@eqtylab/explorer 0.0.0

package/src/v-comp-viewer/utils.tsx

@@ -0,0 +1,824 @@
+// @ts-expect-error - No type declarations available for this module
+import vc_parse from "@eqtylab/vcomp-verify-js/common/vc_parse.js";
+// @ts-expect-error - No type declarations available for this module
+import TEEAttestation from "@eqtylab/vcomp-verify-js/common/TEEAttestation.js";
+// @ts-expect-error - No type declarations available for this module
+import { checkChain, parseChain, getPubKeyRaw, getCertificateInfo } from "@eqtylab/vcomp-verify-js/x509/certificate.js";
+// @ts-expect-error - No type declarations available for this module
+import intel_tdx from "@eqtylab/vcomp-verify-js/intel/intel_tdx.js";
+// @ts-expect-error - No type declarations available for this module
+import nvidia from "@eqtylab/vcomp-verify-js/nvidia/nvidia.js";
+// @ts-expect-error - No type declarations available for this module
+import amd_sev_snp from "@eqtylab/vcomp-verify-js/amd/amd-sev-snp.js";
+// @ts-expect-error - No type declarations available for this module
+import azure from "@eqtylab/vcomp-verify-js/azure/azure.js";
+// @ts-expect-error - No type declarations available for this module
+import TPM from "@eqtylab/vcomp-verify-js/common/TPM.js";
+// @ts-expect-error - No type declarations available for this module
+import { cidGenerator } from "@eqtylab/vcomp-verify-js/common/cidGenerator.js";
+// @ts-expect-error - No type declarations available for this module
+import UKI from "@eqtylab/vcomp-verify-js/common/UKI.js";
+
+export type Validated = "valid" | "partial" | "invalid" | "";
+
+// Upload handling types
+export type UploadKey = "manifest" | "compose" | "cmdline" | "ovmf" | "initrd" | "kernel";
+
+export type UploadValue =
+    | { kind: "manifest"; value: unknown }
+    | { kind: Exclude<UploadKey, "manifest">; value: Uint8Array };
+
+export type UploadsMap = Partial<Record<UploadKey, UploadValue["value"]>>;
+
+export interface UploadVerification {
+    // Azure UKI-only derived fields (not present in ParsedManifest)
+    azureUKIPcrLog?: string;
+    azureUKIPcrHash: {
+        value: string;
+        validated: Validated;
+    };
+    azureUKIPcr: {
+        value: string;
+        validated: Validated;
+    };
+    azureUKIKernel?: string;
+    azureUKICmdLine?: string;
+    azureUKIRootFSHash?: string;
+    azureUKIInitRDLate?: string;
+}
+
+export interface VCompContainerInfo {
+    did: {
+        value: string;
+        validated: Validated;
+    };
+    signedBy: {
+        value: string;
+        validated: Validated;
+    };
+    dockerComposeId: {
+        value: string;
+        validated: Validated;
+    };
+    dockerImages: {
+        images: Array<{
+            name: string;
+            sha256: string;
+        }>;
+        validated: Validated;
+    };
+}
+
+export interface VCompSystemInfo {
+    did: {
+        value: string;
+        validated: Validated;
+    };
+    cpu: {
+        report: {
+            value: string | null;
+            validated: Validated;
+        };
+        reportParsed: unknown | null;
+        type: "intel" | "amd" | "azure" | null;
+        measurements: {
+            mrtd: {
+                value: string;
+                validated: Validated;
+            };
+            rtmr0: {
+                value: string;
+                validated: Validated;
+            };
+            rtmr1: {
+                value: string;
+                validated: Validated;
+            };
+            rtmr2: { value: string; validated: Validated };
+            mrconfigid?: string;
+            mrownerconfig?: string;
+            mrowner?: string;
+            xfam?: string;
+            tdattributes?: string;
+            rootfs: { value: string; validated: Validated };
+            amdMeasurement: {
+                value: string;
+                validated: Validated;
+            };
+            amdReportData?: string;
+        };
+        certificate: {
+            x509: string | null;
+            chain: unknown[] | null;
+            validated: Validated;
+        };
+        hardwareVerifyUrl: string | null;
+    };
+    gpu: {
+        report: {
+            value: string | null;
+            validated: Validated;
+        };
+        reportData: string | null;
+        certificate: {
+            x509: {
+                value: Buffer | null;
+                validated: Validated;
