@super-protocol/pki-attestation-engine 0.0.0-nvidia-local-verifier

package/dist/challengeProvider/challengeProviderToken.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeProviderToken = void 0;
+const pki_common_1 = require("@super-protocol/pki-common");
+class ChallengeProviderToken {
+    token;
+    logger;
+    constructor(token, logger) {
+        this.token = token;
+        this.logger = logger;
+    }
+    async generateChallenge(userData, networkID) {
+        return {
+            type: pki_common_1.ChallengeType.Token,
+            userDataBase64: userData.toString('base64'),
+            token: this.token,
+            networkID,
+        };
+    }
+}
+exports.ChallengeProviderToken = ChallengeProviderToken;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlUHJvdmlkZXJUb2tlbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jaGFsbGVuZ2VQcm92aWRlci9jaGFsbGVuZ2VQcm92aWRlclRva2VuLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUNBLDJEQUEyRTtBQUUzRSxNQUFhLHNCQUFzQjtJQUVWO0lBQ0Q7SUFGcEIsWUFDcUIsS0FBYSxFQUNkLE1BQVk7UUFEWCxVQUFLLEdBQUwsS0FBSyxDQUFRO1FBQ2QsV0FBTSxHQUFOLE1BQU0sQ0FBTTtJQUM3QixDQUFDO0lBQ0osS0FBSyxDQUFDLGlCQUFpQixDQUNuQixRQUFnQixFQUNoQixTQUFrQjtRQUVsQixPQUFPO1lBQ0gsSUFBSSxFQUFFLDBCQUFhLENBQUMsS0FBSztZQUN6QixjQUFjLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7WUFDM0MsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLO1lBQ2pCLFNBQVM7U0FDWixDQUFDO0lBQ04sQ0FBQztDQUNKO0FBaEJELHdEQWdCQyJ9

package/dist/challengeProvider/challengeProviderUntrusted.d.ts

@@ -0,0 +1,9 @@
+/// <reference types="node" />
+import { ChallengeProvider } from './challengeProvider';
+import { Challenge, Log } from '@super-protocol/pki-common';
+export declare class ChallengeProviderUntrusted implements ChallengeProvider {
+    private readonly deviceId;
+    readonly logger?: Log | undefined;
+    constructor(deviceId: Buffer, logger?: Log | undefined);
+    generateChallenge(userData: Buffer, networkID?: string): Promise<Challenge>;
+}

package/dist/challengeProvider/challengeProviderUntrusted.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeProviderUntrusted = void 0;
+const pki_common_1 = require("@super-protocol/pki-common");
+class ChallengeProviderUntrusted {
+    deviceId;
+    logger;
+    constructor(deviceId, logger) {
+        this.deviceId = deviceId;
+        this.logger = logger;
+    }
+    async generateChallenge(userData, networkID) {
+        return {
+            type: pki_common_1.ChallengeType.Untrusted,
+            userDataBase64: userData.toString('base64'),
+            idBase64: this.deviceId.toString('base64'),
+            networkID,
+        };
+    }
+}
+exports.ChallengeProviderUntrusted = ChallengeProviderUntrusted;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlUHJvdmlkZXJVbnRydXN0ZWQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlUHJvdmlkZXIvY2hhbGxlbmdlUHJvdmlkZXJVbnRydXN0ZWQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQ0EsMkRBQTJFO0FBRTNFLE1BQWEsMEJBQTBCO0lBRWQ7SUFDRDtJQUZwQixZQUNxQixRQUFnQixFQUNqQixNQUFZO1FBRFgsYUFBUSxHQUFSLFFBQVEsQ0FBUTtRQUNqQixXQUFNLEdBQU4sTUFBTSxDQUFNO0lBQzdCLENBQUM7SUFFSixLQUFLLENBQUMsaUJBQWlCLENBQ25CLFFBQWdCLEVBQ2hCLFNBQWtCO1FBRWxCLE9BQU87WUFDSCxJQUFJLEVBQUUsMEJBQWEsQ0FBQyxTQUFTO1lBQzdCLGNBQWMsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztZQUMzQyxRQUFRLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1lBQzFDLFNBQVM7U0FDWixDQUFDO0lBQ04sQ0FBQztDQUNKO0FBakJELGdFQWlCQyJ9

