Offline timestamp checks

Published since v0.31, timestamp evidence lives beside a run in RUN.timestamps.json and is bound to its digest. opentine does not fetch tokens from a TSA; obtain them through your own trusted workflow.

# Print the exact bytes whose messageImprint must hash
tine timestamp data run.tine
# Attach an existing RFC 3161 response or token
tine timestamp attach run.tine token.tsr
# Verify offline using operator-provided local trust roots
tine verify run.tine --offline --tsa-roots tsa-roots.pem --json

Offline checks cover the imprint, TSA signature over signed attributes, timestamping EKU, genTime inside certificate validity, and a chain to a local root. Timestamp authorities from a supplied trusted-root file can also provide roots. The versioned offline report adds a check per token and a timestamps section with time, authority, policy OID, and hash details.

Missing roots are unavailable-offline, never a pass. Timestamp checks are not required checks. A trusted timestamp binds evidence under its own verification assumptions; it does not independently prove who authored the run or that its recorded events were truthful.

See offline report semantics, operator trust roots, and upgrade notes.