Skip to main content

ArchiveHasher Overview

ArchiveHasher is two focused Go CLIs that implement the Aptlantis AAMHS v2.0 (Archive Multi-Hash Standard) hashing and signing workflow for archive publication:

  • archive-hasher computes an 8-algorithm parallel multi-hash suite over a single archive artifact and emits a canonical snapshot-hashes.txt manifest.
  • manifest-signer produces detached PGP and optional post-quantum (SLH-DSA) signatures for that manifest, without modifying it.

:::info Status Production, 90% complete — this is one of the more mature CTS tools in the portfolio. lifecycle = active-core and strategic_relevance = High. The main gaps are CTS documentation formalities (command contracts, exit-code tables), not functionality. :::

Who it's for​

Whoever is publishing an Aptlantis archive artifact and needs a cryptographically verifiable, algorithm-diverse hash manifest plus a detached signature — including a post-quantum signature option, which is unusual for a single-operator tool.

The core concept​

The two tools are deliberately separate and compose in sequence:

archive.zip
    │
    ▼  archive-hasher
snapshot-hashes.txt          <-- 8-algorithm hash manifest (canonical, text-first)
    │
    ▼  manifest-signer
snapshot-hashes.txt.asc      <-- detached PGP signature
snapshot-hashes.txt.sphincs  <-- detached SLH-DSA (post-quantum) signature, optional

manifest-signer never touches the manifest itself — signatures are strictly detached, so the manifest remains the single canonical artifact regardless of how many signature types get added later.

Why this shape​

The design follows AAMHS v2.0 directly: an archive is only as trustworthy as the diversity of its hash algorithms and the strength of its signing. Running eight hash algorithms in parallel (rather than one) protects against a single-algorithm compromise, and the optional PQ signature (SLH-DSA-SHAKE-256s via OpenSSL, alongside standard PGP) is a deliberate hedge against future cryptographic breaks — a notably forward-looking choice for a small, single-operator archival tool.