Satoshi Used Timestamps For Early Bitcoin Source Code Versioning

The history of Bitcoin is a fascinating one. People enthralled by Satoshi Nakamoto’s creation will pay attention to the smallest details, uncovering insights into his mysterious persona. However, as with most things historic, authentic sources become scarce and information distorts as time passes.

Luckily for us, authentic early Bitcoin source code releases are still available. While doing research into Satoshi Nakamoto, we came by something interesting – the versioning scheme he used before the SourceForge repository was established in August, 2009.

Methodology

To come to the conclusion we are going the present herein, we analysed the following:

• Early Bitcoin source code archives (a preliminary version from November, 2008, archives from version 0.1.0, and version 0.1.3)
• File and directory timestamps in the archives
• Satoshi Nakamoto email archives

This post will not focus on Satoshi’s identity. We will merely study the metadata in the early Bitcoin source code archives and present our findings. As a result, further research of Bitcoin’s history or the identity of its author may be facilitated.

Early Bitcoin Source Code

We know from an email from 8 January, 2009, that Satoshi uploaded an archive of the Bitcoin source code (v0.1 as he named it) to SourceForge. Unfortunately, the link has been broken since 2011, but we managed to find copies of the archive in a post on Bitcointalk. The files were provided by Hal Finney himself, which adds to their credibility. Version 0.1.3 we found here. However, there are versions that we could not find, namely 0.1.2 and 0.1.5.

In addition to versions 0.1.0 to 0.1.5, there is a preliminary version that was sent to Hal Finney and a few other people in the cryptography mailing list. This happened in November 2008. There are a few different copies of that source code that can be found around the Internet. One that looks original is available here.

Archive Metadata

Having acquired four different authentic Bitcoin source code archives, we went to work analysing their metadata.

Bitcoin Preview (November 2008)

RAR archive ./bitcoin_src1.rar
Pathname/Comment
                 Size    Packed Ratio  Date   Time     Attr      CRC   Meth Ver
main.cpp         66174   14794  22% 15-11-08 00:00     …..A   FDA98018 m3? 2.9
main.h           29219   6842   23% 15-11-08 00:00     …..A   67A56E38 m3? 2.9
node.cpp.        28112   6685   24% 15-11-08 00:00     …..A   D2FCC4D0 m3? 2.9
node.h.          18491   4797   26% 15-11-08 00:00     …..A   E699C7D7 m3? 2.9
readme.txt.      451     304    67% 15-11-08 00:00     …..A   0FC730BA m3? 2.9

At first glance, we notice the date 15 November, 2008 on all files in the archive. The 00:00 time suggests that it was set manually by Satoshi. It would seem that he wanted to conceal original modification time of the files, however, it turns out that’s not why he did it. Further investigation into the archive gives us exact date and time of 15 November, 2008 at 00:00:01.

Bitcoin 0.1.0

There are two archives available for the 0.1.0 version – a RAR and a TGZ. As we already mentioned, both were provided by Hal Finney in a Bitcointalk post.

MD5:
 91e2dfa2af043eabbb38964cbf368500  bitcoin-0.1.0.rar
 dca1095f053a0c2dc90b19c92bd1ec00  bitcoin-0.1.0.tgz

Let’s start with the original Bitcoin source code archive released to the public on 8 January, 2009 – the RAR.

