Current writer default: v4 (requires opentine 0.26+). Legacy v1/v2 files and v3 repositories remain readable. Bare tine migrate now writes a sibling file; use --dry-run for preview only. Read upgrade notes.

Source preview · unreleased · checked 2026-11-03

Offline timestamp checks

Main at 557c518 prepares v0.31.0. GitHub and PyPI publish v0.30.0; this page describes source behavior, not installed release commands.

Attach evidence without fetching it

The source adds tine timestamp attach RUN TOKEN.tsr, storing an RFC 3161 response or token in a RUN.timestamps.json sidecar bound to the run digest. The data subcommand prints the exact bytes whose message imprint must be hashed. Fetching a token from a timestamp authority remains the operator's job; opentine opens no connection for it.

Verify against local roots

Source offline verification accepts --tsa-roots FILE.pem and timestamp authorities from a supplied trusted-root file. Checks cover the imprint, TSA signature over signed attributes, timestamping EKU, certificate validity at genTime, and a chain to a local root. Reports add per-token timestamp checks and a timestamps section with time, authority, policy, and hash details.

A missing root is unavailable-offline, never a pass. Timestamp checks are never required in this source contract. This is not a claim that a timestamp independently establishes run authorship, and these details can change before publication.

Read the pinned source changelog and release status. Use the published offline verification guide for stable behavior.