Software distribution

Witness can timestamp the exact bytes of a release artifact. It is complementary to software signing, provenance, transparency logging, and package-repository controls; it does not replace them.

Timestamp a distribution artifact

After producing the final archive or binary, submit it locally by file:

witness attest --file package.tar.gz --save package-job.json

Poll with witness status <hash>. After confirmation, save the confirmed job, extract .signed_attestation, and verify it:

witness attest --hash <hash> --save package-confirmed.json
jq '.signed_attestation' package-confirmed.json > package-attestation.json
witness verify package-attestation.json

Use the actual 64-character SHA-256 hash in place of <hash>.

What this establishes

Verification establishes that the configured witness threshold signed the attestation for that digest. It does not establish who built or published the artifact, whether the build was reproducible, or whether the artifact is safe. Publish the digest and signature/provenance material according to the package ecosystem's existing controls.

Caveats

Keep the artifact and evidence paired, and review the network configuration used for verification. Hash-only input can still reveal predictable artifacts, and gateway infrastructure can observe request metadata. Witness is pre-1.0, unaudited, and not Byzantine-fault-tolerant.