Package: git-timestamp
git timestamp— Git Timestamping Client forZeitgitterQuick setupBefore you can rungit timestampto create a branch timestamp (recommended)
orgit timestamp --tag SomeTimestampedTag(alternative) in any of your git
repositories, follow these instructions:Ubuntu 16.04, 18.04, 19.10, 20.04, or 20.10 using Python 3sudoaptinstallpython3-pippython3-pygit2
sudopip3installgit-timestamp(Installingpython3-pygit2is not required in all cases, but not
doing it can lead to strange error messages when runningpip3 install git-timestampin some configurations.)pygit2is a very brittle package with subtle (or not so subtle)
dependencies on system packages. If you want to upgradegit-timestamplater, the following command is recommended:sudopip3install-Ugit-timestamp`pip3freeze|greppygit2`Freezingpygit2in this way can also be needed in other
circumstances and for other packages relying onpygit2.Timestamping: Why?Being able to provide evidence thatyou had some piece of information at a
given timeandit has not changed sinceare important in many aspects of
personal, academic, or corporate life.It can help provide evidencethat you had some idea already at a given time,that you already had a piece of code, orthat you knew about a document at a given time.Timestamping does not assureauthorshipof the idea, code, or document. It
only provides evidence to theexistenceat a given point in time. Depending
on the context, authorship might be implied, at least weakly.Zeitgitterfor TimestampingZeitgitterconsists of two components:A timestamping client,git timestamp, which can add a timestamp as a digital signature to
an existinggitrepository. Existinggitmechanisms can then be used
to distribute these timestamps (stored in commits or tags) or keep them
private.A timestamping server,zeitgitterd, which supports timestampinggitrepositories and
stores its history of commits timestamped in agitrepository as well.
Anybody can operate such a timestamping server, but using an independent
timestamper provides strongest evidence, as collusion is less likely.Publication of the timestamps history; as well asgetting cross-timestamps of other independent timestampers on your
timestamp history
both provide mechanisms to assure that timestamping has not been done
retroactively ("backstamping").The timestamping client is calledgit timestampand allows to issue
timestamped, signed tags or commits.To simplify deployment, we provide a free timestamping server athttps://gitta.zeitgitter.net.
It is able to provide several
million timestamps per day. However, if you or your organization plan to issue
more than a hundred timestamps per day, please consider installing and using
your own timestamping server and have it being cross-timestamped with other
servers.Timestamping as a networkThe revolutionary idea behind Zeitgitter is to have timestampers cross-verify
each other. This results in a network which makes it hard to cheat. In fact,
the network requiresonly a single trustworthy memberto prevent all
others from cheating. Even more so, you do not need to know who the
non-cheating member is, as long as you can be sure that there is one or not
all the bad guys are colluding.In fact, the non-cheating member may even change over time. As long as there is
always at least one member who does not backdate any timestamps, this role can
freely move between members.This extreme resilience makes timestamping with Zeitgitter so trustworthy.Client UsageOptionsusage:git-timestamp[--help][--version][--tagTAG][--branchBRANCH][--serverSERVER][--append-branch-namebool][--gnupg-homeGNUPG_HOME][--enable[bool]][--require-enable][--quiet[bool]][COMMIT]Interface to Zeitgitter, the network of independent GIT timestampers.positional arguments:COMMIT:          Which commit-ish to timestamp. Must be a branch name
for branch timestamps with--append-branch-name. Can
be set bygit config timestamp.commit-branch;
fallback default: 'HEAD'optional arguments:--help,-h:   Show this help message and exit. When called asgit timestamp(space, not dash), use-h, as--helpis
captured bygititself.--version:        Show program's version number and exit--tagTAG:        Create a new timestamped tag named TAG--branchBRANCH:  Create a timestamped commit in branch BRANCH, with
identical contents as the specified commit. Default
name derived from servername plus-timestamps. Can
be set bygit config timestamp.branch--serverSERVER:  Zeitgitter server to obtain timestamp from. 'https://'
is optional. The following aliases are supported:
gitta → gitta.zeitgitter.net, diversity →
diversity.zeitgitter.net. Can be set bygit config timestamp.server; fallback default:
'https://gitta.zeitgitter.net'--append-branch-namebool:
Whether to append the branch name of the current
branch to the timestamp branch name, i.e., create per-
branch timestamp branches. (masterwill never be
appended.). Can be set bygit config timestamp.append-branch-name; fallback default:
'True'--gnupg-homeGNUPG_HOME:
Where to store timestamper public keys. Can be set by
git configtimestamp.gnupg-home--enable[ENABLE]: Forcibly enable/disable timestamping operations;
mainly for use ingit config. Can be set bygit config timestamp.enable--require-enable: Disable operation unlessgit config timestamp.enablehasexplicitelybeen set to true--quiet[bool],-q[bool]
Suppress diagnostic messages, only print fatal errors.
Can be set bygit config timestamp.quiet--tagtakes precedence over--branch. When in doubt, use--tagfor
single/rare timestamping, and--branchfor reqular timestamping.boolvalues can be specified as true/false/yes/no/0/1. Arguments with optionalbooloptions default to true if the argument is present, false if absent.Automatic timestamping of every commitTo automatically timestamp every commit, create an executable file.git/hooks/post-commitwith the following contents:#!/bin/shgittimestampAppend parameters as you like.If you do not need parameters (i.e., everything matches the default or has been
overridden withgit config), and you have no other post-commit needs, run the
following command in the root of your checked out repository:ln-s`whichgit-timestamp`.git/hooks/post-commitInclusion in other packagesTimestamping can be a useful add-on feature for many operations, including
verifying whether a repository has been tampered with. For example, we use it
extensively together withetckeeperfor tamper-evidence.If you would like to include timestamping as an optional component in your
software, you have to first decide whether timestamping should beonoroffby default for your software:default-on: Just callgit timestampas normal. Users can disable
timestamping on a per-repository basis by runninggit config timestamp.enable falseat any time.default-off: Timestamp with the option--require-enable. Then, users
have to first rungit config timestamp.enable truein the repository.
In any case, you should check whethergit timestamphas been installed before
calling it. In a shell, you could do this as follows:ifwhichgit-timestamp>/dev/null;thengittimestampOPTIONSfiGeneral and Client DocumentationTimestamping: Why and how?Client installationProtocol descriptionList of publicZeitgitterserversDiscussion of the use of (weak) cryptographyAttributionsZeitgitter logo is based onGit LogobyJason Long, licensed under theCreative Commons Attribution 3.0
Unported License.