TimeBinder vs Sigstore: signing a release or dating its files?

TimeBinder vs Sigstore at a glance

Where Sigstore is the better choice

• Your users need to check who published a release. That’s what signing is for. A timestamp doesn’t do it.
• Your ecosystem expects signatures. If a package registry or deployment tool checks Sigstore signatures, a TimeBind isn’t a substitute.
• You want it inside CI, free. Sigstore’s docs say “Signatures are generated with ephemeral signing keys so there’s no need to manage keys,”.

Where TimeBinder may suit you better

• You want a dated record without signing in with an identity. Sigstore’s signing events go to a public transparency log; its docs explain what each signing method records. A TimeBind records only a fingerprint, and you choose who can see the certificate.
• It isn’t a software artifact. Specs, design documents, datasets, contracts or a private pre-release build can all go into a TimeBind, up to 10 files at a time in the browser app.
• You want the time anchored to Bitcoin rather than one authority. Sigstore’s time comes from Rekor or a timestamp authority. For Rekor v1, its docs note the timestamp “comes from Rekor’s internal clock, which is not externally verifiable”. With Rekor v2, clients “get a signed timestamp from a timestamp authority separate from Rekor.” An ASAP TimeBind is its own Bitcoin transaction and can be checked without relying on TimeBinder.
• You’d rather not use the command line. Drag files into the browser. Each file is hashed on your computer and never uploaded.

Using both on a release

1. Build the release archive (for example a .tar.gz) and any checksums file.
2. Sign it with Sigstore as your project normally does. Its docs say “using a bundle is the recommended way of signing a blob”.
3. Put the archive, the checksums file and the signature bundle into one TimeBind.
4. Keep those exact files. Re-creating an archive later may not give the same bytes, and only the same bytes match the fingerprint.

For more release routines, see source code timestamping and whether Git commit dates are enough.

What hashing a release does and doesn’t show

A fingerprint of a release archive shows that exact archive existed no later than the recorded time. It doesn’t:

• Replace signed commits, tags or releases. It doesn’t say who published anything.
• Fix Git dates. Git’s own docs describe --date=<date> as “Override the author date used in the commit,” and the Pro Git book explains how “you can rewrite commits that already happened so they look like they happened in a different way.” A TimeBind made at release time gives you a record that doesn’t depend on those dates.
• Show who wrote the code, or that it matches a particular commit, builds the same way, or is safe to run.

Pooled or ASAP?

• Pooled (1 Token): Your fingerprint is grouped with other users’ in one shared Bitcoin entry, usually recorded within 24 to 48 hours, and often sooner, depending on Bitcoin network activity. It’s checked through TimeBinder.
• ASAP (3 Tokens): It gets its own Bitcoin transaction, broadcast straight away, although that doesn’t mean instant confirmation. It can be checked independently, without relying on TimeBinder.

The Pooled vs ASAP explainer covers the difference, and how it works explains fingerprints and certificates.

When TimeBinder isn’t the right tool

• You need signed releases or identity checks. Use Sigstore, GPG or SSH signing, or whatever your ecosystem expects.
• You need supply-chain build records. That’s the job of signed provenance and attestations from your build system.
• You want a free record for every commit. Sigstore is free, and OpenTimestamps is free if you’re happy on the command line.
• You need an RFC 3161 token. Use a time-stamp authority. See RFC 3161 vs blockchain timestamps.

TimeBinder pricing

• Free: $0. 1 Token every month (1 Pooled TimeBind). No credit card required. Use it each month, as it doesn’t carry over.
• Essential: $20 a month for 5 Tokens (5 Pooled, or 1 ASAP + 2 Pooled). Unused Tokens roll over. Cancel any time.
• Expert: $50 a month for 15 Tokens (15 Pooled, 5 ASAP, or a mix).
• Business: $149 a month for 60 Tokens. Business Plus: $299 a month for 150 Tokens. Both are billed by monthly invoice. API access is included in the Business, Business Plus and Enterprise plans.
• Extra Tokens: 1 for $5, 3 for $15 or 9 for $40. Tokens you buy never expire.

A paid plan replaces the Free plan’s monthly Token, so Essential gives you 5 Tokens a month in total, not 6.

Enterprise plans have custom Token limits and dedicated support. Service terms for every plan are set out in the TimeBinder Terms and Conditions. If you release a few times a month, which plan do I need compares the Free plan plus Tokens with the paid plans.