.tsr; curl -sO https://freetsa.org/files/cacert.pem; curl -sO https://freetsa.org/files/tsa.crt; openssl ts -verify -digest <head> -in a.tsr -CAfile cacert.pem -untrusted tsa.crt   # prints Verification: OK; openssl ts -reply -in a.tsr -text shows the time

TSA fallback (tf-1, anchors whose tsa_url is timestamp.sectigo.com): curl -s https://countersign.signalry.ai/v1/anchors/<id>/tsr -o a.tsr; openssl ts -verify -digest <head> -in a.tsr -CAfile /etc/ssl/certs/ca-certificates.crt   # the token embeds Sectigo's signer, CA R41 and Root R46 (cross-signed by USERTrust RSA Certification Authority, in the system roots); countersign-verify >= 0.1.10 pins the R46 key offline

Rekor (Sigstore transparency log): curl -s https://rekor.sigstore.dev/api/v1/log/entries/<rekor_uuid> | jq -r '.[].body' | base64 -d | jq -r .spec.data.hash.value   # must equal: printf 'countersign-chain-head:<head>' | sha256sum

Merkle root (ml-2): curl -s https://rekor.sigstore.dev/api/v1/log/entries/<merkle.rekor_uuid> | jq -r '.[].body' | base64 -d | jq -r .spec.data.hash.value   # must equal: printf 'countersign-merkle-root:<tree_size>:<root_hash>' | sha256sum; then curl -s "https://countersign.signalry.ai/v1/log/consistency?first=<tree_size>" proves today's tree extends it

Chain: curl -s https://countersign.signalry.ai/v1/audit   # the receipt at <seq> must still have hash <head>; audit also checks every stored anchor

Limits: an anchor proves the head existed by that time; it does not prove the receipts before it were true. Ledger entries made after the last anchor are not yet covered.