+            };
+            chain: unknown[] | null;
+        };
+        hardwareVerifyUrl: string | null;
+    };
+    azure: {
+        bootLog: {
+            value: string | null;
+        };
+        bootLogHash: {
+            value: string | null;
+            validated: Validated;
+        };
+        tpmAKCertificate: {
+            value: string | null;
+            validated: Validated;
+        };
+        tpmLog: string | null;
+        tpmQuote: {
+            value: string | null;
+            validated: Validated;
+        };
+        tpmQuoteSignature: {
+            value: string | null;
+            validated: Validated;
+        };
+        tpmPCRHash: {
+            value: string | null;
+            validated: Validated;
+        };
+        tpmNotaryHex: {
+            value: string | null;
+            validated: Validated;
+        };
+        tpmNotaryDID: {
+            value: string | null;
+            validated: Validated;
+        };
+        azureTPMAKKey: {
+            value: string | null;
+            validated: Validated;
+        };
+        azureAKTPMPubKey: {
+            value: string | null;
+            validated: Validated;
+        };
+    };
+}
+
+export interface ParsedManifest {
+    // map of did keys to container info
+    containers: Record<string, VCompContainerInfo>;
+    // map of did keys to system info
+    systems: Record<string, VCompSystemInfo>;
+}
+
+function bufferToHex(buffer: Buffer): string {
+    return Array.from(new Uint8Array(buffer))
+        .map((byte) => byte.toString(16).padStart(2, "0"))
+        .join("");
+}
+
+/**
+ * Read a browser File into a Uint8Array
+ */
+async function readFileAsUint8Array(file: File): Promise<Uint8Array> {
+    const arrayBuffer = await file.arrayBuffer();
+    return new Uint8Array(arrayBuffer);
+}
+
+/**
+ * Rough YAML detection similar to the legacy main.js
+ */
+function isLikelyYaml(text: string): boolean {
+    return /^[\s-]*[a-zA-Z0-9_-]+:/m.test(text);
+}
+
+/**
+ * Parse Linux kernel cmdline bytes into key=value pairs
+ */
+export function parseKernelArgs(cmdlineBytes: Uint8Array): Record<string, string> {
+    const decoder = new TextDecoder("ascii");
+    const input = decoder.decode(cmdlineBytes);
+    const result: Record<string, string> = {};
+    input.split(/\s+/).forEach((pair) => {
+        const index = pair.indexOf("=");
+        if (index !== -1) {
+            const key = pair.substring(0, index);
+            const value = pair.substring(index + 1);
+            result[key] = value;
+        }
+    });
+    return result;
+}
+
+/**
+ * Detect upload kind(s) from a File and return detected values
+ * Mirrors the order and checks from main.js's parseFile
+ */
+export async function detectUploadsFromFile(file: File): Promise<UploadValue[]> {
+    const out: UploadValue[] = [];
+    const uint8Array = await readFileAsUint8Array(file);
+
+    // JSON manifest detection (first byte '{')
+    if (uint8Array[0] === 0x7b) {
+        try {
+            const jsonString = new TextDecoder().decode(uint8Array);
+            const jsonObject = JSON.parse(jsonString);
+            out.push({ kind: "manifest", value: jsonObject });
+            // When manifest is detected, legacy logic resets other parsed states.
+            // We still return below to also allow other detections if needed.
+        } catch (_e) {
+            // Not valid JSON, continue
+        }
+    } else if (uint8Array.length < 1_000_000) {
+        // Text-sized file: YAML or cmdline
+        const textContent = new TextDecoder().decode(uint8Array);
+        if (isLikelyYaml(textContent)) {
+            out.push({ kind: "compose", value: uint8Array });
+        } else {
+            out.push({ kind: "cmdline", value: uint8Array });
+        }
+    } else if (uint8Array.length < 5_000_000) {
+        // Likely OVMF firmware blob
+        out.push({ kind: "ovmf", value: uint8Array });
+    }
+
+    // Gzip magic = initrd
+    if (uint8Array[0] === 0x1f && uint8Array[1] === 0x8b) {
+        out.push({ kind: "initrd", value: uint8Array });
+    }
+
+    // 'MZ' magic (0x4d 0x5a) heuristic for kernel image here
+    if (uint8Array[0] === 0x4d && uint8Array[1] === 0x5a) {
+        out.push({ kind: "kernel", value: uint8Array });
+    }
+
+    return out;
+}
+
+/**
+ * Verify uploaded blobs against parsed manifest measurements where feasible.
