Generate the same Jira report twice, a minute apart, from the same filter. Hash both files. You get two different SHA-256 values, and nothing in the report changed.
We ran into this while building document control into a Jira export, so we measured it. In the .docx, the only part that differed between the two runs was docProps/core.xml, which holds the created and modified timestamps. The body of the document, word/document.xml, came out byte for byte the same. The PDF differed too. A file records the moment it was written, not only what it says.
That matters if your document control procedure (clause 7.5.3 in ISO 27001, and the same clause number in ISO 9001) leans on a file checksum to show that the copy in front of the auditor is the one you issued.
Why a file checksum is the wrong tool
- It changes when nothing changed. Regenerate the report, or open it in Word and save, and you get a new file with a new hash.
- It disappears when the document leaves the computer. Save as PDF, print, scan, photocopy. A printed page has no checksum, and printed pages are what end up in the audit binder.
- Nobody can read it off the page. No one in the audit room is going to hash anything.
Fingerprint the content instead
The idea is to hash what the document says and print the result on the document itself. Four decisions make it hold up.
- Hash exactly what gets printed. Title, organization, scope, and every row in the order it appears. If a field is in the table, it's in the hash. If it isn't printed, leave it out, or the fingerprint will change for reasons the reader can't see.
- Fix the order. Sort by a stable key in the JQL itself, for example
ORDER BY key ASC. Same filter, same order, same fingerprint. - Separate the cells with something that can't appear in them. Without a separator, a row with "ab" and "c" and a row with "a" and "bc" join into the same text and get the same fingerprint. Use one control character between cells and another between rows.
- Keep the issue date and the version number out. This is the one that's easy to get wrong. If they're in the hash, every issue gets a new fingerprint even when the content is identical. Leaving them out is what lets you put two issues of the same period side by side and see at a glance whether anything changed.
Then print a short form on every page, next to the title and the version. Twelve hex characters in three groups, like 7C1D-04AE-93B2, are easy to compare by eye. Keep a register with the version, issue date, issuer, record count and fingerprint of each issue, so anyone can match a loose page to the issue it came from.
Doing it by hand
Without an app, a spreadsheet and a terminal get you most of the way.
- Save the filter with an explicit
ORDER BY. - Copy only the columns you'll print into a plain text file, one row per line, cells separated by tabs.
- Hash that text file, not the Word or PDF file.
- Put the first 12 characters in the header of your template, so they show on every page.
- Add a line to your document register.
# macOS / Linux
shasum -a 256 evidence.txt
# Windows PowerShell
Get-FileHash evidence.txt -Algorithm SHA256
Watch the invisible characters. Trailing spaces and line endings (Windows writes CRLF, macOS and Linux write LF) change the hash, so make the text file the same way every time.
What it proves, and what it doesn't
A content fingerprint tells you whether two documents carry the same content. It doesn't tell you who issued the document, and it doesn't stop someone from editing a page and its fingerprint together. The signature and the register cover those. What the fingerprint does is turn "which version did we hand in?" into a ten-second check.
Where Dossier fits
We build Dossier, and it does this on every issue. It computes the fingerprint over the cover and the rows as printed, stamps it on every page with the version, and keeps the register of issues inside Atlassian. The Word and the PDF from the same issue carry the same fingerprint, because both come from the same content.
How does your team show an auditor which version of a report was issued? I'd like to know whether anyone relies on file hashes today, and how that has gone.
I work at Vortex Labs, the company behind Dossier.
