Verifying Paper Timestamps

Each preprint hosted on this site is accompanied by a SHA-256 cryptographic hash and an upload date. Together with the public Git commit history, this provides verifiable proof that a specific version of a paper existed at a specific time.

Why this matters

Not all preprints are available through traditional repositories like arXiv or PhilArchive. For papers hosted only on this site, the SHA-256 hash and Git history establish provenance and priority without relying on a third-party timestamping service.

How to verify

Download the PDF from this site. Then compute its SHA-256 hash and compare it to the hash displayed on the paper's page.

On Linux / macOS

sha256sum filename.pdf

On macOS (alternative)

shasum -a 256 filename.pdf

On Windows (PowerShell)

Get-FileHash filename.pdf -Algorithm SHA256

If the output matches the hash displayed on this site, the file is byte-for-byte identical to the version that was committed to the repository.

Third-party verification via Git

This site is hosted on GitHub Pages. The full commit history is publicly available at github.com/irawolfson/irawolfson.github.io.

To verify when a specific paper was first committed:

git log --follow --diff-filter=A -- assets/Papers/filename.pdf

What proves what

The SHA-256 hash proves integrity — that the file has not been modified since the hash was recorded. It says nothing about timing on its own.

Git provides the timing. However, there is an important distinction: a Git commit has two dates. The author date is set locally and can be backdated. The push receipt timestamp is recorded by GitHub's servers when the push is received, and cannot be altered by the repository owner. The authoritative timestamp is therefore GitHub's server-side record, not the local author date.

The proof chain works as follows: a commit contains both the PDF and the HTML page displaying its hash. GitHub records when that commit was pushed. Anyone can later download the PDF, recompute the hash, confirm it matches the page, and check GitHub's push history to verify the date. If the PDF, the hash, and the commit all appear together, the file is locked to that point in time.

To inspect GitHub's server-side push events, use the GitHub Events API:

curl https://api.github.com/repos/irawolfson/irawolfson.github.io/events