foreground-team/Stamp Delivery
Encrypt your repository, upload the payload to Stamped, and receive a legally qualified RFC 3161 eIDAS timestamp anchoring the delivery to a certified time. Your source code is encrypted client-side and never transmitted in plaintext.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| token | Stamped API token with contributor role or above on the registry. Store as a GitHub Actions secret named STAMPED_TOKEN. | yes | — |
| registry-id | UUID of the Stamped registry that will own this release. Store as a GitHub Actions secret named STAMPED_REGISTRY_ID. | yes | — |
| encryption-key | AES-256-GCM encryption key used to encrypt the repository archive. Generate once with: openssl rand -base64 32 Store as a GitHub Actions secret named STAMPED_ENCRYPTION_KEY. This key never leaves your infrastructure — Stamped only receives the SHA-256 hash of the encrypted payload. | yes | — |
| api-url | Base URL of the Stamped API. Override only when self-hosting or testing against a staging environment. | no | https://api.stamped.so |
| pbkdf2-iterations | Number of PBKDF2 iterations used when deriving the AES key from the encryption key passphrase. Higher values increase brute-force resistance. Must match the value used when decrypting. | no | 100000 |
Outputs
| name | description |
|---|---|
| release-id | UUID of the sealed release row in Stamped. |
| signing-time | RFC 3161 certified signing time as an ISO 8601 string. This is the authoritative, legally qualified delivery timestamp. |
| verify-url | Public URL to verify the delivery proof independently. Share this URL with your client as proof of delivery date and integrity. |