+ * Returns simple booleans that a component can use to decorate the UI.
+ */
+export async function verifyUploads(uploads: UploadsMap, parsed: ParsedManifest): Promise<UploadVerification> {
+    const result: UploadVerification = {
+        // Azure UKI
+        azureUKIPcrLog: "",
+        azureUKIPcrHash: {
+            value: "",
+            validated: "",
+        },
+        azureUKIPcr: {
+            value: "",
+            validated: "",
+        },
+        azureUKIKernel: "",
+        azureUKICmdLine: "",
+        azureUKIRootFSHash: "",
+        azureUKIInitRDLate: "",
+    };
+
+    for (const key in parsed.systems) {
+        // Only Intel TDX verifications are implemented to mirror main.js
+        if (parsed.systems[key].cpu.type === "intel") {
+            const intel = new intel_tdx();
+
+            if (uploads.ovmf) {
+                const calculated_mrtd = await intel.calcMrtd(uploads.ovmf as Uint8Array);
+                if (parsed.systems[key].cpu.measurements.mrtd.value === calculated_mrtd) {
+                    parsed.systems[key].cpu.measurements.mrtd.validated = "valid";
+                } else {
+                    parsed.systems[key].cpu.measurements.mrtd.validated = "invalid";
+                }
+
+                const useGpu = false; // Unknown here; legacy code toggles based on GPU report presence
+                const calculated_rtmr0 = intel.calcRtmr0(uploads.ovmf as Uint8Array, useGpu ? 1 : 0);
+                if (parsed.systems[key].cpu.measurements.rtmr0.value === calculated_rtmr0) {
+                    parsed.systems[key].cpu.measurements.rtmr0.validated = "valid";
+                } else {
+                    parsed.systems[key].cpu.measurements.rtmr0.validated = "invalid";
+                }
+            }
+
+            if (uploads.cmdline && uploads.initrd) {
+                const calculated_rtmr2 = intel.calcRtmr2(uploads.cmdline as Uint8Array, uploads.initrd as Uint8Array);
+
+                if (parsed.systems[key].cpu.measurements.rtmr2.value == calculated_rtmr2) {
+                    parsed.systems[key].cpu.measurements.rtmr2.validated = "valid";
+                } else {
+                    parsed.systems[key].cpu.measurements.rtmr2.validated = "invalid";
+                }
+
+                const cmdParse = parseKernelArgs(uploads.cmdline as Uint8Array);
+
+                if (parsed.systems[key].cpu.measurements.rootfs.value == cmdParse.rootfs) {
+                    parsed.systems[key].cpu.measurements.rootfs.validated = "valid";
+                } else {
+                    parsed.systems[key].cpu.measurements.rootfs.validated = "invalid";
+                }
+            }
+
+            if (uploads.kernel && uploads.initrd) {
+                const calculated_rtmr1 = await intel.calcRtmr1(
+                    uploads.kernel as Uint8Array,
+                    uploads.initrd as Uint8Array,
+                );
+
+                if (parsed.systems[key].cpu.measurements.rtmr1.value == calculated_rtmr1) {
+                    parsed.systems[key].cpu.measurements.rtmr1.validated = "valid";
+                } else {
+                    parsed.systems[key].cpu.measurements.rtmr1.validated = "invalid";
+                }
+            }
+        }
+
+        // Azure UKI: compare PCR11 hash with TPM PCR hash from Azure report
+        if (parsed.systems[key].cpu.type === "azure" && uploads.kernel) {
+            const U = uploads.kernel as Uint8Array;
+            const ukiFile = new UKI(U);
+            const pcrLog = ukiFile.PCR;
+            let pcrLogText = "";
+            pcrLog.PCR_LOG.forEach((item: string) => {
+                pcrLogText = pcrLogText + item + "\n";
+            });
+
+            result.azureUKIPcrLog = pcrLogText;
+            result.azureUKIPcr.value = pcrLog.PCR;
+            result.azureUKIKernel = ukiFile.UKI_MODEL[".linux"]["sha256"];
+            result.azureUKICmdLine = ukiFile.UKI_MODEL[".cmdline"]["sha256"];
+            result.azureUKIRootFSHash = ukiFile.UKI_MODEL[".cmdline"]["extra"]["rootfs"];
+            result.azureUKIInitRDLate = ukiFile.UKI_MODEL[".initrd"]["extra"]["late"];
