A public project should not be credible only because it appears online.
This is why I am using ProofBundle for the projects I publish and discuss publicly, including the ones I present here on LinkedIn.
ProofBundle creates a portable cryptographic proof for a project snapshot.
It takes the files, builds a deterministic SHA-256 manifest, reduces the entries into a Merkle tree, and produces one Merkle root for the whole project state.
Then that root is bound to a signed author/custody claim.
ProofBundle can also use OpenTimestamps: the Merkle root and manifest hash are timestamped and anchored to public blockchains, without uploading the original project and without putting the contents on-chain.
So the proof has three layers:
- integrity: SHA-256 hashes, manifest, and Merkle root
- identity/custody: Ed25519 or OpenPGP signature
- time evidence: OpenTimestamps blockchain anchoring
For signing, ProofBundle supports a default Ed25519 mode: modern, compact, and easy to verify.
It can also use a detached OpenPGP signature, including OpenPGP keys based on Ed25519. And for stronger key custody, OpenPGP signing can optionally be backed by a YubiKey, so the private signing key stays
hardware-backed and non-exportable.
This is not copyright registration and it is not a legal shortcut.
It is technical evidence that:
- this exact project state existed
- these files matched this manifest
- this Merkle root represented the snapshot
- this key signed the claim
- the timestamp evidence was
anchored through OpenTimestamps
- the proof can be verified independently
Full technical note:
https://www.gabrielesalati.eu/blog/proofbundle-verifiable-project-integrity.html
#ProofBundle #OpenTimestamps #Blockchain #OpenPGP #Ed25519 #MerkleTree #YubiKey #CyberSecurity #SoftwareEngineering #OpenSource
