A command-line tool that seals a directory of audit evidence into a tamper-evident manifest. Later, it proves the package is byte-for-byte what was collected — and names anything that moved. Signing and trusted timestamps prove who and when.
Each layer is optional and composes with the others — the core needs no dependencies at all.
Every file is hashed with SHA-256 and folded into a single Merkle root. Any change to any file, name, or byte flips the root — and verify names exactly what was modified, added, or removed.
Seal each new package against the last and every manifest links to the previous by hash. A reordered, missing, or spliced-out link is detectable — an append-only history of a package over time.
Sign a seal with an ed25519 key to attest who collected it. Add an RFC 3161 timestamp from an independent authority to prove it existed by a certain time — not backdated.
Every command exits 0 when all is well, 1 on tamper, and 2 on a usage error — so a pipeline can gate on the difference.
# Core is pure standard library. # Extras add signing + timestamping: pip install "evidence-seal[sign,timestamp]" # Seal, then verify evidence-seal seal ./evidence evidence-seal verify ./evidence
The exit-code contract, at a glance:
Distinguishing 1 from 2 lets CI separate “the evidence was tampered with” from “the job is misconfigured.”