ComputeLedger CLI Flags a Key Cryptographic Flaw in Signed Compute-Usage Receipts

Developers Rudrendu Paul and Sourav Nandy have released ComputeLedger, an open-source command-line tool for signing and independently verifying compute-usage receipts across cloud providers. The project highlights a subtle but critical security gap: a cryptographically signed receipt can still be forged if the signer's public key is passed alongside the payload rather than embedded within it, allowing an attacker to substitute their own key and re-sign undetected. ComputeLedger addresses this by including the public key as a hashed field inside the signed payload itself, binding the claim to a specific trusted identity. The tool is available as both an npm package and a Python package, with two independently maintained implementations currently live on their respective registries. The authors note that no existing multi-cloud job or cost-monitoring tool currently produces usage records that an independent third party with no account or prior trust can cryptographically verify.