If someone asks you to prove it, can you produce the exact bytes you timestamped?

Description and use

When hashing a release, reproducing the exact bytes is essential for a valid proof. Solutions include deterministic packaging, hashing a manifest, or storing the archive itself.

Problem

When a release is hashed, signed, or timestamped, a challenge may arise if the exact bytes that produced the hash cannot be reproduced, making the proof ineffective.

Outcome

Deterministic packaging or manifest hashing ensures that the same SHA‑256 can be reproduced, allowing a valid proof of the exact bytes. Storing the exact archive is the simplest guarantee.

Workflow

• 1. Build the artifact (e.g., make dist).
• 2. Package into an archive (tar -czf release.tar.gz dist/).
• 3. Compute SHA‑256 hash of the archive.
• 4. Rebuild the artifact and repeat steps 1‑3 to compare hashes.
• 5. If hashes differ, identify metadata causing drift (mtime, owner, group, mode, entry order).
• 6. Apply deterministic flags: export SOURCE_DATE_EPOCH=$(git log -1 --format=%ct); tar --sort=name --mtime="@${SOURCE_DATE_EPOCH}" --owner=0 --group=0 --numeric-owner --mode='u+rwX,go+rX,go-w' -cf - dist/ | gzip -n > release.tar.gz; sha256sum release.tar.gz.
• 7. Re‑run rebuild test to verify identical hashes.
• 8. Alternatively, generate a manifest of file contents and hash it: cd dist; find . -type f -print0 | LC_ALL=C sort -z | xargs -0 sha256sum > ../MANIFEST.sha256; cd ..; sha256sum MANIFEST.sha256.
• 9. Store the exact archive or manifest for future proofing.

Evidence

The tar format stores more than file contents. Every entry gets: the file's modification time, which your rebuild just reset

Source

With GNU tar and gzip: export SOURCE_DATE_EPOCH=$(git log -1 --format=%ct) tar --sort=name --mtime="@${SOURCE_DATE_EPOCH}" --owner=0 --group=0 --numeric-owner --mode='u+rwX,go+rX,go-w' -cf - dist/ | gzip -n > release.tar.gz sha256sum release.tar.gz

Source

Another option is to stop timestamping the archive at all. Timestamp a manifest of what's inside it

Source