The source code of the libraries

Why it is not on GitHub

Since August 2026 this code is not hosted on GitHub or published to a package registry. It is not abandonment: through 2026 the registries and code platforms took chained supply-chain attacks, and hosting cryptography and evidence-custody tooling there stopped being a neutral decision. The source did not disappear — it is right here, and the delivery is signed.

How to verify what you download

Verify the manifest first, then the files against it. That order is the whole point: a signature over a tarball proves those bytes came from this key, but not that they are the artifact you asked for. SHA256SUMS is what ties each name to its contents, so it is the file that has to be signed.

chmod +x verificar-firma
./verificar-firma verificar "$(cat CLAVE-PUBLICA.txt)" \
    SHA256SUMS SHA256SUMS.firma      # 1. the manifest is authentic
sha256sum -c SHA256SUMS              # 2. every file matches it

Step 1 prints FIRMA VALIDA and exits 0; step 2 prints OK for every line. The signature is hybrid — Ed25519 and ML-DSA-87 — and validates only if both do, so whoever stores these files today and owns a quantum computer tomorrow still cannot forge a past delivery. The verifier is a static Linux x86-64 binary: no dependencies, no network.

Each tarball also carries its own .firma, handy for checking a single file — but on its own it does not tell you the file is the one you named. Use the manifest.

What this does not cover, said plainly: whoever controls this server can still serve you a previous, genuinely signed release instead of the current one. Detached signatures cannot stop a rollback on their own. If that matters to you, ask for the checksums by email and compare.

Check the key against a second channel. A public key that travels only inside the package it authenticates proves nothing. The same fingerprint is published at /en/quipu/code.