package/dist/challengeProvider/index.d.ts

@@ -0,0 +1,8 @@
+export * from './challengeProvider';
+export * from './challengeProviderTdx';
+export * from './challengeProviderAzure';
+export * from './challengeProviderUntrusted';
+export * from './challengeProviderSevSnp';
+export * from './challengeNvidiaCCHelper';
+export * from './challengeProviderCertificate';
+export * from './challengeProviderToken';

package/dist/challengeProvider/index.js

@@ -0,0 +1,25 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./challengeProvider"), exports);
+__exportStar(require("./challengeProviderTdx"), exports);
+__exportStar(require("./challengeProviderAzure"), exports);
+__exportStar(require("./challengeProviderUntrusted"), exports);
+__exportStar(require("./challengeProviderSevSnp"), exports);
+__exportStar(require("./challengeNvidiaCCHelper"), exports);
+__exportStar(require("./challengeProviderCertificate"), exports);
+__exportStar(require("./challengeProviderToken"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlUHJvdmlkZXIvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLHNEQUFvQztBQUNwQyx5REFBdUM7QUFDdkMsMkRBQXlDO0FBQ3pDLCtEQUE2QztBQUM3Qyw0REFBMEM7QUFDMUMsNERBQTBDO0FBQzFDLGlFQUErQztBQUMvQywyREFBeUMifQ==

package/dist/challengeValidator/challengeValidator.d.ts

@@ -0,0 +1,18 @@
+/// <reference types="node" />
+import { Challenge } from '@super-protocol/pki-common';
+export interface SuccessChallengeResult {
+    success: true;
+    validatedUserData: Buffer;
+    validatedId: Buffer;
+    validatedCommonId?: Buffer;
+    validatedSolutionHash?: Buffer;
+}
+export interface UnsuccessfulChallengeResult {
+    success: false;
+    error: string;
+}
+export type ChallengeResult = SuccessChallengeResult | UnsuccessfulChallengeResult;
+export interface ChallengeValidator {
+    validate(challenge: Challenge, publicKeyPem?: string): Promise<ChallengeResult>;
+    initialize?: () => Promise<void>;
+}

package/dist/challengeValidator/challengeValidator.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlVmFsaWRhdG9yLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NoYWxsZW5nZVZhbGlkYXRvci9jaGFsbGVuZ2VWYWxpZGF0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/dist/challengeValidator/challengeValidatorAzure.d.ts

@@ -0,0 +1,29 @@
+import { Challenge, Log, NetworkType } from '@super-protocol/pki-common';
+import { ChallengeResult, ChallengeValidator } from './challengeValidator';
+import { AzureValidationConfig } from './validatorConfig';
+import { AttestationWasmAzure } from './wasmVerificationPolicy';
+export interface ChallengeValidatorAzureOptions {
+    /**
+     * A debug VM offers no confidentiality, so it is accepted only when the
+     * network is explicitly untrusted.
+     */
+    networkType?: NetworkType;
+    config?: AzureValidationConfig;
+    loadAttestationModule?: () => Promise<AttestationWasmAzure>;
+}
+/**
+ * Validates Azure confidential VM evidence (Intel TDX and AMD SEV-SNP) with
+ * @super-protocol/attestation-wasm: the Intel / AMD signature of the hardware
+ * report, the Microsoft vTPM attestation key, the TPM quote and the event log.
+ * Microsoft Azure Attestation is always asked whether the paravisor is a
+ * genuine Azure one; evidence is rejected when MAA is unreachable.
+ *
+ * NOT verified on a live SEV-SNP guest yet.
+ */
+export declare class ChallengeValidatorAzure implements ChallengeValidator {
+    private readonly log;
+    private readonly options;
+    constructor(log: Log, options?: ChallengeValidatorAzureOptions);
+    validate(challenge: Challenge): Promise<ChallengeResult>;
+    private validateEvidence;
+}

