Documentation
¶
Overview ¶
Package tee — shared TEE attestation primitives. Each provider package (llm/chutes, llm/phala) handles its own provider-specific report_data binding; this package handles the parts that are common: Intel TDX quote signature + chain verification against the embedded Intel SGX Root CA, and NVIDIA GPU evidence verification against NRAS.
Index ¶
- func TDXQuoteRTMR3(rawQuote []byte) ([]byte, error)
- func VerifyGPUEvidence(ctx context.Context, hc *http.Client, nrasURL, jwksURL string, ...) error
- func VerifyTDXQuote(rawQuote []byte) ([]byte, error)
- func VerifyTDXQuoteWithOptions(rawQuote []byte, opts Options) ([]byte, error)
- type Error
- type GPUEvidence
- type Options
- type Reason
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func TDXQuoteRTMR3 ¶
TDXQuoteRTMR3 parses raw TDX quote bytes and returns a copy of RTMR3 (the 4th runtime measurement register, 48 bytes) from the quote body. It performs no signature or chain verification and no network I/O — it is a pure parse-and- extract used by the Dstack ACI event-log replay to compare the replayed IMR3 against the value the (separately verified) quote attests.
The returned slice is a fresh copy, so callers may mutate it without affecting the parsed quote. Any failure — unparseable bytes, an unexpected quote type, or a missing/short RTMR3 — returns a *tee.Error with ReasonEvidenceMalformed.
func VerifyGPUEvidence ¶
func VerifyGPUEvidence(ctx context.Context, hc *http.Client, nrasURL, jwksURL string, gpu []GPUEvidence) error
VerifyGPUEvidence POSTs the GPU evidence to NRAS (nrasURL), then verifies the returned EAT JWT (ES384) against the NVIDIA JWKS (jwksURL) and asserts the x-nvidia-overall-att-result claim is true. The NRAS nonce is read from the GPU evidence itself (bytes [4:36] of the decoded NVIDIA attestation report), NOT supplied by the caller.
Returns:
- *tee.Error{Reason: ReasonNvidiaVerdictInvalid} on any verification failure (no evidence, bad signature, wrong alg, unknown kid, malformed token, or verdict false).
- *failure.NetworkError on transport failure.
- *failure.APIError when NRAS or the JWKS endpoint returns a non-2xx status.
func VerifyTDXQuote ¶
VerifyTDXQuote parses raw TDX quote bytes, verifies the ECDSA signature and PCK certificate chain against the embedded Intel SGX Root CA, and returns the 64-byte report_data field. Callers do their own report_data binding check (the binding is provider-specific).
No network I/O: it is a thin back-compat wrapper over VerifyTDXQuoteWithOptions with a zero Options, so GetCollateral and CheckRevocations are both false and TCB level / QE identity / CRL revocation are NOT checked.
func VerifyTDXQuoteWithOptions ¶
VerifyTDXQuoteWithOptions is VerifyTDXQuote with injectable, bounded DCAP options. It performs the same parse/validate prologue, then threads all four option fields into verify.Options. When opts.GetCollateral or opts.CheckRevocations is set, the (bounded by default) Getter is used to fetch collateral/CRL data; otherwise no network I/O occurs.
Types ¶
type Error ¶
Error is the typed error returned from every llm/tee verification function. Callers inspect Reason via errors.As; Err is the underlying cause.
type GPUEvidence ¶
type GPUEvidence struct {
Certificate string `json:"certificate"`
Evidence string `json:"evidence"`
Arch string `json:"arch"`
}
GPUEvidence is one entry of the per-instance gpu_evidence list returned by a TEE attestation endpoint: a base64 NVIDIA attestation report and the base64 cert chain that signed it, plus the GPU architecture ("HOPPER", "BLACKWELL"). Exported because both llm/chutes and llm/phala build this slice from the provider-specific attestation response.
type Options ¶
type Options struct {
// GetCollateral, when true, makes the verifier fetch TCB info / QE
// identity collateral from Intel PCS over the network using Getter.
GetCollateral bool
// CheckRevocations, when true, makes the verifier fetch the CRL and check
// the PCK certificate chain for revocation over the network using Getter.
CheckRevocations bool
// Getter fetches collateral/CRL bytes. If nil, a bounded, context-aware,
// HTTPS-only getter is used (never the library's unbounded default).
Getter trust.HTTPSGetter
// Now produces the time at which certificate / collateral validity is
// judged. If nil, time.Now is used. It is a func so tests can pin time;
// it is called once per verification.
Now func() time.Time
}
Options configures TDX quote verification. The zero value is the safe, no network default used by VerifyTDXQuote: collateral and revocation checks off, the bounded getter (unused when no network is performed), and Now == time.Now.
Open/Closed: new verification knobs are added here without touching the parse/validate prologue.
type Reason ¶
type Reason string
Reason names the failing TEE attestation check. Provider packages may wrap these in their own typed errors, but the shared reason vocabulary lives here so both chutes and phala speak the same names for the same failure.
const ( // ReasonQuoteSignatureInvalid: the TDX quote's ECDSA signature or QE // report signature did not verify. ReasonQuoteSignatureInvalid Reason = "quote_signature_invalid" // ReasonRootCAUntrusted: the PCK certificate chain did not chain to the // trusted Intel SGX Root CA (or a chain cert was expired). ReasonRootCAUntrusted Reason = "root_ca_untrusted" // ReasonEvidenceMalformed: the raw quote bytes could not be parsed into // a TDX quote. ReasonEvidenceMalformed Reason = "evidence_malformed" // ReasonNvidiaVerdictInvalid: NRAS verification failed (Task 2 will use // this). ReasonNvidiaVerdictInvalid Reason = "nvidia_verdict_invalid" )
Source Files