A public project should not be credible only because it appears online.

This is why I am using ProofBundle for the projects I publish and discuss publicly, including the ones I present here on LinkedIn.

ProofBundle creates a portable cryptographic proof for a project snapshot.

It takes the files, builds a deterministic SHA-256 manifest, reduces the entries into a Merkle tree, and produces one Merkle root for the whole project state.

Then that root is bound to a signed author/custody claim.

ProofBundle can also use OpenTimestamps: the Merkle root and manifest hash are timestamped and anchored to public blockchains, without uploading the original project and without putting the contents on-chain.

So the proof has three layers:

- integrity: SHA-256 hashes, manifest, and Merkle root
- identity/custody: Ed25519 or OpenPGP signature
- time evidence: OpenTimestamps blockchain anchoring

For signing, ProofBundle supports a default Ed25519 mode: modern, compact, and easy to verify.

It can also use a detached OpenPGP signature, including OpenPGP keys based on Ed25519. And for stronger key custody, OpenPGP signing can optionally be backed by a YubiKey, so the private signing key stays
hardware-backed and non-exportable.

This is not copyright registration and it is not a legal shortcut.

It is technical evidence that:
- this exact project state existed
- these files matched this manifest
- this Merkle root represented the snapshot
- this key signed the claim
- the timestamp evidence was

anchored through OpenTimestamps
- the proof can be verified independently

Read about it:
gabrielesalati.eu/blog/proofbu…