Trivy routes OpenVEX output through go-vex, so go-vex CanonicalHash applies directly to Trivy documents. Every VEX document Trivy produces already has a canonical content hash available at emission time.
Real CanonicalHash of a Trivy-emitted OpenVEX document:
513aa43ac4ab69ef3b1e46032c3eb252ad5a4e6d47c4c503139b9db49dd067a0
Stamping that CanonicalHash into Bitcoin (settled at block 957452) gives every emitted VEX an existence proof against backdating, at no cost to the format. A not_affected verdict cannot be predated past its anchor, and the check runs offline against an unowned clock.
Honest scope: OpenTimestamps proves existence and ordering at a point in time only. It does not prove consistency or non-equivocation. It is a complement to the scan and the VEX statement, never a replacement.
Work and verifiers:
- github.com/MarkovianProtocol/tlog-bitcoin-anchor (spec, Go and Python verifiers, test vectors)
- github.com/MarkovianProtocol/audit-anchor
- markovianprotocol.com
Tell me where it breaks.
Trivy routes OpenVEX output through go-vex, so go-vex CanonicalHash applies directly to Trivy documents. Every VEX document Trivy produces already has a canonical content hash available at emission time.
Real CanonicalHash of a Trivy-emitted OpenVEX document:
513aa43ac4ab69ef3b1e46032c3eb252ad5a4e6d47c4c503139b9db49dd067a0Stamping that CanonicalHash into Bitcoin (settled at block 957452) gives every emitted VEX an existence proof against backdating, at no cost to the format. A not_affected verdict cannot be predated past its anchor, and the check runs offline against an unowned clock.
Honest scope: OpenTimestamps proves existence and ordering at a point in time only. It does not prove consistency or non-equivocation. It is a complement to the scan and the VEX statement, never a replacement.
Work and verifiers:
Tell me where it breaks.