RAR archive ./bitcoin-0.1.0.rar
 Pathname/Comment
                   Size   Packed Ratio  Date   Time     Attr      CRC   Meth Ver
  src/makefile
                   2693      967  36% 07-01-09 01:00   .....A   C3C06DAC m5? 2.9
  src/obj
                      0        0   0% 07-01-09 15:36   .D....   00000000 m0? 2.0
  src/rc/addressbook16.bmp
                   1334      796  60% 07-01-09 01:00   .....A   7D00BCF5 m5? 2.9
  src/rc/addressbook16mask.bmp
                    126       40  32% 07-01-09 01:00   .....A   6428BA44 m5? 2.9
  src/rc/addressbook20.bmp
                   1478      545  37% 07-01-09 01:00   .....A   747AADED m5? 2.9
  src/rc/addressbook20mask.bmp
                    142       49  35% 07-01-09 01:00   .....A   49D20842 m5? 2.9
  src/rc/send16.bmp
                   1334      385  29% 07-01-09 01:00   .....A   9D892475 m5? 2.9
  src/rc/send16mask.bmp
                    126       45  36% 07-01-09 01:00   .....A   51360655 m5? 2.9
  src/rc/send16masknoshadow.bmp
                    126       24  19% 07-01-09 01:00   .....A   F6876188 m5? 2.9
  src/rc/send20.bmp
                   1478      495  33% 07-01-09 01:00   .....A   39F9B908 m5? 2.9
  src/rc/send20mask.bmp
                    142       39  27% 07-01-09 01:00   .....A   FA78BFA8 m5? 2.9
  src/rc
                      0        0   0% 07-01-09 15:37   .D....   00000000 m0? 2.0
  src/db.cpp
                  16382     3413  21% 07-01-09 01:00   .....A   8C8159E8 m5? 2.9
  src/irc.cpp
                   6568     1348  21% 10-01-09 01:01   .....A   0F73F00C m5? 2.9
  src/main.cpp
                  82983    12833  15% 07-01-09 01:00   .....A   F9387E1B m5? 2.9
  src/market.cpp
                   6938     1275  18% 07-01-09 01:00   .....A   D087E0DE m5? 2.9
  src/net.cpp
                  31293     4466  14% 07-01-09 01:00   .....A   E22F1E37 m5? 2.9
  src/script.cpp
                  35279     4084  12% 07-01-09 01:00   .....A   70DE7357 m5? 2.9
  src/sha.cpp
                  19000     4823  25% 07-01-09 01:00   .....A   7B45200F m5? 2.9
  src/ui.cpp
                  97185    13159  14% 07-01-09 01:00   .....A   0F952088 m5? 2.9
  src/uibase.cpp
                 108295     6915   6% 07-01-09 01:00   .....A   26639AFE m5? 2.9
  src/util.cpp
                   9386     1989  21% 07-01-09 01:00   .....A   5766966A m5? 2.9
  src
                      0        0   0% 10-01-09 23:15   .D....   00000000 m0? 2.0
  libeay32.dll
                1306630   427596  33% 07-01-09 01:00   .....A   A1896702 m5? 2.9
  mingwm10.dll
                  11673     2611  22% 07-01-09 01:00   .....A   555A37B7 m5? 2.9
  bitcoin.exe
                6440960  1597337  25% 10-01-09 01:01   .....A   9C811519 m5? 2.9
  src/uiproject.fbp
                 841798    11074   1% 07-01-09 01:00   .....A   C4A39D79 m5? 2.9
  src/base58.h
                   5639     1380  24% 07-01-09 01:00   .....A   DD2EC569 m5? 2.9
  src/bignum.h
                  14096     1919  14% 07-01-09 01:00   .....A   A9A6A507 m5? 2.9
  src/db.h
                  10979     1582  14% 07-01-09 01:00   .....A   F6BAF4B2 m5? 2.9
  src/headers.h
                   1639      385  23% 07-01-09 01:00   .....A   5C745AA1 m5? 2.9
  src/irc.h
                    317       84  26% 07-01-09 01:00   .....A   00C6F007 m5? 2.9
  src/key.h
                   4639      630  14% 07-01-09 01:00   .....A   0C5ABC88 m5? 2.9
  src/main.h
                  33212     5080  15% 07-01-09 01:00   .....A   5369988D m5? 2.9
  src/market.h
                   3745      429  11% 07-01-09 01:00   .....A   27420D6A m5? 2.9
  src/net.h
                  21344     3495  16% 07-01-09 01:00   .....A   377199D8 m5? 2.9
  src/script.h
                  17707     2335  13% 07-01-09 01:00   .....A   FF1DE242 m5? 2.9
  src/serialize.h
                  39878     4881  12% 10-01-09 01:01   .....A   2C064D8D m5? 2.9
  src/sha.h
                   5023     1079  21% 07-01-09 01:00   .....A   9CF10FA3 m5? 2.9
  src/ui.h
                  11887     1448  12% 07-01-09 01:00   .....A   4614B77B m5? 2.9
  src/uibase.h
                  27772     2083   8% 07-01-09 01:00   .....A   9D64FB45 m5? 2.9
  src/uint256.h
                  25269     2148   9% 07-01-09 01:00   .....A   524954B7 m5? 2.9
  src/util.h
                  11482     2035  18% 07-01-09 01:00   .....A   D10D475F m5? 2.9
  src/rc/bitcoin.ico
                  22486      110   0% 07-01-09 01:00   .....A   EE40473A m5? 2.9
  src/rc/check.ico
                    766       17   2% 07-01-09 01:00   .....A   F4E0FC06 m5? 2.9
  src/ui.rc
                    602      131  22% 07-01-09 01:00   .....A   4303CA25 m5? 2.9
  license.txt
                   1079      502  47% 07-01-09 01:00   .....A   1EF87B23 m5? 2.9
  src/license.txt
                   1079       20   2% 07-01-09 01:00   .....A   1EF87B23 m5? 2.9
  readme.txt
                   1856      588  32% 07-01-09 01:00   .....A   FB70D7AF m5? 2.9
  src/readme.txt
                   2663      850  32% 07-01-09 01:00   .....A   2AE1E59F m5? 2.9
  src/makefile.vc
                   2647      804  30% 07-01-09 01:00   .....A   35548F9A m5? 2.9

