Notarizing 59 Repositories with Dual RFC 3161 Timestamps: An Offline-Verifiable Supply-Chain Record and Its Limits

Abstract

We present and measure a supply-chain record that binds 59 source repositories, 6,713 file entries in total, to two independently operated RFC 3161 timestamp authorities, and that a third party can check without network access and without trusting the tool that produced it. Each repository is described by a canonical, byte-sorted manifest; each timestamp token commits to the SHA-256 of one manifest's bytes; a master index records every manifest digest together with both tokens and is itself timestamped by both authorities. We audit all 59 committed records: every manifest digest matches its index row, every recorded commit matches the manifest header, and all 120 tokens verify offline against two committed trust anchors, with the token imprint equal to the SHA-256 of the signed file in all 120 cases. Negative controls confirm that a mutated manifest, a manifest belonging to another repository, and a wrong trust anchor are each rejected. The claim is deliberately narrow. The record shows that particular bytes existed before a time attested by two commercial authorities; it does not establish authorship, does not bind file contents unless the corresponding git objects are available, cannot show that either authority was honest at signing time, and does not conceal the names of three private repositories that it indexes. We state these limits, and the quantities our audit did not measure, explicitly.

Body

Imported entry paper (unverified hypothesis)

This paper was imported into jetessays as an entry paper from the author's local archive (notarization). It is not an established result: under jetessays policy every item is an UNVERIFIED HYPOTHESIS unless explicitly verified. The original source files (LaTeX, figures, scripts, measurements) live in the author's local archive and are not hosted here.

Abstract (as submitted)

We present and measure a supply-chain record that binds 59 source repositories, 6,713 file entries in total, to two independently operated RFC 3161 timestamp authorities, and that a third party can check without network access and without trusting the tool that produced it. Each repository is described by a canonical, byte-sorted manifest; each timestamp token commits to the SHA-256 of one manifest's bytes; a master index records every manifest digest together with both tokens and is itself timestamped by both authorities. We audit all 59 committed records: every manifest digest matches its index row, every recorded commit matches the manifest header, and all 120 tokens verify offline against two committed trust anchors, with the token imprint equal to the SHA-256 of the signed file in all 120 cases. Negative controls confirm that a mutated manifest, a manifest belonging to another repository, and a wrong trust anchor are each rejected. The claim is deliberately narrow. The record shows that particular bytes existed before a time attested by two commercial authorities; it does not establish authorship, does not bind file contents unless the corresponding git objects are available, cannot show that either authority was honest at signing time, and does not conceal the names of three private repositories that it indexes. We state these limits, and the quantities our audit did not measure, explicitly.

Note

Imported via the jetessays seed importer. The author chose not to keep an explicit upload record on this site; the work is listed as an entry paper so it can be discovered, discussed, endorsed and relayed.

Discussion

Log in to join the discussion

← back to browse