+
+            result.azureUKIPcrHash.value = TPM.hash_pcr_sha256(pcrLog.PCR);
+
+            if (result.azureUKIPcrHash.value === parsed.systems[key].azure.tpmPCRHash.value) {
+                result.azureUKIPcrHash.validated = "valid";
+                parsed.systems[key].azure.tpmPCRHash.validated = "valid";
+                result.azureUKIPcr.validated = "valid";
+            }
+        }
+    }
+
+    // Docker Compose CID verification
+    if (uploads.compose) {
+        const calculatedCid = await cidGenerator.fromArrayBuffer(uploads.compose as unknown as ArrayBuffer);
+
+        for (const key in parsed.containers) {
+            const container = parsed.containers[key];
+            if (container.dockerComposeId.value === calculatedCid) {
+                container.dockerComposeId.validated = "valid";
+            } else {
+                container.dockerComposeId.validated = "invalid";
+            }
+        }
+    }
+    return result;
+}
+
+async function parse(MANIFEST: unknown): Promise<ParsedManifest> {
+    const vc = new vc_parse(MANIFEST);
+
+    // Initialize result object
+    const result: ParsedManifest = {
+        containers: {},
+        systems: {},
+    };
+
+    // Container parsing
+    const ContainerDID = vc.getContainerDID();
+
+    for (let i = 0; i < ContainerDID.length; i++) {
+        const statement = ContainerDID[i];
+        const didKey = statement["did"];
+
+        const images = statement["vcomp"]["image"].map((image: unknown) => ({
+            name: (image as { name: string }).name,
+            sha256: (image as { sha256: string }).sha256.replace(/^sha256:/, ""),
+        }));
+
+        const vcs = vc.getCredentialRegistration(statement["@id"])[0];
+        const vcValidated = vc.validateVC(vcs);
+
+        result.containers[didKey] = {
+            did: {
+                value: didKey,
+                validated: vcValidated ? "valid" : "invalid",
+            },
+            signedBy: {
+                value: ContainerDID[i]["registeredBy"],
+                validated: vcValidated ? "valid" : "invalid",
+            },
+            dockerComposeId: {
+                value: ContainerDID[i]["vcomp"]["compose"].replace(/^urn:cid:/, ""),
+                validated: vcValidated ? "partial" : "invalid",
+            },
+            dockerImages: {
+                images,
+                validated: vcValidated ? "partial" : "invalid",
+            },
+        };
+    }
+
+    const NotaryDID = vc.getNotaryDIDRegistrations();
+
+    for (let i = 0; i < NotaryDID.length; i++) {
+        const statement = NotaryDID[i];
+        const didKey = statement["did"];
+
+        result.systems[didKey] = {
+            did: {
+                value: didKey,
+                validated: "",
+            },
+            cpu: {
+                report: {
+                    value: null,
+                    validated: "",
+                },
+                reportParsed: null,
+                type: null,
+                measurements: {
+                    mrtd: {
+                        value: "",
+                        validated: "",
+                    },
+                    rtmr0: {
+                        value: "",
+                        validated: "",
+                    },
+                    rtmr1: {
+                        value: "",
+                        validated: "",
+                    },
+                    rtmr2: {
+                        value: "",
+                        validated: "",
+                    },
+                    rootfs: {
+                        value: "",
+                        validated: "",
+                    },
+                    amdMeasurement: {
+                        value: "",
+                        validated: "",
+                    },
+                },
+                certificate: {
+                    x509: null,
+                    chain: null,
+                    validated: "",
+                },
+                hardwareVerifyUrl: null,
+            },
+            gpu: {
+                report: {
+                    value: null,
