JGoyd Public Evidence System: 187 Verifiable Events | 5 CVE Rescores | 27 Global

Cases

scripts/anchor.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# anchor.sh — Hash, PGP-sign, and OpenTimestamps-anchor a single artifact.
+#
+# Usage:   ./anchor.sh path/to/artifact.eml
+# Effect:  Produces <artifact>.sha256, <artifact>.asc, <artifact>.ots in the same directory.
+#
+# Requirements:
+#   gpg (with the canonical signing key already imported and the fingerprint
+#        configured below or in env var GOYD_PGP_FPR)
+#   sha256sum (coreutils)
+#   ots         (pip install opentimestamps-client)
+#
+# Resilience notes:
+#   - We sign the hash FILE, not the artifact directly. This is so a verifier
+#     can cheaply check "this artifact is the one I anchored" without re-reading
+#     a multi-MB file.
+#   - We OTS-anchor the hash FILE for the same reason: small file, fast Bitcoin
+#     attestation, no need to push the artifact body anywhere.
+
+set -euo pipefail
+
+if [[ $# -ne 1 ]]; then
+  echo "usage: $0 <artifact-path>" >&2
+  exit 64
+fi
+
+ART="$1"
+if [[ ! -f "$ART" ]]; then
+  echo "not a file: $ART" >&2
+  exit 66
+fi
+
+# CHOOSE ONE canonical signing key. The user currently has two fingerprints in
+# circulation; reconcile before using this script in production.
+FPR="${GOYD_PGP_FPR:-4A041F506D894F5EE391743864878B56A2EB2D11}"
+
+DIR="$(dirname "$ART")"
+BASE="$(basename "$ART")"
+HASH_FILE="${ART}.sha256"
+SIG_FILE="${ART}.asc"
+OTS_FILE="${HASH_FILE}.ots"
+
+# 1. Hash
+( cd "$DIR" && sha256sum "$BASE" ) > "$HASH_FILE"
+echo "wrote $HASH_FILE"
+
+# 2. PGP-sign the artifact (detached, armored)
+gpg --local-user "$FPR" --armor --detach-sign --output "$SIG_FILE" "$ART"
+echo "wrote $SIG_FILE"
+
+# 3. PGP-sign the hash file too (so a verifier can cheaply confirm the binding)
+gpg --local-user "$FPR" --armor --detach-sign --output "${HASH_FILE}.asc" "$HASH_FILE"
+echo "wrote ${HASH_FILE}.asc"
+
+# 4. OpenTimestamps-anchor the hash file
+ots stamp "$HASH_FILE"
+echo "wrote $OTS_FILE  (pending Bitcoin confirmation, run 'ots upgrade' later)"
+
+echo
+echo "Verification commands a third party will run:"
+echo "  sha256sum -c $HASH_FILE"
+echo "  gpg --verify $SIG_FILE $ART"
+echo "  gpg --verify ${HASH_FILE}.asc $HASH_FILE"
+echo "  ots verify $OTS_FILE"