Obviously, there a few things that are off in those timestamps. Every file, with the exception of the directories, has a timestamp of either 7 January, 2009 at 01:00:00 or 10 January, 2009 at 01:01:00. The second timestamp is suspicious since it is after the release date of this version. As for the time, there’s a reason it is either 01:00:00 or 01:01:00.

Now let’s take a look at the tarball (bitcoin-0.1.0.tgz).

$ TZ=US/Pacific tar tzvf bitcoin-0.1.0.tgz
drwxrwxr-x hal/hal           0 2009-01-10 18:34 bitcoin/
drwxrwxr-x hal/hal           0 2009-01-10 18:34 bitcoin/src/
-rw-rw-r-- hal/hal        2693 2009-01-07 01:00 bitcoin/src/makefile
drwxrwxr-x hal/hal           0 2009-01-07 15:36 bitcoin/src/obj/
drwxrwxr-x hal/hal           0 2009-01-10 18:34 bitcoin/src/rc/
-rw-rw-r-- hal/hal        1334 2009-01-07 01:00 bitcoin/src/rc/addressbook16.bmp
-rw-rw-r-- hal/hal         126 2009-01-07 01:00 bitcoin/src/rc/addressbook16mask.bmp
-rw-rw-r-- hal/hal        1478 2009-01-07 01:00 bitcoin/src/rc/addressbook20.bmp
-rw-rw-r-- hal/hal         142 2009-01-07 01:00 bitcoin/src/rc/addressbook20mask.bmp
-rw-rw-r-- hal/hal        1334 2009-01-07 01:00 bitcoin/src/rc/send16.bmp
-rw-rw-r-- hal/hal         126 2009-01-07 01:00 bitcoin/src/rc/send16mask.bmp
-rw-rw-r-- hal/hal         126 2009-01-07 01:00 bitcoin/src/rc/send16masknoshadow.bmp
-rw-rw-r-- hal/hal        1478 2009-01-07 01:00 bitcoin/src/rc/send20.bmp
-rw-rw-r-- hal/hal         142 2009-01-07 01:00 bitcoin/src/rc/send20mask.bmp
-rw-rw-r-- hal/hal       22486 2009-01-07 01:00 bitcoin/src/rc/bitcoin.ico
-rw-rw-r-- hal/hal         766 2009-01-07 01:00 bitcoin/src/rc/check.ico
-rw-rw-r-- hal/hal       16382 2009-01-07 01:00 bitcoin/src/db.cpp
-rw-rw-r-- hal/hal        6568 2009-01-10 01:01 bitcoin/src/irc.cpp
-rw-rw-r-- hal/hal       82983 2009-01-07 01:00 bitcoin/src/main.cpp
-rw-rw-r-- hal/hal        6938 2009-01-07 01:00 bitcoin/src/market.cpp
-rw-rw-r-- hal/hal       31293 2009-01-07 01:00 bitcoin/src/net.cpp
-rw-rw-r-- hal/hal       35279 2009-01-07 01:00 bitcoin/src/script.cpp
-rw-rw-r-- hal/hal       19000 2009-01-07 01:00 bitcoin/src/sha.cpp
-rw-rw-r-- hal/hal       97185 2009-01-07 01:00 bitcoin/src/ui.cpp