+                    validated: "",
+                },
+                reportData: null,
+                certificate: {
+                    x509: {
+                        value: null,
+                        validated: "",
+                    },
+                    chain: null,
+                },
+                hardwareVerifyUrl: null,
+            },
+            azure: {
+                bootLog: {
+                    value: null,
+                },
+                bootLogHash: {
+                    value: null,
+                    validated: "",
+                },
+                tpmAKCertificate: {
+                    value: null,
+                    validated: "",
+                },
+                tpmLog: null,
+                tpmQuote: {
+                    value: null,
+                    validated: "",
+                },
+                tpmQuoteSignature: {
+                    value: null,
+                    validated: "",
+                },
+                tpmPCRHash: {
+                    value: null,
+                    validated: "",
+                },
+                tpmNotaryHex: {
+                    value: null,
+                    validated: "",
+                },
+                tpmNotaryDID: {
+                    value: null,
+                    validated: "",
+                },
+                azureTPMAKKey: {
+                    value: null,
+                    validated: "",
+                },
+                azureAKTPMPubKey: {
+                    value: null,
+                    validated: "",
+                },
+            },
+        };
+
+        // Find the Evidence for the system notary
+        let systemNotarySubject = null;
+        let systemVC = [];
+
+        if (statement["@id"]) {
+            systemNotarySubject = statement["@id"];
+            systemVC = vc.getCredentialRegistration(systemNotarySubject);
+        }
+
+        let CPU_REPORT: Buffer | null = null;
+        let GPU_REPORT: Buffer | null = null;
+        let GPU_CHAIN: Buffer | null = null;
+        let AZURE_REPORT: unknown = null;
+        let CPU_REPORT_PARSED: unknown = null;
+        const URL: { [key: string]: string } = {};
+
+        // Loop through registrations looking for Attestations
+        for (let i = 0; i < systemVC.length; i++) {
+            if (systemVC[i]["credential"]["evidence"]["type"]) {
+                const report_cid = systemVC[i]["credential"]["evidence"]["report"];
+                const REPORT = vc.getBloblByCID(report_cid);
+
+                const cert_cid = systemVC[i]["credential"]["evidence"]["certificateChain"];
+                let CHAIN: Buffer | null = null;
+                if (cert_cid) {
+                    CHAIN = vc.getBloblByCID(cert_cid);
+                }
+
+                // NVIDIA evidence
+                if (systemVC[i]["credential"]["evidence"]["type"].includes("EqtyVCompNvidiaCcV0Evidence")) {
+                    GPU_REPORT = REPORT;
+                    GPU_CHAIN = CHAIN;
+
+                    if (GPU_CHAIN) {
+                        const endMarker = "-----END CERTIFICATE-----";
+                        const parts = GPU_CHAIN.toString("utf8").split(endMarker);
+                        const firstCert = parts[0] + endMarker;
+                        const res = Buffer.concat([REPORT, Buffer.from(firstCert)]);
+
+                        URL["nvidia"] =
+                            "https://hardware.verify.eqtylab.io/nvidia.html?report=" +
+                            encodeURIComponent(res.toString("base64")) +
+                            "&did=" +
+                            didKey;
+                    }
+                }
+
+                // Intel Evidence
+                if (systemVC[i]["credential"]["evidence"]["type"].includes("EqtyVCompIntelTdxV0Evidence")) {
+                    CPU_REPORT = REPORT;
+                    URL["CPU"] =
+                        "https://hardware.verify.eqtylab.io/intel.html?report=" +
+                        encodeURIComponent(REPORT.toString("base64")) +
+                        "&did=" +
