Attesting files and logs

The pattern from Getting started — hash a file, request a token, keep the token next to the file — covers most cases where you need to prove a file existed, unchanged, at a point in time.

Backups

Stamp a backup right after it's produced, as part of the same job:

tar czf "/backups/daily-$(date +%Y%m%d).tar.gz" /data
stamp "/backups/daily-$(date +%Y%m%d).tar.gz"

Release artifacts

Stamp the artifact you publish, not a rebuild of it — the hash has to match exactly what a consumer downloads:

stamp release-v1.0.0.tar.gz

For a container image, stamp the digest rather than the (mutable) tag:

docker inspect --format='{{index .RepoDigests 0}}' myapp:v1.0.0 > myapp-v1.0.0.digest
stamp myapp-v1.0.0.digest

Logs

A log file changes continuously, so there's no single point to stamp it once. Stamp it periodically instead — hourly, via cron — and keep each token:

# hourly, via cron
stamp /var/log/audit/app.log
mv /var/log/audit/app.log.tsr "/var/log/audit/stamps/app.log.$(date +%Y%m%d%H%M).tsr"

The resulting sequence of tokens forms a chain: each one proves the log's content at that point existed by that time, so an entry that appears between two consecutive tokens' timestamps but predates the log state one of them attests to is evidence of tampering. This is the same pattern CNX's own DNS audit reports use to seal each day's manifest — see Verifying report integrity for that concrete example.