Spain's Verifactu Law Forces Hash-Chained Invoices on Businesses by 2027

·1 views

Spain's Verifactu regulation requires every invoice issued by software to generate a SHA-256 hash-chained record, with each entry linking to the previous one in a permanent, uneditable chain per tax ID. Deadlines were pushed back by Royal Decree RD-ley 15/2025, now set for January 1, 2027 for companies and July 1, 2027 for sole traders, though software vendors have been liable since July 2025. Cancellations and corrections do not delete records but instead add new record types to the same chain, and printed invoices must carry a QR code with verification data. The sequential nature of the chain creates backend concurrency challenges, and failed submission retries risk duplicating records or breaking the chain, which requires procedural rather than technical remediation. Businesses selling invoicing software to third parties face fines of up to €150,000 per year per non-compliant product under Article 201 bis of Spain's general tax law.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Google's TypeScript ADK Enables Developers to Build AI Agents with Gemini

Google's Agent Development Kit (ADK) for TypeScript allows developers to build and deploy AI agents using Node.js 20 or newer. A tutorial on DEV Community walks through creating a minimal 'Hello World' weather and time agent, with the full sample project available on GitHub. The ADK supports both the Gemini Developer API and Vertex AI for authentication, offering flexibility in how agents connect to Google's AI infrastructure. TypeScript's static type system ensures that tool parameters, results, and agent configurations are validated at compile time, reducing errors before deployment. The ADK is designed to be model-agnostic and framework-compatible, though it is optimized for Gemini and the broader Google ecosystem.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Linux Secure Boot Shim Signing Keys Expired in June — How to Audit Yours

Microsoft's shim loader signing keys used to validate Linux boot components expired in June 2026, affecting systems with Secure Boot enabled. The expiry does not immediately break anything, as firmware validates signatures without checking expiration dates. However, administrators should audit their Secure Boot state using the 'mokutil --sb-state' command and review enrolled keys with 'mokutil --db'. Fedora and RHEL-based users can pull updated keys via 'fwupdmgr update', while Ubuntu users should verify their shim-signed package is up to date. The issue is considered routine maintenance rather than an emergency, but is especially worth addressing for those managing fleets of Linux workstations or servers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Agent memory portability is a hidden risk — here's how to test for it

Developers building AI agents often discover too late that their stored memories are tied to specific embedding models, frameworks, or storage formats that are difficult to migrate or audit. Unlike static documents, agent memory accretes passively across interactions, creating five unresolved challenges: deciding what to retain, handling superseded facts, consolidating events into durable beliefs, tracking provenance, and enabling clean deletion. Google Cloud's Open Knowledge Format (OKF), published in June, has sparked debate about curated versus retrieved memory, but critics argue this misframes the core issue as a reading problem when memory is fundamentally a writing problem. A benchmark by researcher Satvik Singh found that question type — not tooling choice — determined retrieval success, with curated docs winning on architecture questions and grep-style search winning on code details. The article urges developers to run portability and round-trip export tests before a framework deprecation or compliance request forces the issue.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Safely Give Local AI Agents Filesystem Access Using Sandboxing Patterns

A developer shares practical security patterns after a local AI agent unexpectedly rewrote a config file it was never instructed to touch, highlighting how even small language models can cause damage through confident errors rather than malice. The core strategy involves allowlisting only specific directories — typically the active project folder and a disposable scratch space — rather than trying to block dangerous paths, which tends to fail due to overlooked edge cases. Paths must be canonicalized before any permission check, since relative traversal sequences and symlinks can bypass naive prefix matching. Sensitive files such as .env, .git contents, and credential files are hidden from the agent by default, with read access also restricted to prevent accidental exposure of secrets. Every write operation is first run in dry-run mode, displaying a full unified diff of proposed changes, so the developer can verify behavior before granting the agent broader trust.

0 comments Read more at DEV Community