+                        didKey;
+                }
+
+                // AMD Evidence
+                if (systemVC[i]["credential"]["evidence"]["type"].includes("EqtyVCompAmdSevV1Evidence")) {
+                    CPU_REPORT = REPORT;
+                    URL["CPU"] =
+                        "https://hardware.verify.eqtylab.io/amd.html?report=" +
+                        encodeURIComponent(REPORT.toString("base64")) +
+                        "&did=" +
+                        didKey;
+                }
+
+                // Azure Evidence
+                if (systemVC[i]["credential"]["evidence"]["type"].includes("EqtyVCompAzureV1Evidence")) {
+                    CPU_REPORT = REPORT;
+
+                    AZURE_REPORT = {
+                        azureBootLog: vc.getBloblByCID(systemVC[i]["credential"]["evidence"]["azureBootLog"]),
+                        tpmAKCertificate: vc.getBloblByCID(systemVC[i]["credential"]["evidence"]["tpmAKCertificate"]),
+                        tpmLog: vc.getBloblByCID(systemVC[i]["credential"]["evidence"]["tpmLog"]),
+                        tpmQuote: vc.getBloblByCID(systemVC[i]["credential"]["evidence"]["tpmQuote"]),
+                        tpmQuoteSignature: vc.getBloblByCID(systemVC[i]["credential"]["evidence"]["tpmQuoteSignature"]),
+                    };
+
+                    if (TEEAttestation.reportType(REPORT) == "INTEL") {
+                        URL["CPU"] =
+                            "https://hardware.verify.eqtylab.io/intel.html?report=" +
+                            encodeURIComponent(REPORT.toString("base64"));
+                    } else {
+                        URL["CPU"] =
+                            "https://hardware.verify.eqtylab.io/?report=" +
+                            encodeURIComponent(REPORT.toString("base64"));
+                    }
+                }
+            }
+        }
+
+        // Process CPU Report
+        if (CPU_REPORT) {
+            result.systems[didKey].cpu.report.value = CPU_REPORT.toString("base64");
+            result.systems[didKey].cpu.hardwareVerifyUrl = URL["CPU"];
+
+            const CPU_REPORT_BYTE = Buffer.from(CPU_REPORT);
+            const REPORT_DATA = TEEAttestation.parse(CPU_REPORT_BYTE);
+            CPU_REPORT_PARSED = REPORT_DATA;
+            result.systems[didKey].cpu.reportParsed = REPORT_DATA;
+
+            if (REPORT_DATA.TYPE == "amd") {
+                result.systems[didKey].cpu.type = "amd";
+                result.systems[didKey].cpu.measurements.amdMeasurement.value = bufferToHex(REPORT_DATA.MEASUREMENT);
+                result.systems[didKey].cpu.measurements.amdReportData = (
+                    CPU_REPORT_PARSED as { EQTY_USER_DATA: Buffer }
+                ).EQTY_USER_DATA.toString("hex");
+            } else if (REPORT_DATA.TYPE == "intel") {
+                result.systems[didKey].cpu.type = "intel";
+                result.systems[didKey].cpu.measurements.mrtd.value = bufferToHex(REPORT_DATA.MRTD);
+                result.systems[didKey].cpu.measurements.rtmr0.value = bufferToHex(REPORT_DATA.RTMR0);
+                result.systems[didKey].cpu.measurements.rtmr1.value = bufferToHex(REPORT_DATA.RTMR1);
+                result.systems[didKey].cpu.measurements.rtmr2.value = bufferToHex(REPORT_DATA.RTMR2);
+                result.systems[didKey].cpu.measurements.mrconfigid = bufferToHex(REPORT_DATA.MRCONFIGID);
+                result.systems[didKey].cpu.measurements.mrownerconfig = bufferToHex(REPORT_DATA.MROWNERCONFIG);
+                result.systems[didKey].cpu.measurements.mrowner = bufferToHex(REPORT_DATA.MROWNER);
+                result.systems[didKey].cpu.measurements.xfam = bufferToHex(REPORT_DATA.XFAM);
+                result.systems[didKey].cpu.measurements.tdattributes = bufferToHex(REPORT_DATA.TDATTRIBUTES);
+                result.systems[didKey].cpu.measurements.rootfs.value = REPORT_DATA.REPORT_DATA_ROOTFS_HASH_HEX;
+            }
+
+            // Process certificate
+            result.systems[didKey].cpu.certificate.x509 = REPORT_DATA.CERT;
+            const cert_chain_status = checkChain(REPORT_DATA.CERT);
