Docs
Log inGet started
DocsUse cases

Timestamp builds and releases in CI

Prove what your pipeline produced and when: hash the artifact in CI, send only the digest, archive the timestamp token next to the release. A few lines in any CI system.

Timestamp builds and releases in CI

A release artifact with a trusted timestamp answers questions that come up years later: was this binary really built before the incident? Is this the exact artifact we shipped to the customer? Did we have this code before the competitor's filing? An RFC 3161 timestamp gives each artifact independently verifiable proof of existence at a point in time — with qualified timestamps available when the proof needs statutory weight — and adding it to a pipeline is a hash and one API call.

The pattern

Hash locally, transmit only the digest, store the returned .tsr token next to the artifact:

HASH=$(sha256sum dist/release.tar.gz | awk '{print $1}')

curl -s -X POST https://api.sigill.ai/tsa/stamp-hash \
  -H "Authorization: Bearer $SIGILL_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"hashHex\":\"$HASH\",\"tsaSlug\":\"auto\",\"label\":\"release-v2.4.1\"}" \
  | jq -r '.tsrBase64' | base64 -d > dist/release.tar.gz.tsr

The artifact never leaves your runner — only its SHA-256 does. tsaSlug: "auto" uses Sigill-managed rotation with automatic failover across independent timestamp authorities, so a single TSA outage doesn't break your release job.

GitHub Actions

- name: Timestamp release artifact
  env:
    SIGILL_API_KEY: ${{ secrets.SIGILL_API_KEY }}
  run: |
    HASH=$(sha256sum dist/release.tar.gz | awk '{print $1}')
    curl -sf -X POST https://api.sigill.ai/tsa/stamp-hash \
      -H "Authorization: Bearer $SIGILL_API_KEY" \
      -H "Content-Type: application/json" \
      -d "{\"hashHex\":\"$HASH\",\"tsaSlug\":\"auto\",\"label\":\"${{ github.ref_name }}\"}" \
      | jq -r '.tsrBase64' | base64 -d > dist/release.tar.gz.tsr

- name: Attach token to the release
  uses: softprops/action-gh-release@v2
  with:
    files: |
      dist/release.tar.gz
      dist/release.tar.gz.tsr

The CI stamping walkthrough on the blog goes deeper, including stamping SBOMs and provenance files.

Verifying a build later

Anyone holding the artifact and the token can verify offline with stock OpenSSL — no Sigill account, no API:

openssl ts -verify -in release.tar.gz.tsr -data release.tar.gz -CAfile tsa-ca-bundle.pem

Or drop both files on sigill.ai/verify. See Verify a seal without a Sigill account for all the independent options.

Notes