Blockchain-timestamp posts

[ralsina]

As suggested by @marianoguerra we could use https://opentimestamps.org/ to timestamp posts via blockchain.

I am not sure why, or what for, but sure, we could :-)

[marianoguerra]

where/how do I hook to operate on changed posts?

[marianoguerra]

rationale:

[Kwpolska]

Let’s play… Buzzword Bingo!

As for the problem, it’s not going to be simple: perhaps something that looks at doit’s to-do task list and timestamps the new/changed files?

[marianoguerra]

@Kwpolska some buzzword driven marketing for nikola won't hurt ;)

regarding how, isn't it possible to hook wherever nikola hooks to decide which posts to rebuild? then my "build step" is the timestamp request via the opentimestamp library and my build artifact is the .ots file to verify the timestamp.

[ralsina]

Hmmmm... so, this is trickier than it seems.

@marianoguerra do you want to timestamp sources or output?

If sources, then just use POSTS/PAGES to find them and timestamp them when changed.

This has the problem of things like include files and such.

If output, then you can do a task that depends on the compiled HTML fragments from the timeline, and it would look a lot like plugins/task/pages.py

[ralsina]

The ots client is async and can take a loooong time to work (and by default it will not wait, which is reasonable, but means also you have no idea whether a file is signed or not.

If someone REALLY wants to implement this, here is how.

1. For each sourcefile, calculate the sha256 hash.
2. If there is no matching sourcefile.ots file, then call ots sign sourcefile
3. If there is a matching ots file, call ots info sourcefile.ots and verify the sha256 of the file
4. If the sha256 of the file changed, move the sorcefile.ots to a backup (or delete it) and re-sign the file

There really is no point in backing up signatures if you didn't backup the sourcefile, since the signature is just a hash.

[ralsina]

Oh, what the hell, I'll do it.

[ralsina]

Implemented in getnikola/plugins@70e4504...ca2dc37