← All posts
How to Verify Your Git Commit Timestamps

How to Verify Your Git Commit Timestamps

timestamp git blockchain proof

How to Verify Your Git Commit Timestamps

A Git commit timestamp is a claim. Verification is the proof. In Git, commit dates are mutable metadata — git commit --date can set arbitrary dates, rebase rewrites history, and force-push can rewrite a shared remote. If you are relying on commit timestamps to prove prior art, you need something stronger than a date string in your log.

Timestamp GIT closes that gap by anchoring your Git commit hashes into the Bitcoin blockchain using the OpenTimestamps protocol. It is a managed SaaS and GitHub App: install the app once, connect a repository, and every commit is anchored automatically each night. No CLI tools, no manual protocol steps.

This article focuses on the verification side: what a proof looks like, how to check it with Timestamp GIT’s built-in tools, and how to interpret the result. If you need the full motivation for why this matters in patent disputes, see Defend Your Software Against Patent Trolls with Timestamps.

Why Verification Matters for Your Code’s Prior Art

A timestamp is only valuable if you can prove it later. Internal Git logs usually fail that test because they live on servers you do not fully control or in databases that can be edited. In a legal audit or compliance review, those logs are often dismissed as self-serving.

Timestamp GIT generates cryptographic proofs that are anchored in Bitcoin. That changes the equation:

Because the proof only involves commit hashes, anyone can verify that a given commit existed at a given time without access to your source code. That makes verification a practical step you can hand off to a lawyer, auditor, or compliance officer.

What a Timestamp GIT Proof Looks Like

When you connect a repository to the Timestamp GIT GitHub App, the service does not read your code. It reads only the commit hashes. Each night, a worker collects the pending hashes into a manifest file per repository, builds a Merkle tree, creates OpenTimestamps proofs, and anchors the Merkle root into the Bitcoin blockchain.

The resulting proof artifacts are pushed to a dedicated timestamps branch or shadow repository. A typical timestamps branch may look conceptually like this:

timestamps/
└── 2026/
    └── 08/
        └── 22/
            ├── manifest.txt
            └── manifest.txt.ots

The two key files are:

The proof is self-contained. You can download the .ots file and verify it against the Bitcoin blockchain using standard OpenTimestamps verification tools, completely offline and without Timestamp GIT’s infrastructure. Timestamp GIT gives you the friendly path; the underlying proof remains yours.

Step-by-Step Verification Using Timestamp GIT Tools

Timestamp GIT provides several verification surfaces. You can use whichever fits your workflow.

1. Check the public status page

For any connected repository, navigate to:

https://timestampgit.dev/status/{user}/{repo}

Replace {user} with your GitHub user or organization and {repo} with the repository name.

The status page shows proof longevity, the earliest anchor date, daily regularity, Bitcoin block and transaction data, and a calendar heatmap. From there you can also download an audit CSV or a PDF certificate for a specific date.

For public repositories, anyone can visit this page. For private repositories, access is restricted by an encrypted HMAC, so only authorized users can view the status.

2. Embed a verification badge in your README

Timestamps in a repository become more useful when your contributors, customers, or auditors can see them at a glance. Timestamp GIT provides embeddable Shields.io badges.

First, get the badge snippet from the authenticated endpoint:

curl https://timestampgit.dev/api/badgeLink/your-org/your-repo

The response includes a badge URL and a ready-to-paste markdown snippet:

{
  "badgeUrl": "https://img.shields.io/endpoint?url=https://timestampgit.dev/api/statusSummary/your-org/your-repo",
  "markdown": "[![timestamped](https://img.shields.io/endpoint?url=https://timestampgit.dev/api/statusSummary/your-org/your-repo)](https://timestampgit.dev/status/your-org/your-repo)"
}

Paste the markdown into your README.md. The badge links to the public status page, so anyone can click through and verify the latest timestamp.

3. Run the cryptographic verification page

The verification page gives you a step-by-step view of the Merkle chain for a specific day:

https://timestampgit.dev/verification/{user}/{repo}/{date}

For example, to verify a repository timestamped on August 22, 2026:

https://timestampgit.dev/verification/your-org/your-repo/2026-08-22

This page shows the multi-level Merkle chain verification. All cryptographic computation happens locally in your browser — Timestamp GIT does not see what you verify.

If you prefer to work with the raw Merkle chain data programmatically, use the public verification endpoint:

curl https://timestampgit.dev/api/verify/your-org/your-repo/2026-08-22

4. Download a PDF certificate

For meetings, legal disputes, or compliance files, you often need a portable document. Timestamp GIT can generate a PDF certificate for a specific date.

