Report ledger

A report version’s PDF never changes after it is issued, and its SHA-256 is printed on the report page. This ledger lets anyone show, without relying on PayAuthors, that a given PDF existed on a given day: the list holds only hashes, with no names, orders or report contents.

To check a report PDF: (1) compute its SHA-256 (or use /verify, which hashes it in your browser); (2) find that hash in the list for the day the version was issued; (3) compute the SHA-256 of the list file itself, which is the root shown below; (4) check the root’s time stamp, for example with OpenSSL: openssl ts -verify -digest <root> -in payauthors-ledger-<day>.tsr -CAfile <the authority’s certificate chain>. Each issued version’s PDF also has its own time stamp, linked on the report page.

Days before October 13, 2026 were sealed on or after that date, which the table shows. A day with no reports has an empty list, sealed the same way.