Is there a way to prove that a git commit was made at a certain time?

I want to find a way for a git hosting platform that will log, somehow, every time I push a commit.

I want this log to be untamperable, in the sense that I will not be able to make it look as if a commit was done earlier than it was actually done.

I tried searching the web for solutions but didn't find any.

Several solutions include:

• A specific hosting platform with a setting to specifically log push times, in a place not editable to the users and in a way that cannot be faked
• A git hosting platform where I can look at git's internal directories and see the modification date of git objects
• Anything else you may think of

Does any of you know anything that might fit the requirements?

Thanks!

In the end I used https://freetsa.org to timestamp my commits when they are committed.

That way, they are signed with timestamp and with a private key I don't have access to.

Specifically, that's my post-commit file:

commit_hash=`git rev-parse HEAD`
toplevel_path=`git rev-parse --show-toplevel`
path=$toplevel_path/timestamps/$commit_hash
openssl ts -query -digest $commit_hash -no_nonce -out $path.tsq
curl -H "Content-Type: application/timestamp-query" --data-binary \@$path.tsq https://freetsa.org/tsr > $path.tsr || rm $path.tsr
rm $path.tsq

If I want to check the time in the signature I can use the command openssl ts -reply -in timestamps/<commit-hash>.tsr -text and if I want to check the timestamp's validity I can use the command openssl ts -verify -digest <commit-hash> -in timestamps/<commit-hash>.tsr -CAfile cacert.pem -untrusted tsa.crt where cacert.pem and tsa.crt are downloaded from https://freetsa.org.

P.S. Partial credit to chatGPT. In an earlier answer which got deleted someone posted a reply that seems to have come from chatGPT, in which one of the solutions was timestamping the commits. I didn't undertand it at first because I thought of timestamping it myself with a private key that I would generate and asked in a comment if there is a timestamp service, but I remained unanswered, until I thought to search google for a cryptographic timestamp service and found that this thing actually (unsurprisingly) exists.