+            if (cert_chain_status) {
+                result.systems[didKey].cpu.certificate.chain = parseChain(REPORT_DATA.CERT);
+            }
+
+            // Validate attestation
+            if (REPORT_DATA.TYPE == "amd") {
+                const amd = new amd_sev_snp();
+                if (await amd.verify(CPU_REPORT)) {
+                    result.systems[didKey].cpu.report.validated = "valid";
+                    result.systems[didKey].cpu.certificate.validated = "valid";
+                    result.systems[didKey].cpu.measurements.amdMeasurement.validated = "valid";
+                } else {
+                    result.systems[didKey].cpu.report.validated = "invalid";
+                    result.systems[didKey].cpu.certificate.validated = "invalid";
+                    result.systems[didKey].cpu.measurements.amdMeasurement.validated = "invalid";
+                }
+            } else if (REPORT_DATA.TYPE == "intel") {
+                const intel = new intel_tdx();
+                if (await intel.verify(CPU_REPORT)) {
+                    result.systems[didKey].cpu.report.validated = "valid";
+                    result.systems[didKey].cpu.certificate.validated = "valid";
+
+                    result.systems[didKey].cpu.measurements.mrtd.validated = "partial";
+                    result.systems[didKey].cpu.measurements.rtmr0.validated = "partial";
+                    result.systems[didKey].cpu.measurements.rtmr1.validated = "partial";
+                    result.systems[didKey].cpu.measurements.rtmr2.validated = "partial";
+                    result.systems[didKey].cpu.measurements.rootfs.validated = "partial";
+                } else {
+                    result.systems[didKey].cpu.report.validated = "invalid";
+                    result.systems[didKey].cpu.certificate.validated = "invalid";
+                    result.systems[didKey].did.validated = "invalid";
+                }
+            }
+        }
+
+        // Process GPU Report
+        if (GPU_REPORT) {
+            result.systems[didKey].gpu.report.value = GPU_REPORT.toString("base64");
+            result.systems[didKey].gpu.hardwareVerifyUrl = URL["nvidia"];
+
+            const nvidia_report = new nvidia();
+            const REPORT = await nvidia_report.parse_nvidia_attestation(GPU_REPORT);
+            result.systems[didKey].gpu.reportData = REPORT.nonce;
+
+            if (GPU_CHAIN) {
+                result.systems[didKey].gpu.certificate.x509.value = GPU_CHAIN;
+
+                if (await nvidia_report.verify(GPU_REPORT, GPU_CHAIN)) {
+                    result.systems[didKey].gpu.report.validated = "valid";
+                    result.systems[didKey].gpu.certificate.x509.validated = "valid";
+                } else {
+                    result.systems[didKey].gpu.report.validated = "invalid";
+                    result.systems[didKey].gpu.certificate.x509.validated = "invalid";
+                }
+
+                const GPU_CHAIN_PEM = new TextDecoder().decode(GPU_CHAIN);
+                const cert_chain_status = checkChain(GPU_CHAIN_PEM);
+                if (cert_chain_status) {
+                    result.systems[didKey].gpu.certificate.chain = parseChain(GPU_CHAIN_PEM);
+                }
+            }
+        }
+
+        // Process Azure Report
+        if (AZURE_REPORT) {
+            result.systems[didKey].cpu.type = "azure";
+            const azureReport = AZURE_REPORT as {
+                azureBootLog: Buffer;
+                tpmAKCertificate: Buffer;
+                tpmLog: Buffer;
+                tpmQuote: Buffer;
+                tpmQuoteSignature: Buffer;
+            };
+            result.systems[didKey].azure.bootLog.value = azureReport.azureBootLog?.toString("base64") || null;
+            result.systems[didKey].azure.tpmAKCertificate.value =
+                azureReport.tpmAKCertificate?.toString("base64") || null;
+            result.systems[didKey].azure.tpmLog = azureReport.tpmLog?.toString("base64") || null;
+            result.systems[didKey].azure.tpmQuote.value = azureReport.tpmQuote?.toString("base64") || null;
