Archive integrity

• It proves that a record existed in the archive no later than its checkpoint’s timestamp, and that nobody, Rewindex included, has changed or removed it since. Changing any past record changes its day’s root, and because every checkpoint includes the previous one’s hash, every checkpoint after it would change too.
• It does not prove that the vendor served those exact bytes, or that the capture time is right: a record could have been made up before it was committed. Checkpoints are made every night, so that window is about a day at most for anything captured since October 17.
• Full vendor pages are not republished. For page captures, a proof contains the hash of the exact bytes captured, not the page itself, so anyone holding a copy of the page as captured can check it against the record.

1. Get the proof. Use “Download proof” on any incident or change page, or ask for one by record:

   curl -s 'https://rewindex.com/integrity/proof.json?type=incident_version&key=…' -o proof.json

2. Content. For incident versions and component status changes, the archived bytes must hash to payload_sha256 in the record:

   jq -j .payload.text proof.json | sha256sum
   jq -r .record.record_json proof.json | jq -r .payload_sha256

3. Record. The record’s hash, with a zero byte in front, is its leaf in the day’s tree:

   { printf '\x00'; jq -j .record.record_json proof.json; } | sha256sum
   jq -r .record.leaf_hash proof.json

4. Path. Combine the leaf with .proof.audit_path as in RFC 9162, section 2.1.3.2 (any Certificate Transparency library does this). The result must equal root_hash inside .checkpoint.checkpoint_json.
5. Checkpoint. The checkpoint text hashes to checkpoint_sha256, and its prev_checkpoint_sha256 is the previous day’s checkpoint hash (from /integrity/<day>.json):

   jq -j .checkpoint.checkpoint_json proof.json | sha256sum

6. Timestamps. Each token is signed by its authority over the checkpoint hash:

   H=$(jq -r .checkpoint.checkpoint_sha256 proof.json)
   jq -r '.timestamps[] | select(.name=="FreeTSA") | .tsr_base64' proof.json | base64 -d > freetsa.tsr
   curl -sO https://freetsa.org/files/cacert.pem -sO https://freetsa.org/files/tsa.crt
   openssl ts -verify -digest "$H" -in freetsa.tsr -CAfile cacert.pem -untrusted tsa.crt
   jq -r '.timestamps[] | select(.name=="DigiCert") | .tsr_base64' proof.json | base64 -d > digicert.tsr
   openssl ts -verify -digest "$H" -in digicert.tsr -CAfile /etc/ssl/certs/ca-certificates.crt
   openssl ts -reply -in digicert.tsr -text | grep 'Time stamp'

• Records are JSON in the canonical form of RFC 8785 (sorted keys, no spaces), UTF-8, with times as YYYY-MM-DDTHH:MM:SS.ffffffZ and hashes as lowercase hex. Each states its type, key, company, captured_at and the SHA-256 of its payload.
• Payloads: incident versions are the canonical JSON of the incident as served by the vendor’s status page, including every update; component status changes are the canonical JSON of the component, its status and when it began; page captures are the page bytes as stored, with raw_match saying whether they are exactly the bytes received.
• Trees: one per UTC day, leaves ordered by capture time, then type, then key. Leaf hash is SHA-256 of 0x00 followed by the record; inner nodes are SHA-256 of 0x01, left and right (RFC 9162).
• Checkpoints are canonical JSON with the day, cutoff, tree size, root hash, record counts and the previous checkpoint’s SHA-256. That SHA-256 is what the timestamp authorities sign.

Records: 23,479 in 2 checkpoints. JSON, Markdown.