DEV Community

rene
rene

Posted on

Prove a file existed at a point in time with two free anchors: OpenTimestamps and RFC 3161

#tutorial #devops #security #opensource

If you ship AI-generated artifacts, reports or datasets, sooner or later someone asks: "how do you know this file existed, unchanged, on that date?" A git commit date or a file mtime proves nothing, because both are trivial to edit. A timestamp anchored by a third party is much harder to dispute.

Here are two free anchors you can use today, with the commands.

Anchor 1: OpenTimestamps (Bitcoin-anchored, no account) 

pip install opentimestamps-client
ots stamp report.pdf        # creates report.pdf.ots
# wait a few hours for the calendar to be confirmed in a block
ots upgrade report.pdf.ots
ots verify report.pdf.ots
Enter fullscreen mode Exit fullscreen mode

The .ots file is a proof that the SHA-256 of your file was committed to by a Bitcoin block. It uses Bitcoin only as a public notary. You do not need a wallet or any coins to stamp or verify.

Anchor 2: RFC 3161 via freeTSA 

openssl ts -query -data report.pdf -no_nonce -sha512 -cert -out report.tsq
curl -H "Content-Type: application/timestamp-query" \
     --data-binary @report.tsq https://freetsa.org/tsr > report.tsr
# verify against the freeTSA CA files you downloaded from freetsa.org
openssl ts -verify -in report.tsr -queryfile report.tsq \
     -CAfile cacert.pem -untrusted tsa.crt
Enter fullscreen mode Exit fullscreen mode

freeTSA's usage policy allows commercial use of its timestamps. It asks for at most one request per second per IP and offers no SLA.

Honest limits

  • freeTSA is an independent non-profit. It is not an eIDAS qualified trust service provider, so do not present its timestamps as legally qualified ones.
  • It is best effort with no uptime guarantee. If it is down, retry later. Do not fake a proof.
  • A timestamp proves the file existed no later than that moment. It does not prove who wrote it or that its content is true.
  • Using both anchors means one failing or being disputed does not leave you with nothing.

If you want it packaged

I bundled this flow into a small kit (a stamp script, a verify script and a REPORT that records what was and was not anchored). It is $24, and I use it myself for agent run artifacts: Timestamp Proof Kit. The link applies a 20% launch discount (code LAUNCH20, first 50 uses). The commands above are enough to do it yourself for free.

Disclosure: drafted with AI assistance and reviewed before publishing. I claim no benchmark numbers here.

Top comments (0)