Evidence and verification

Eligible completed checks provide a canonical JSON proof and its SHA-256 digest. RestoreTrust can also submit that digest for OpenTimestamps anchoring to Bitcoin.

Use these files when a reviewer needs a portable record of exactly what RestoreTrust recorded for a check.

Evidence states

Anchoring is asynchronous and can remain pending for hours. OpenTimestamps uses public third-party calendars; their response time is outside RestoreTrust's control.

Some checks that end before worker execution do not receive an OpenTimestamps proof. Do not assume every check has a downloadable .ots file; use the evidence state shown on that check.

Export and verify

1. 1

   Review the check

   Confirm the project, schedule snapshot, selected artifact, status, timing, and gates. Evidence preserves the recorded outcome; it does not decide whether your criteria were strong enough.

2. 2

   Download the JSON proof

   Export the proof from the check. This is the exact canonical document whose SHA-256 digest RestoreTrust displays.

3. 3

   Recalculate SHA-256

   Hash the downloaded JSON without reformatting it and compare the result with the check's displayed digest.

   macOSLinux

   bashCopy

   shasum -a 256 check-proof.json

4. 4

   Download and verify OpenTimestamps

   When a .ots file is available, keep it beside the unchanged JSON and verify it with a compatible OpenTimestamps client. A verified result should refer to the same SHA-256 digest.

What the evidence establishes

A matching SHA-256 digest establishes that the downloaded canonical JSON has not changed. A verified OpenTimestamps proof additionally establishes that this digest existed no later than the referenced Bitcoin anchoring time.

Check digest and backup checksum

There are two different SHA-256 values:

• The check proof digest hashes the canonical JSON downloaded from the check. This is the digest used for OpenTimestamps.
• The backup file checksum in result.artifact.sha256 hashes the downloaded backup bytes before decryption, decompression, or unpacking. When available, that checksum and the source snapshot are included in the canonical check JSON.

To compare a retained backup with the recorded file, hash that original backup file and compare it with the backup checksum. Compare the unchanged JSON with the check proof digest separately. Older checks, older workers, or incomplete downloads can lack a backup checksum.

Retain the JSON and .ots file together with your backup retention, recovery runbook, and review records. A report is useful for presentation, but it is not a replacement for these per-check verification files.