Fingerprints

Every edit in wrisp carries a fingerprint, tied to every edit before it, so changing any part of a document's history changes its fingerprint. Once a day, the latest fingerprint of every document that changed is combined into one value and published here.

Once published, a day's fingerprint can't be changed without it showing, not even by whoever runs wrisp. So a replay that matches one proves its history up to that day is exactly as it was then. The fingerprints say nothing about what anyone wrote, or whose documents they are: only how many documents changed.

A shared replay checks itself: your browser recomputes the history's fingerprints from what it's replaying and finds them in these checkpoints, then says so above the replay ("History unchanged since…"). It can also compare a checkpoint with the copy in the public repository, which only takes a click.

Checking one yourself

Each checkpoint below links to the exact file that was published, and to the timestamp authority's signed reply. With openssl and the authority's certificates (FreeTSA publishes cacert.pem and tsa.crt at freetsa.org):

openssl ts -verify -data checkpoint-12.json -in checkpoint-12.tsr \
    -CAfile cacert.pem -untrusted tsa.crt

"Verification: OK" means that file existed, unchanged, at the time the authority signed. Each checkpoint also names the one before it (previous_root), so a missing day shows as a broken link. How each document's fingerprint fits into a checkpoint is described in the README, under "Fingerprints".