Timestamp a release

Use a release artifact's final bytes as the timestamp subject. This can provide evidence that a particular archive or binary matched a digest at the recorded time; it does not replace software signing or a provenance system.

Create the artifact and submit it

Do not timestamp a file that may still change. Then submit the final artifact:

witness attest --file product-1.2.3.tar.gz --save release-job.json

Poll using the SHA-256 hash printed by the command:

witness status <64-character-sha256-hex>

Once confirmed, save a current response and verify the nested signed result:

witness attest --hash <64-character-sha256-hex> --save release-confirmed.json
jq '.signed_attestation' release-confirmed.json > release-attestation.json
witness verify release-attestation.json

Replace the placeholder with the artifact's actual digest.

Preserve the evidence

Keep the exact artifact, digest, confirmed job response, signed attestation, and the verification configuration used by your release process. If you later use a proof bundle or external anchor, retain those outputs as separate evidence.

Caveats

Witness does not identify the publisher, sign the artifact, establish a build provenance chain, or prove that an artifact is safe. Pair it with the signing and distribution controls appropriate to your release. The gateway and proxy can observe request metadata, and Witness remains pre-1.0 and unaudited.