-rw-rw-r-- hal/hal      108295 2009-01-07 01:00 bitcoin/src/uibase.cpp
-rw-rw-r-- hal/hal        9386 2009-01-07 01:00 bitcoin/src/util.cpp
-rw-rw-r-- hal/hal      841798 2009-01-07 01:00 bitcoin/src/uiproject.fbp
-rw-rw-r-- hal/hal        5639 2009-01-07 01:00 bitcoin/src/base58.h
-rw-rw-r-- hal/hal       14096 2009-01-07 01:00 bitcoin/src/bignum.h
-rw-rw-r-- hal/hal       10979 2009-01-07 01:00 bitcoin/src/db.h
-rw-rw-r-- hal/hal        1639 2009-01-07 01:00 bitcoin/src/headers.h
-rw-rw-r-- hal/hal         317 2009-01-07 01:00 bitcoin/src/irc.h
-rw-rw-r-- hal/hal        4639 2009-01-07 01:00 bitcoin/src/key.h
-rw-rw-r-- hal/hal       33212 2009-01-07 01:00 bitcoin/src/main.h
-rw-rw-r-- hal/hal        3745 2009-01-07 01:00 bitcoin/src/market.h
-rw-rw-r-- hal/hal       21344 2009-01-07 01:00 bitcoin/src/net.h
-rw-rw-r-- hal/hal       17707 2009-01-07 01:00 bitcoin/src/script.h
-rw-rw-r-- hal/hal       39878 2009-01-10 01:01 bitcoin/src/serialize.h
-rw-rw-r-- hal/hal        5023 2009-01-07 01:00 bitcoin/src/sha.h
-rw-rw-r-- hal/hal       11887 2009-01-07 01:00 bitcoin/src/ui.h
-rw-rw-r-- hal/hal       27772 2009-01-07 01:00 bitcoin/src/uibase.h
-rw-rw-r-- hal/hal       25269 2009-01-07 01:00 bitcoin/src/uint256.h
-rw-rw-r-- hal/hal       11482 2009-01-07 01:00 bitcoin/src/util.h
-rw-rw-r-- hal/hal         602 2009-01-07 01:00 bitcoin/src/ui.rc
-rw-rw-r-- hal/hal        1079 2009-01-07 01:00 bitcoin/src/license.txt
-rw-rw-r-- hal/hal        2663 2009-01-07 01:00 bitcoin/src/readme.txt
-rw-rw-r-- hal/hal        2647 2009-01-07 01:00 bitcoin/src/makefile.vc
-rw-rw-r-- hal/hal     1306630 2009-01-07 01:00 bitcoin/libeay32.dll
-rw-rw-r-- hal/hal       11673 2009-01-07 01:00 bitcoin/mingwm10.dll
-rw-rw-r-- hal/hal     6440960 2009-01-10 01:01 bitcoin/bitcoin.exe
-rw-rw-r-- hal/hal        1079 2009-01-07 01:00 bitcoin/license.txt
-rw-rw-r-- hal/hal        1856 2009-01-07 01:00 bitcoin/readme.txt

We can immediately spot the Unix user and group hal/hal. Obviously, that archive was created by Hal Finney and the timestamps are pretty much the same as with the RAR. Finney extracted the files on 10 January at 18:34 local time (see first entry), assuming that his local time zone was US/Pacific (UTC-8 at the time).

