{"id":21328734,"url":"https://github.com/rsvp/victor","last_synced_at":"2025-07-12T08:32:09.571Z","repository":{"id":138912801,"uuid":"45083621","full_name":"rsvp/victor","owner":"rsvp","description":"Victor, verifier in cryptography, publicly issues free trusted TIMESTAMP of file hash information embedded into a blockchain.  ","archived":false,"fork":false,"pushed_at":"2018-01-02T14:00:10.000Z","size":37,"stargazers_count":9,"open_issues_count":0,"forks_count":3,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-06T16:22:56.468Z","etag":null,"topics":["bitcoin","blockchain","copyleft","copyright","cryptography","hash","sha256","timestamp","trusted-timestamping","verification"],"latest_commit_sha":null,"homepage":"https://git.io/victor","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rsvp.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":".github/CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":".github/CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2015-10-28T02:27:03.000Z","updated_at":"2024-06-24T07:09:50.000Z","dependencies_parsed_at":null,"dependency_job_id":"116a1d5b-3ff6-4f35-875b-90a8d6cd33a0","html_url":"https://github.com/rsvp/victor","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/rsvp/victor","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rsvp%2Fvictor","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rsvp%2Fvictor/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rsvp%2Fvictor/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rsvp%2Fvictor/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rsvp","download_url":"https://codeload.github.com/rsvp/victor/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rsvp%2Fvictor/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264962378,"owners_count":23689804,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bitcoin","blockchain","copyleft","copyright","cryptography","hash","sha256","timestamp","trusted-timestamping","verification"],"created_at":"2024-11-21T21:40:38.660Z","updated_at":"2025-07-12T08:32:09.556Z","avatar_url":"https://github.com/rsvp.png","language":"Shell","funding_links":[],"categories":["Shell"],"sub_categories":[],"readme":"# victor\n\n[![Join the chat at https://gitter.im/rsvp/victor](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/rsvp/victor?utm_source=badge\u0026utm_medium=badge\u0026utm_campaign=pr-badge\u0026utm_content=badge)\n\nVictor, familiar name in cryptography to denote **VERIFIER**, \nserves to publicly timestamp hash fingerprints of files. \n\nWe may need to certify that a document existed on a \nparticular date (e.g. for copyright or patent purposes). \nIf the certification process can take place publicly \nthat would certainly add veracity to the matter. \nGitHub can be used to perform as a trusted timestamping service. \n\nA git repository is designed in such a way that it is \nimpossible to change a single bit of its content without \nthat change becoming apparent in the commit identifiers \n(SHA-1). The explicit time of a commit is recorded by git, \nalthough it relies on the accuracy of the system's local clock. \n\nThe **victor** repository is used as follows:\n\n- User produces an one-way hash of a document, say, using SHA-256.\n- That hash is posted at a reliable public site (\"*Marker*\"), \n  e.g. in a Bitbucket snippet or Twitter tweet with permalink.\n- That joint information is committed under the `time/YYYY` directory.\n- Anyone can then *verify* the date and time of said hash \n  via the commit identifier. \n- The commit ID is finally embedded into a distributed ledger, \n  i.e. a public blockchain (e.g. Bitcoin), for another timestamp.\n\nThe virtue of this protocol is that the document itself \nis not stored within this repository. The user does not \nneed to reveal the content of the document (*privacy*) \nsince the hash digest will cryptographically suffice. \n\nClearly the repository will not be large in size \nsince the documents themselves are not stored \n(unless they serve to authenticate the timeline). \nThe data is centrally backed up, but if this repository is \ndistributed among many users, it can be securely reconstituted \n(not necessarily at GitHub). \n\nIf a challenge occurs to a particular timestamp, one could \nin principle get testimony from originators of the previous and \nfollowing documents: for the correct time must be sandwiched \nin-between them. Email addresses are used at GitHub to attribute \nwork done in a repository. However, cross-validation \nusing the URL addresses of where the hash codes were published \nshould serve as evidence against collusion and faked timestamps. \n\nOne may think of this repository as a collective union \nsigning the public timeline of hash commits. \nThe strict relative history of commits and git's cryptographic \nhash of those commits, together with open verification, \nare the essence of this project.\n\nYou can also contribute by periodically adding a hash of \nvictor's last state to a blockchain for another source of \nindependent timestamping. *New in v2:* every victor commit \nhash can be embedded into the **Bitcoin blockchain** \nautomatically by incorporating the post-commit hook \nposted in `bin` -- free of charge! \n\n\n### Practical example\n\nAlice has just finished her 404-page novel, \nand would like to register its date before sending \nit off to nine publishers for review. \nThere is also a high-resolution image she would \nlike to see on the front cover. \n\n```\nI, Alice Example of Los Angeles, thereby record the \nSHA-256 digest of my novel, Unsolved Disappearances:\nd98722c626307fb00e728ba2ff246b7dd91b932a1e872f19a42dedee3058cc8a\nand a photo of my college friends:\nf9c8cda5be4787626905f39e2d73ca4fe9615aeb607375683921595d3bb21cc0\non this day, Wed Nov  4 16:01:40 PST 2015.