Sigstore Verification
MLB Picks · Wednesday, July 8, 2026
The Sigstore log entry below cryptographically proves that the picks file existed at a specific moment in time. The hash in Sigstore matches the SHA-256 of the picks file — meaning the file cannot have been altered since the log entry was created.
What was signed
- File
- mlb/3 picks · 2026-07-08.json
- SHA-256
- 8b5c57b0227040a5c1816564f5e0dd84aed4e55f8ae91b17b24c0af10f1235c2
- Source
- Open raw file
Contents — 3 picks
- ·
SEA
MIA—MIA ML @ 2.10 - ·
ARI
SD—Under 8.0 @ 1.95 - ·
OAK
DET—DET -1.5 @ 2.30
hashes match
What Sigstore logged
- SHA-256 of signed content
- 8b5c57b0227040a5c1816564f5e0dd84aed4e55f8ae91b17b24c0af10f1235c2
- Integrated at (Rekor log time)
- 2026-07-08 13:36:34 UTC
- Log index
- #2,116,395,522
- Signed by
- github.com/jvalenza11/dailybet
.github/workflows/daily_pipeline.yml@main
What this proves, in plain English
Sigstore is a third-party transparency log. When our pipeline ran at 2026-07-08 13:36:34 UTC, it computed the SHA-256 of the picks file and submitted that hash to Sigstore. Sigstore recorded it, then notarized the entry with the GitHub Actions identity that submitted it (visible above). The entry can never be deleted or backdated.
If we changed even one character of the picks file after this entry was created, its SHA-256 would change — and the file no longer matches the hash Sigstore has on record. That's the chain: file → hash → Sigstore log entry → identity. Anyone can independently re-compute the SHA of the picks file above and confirm it matches the hash shown on this page and on search.sigstore.dev.