Bitcoin 0.1.3

For this part of the analysis, we will also denote the lines that differ between this version and version 0.1.0 by adding a + (for 0.1.3) or a – (for 0.1.0) at the beginning of the line.

-RAR archive ./bitcoin-0.1.0.rar
+RAR archive ./bitcoin-0.1.3.rar

 Pathname/Comment
                   Size   Packed Ratio  Date   Time     Attr      CRC   Meth Ver
@@ -32,82 +32,82 @@
  src/db.cpp
-                 16382     3413  21% 07-01-09 01:00   .....A   8C8159E8 m5? 2.9
+                 16616     3486  21% 11-01-09 01:02   .....A   9309EFB7 m5? 2.9
  src/irc.cpp
-                  6568     1348  21% 10-01-09 01:01   .....A   0F73F00C m5? 2.9
+                  7173     1483  21% 11-01-09 01:02   .....A   806DD781 m5? 2.9
  src/main.cpp
-                 82983    12833  15% 07-01-09 01:00   .....A   F9387E1B m5? 2.9
+                 83058    12791  15% 07-01-09 01:00   .....A   E51CE2B1 m5? 2.9
  src/net.cpp
-                 31293     4466  14% 07-01-09 01:00   .....A   E22F1E37 m5? 2.9
+                 32774     4639  14% 12-01-09 01:03   .....A   B5CED220 m5? 2.9
  src/util.cpp
-                  9386     1989  21% 07-01-09 01:00   .....A   5766966A m5? 2.9
+                  9610     2045  21% 11-01-09 01:02   .....A   5CE3CB17 m5? 2.9
  bitcoin.exe
-               6440960  1597337  25% 10-01-09 01:01   .....A   9C811519 m5? 2.9
+               6438912  1591536  25% 12-01-09 01:03   .....A   292232FB m5? 2.9
  src/net.h
-                 21344     3495  16% 07-01-09 01:00   .....A   377199D8 m5? 2.9
+                 21397     3519  16% 11-01-09 01:02   .....A   FAC43B12 m5? 2.9
  src/serialize.h
-                 39878     4881  12% 10-01-09 01:01   .....A   2C064D8D m5? 2.9
+                 39878     4889  12% 07-01-09 01:00   .....A   71E29667 m5? 2.9
  readme.txt
-                  1856      588  32% 07-01-09 01:00   .....A   FB70D7AF m5? 2.9
+                  1857      587  32% 12-01-09 01:03   .....A   628FFF0C m5? 2.9
  src/readme.txt
-                  2663      850  32% 07-01-09 01:00   .....A   2AE1E59F m5? 2.9
+                  2664      851  32% 12-01-09 01:03   .....A   20E4D16A m5? 2.9

We spot that there are four unique timestamps: 07-01-09 01:00, 10-01-09 01:01, 11-01-09 01:02, 12-01-09 01:03. A clear pattern emerges.

File Versioning Scheme Using Timestamps

The time follows the version number. That means that the time 01:00 signifies that the file hasn’t changed since version 0.1.0, and 01:01 points to version 0.1.1, and so on. We can verify that claim by checking the release dates of early Bitcoin client versions. The source we can check is the bitcoin-list mailing list, where the version dates and release dates for 0.1.2 and 0.1.3 are exactly the same. The Internet Archive is one of the sources that has an early record of Bitcoin SourceForge files. Another source is the email conversations between Hal Finney and Satoshi Nakamoto. They put the date of the version releases between 0.1.1 and 0.1.3 within a day from the file timestamp, which might as well be a time zone difference.

There are a few exceptions though, the first one is that there is no public release of version 0.1.1, but we will explain that in the next chapter. Another issue is that src/serialize.h had its timestamp reset back to version 0.1.0, but the code contains static const int VERSION = 103;. We argue that this was simply a mistake.

