In 2013 I wrote a diploma on elliptic curves. Last night my tool used them to check its own release.
TL;DR : In 2013 I wrote a university diploma on elliptic-curve cryptography, and it went into a drawer. Thirteen years later the same math signs most of what you npm install . I taught croak 🐸, my pre-install gate for AI agents, to check those signatures itself. Last night it checked its own fresh release: verified . Then I gave it the same signature with a different tarball: invalid . Below is…
In 2013, the author authored a diploma on elliptic curves and key exchange, which they later placed in a drawer. Thirteen years later, the same mathematical principles are utilized to verify software installations. The author developed a tool called croak, which serves as a pre-install gate for AI agents. croak checks the signatures of packages before they are installed, ensuring their authenticity.
During a recent test, croak successfully verified its own recent release. The verification process involves signing and validating statements about the packages, which are then stored in a public log called Rekor. The author highlights the importance of package provenance, particularly in the context of AI agents running npm install autonomously.
By employing elliptic curves, croak's verification system provides a robust and secure method for ensuring package integrity.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