package/dist/challengeValidator/challengeValidatorAzure.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeValidatorAzure = void 0;
+const attestation_common_1 = require("@super-protocol/attestation-common");
+const pki_common_1 = require("@super-protocol/pki-common");
+const wasmVerificationPolicy_1 = require("./wasmVerificationPolicy");
+const preservedDynamicImport = new Function('specifier', 'return import(specifier)');
+const defaultLoadAttestationModule = () => preservedDynamicImport('@super-protocol/attestation-wasm/node');
+const EXPECTED_EVIDENCE_TYPE = {
+    [pki_common_1.ChallengeType.TDXAZURE]: attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_AZURE,
+    [pki_common_1.ChallengeType.SEVSNPAZURE]: attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_AMD_SEV_SNP_AZURE,
+};
+/**
+ * Validates Azure confidential VM evidence (Intel TDX and AMD SEV-SNP) with
+ * @super-protocol/attestation-wasm: the Intel / AMD signature of the hardware
+ * report, the Microsoft vTPM attestation key, the TPM quote and the event log.
+ * Microsoft Azure Attestation is always asked whether the paravisor is a
+ * genuine Azure one; evidence is rejected when MAA is unreachable.
+ *
+ * NOT verified on a live SEV-SNP guest yet.
+ */
+class ChallengeValidatorAzure {
+    log;
+    options;
+    constructor(log, options = {}) {
+        this.log = log;
+        this.options = options;
+    }
+    async validate(challenge) {
+        switch (challenge.type) {
+            case pki_common_1.ChallengeType.TDXAZURE:
+            case pki_common_1.ChallengeType.SEVSNPAZURE:
+                try {
+                    return await this.validateEvidence(challenge.type, Buffer.from(challenge.evidenceBase64, 'base64'));
+                }
+                catch (e) {
+                    return {
+                        success: false,
+                        error: e.message,
+                    };
+                }
+        }
+        throw new Error('Method not implemented.');
+    }
+    async validateEvidence(challengeType, evidence) {
+        const log = this.log.child({
+            validator: 'ChallengeValidatorAzure',
+            challengeType,
+        });
+        const attestation = await (this.options.loadAttestationModule ?? defaultLoadAttestationModule)();
+        const verification = await attestation.verifyTeeEvidence(evidence, (0, wasmVerificationPolicy_1.buildAzureVerifyOptions)(this.options.config));
+        if (verification.evidenceType !== EXPECTED_EVIDENCE_TYPE[challengeType]) {
+            throw new Error(`Evidence type ${verification.evidenceType} does not match challenge type ${challengeType}`);
+        }
+        const { mrEnclave, reportData } = (0, wasmVerificationPolicy_1.checkAzureVerificationResult)(verification, attestation, { networkType: this.options.networkType, log });
+        log.debug('Azure evidence verified', {
+            mrEnclaveHex: mrEnclave.toString('hex'),