\n```\n\nShe would like her notice to be posted on some reputable website, \nso she makes public the following: \nhttps://bitbucket.org/snippets/rsvp/bRxRA \nwhich will date Alice's notice independently of her stated claim. \n\nTo strength the evidence of her authorship and completion date, \nshe goes to Victor and makes a pull request of her original notice \nwith added mention of the *Marker* site. \nAlice has been authenticated by GitHub, so Victor merges \ninto the `time/2015` directory, resulting in: \nhttps://github.com/rsvp/victor/commit/ebe6e6b715089430017a03f2615722f1bb29da49\n\nSo now we have two more additional sources for the timeline: \nVictor's machine and the system time at a central repository. \nIn fact, Alice has even stronger evidence because her commit is \nsandwiched among other authenticated users with an ordered trail of \nthird-party markers publicly open for verification. \n\nThe design of *git* as version control software places Alice's \nmarker notice in a DAG, directed acyclic graph, \nwith an unique immutable SHA-1 commit \nidentifier: `ebe6e6b715089430017a03f2615722f1bb29da49` \nwhich will reveal not only various date sources but also \nthe hash signatures of her original works. \nThat identifier would serve as a superb reference code in \nAlice's communication with her prospective publishers. \n\nAs a bonus, Alice had installed the post-commit hook \nfound in Victor's bin -- which embedded her commit \ntimestamp in another blockchain, Bitcoin -- free \nof charge:\n\n```\n ::  hooks/post-commit: ebe6e6b715089430017a03f2615722f1bb29da49 to BLOCKCHAIN.\n{\"hash_sha256\":\"ebe6e6b715089430017a03f2615722f1bb29da49\",\n\"created_at\":\"2015-11-05T01:10:15.648Z\", \n\"updated_at\":\"2015-11-05T01:10:15.648Z\",\n\"submitted_at\":null,\"title\":null}\n ::  http://www.originstamp.org/s/ebe6e6b715089430017a03f2615722f1bb29da49\n[develop ebe6e6b] Add 2015-11-05-example.txt only as illustrative marker\n```\n\nThus we have another verifiable public marker \nhttp://www.originstamp.org/s/ebe6e6b715089430017a03f2615722f1bb29da49 \nwhich not only dated Alice's commit in real time, but also \nwill report back hours later on the blocktime, the time \nof the confirmed Bitcoin transaction embedding her commit identifier. \n\nIn effect, Alice's signed work is *permanently* on the Bitcoin blockchain. \nAnd just in case, for all the world to witness, a tweet is \nautomatically posted (discretely) regarding this event: \nhttps://twitter.com/OriginStamp/status/662074416113799168 \nwhich would constitute the seventh timestamp! \n\nVictor's protocol permits a timestamp to become trustworthy \nby the chained integrity of multiple independent sources of evidence \nwhich are publicly verifiable. \nAlice did not necessarily have to reveal the full contents \nof her novel to the world, but the means to authenticate \nit resides in one string preserved in many backed up \ncopies of the open *victor* repository. \n\n\n### References\n\n- Trusted timestamping: https://en.wikipedia.org/wiki/Trusted_timestamping \n  see esp. [ANSI ASC X9.95 Standard](https://en.wikipedia.org/wiki/ANSI_ASC_X9.95_Standard) \n  and [Linked timestamping](https://en.wikipedia.org/wiki/Linked_timestamping). \n\n- Bela Gipp, N. Meuschke, and A. Gernandt. \"Decentralized Trusted Timestamping \n  using the Crypto Currency Bitcoin,\" in *Proceedings of the iSchools iConference*, \n  Newport Beach, CA, USA, \n  [March 2015](http://www.gipp.com/wp-content/papercite-data/pdf/gipp15a.pdf) \n  or [arXiv:1502.04015 cs.CR](http://arxiv.org/abs/1502.04015) \n  [implemented in victor v2 post-commit hook]. \n\n- Bruce Schneier, *Applied Cryptography*, 1996 second edition, see esp. chapter 4.1.\n\n\n### Appendix 1: Standards\n\nTimestamps based on the X9.95 standard can be used to provide [*victor* comments]:\n\n- Authenticity: trusted, non-refutable time when data was digitally signed. \n  [*victor presumes GitHub and markers use trusted time sources, e.g. NIST. \n  Note that victor does not hash or check the original document itself, \n  that's the committer's responsibility.*] \n\n- Integrity: protection of the timestamp from tampering without detection. \n  [*victor relies on the git's hash tree structure for integrity.*]\n\n- Timeliness: proof that the time of the digital signature was the actual time. \n  [*victor timeline provides excellent approximation.*] \n\n- Evidentiary trail of authenticity. \n  [*A document's hash and a time Marker jointly produces another hash, \n  git's commit identifier.*] \n\n\"**Linked timestamping** creates tokens [*markers*] \nwhich are dependent on each other, entangled into some \nauthenticated data structure [*git hash tree* by GitHub users]. \nLater modification of issued timestamps would invalidate this structure. \nTemporal order of issued timestamps is also protected by this data structure, \nmaking backdating of the issued timestamps impossible, \neven by the issuing server itself.\" \n\nSummary: **The issued timestamps from *victor* are in fact \nGit commit identifiers. By examining the git log, \nthe secure hash and signatory information of the original document can be \nrecovered along with verifiable date and time of the entries.**\n\n---\n\nShortcut to this page: https://git.io/victor | Revision date : 2018-01-02\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frsvp%2Fvictor","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frsvp%2Fvictor","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frsvp%2Fvictor/lists"}