> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truthlocks.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Code Authorship Protection
> Prove you wrote the code with cryptographic attestations.
Prove you wrote the code. Truthlocks creates cryptographic attestations for source code, APIs, documentation, and other digital assets. Protect your intellectual property with SHA-256 hashing and timestamped proof — all without your source code ever leaving your machine.
## Why Code Authorship Matters
* **IP disputes:** Prove you wrote the code before someone else claims it. Timestamped cryptographic proof is admissible evidence.
* **Open source protection:** Protect your contributions before publishing. If someone forks and claims ownership, you have proof.
* **Contract work:** Prove delivery dates and authorship to clients with independently verifiable attestations.
* **Portfolio verification:** Prospective employers or clients can verify your claimed work is genuinely yours.
## How It Works
Compute SHA-256 of your source file, repository archive, or any artifact.
The file content never leaves your machine.
Send the hash, title, and metadata to the Truthlocks API. An attestation is
created with your personal signing key.
The attestation is anchored to an append-only, RFC 6962-compatible
transparency log with an immutable timestamp.
Get a shareable proof URL, embeddable badge, or downloadable certificate.
## Protect a Single File (CLI / API)
Hash a source file and submit the attestation:
```bash theme={null}
# Hash a file locally (macOS/Linux)
HASH=$(sha256sum main.go | awk '{print $1}')
# Submit to Truthlocks API
curl -X POST https://api.truthlocks.com/v1/consumer/mint \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{
"content_hash": "'$HASH'",
"title": "main.go — Core Engine v2.1",
"description": "Primary application entry point and engine logic",
"file_name": "main.go",
"content_type": "code",
"category": "source_code",
"visibility": "public"
}'
```
## Protect an Entire Repository
Create a deterministic archive of your repo and hash it:
```bash theme={null}
# Create a deterministic git archive
git archive --format=tar HEAD | sha256sum | awk '{print $1}'
# Or hash a specific commit
git archive --format=tar | sha256sum | awk '{print $1}'
```
Use `git archive` instead of zipping the directory — it produces deterministic
output regardless of filesystem metadata, making the hash reproducible.
## Examples
```javascript Node.js theme={null}
import { createHash } from 'crypto';
import { readFileSync } from 'fs';
// Hash a source file
const content = readFileSync('src/index.ts');
const hash = createHash('sha256').update(content).digest('hex');
// Submit to Truthlocks
const response = await fetch('https://api.truthlocks.com/v1/consumer/mint', {
method: 'POST',
headers: {
'Authorization': 'Bearer ' + token,
'Content-Type': 'application/json',
},
body: JSON.stringify({
content_hash: hash,
title: 'src/index.ts — API Server',
description: 'Main API server entry point',
content_type: 'code',
category: 'source_code',
}),
});
const { attestation_id, content_hash, protected_at, verify_url } = await response.json();
console.log('Proof URL:', verify_url);
console.log('Hash:', content_hash, 'Protected at:', protected_at);
```
```go Go theme={null}
package main
import (
"crypto/sha256"
"encoding/hex"
"fmt"
"os"
)
func hashFile(path string) (string, error) {
data, err := os.ReadFile(path)
if err != nil {
return "", err
}
h := sha256.Sum256(data)
return hex.EncodeToString(h[:]), nil
}
func main() {
hash, err := hashFile("main.go")
if err != nil {
panic(err)
}
fmt.Printf("SHA-256: %s\n", hash)
// Submit hash to POST /v1/consumer/mint
}
```
```python Python theme={null}
import hashlib
import requests
def hash_file(path: str) -> str:
with open(path, "rb") as f:
return hashlib.sha256(f.read()).hexdigest()
file_hash = hash_file("app.py")
response = requests.post(
"https://api.truthlocks.com/v1/consumer/mint",
headers={
"Authorization": f"Bearer {token}",
"Content-Type": "application/json",
},
json={
"content_hash": file_hash,
"title": "app.py — Flask Application",
"content_type": "code",
"category": "source_code",
},
)
data = response.json()
print(f"Proof: {data['verify_url']}")
print(f"Hash: {data['content_hash']} Protected at: {data['protected_at']}")
```
## CI/CD Integration
Automate code protection in your CI pipeline. Protect every release:
```yaml GitHub Actions theme={null}
- name: Protect release artifact
run: |
HASH=$(sha256sum dist/app.tar.gz | awk '{print $1}')
curl -X POST https://api.truthlocks.com/v1/consumer/mint \
-H "Authorization: Bearer $TRUTHLOCKS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"content_hash": "'$HASH'",
"title": "Release build",
"description": "Production release artifact",
"content_type": "code",
"category": "release"
}'
```
## Add a Badge to Your README
Show verification status directly in your repository:
```md Markdown theme={null}
[](https://verify.truthlocks.com/proof/ATTESTATION_ID)
```
The badge dynamically shows verification status and is cached for performance. Replace `ATTESTATION_ID` with the ID returned from the mint endpoint.
## Verification
Anyone can independently verify your code authorship:
1. Hash the original file with SHA-256 (same algorithm used during protection).
2. Visit the proof URL or call `POST /v1/verify` with the attestation ID.
3. The system confirms the hash matches, verifies the cryptographic signature, and checks the transparency log anchor.
```bash theme={null}
# Verify an attestation
curl -X POST https://api.truthlocks.com/v1/verify \
-H "Content-Type: application/json" \
-d '{"attestation_id": "b2c3d4e5-..."}'
```
## Security Guarantees
* **Zero-knowledge:** Only the hash is transmitted — your source code never leaves your machine.
* **Tamper-proof:** Attestations are anchored to an append-only transparency log. Altering the record would break the Merkle tree.
* **Non-repudiable:** Each attestation is signed with your personal Ed25519 key. Only you could have created it.
* **Independently verifiable:** Proof can be verified without Truthlocks involvement — anyone can check the hash, signature, and log anchor.