Attesting files and logs

The pattern from Getting started — hash a file, request a token, keep the token next to the file — covers most cases where you need to prove a file existed, unchanged, at a point in time.

The following examples use a Bash helper. Define it in the script that produces the evidence:

stamp() {
  openssl ts -query -sha256 -data "$1" -cert -out "$1.tsq" &&
    curl --fail --silent --show-error \
      -H "Content-Type: application/timestamp-query" \
      --data-binary "@$1.tsq" --output "$1.tsr" https://free.tsa.cnx.net.kh/
}

Use your subscriber endpoint and supplied authentication configuration for subscriber jobs. Verify successful issuance using Verifying a timestamp before treating the response as evidence. Keep the source file, .tsq, and .tsr together.

Backups

Stamp a backup right after it's produced, as part of the same job:

tar czf "/backups/daily-$(date +%Y%m%d).tar.gz" /data
stamp "/backups/daily-$(date +%Y%m%d).tar.gz"

Release artifacts

Stamp the artifact you publish, not a rebuild of it — the hash has to match exactly what a consumer downloads:

stamp release-v1.0.0.tar.gz

For a container image, stamp the digest rather than the (mutable) tag:

docker inspect --format='{{index .RepoDigests 0}}' myapp:v1.0.0 > myapp-v1.0.0.digest
stamp myapp-v1.0.0.digest

Logs

A growing log must be closed or snapshotted before timestamping so the retained bytes match the timestamped hash. Configure your logging system to rotate or export a completed interval, then timestamp that immutable file:

# Run after the logging system has closed this interval's file.
stamp /var/log/audit/archive/app-2026-10-02-09.log

Retain every completed log file with its request and response. Each token attests to its file's hash; a sequence of separate tokens does not by itself prove that logging was complete or establish a cryptographic chain between intervals.

For a batch of files, timestamp a manifest of their hashes and retain the manifest with those files. CNX's DNS evidence package uses this pattern; see Verifying report integrity for the verification procedure.