Skip to content

Timestamp a file

This workflow hashes a file locally, submits the 64-character hexadecimal SHA-256 digest, and polls the resulting durable job. Witness does not upload the file through this command.

Submit the file

With a built witness binary or through Cargo:

cargo run -p witness-cli -- attest --file document.pdf --save attestation-job.json

The first response may be pending or retryable. The command prints the hash; save it for polling. A confirmed job contains the signed attestation.

Poll and verify

witness status <64-character-sha256-hex>
witness attest --hash <64-character-sha256-hex> --save confirmed-job.json
jq '.signed_attestation' confirmed-job.json > signed-attestation.json
witness verify signed-attestation.json

Replace the placeholder with the actual hash; it is not a literal CLI value. verify fetches the public verification configuration from the gateway and performs cryptographic verification locally.

Caveats

  • A hash of public or predictable content can be guessed. Hash-only submission is not unconditional confidentiality.
  • Gateway, proxy, and network operators can still observe transport metadata.
  • A valid signature proves the configured witness threshold signed the attestation. It does not prove authorship, ownership, or content truth.
  • Witness is pre-1.0, unaudited, and not Byzantine-fault-tolerant.