+            result.systems[didKey].azure.tpmQuoteSignature.value =
+                azureReport.tpmQuoteSignature?.toString("base64") || null;
+
+            // Read Measurement from attestation report
+            result.systems[didKey].azure.bootLogHash.value =
+                (CPU_REPORT_PARSED as { EQTY_USER_DATA?: string })?.EQTY_USER_DATA?.substring(0, 64) || null;
+
+            // Extract vTPM key from Azure Boot Logs
+            const bootlog = azure.parseBootLogs(azureReport.azureBootLog);
+            result.systems[didKey].azure.azureTPMAKKey.value = bootlog.AKPubKey;
+
+            // Calculate attestation from azureBootLog
+            if (result.systems[didKey].azure.bootLogHash.value == bootlog.bootLogsHash) {
+                result.systems[didKey].azure.bootLogHash.validated = "valid";
+            } else {
+                result.systems[didKey].azure.bootLogHash.validated = "invalid";
+            }
+
+            // Get public key
+            const certinfo = getCertificateInfo(azureReport.tpmAKCertificate);
+            result.systems[didKey].azure.azureAKTPMPubKey.value = getPubKeyRaw(certinfo.pubkey);
+
+            // Validate TPMQuote and signatures
+            const isTPMQuoteValid = TPM.verify_tpm(
+                azureReport.tpmAKCertificate,
+                azureReport.tpmQuoteSignature,
+                azureReport.tpmQuote,
+            );
+
+            if (isTPMQuoteValid) {
+                result.systems[didKey].azure.tpmAKCertificate.validated = "valid";
+                result.systems[didKey].azure.tpmQuote.validated = "valid";
+                result.systems[didKey].azure.tpmQuoteSignature.validated = "valid";
+
+                if (
+                    result.systems[didKey].azure.azureTPMAKKey.value ===
+                    result.systems[didKey].azure.azureAKTPMPubKey.value
+                ) {
+                    result.systems[didKey].azure.azureTPMAKKey.validated = "valid";
+                    result.systems[didKey].azure.azureAKTPMPubKey.validated = "valid";
+                } else {
+                    result.systems[didKey].azure.azureTPMAKKey.validated = "invalid";
+                    result.systems[didKey].azure.azureAKTPMPubKey.validated = "invalid";
+                }
+            } else {
+                result.systems[didKey].azure.tpmAKCertificate.validated = "invalid";
+                result.systems[didKey].azure.tpmQuote.validated = "invalid";
+                result.systems[didKey].azure.tpmQuoteSignature.validated = "invalid";
+                result.systems[didKey].azure.azureTPMAKKey.validated = "invalid";
+                result.systems[didKey].azure.azureAKTPMPubKey.validated = "invalid";
+            }
+
+            // Parse TPM Quote
+            const quoteData = TPM.parseQuoteData(azureReport.tpmQuote);
+            result.systems[didKey].azure.tpmPCRHash.value = bufferToHex(quoteData.pcrData);
+            result.systems[didKey].azure.tpmNotaryHex.value = bufferToHex(quoteData.notaryKey);
+            result.systems[didKey].azure.tpmNotaryDID.value = vc_parse
+                .pubkey2did(bufferToHex(quoteData.notaryKey))
+                .replace(/^did:key:/, "");
+
+            if (result.systems[didKey].did.value == result.systems[didKey].azure.tpmNotaryDID.value) {
+                result.systems[didKey].did.validated = "valid";
+                result.systems[didKey].azure.tpmNotaryDID.validated = "valid";
+                result.systems[didKey].azure.tpmNotaryHex.validated = "valid";
+            } else {
+                result.systems[didKey].did.validated = "invalid";
+                result.systems[didKey].azure.tpmNotaryDID.validated = "invalid";
+                result.systems[didKey].azure.tpmNotaryHex.validated = "invalid";
+            }
+
+            // Validate system DID
+            result.systems[didKey].did.validated = "valid";
+        } else {
+            //##TODO## check if the systemDID is valid from the CPU Report
+            result.systems[didKey].did.validated = "valid"; // Default to validated if no Azure report
+        }
+    }
+
+    return result;
+}
+
+export { parse };