+        });
+        return {
+            success: true,
+            validatedUserData: reportData,
+            validatedId: mrEnclave,
+        };
+    }
+}
+exports.ChallengeValidatorAzure = ChallengeValidatorAzure;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlVmFsaWRhdG9yQXp1cmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlVmFsaWRhdG9yL2NoYWxsZW5nZVZhbGlkYXRvckF6dXJlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDJFQUFxRTtBQUNyRSwyREFLb0M7QUFHcEMscUVBSWtDO0FBRWxDLE1BQU0sc0JBQXNCLEdBQUcsSUFBSSxRQUFRLENBQ3ZDLFdBQVcsRUFDWCwwQkFBMEIsQ0FDVyxDQUFDO0FBRTFDLE1BQU0sNEJBQTRCLEdBQUcsR0FBa0MsRUFBRSxDQUNyRSxzQkFBc0IsQ0FDbEIsdUNBQXVDLENBQzFDLENBQUM7QUFFTixNQUFNLHNCQUFzQixHQUFHO0lBQzNCLENBQUMsMEJBQWEsQ0FBQyxRQUFRLENBQUMsRUFBRSxvQ0FBZSxDQUFDLGlDQUFpQztJQUMzRSxDQUFDLDBCQUFhLENBQUMsV0FBVyxDQUFDLEVBQ3ZCLG9DQUFlLENBQUMsbUNBQW1DO0NBQ2pELENBQUM7QUFZWDs7Ozs7Ozs7R0FRRztBQUNILE1BQWEsdUJBQXVCO0lBRVg7SUFDQTtJQUZyQixZQUNxQixHQUFRLEVBQ1IsVUFBMEMsRUFBRTtRQUQ1QyxRQUFHLEdBQUgsR0FBRyxDQUFLO1FBQ1IsWUFBTyxHQUFQLE9BQU8sQ0FBcUM7SUFDOUQsQ0FBQztJQUVKLEtBQUssQ0FBQyxRQUFRLENBQUMsU0FBb0I7UUFDL0IsUUFBUSxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDckIsS0FBSywwQkFBYSxDQUFDLFFBQVEsQ0FBQztZQUM1QixLQUFLLDBCQUFhLENBQUMsV0FBVztnQkFDMUIsSUFBSSxDQUFDO29CQUNELE9BQU8sTUFBTSxJQUFJLENBQUMsZ0JBQWdCLENBQzlCLFNBQVMsQ0FBQyxJQUFJLEVBQ2QsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsY0FBYyxFQUFFLFFBQVEsQ0FBQyxDQUNsRCxDQUFDO2dCQUNOLENBQUM7Z0JBQUMsT0FBTyxDQUFNLEVBQUUsQ0FBQztvQkFDZCxPQUFPO3dCQUNILE9BQU8sRUFBRSxLQUFLO3dCQUNkLEtBQUssRUFBRSxDQUFDLENBQUMsT0FBTztxQkFDbkIsQ0FBQztnQkFDTixDQUFDO1FBQ1QsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQUMseUJBQXlCLENBQUMsQ0FBQztJQUMvQyxDQUFDO0lBRU8sS0FBSyxDQUFDLGdCQUFnQixDQUMxQixhQUFpRSxFQUNqRSxRQUFnQjtRQUVoQixNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQztZQUN2QixTQUFTLEVBQUUseUJBQXlCO1lBQ3BDLGFBQWE7U0FDaEIsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxXQUFXLEdBQUcsTUFBTSxDQUN0QixJQUFJLENBQUMsT0FBTyxDQUFDLHFCQUFxQixJQUFJLDRCQUE0QixDQUNyRSxFQUFFLENBQUM7UUFFSixNQUFNLFlBQVksR0FBRyxNQUFNLFdBQVcsQ0FBQyxpQkFBaUIsQ0FDcEQsUUFBUSxFQUNSLElBQUEsZ0RBQXVCLEVBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FDL0MsQ0FBQztRQUVGLElBQ0ksWUFBWSxDQUFDLFlBQVksS0FBSyxzQkFBc0IsQ0FBQyxhQUFhLENBQUMsRUFDckUsQ0FBQztZQUNDLE1BQU0sSUFBSSxLQUFLLENBQ1gsaUJBQWlCLFlBQVksQ0FBQyxZQUFZLGtDQUFrQyxhQUFhLEVBQUUsQ0FDOUYsQ0FBQztRQUNOLENBQUM7UUFFRCxNQUFNLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxHQUFHLElBQUEscURBQTRCLEVBQzFELFlBQVksRUFDWixXQUFXLEVBQ1gsRUFBRSxXQUFXLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLEVBQUUsR0FBRyxFQUFFLENBQ2pELENBQUM7UUFDRixHQUFHLENBQUMsS0FBSyxDQUFDLHlCQUF5QixFQUFFO1lBQ2pDLFlBQVksRUFBRSxTQUFTLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQztTQUMxQyxDQUFDLENBQUM7UUFFSCxPQUFPO1lBQ0gsT0FBTyxFQUFFLElBQUk7WUFDYixpQkFBaUIsRUFBRSxVQUFVO1lBQzdCLFdBQVcsRUFBRSxTQUFTO1NBQ3pCLENBQUM7SUFDTixDQUFDO0NBQ0o7QUFqRUQsMERBaUVDIn0=