From the status page, use the download option. Or call the report endpoint directly:

curl -o timestamp-proof-2026-08-22.pdf \
  https://timestampgit.dev/api/report/your-org/your-repo/2026-08-22

The PDF includes the proof details for that date and is formatted for human review.

5. Use the public API for automation

If you want to integrate verification into CI/CD checks, internal dashboards, or compliance scripts, Timestamp GIT exposes public status endpoints.

Check the last anchored Bitcoin block:

curl https://timestampgit.dev/api/statusLast/your-org/your-repo

Check the total number of committed and stamped commits:

curl https://timestampgit.dev/api/statusCount/your-org/your-repo

Check a combined summary that can be consumed by Shields.io:

curl https://timestampgit.dev/api/statusSummary/your-org/your-repo

A typical statusSummary response looks like this:

{
  "schemaVersion": 1,
  "label": "timestamped",
  "message": "42 commits",
  "color": "brightgreen"
}

Interpreting Verification Results and Edge Cases

A successful verification means the following chain held:

  1. Your commit hash was included in the daily manifest for the repository.
  2. The manifest was included in a Merkle tree.
  3. The Merkle root was anchored in a Bitcoin transaction.
  4. That transaction was confirmed in a Bitcoin block.

In plain English: the commit hash existed before the Bitcoin block time. That block time becomes the upper bound for your prior art claim.

Pending proofs and confirmation delay

Timestamp GIT batches commits every night. After the batch is created, the Bitcoin network must confirm the anchor transaction. This normally takes a few hours. A commit made today may not appear as fully verified until the next day.

The status page is your friend here: it shows the earliest anchor date and daily regularity, so you can see whether a repository is on schedule or whether a specific day is still pending.

Private repositories and HMAC access

Verification links for private repositories include an encrypted HMAC. This HMAC is specific to the Timestamp GIT server instance and prevents unauthorized users from viewing private status information.

The GitHub App itself requires appropriate permissions to access private repositories. Without those permissions, Timestamp GIT cannot read the commit hash in the first place.

Independence from Timestamp GIT

The .ots receipt files are not tied to Timestamp GIT’s servers. They are proofs built on the OpenTimestamps protocol and anchored in Bitcoin. Even if Timestamp GIT disappears, you can still verify the receipts using standard OpenTimestamps tooling against the Bitcoin blockchain.

For a complete ledger of all timestamps for a repository, download the audit CSV:

curl -o audit-ledger.csv https://timestampgit.dev/api/audit/your-org/your-repo

This CSV is useful for legal discovery, internal audits, or showing a continuous timestamp history.

FAQ

Can I verify a Git commit timestamp without installing any software?

Yes. Timestamp GIT provides a web-based verification page where all cryptographic checks run locally in your browser. You can also use the public status page or the embeddable badge to view verification status without any installation.

What if Timestamp GIT goes out of business? Can I still verify my timestamps?

Absolutely. The proofs are based on the OpenTimestamps protocol and anchored in the Bitcoin blockchain. You can download the .ots receipt file and verify it using standard OpenTimestamps tools against the Bitcoin blockchain, independent of Timestamp GIT.

How long does it take for a commit to be verifiable?

Timestamp GIT batches commits daily and anchors them into the Bitcoin blockchain. Confirmation typically takes a few hours after the daily batch is processed. The status page shows the earliest anchor date and daily regularity.

Can I verify timestamps for private repositories?

Yes, but access is restricted. Verification links for private repos include an encrypted HMAC, so only authorized users can view the status. The GitHub App requires appropriate permissions to access private repositories.

What happens if I remove the GitHub App?

Already generated .ots receipts and manifests remain in your repository and can still be verified independently. New commits will not be timestamped automatically until you reinstall the GitHub App.

Conclusion: Trust but Verify

Verification is where a timestamp becomes a proof. Timestamp GIT removes the operational burden of creating those proofs while giving you simple, developer-friendly ways to check them: a public status page, README badges, a browser-based Merkle chain viewer, PDF certificates, audit CSVs, and public APIs.

You do not have to learn raw OpenTimestamps commands, run a Bitcoin node, or manually manage receipts. The GitHub App handles the pipeline; the verification pages handle the rest. But because the underlying proof is standard and Bitcoin-anchored, you are never locked in.

If you have not started timestamping yet, the fastest path is to install the Timestamp GIT GitHub App, connect a repository, and watch the first nightly anchor appear. If you need an air-gapped or self-hosted setup, Timestamp GIT is also available as a Docker image with a time-limited demo license.

Get started at https://timestampgit.dev.

Related posts

Published on Timestamp GIT · Timestamp GIT
EU label: AI-generated content