Yenta Girl Canvas Print SW-2026-257068
Seven steps, in order. Each one is something a collector can check without trusting this website.
When a piece leaves the bench, the workshop enters it in its records and gives it a serial. No other work carries that number, and the record page at that serial is permanent.
What you can check
The record is a small file called provenance.json. It lists the serial, the title, the making details, and the address of the public page. Everything that follows is about protecting that one file.
What you can check
A fingerprint is a short code computed from a whole file, using a method called SHA-256. Change one letter in the file and the fingerprint changes completely. Two files with the same fingerprint are the same file, to the last byte.
What you can check
9cdb923b3f1e9c1c8a4bb36c4a1bfb38747b161f2b433a5caeb6b0b6574d49acDownload the certificate PDF, ask your computer for its SHA-256, and the two should match. The record file has its own fingerprint, and that is the one that goes into the log.The workshop signs the fingerprint with its own signing certificate, its digital ID. A signature is a seal only the workshop can make and anyone can check. If the file changes after signing, the seal no longer fits.
What you can check
Sunlit Workshop files the fingerprint, its signature, and its signing certificate in a public log called Rekor, run by the Sigstore project under the Linux Foundation. The log is append-only: anyone can add an entry, and nobody can quietly change or remove one afterwards. The log holds the fingerprint and the seal, not the record itself. The workshop is the publisher; the work files a second public-log entry over the same fingerprint.
What you can check
108e9186e8c5677ad52cf87366442327924a6f12aeec6486ffa4045a08d25a75a53d1d47a392ade6 The work’s own entry is 2,786,513,160 (open it · Check on Sigstore or download it with its inclusion proof) .The log shows that this exact record existed, and was signed by Sunlit Workshop, by the time of the entry. It does not by itself prove the physical piece in your hand. For that, compare any recorded physical marks with the item’s record page.
What you can check
If the workshop changes this record later, say to add a photo or pair a new chip, that change is signed and filed the same way. The history grows; nothing earlier is erased.
What you can check
With the rekor-cli tool, the record file, its signature, and the workshop’s public signing certificate, one command confirms the entry on your own machine:
rekor-cli verify --artifact provenance.json --signature provenance.json.sig --public-key doc-signing.pemThe work files a second entry over the same fingerprint. Check it with its signature and its signing certificate:
rekor-cli verify --artifact provenance.json --signature provenance.json.item.sig --public-key item-signing-cert.pemThe work’s own countersignature checks with standard OpenSSL, the record file, the countersignature file from the record page, and the published Sunlit Bytes roots (roots.pem, linked from the certificate page):
openssl cms -verify -binary -inform DER -content provenance.json -in provenance.json.item.p7s -CAfile roots.pem -purpose anyThe certificate is also independently timestamped (OpenTimestamps, RFC 3161); those files are listed under Technical proofs on the record page.