Back to the record

1. 1

   The work is finished and given its serial

   When a piece leaves the bench, the workshop enters it in its records and gives it a serial. No other work carries that number, and the record page at that serial is permanent.

   What you can check

   Serial SW-2026-257068, made 24 August 2026. It matches the serial on the piece and on the record page.
2. 2

   The workshop writes the record

   The record is a small file called provenance.json. It lists the serial, the title, the making details, and the address of the public page. Everything that follows is about protecting that one file.

   What you can check

   The file itself is reserved for the registered owner, who can download it from the record page after signing in. Everyone else can still check its fingerprint and signature, which is what the next steps are for.
3. 3

   The record gets a fingerprint

   A fingerprint is a short code computed from a whole file, using a method called SHA-256. Change one letter in the file and the fingerprint changes completely. Two files with the same fingerprint are the same file, to the last byte.

   What you can check

   Every file the workshop publishes gets one. The fingerprint of this work’s certificate PDF, for example:9cdb923b3f1e9c1c8a4bb36c4a1bfb38747b161f2b433a5caeb6b0b6574d49acDownload the certificate PDF, ask your computer for its SHA-256, and the two should match. The record file has its own fingerprint, and that is the one that goes into the log.
4. 4

   The workshop signs it

   The workshop signs the fingerprint with its own signing certificate, its digital ID. A signature is a seal only the workshop can make and anyone can check. If the file changes after signing, the seal no longer fits. The work carries two certificates of its own. Its identity certificate names the work and signs nothing. Its signing certificate signs the certificate PDF and countersigns this same record, so the workshop and the work both vouch for the same file.

   What you can check

   The workshop’s public signing certificate is published for anyone to download, and so is the signature over this record. This work also carries its own digital certificate, a separate ID card for this one piece, and its signing certificate. The work’s countersignature is listed under Technical proofs on the record page, beside the workshop’s signature.
5. 5

   The signature is published in a public log

   Sunlit Workshop files the fingerprint, its signature, and its signing certificate in a public log called Rekor, run by the Sigstore project under the Linux Foundation. The log is append-only: anyone can add an entry, and nobody can quietly change or remove one afterwards. The log holds the fingerprint and the seal, not the record itself. The workshop is the publisher; the work’s own countersignature is anchored by the later entries that name its fingerprint.

   What you can check

   Entry 2,777,409,373, filed 10 September 2026, 03:56 UTC. See the entry or download it with its inclusion proof. Its identifier in the log:108e9186e8c5677ad52cf87366442327924a6f12aeec6486ffa4045a08d25a75a53d1d47a392ade6
6. 6

   What this proves, and what it does not

   The log shows that this exact record existed, and was signed by Sunlit Workshop, by the time of the entry. It does not by itself prove the physical piece in your hand. For that, match the seal on the work to the hologram on the record page, and tap the chip in the app for a live check.

   What you can check

   The record page shows the hologram to match. Marks & tags explains what each kind of check proves.
7. 7

   Later changes are logged too

   If the workshop changes this record later, say to add a photo or pair a new chip, that change is signed and filed the same way. The history grows; nothing earlier is erased.

   What you can check

   • Certificate reissued10 Sept 2026Entry 2,777,325,185
   • Record updated10 Sept 2026Entry 2,777,387,763
   • Certificate reissued10 Sept 2026Entry 2,777,393,746
   • Record updated10 Sept 2026Entry 2,777,409,456