An interesting take on this file versioning scheme is to consider it as a primitive version control system (VCS) that Nakamoto could have used on his own. Decentralised VCSs like Git were not popular at the time when Bitcoin source code was published. In fact, it wasn’t until mid-2009 when the SourceForge repository for Bitcoin was set up by a member of the community (sirius-m).

On a side note, if we apply that file versioning scheme to the preview release from November 2008, which had files with time set to 00:00:01, the resulting version would be 0.0.0.1.

Available Bitcoin 0.1.0 Is Actually 0.1.1

There are more than a few clues, which show that the original Bitcoin 0.1.0 version was replaced with a newer version. From an early record of SourceForge files we can see that bitcoin-0.1.0.rar has a release date of 12 January, 2009, instead of the expected 8 January, 2009, when the first announcement email was sent.

We know from emails that Hal Finney had tested version 0.1.0 and identified a major issue that made the client crash. Nakamoto managed to find the culprit in irc.cpp (mapAddresses.count() method call) and removed it. The current v0.1.0 doesn’t have that code and issue. Moreover, according to the emails the bitcoin-0.1.1.rar archive that Hal Finney received had exactly the same size of 2,132,686 bytes.

If we open the /src/serialize.h header file in bitcoin-0.1.0.rar archive, we find the following definition: static const int VERSION = 101;

Finally, the latest file timestamp in bitcoin-0.1.0.rar is 2009-01-10 01:01. Using the file versioning scheme we established earlier, and knowing that there is a gap between 0.1.0 and 0.1.2, we can conclude that the first public release we can get on the Internet at the moment is actually a Bitcoin client version 0.1.1, incorrectly passed around as 0.1.0.

What are the differences between those two versions? Looking at the timestamps, we can infer that only two source files were changed – irc.cpp and serialize.h. That is, the bug fix and changing static const int VERSION = 100; to static const int VERSION = 101;.

Additional Metadata

We have purposefully skipped a few metadata timestamps and facts that are insignificant. After investigating the timestamps of the files and the timestamps of the directories, we concluded that the RAR archives were created on a Windows machine. This is shown by the host flag for the file entries and the microsecond precision directory timestamps. Another interesting piece of information is the directory timestamps themselves, which look untouched.

FILE: hdrlen=44 datlen=0 is=-D-
   flags=0x90f0:SOLID,EXTTIME,LONG,DIR
   os=2:WIN ver=20 mode=DIRECTORY,ARCHIVE,COMPRESSED meth=0 cmp=0 dec=0 vol=0
   crc=0x00000000 (0) date_time=2009-01-07 15:36:27
   name=src/obj/
   mtime=2009-01-07T15:36:27.468750
FILE: hdrlen=43 datlen=0 is=-D-
   flags=0x90f0:SOLID,EXTTIME,LONG,DIR
   os=2:WIN ver=20 mode=DIRECTORY,ARCHIVE,COMPRESSED meth=0 cmp=0 dec=0 vol=0
   crc=0x00000000 (0) date_time=2009-01-07 15:37:33
   name=src/rc/
   mtime=2009-01-07T15:37:33.671875
FILE: hdrlen=40 datlen=0 is=-D-
   flags=0x90f0:SOLID,EXTTIME,LONG,DIR
   os=2:WIN ver=20 mode=DIRECTORY,ARCHIVE,COMPRESSED meth=0 cmp=0 dec=0 vol=0
   crc=0x00000000 (0) date_time=2009-01-10 23:15:06
   name=src/
   mtime=2009-01-10T23:15:06.703125

Summary

The article dives into the metadata of some of the early releases of the Bitcoin client. As a result, we have unravelled a file versioning scheme used by Satoshi, which utilises file modification time to show the version of the file. Thus, we can say with certainty that the currently available bitcoin-0.1.0.rar actually contains version 0.1.1.

Further investigation into the metadata of following releases would be an interesting continuation of this research. However, more than 11 years after the public release of Bitcoin, it is hard to come by original archives of early versions, namely 0.1.2 and 0.1.5. If you happen to have any of those, please send them to us. We’d love to further this research with more data.