K-Veritas：用密码学签名证明代码的真实产出

开源工具 K-Veritas 已在 Hacker News 上发布，旨在解决科研和代码审查中的信任问题1。该工具通过密码学签名的 PDF 将已发布的计算结果绑定到生成它的确切代码、硬件和时间，使审阅者无需重新运行代码即可验证结果的真实性1。

K-Veritas 采用 RSA-PSS-SHA256 算法进行签名，密钥长度为 4096 位，创建不可篡改的证明文件1。该工具支持任何编程语言、零运行时依赖，并在 Linux、macOS 和 Windows 平台上提供 amd64 和 arm64 二进制文件1。在数据采集方面，工具可监测 CPU、内存、GPU 利用率、功率和温度等硬件指标，采样频率约为 10 Hz1。

验证过程既支持在线进行——通过 kveritas.org/verify 网站——也支持离线验证，用户可使用 --offline 标志本地验证1。在开源许可方面，CLI 工具和验证库采用 Apache-2.0 许可证，而证明服务器则采用 AGPL-3.0 许可证1。

K-Veritas is an open source project designed to eliminate the need for code reviewers to re-run computational experiments 1. The tool binds published results to the exact code, hardware, and timestamp that generated them through cryptographically signed PDF certificates, allowing anyone to verify whether code genuinely produced the claimed outcomes 1.

The tool supports any programming language and requires zero runtime dependencies 1. K-Veritas employs RSA-PSS-SHA256 cryptographic signatures with 4096-bit key lengths to create tamper-proof proof documents 1. It is available across Linux, macOS, and Windows platforms with both amd64 and arm64 binary releases 1. The verification process can be performed online through kveritas.org/verify or offline using the --offline flag 1.

During execution, K-Veritas monitors system hardware metrics including CPU, memory, GPU utilization, power consumption, and temperature at a sampling frequency of approximately 10 Hz 1. The project uses Apache-2.0 licensing for its command-line interface and verification library, while the proof server operates under AGPL-3.0 1.