package/dist/challengeValidator/challengeValidatorCertificate.d.ts

@@ -0,0 +1,9 @@
+import { Challenge } from '@super-protocol/pki-common';
+import { ChallengeResult, ChallengeValidator } from './challengeValidator';
+import { Log } from '@super-protocol/pki-common';
+export declare class ChallengeValidatorCertificate implements ChallengeValidator {
+    private readonly log;
+    constructor(log: Log);
+    validate(challenge: Challenge, publicKeyPem: string): Promise<ChallengeResult>;
+    private verifyUserData;
+}

package/dist/challengeValidator/challengeValidatorCertificate.js

@@ -0,0 +1,55 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeValidatorCertificate = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const pki_common_1 = require("@super-protocol/pki-common");
+const sdk_js_1 = require("@super-protocol/sdk-js");
+class ChallengeValidatorCertificate {
+    log;
+    constructor(log) {
+        this.log = log;
+    }
+    async validate(challenge, publicKeyPem) {
+        switch (challenge.type) {
+            case pki_common_1.ChallengeType.Certificate:
+                try {
+                    await sdk_js_1.TeeCertificateService.validateTeeCertChainOrFail(challenge.orderCertificate + challenge.orderCABundle);
+                    this.verifyUserData(publicKeyPem, challenge.userDataSignatureBase64, challenge.orderCertificate);
+                    return {
+                        success: true,
+                        validatedUserData: (0, pki_common_1.getPublicKeyPemHash)(publicKeyPem),
+                        validatedId: sdk_js_1.CertificatesHelper.getExtensionValue(challenge.orderCertificate, pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_ID) ?? Buffer.alloc(0),
+                        validatedCommonId: sdk_js_1.CertificatesHelper.getExtensionValue(challenge.orderCertificate, pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_COMMON_ID),
+                        validatedSolutionHash: sdk_js_1.CertificatesHelper.getExtensionValue(challenge.orderCertificate, sdk_js_1.constants.OID_CUSTOM_EXTENSION_USER_DATA),
+                    };
+                }
+                catch (e) {
+                    return {
+                        success: false,
+                        error: e.message,
+                    };
+                }
+        }
+        throw new Error('Method not implemented.');
+    }
+    async verifyUserData(publicKeyPem, signatureBase64, certificatePem) {
+        const cert = await sdk_js_1.CertificateGenerator.checkAndParseCert(certificatePem);
+        const certPublicKeyPem = await sdk_js_1.CryptoKeysTransformer.cryptoKeyToSpkiPem(cert.publicKey);
+        const certPublicKeyKeyObj = crypto_1.default.createPublicKey(certPublicKeyPem);
+        const publicKeyHash = (0, pki_common_1.getPublicKeyPemHash)(publicKeyPem);
+        const isValid = await sdk_js_1.Crypto.verify({
+            data: publicKeyHash,
+            signature: signatureBase64,
+            publicKey: certPublicKeyKeyObj,
+            signatureFormat: 'base64',
+        });
+        if (!isValid) {
+            throw Error('Signature verification failed');
+        }
+    }
+}
+exports.ChallengeValidatorCertificate = ChallengeValidatorCertificate;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlVmFsaWRhdG9yQ2VydGlmaWNhdGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlVmFsaWRhdG9yL2NoYWxsZW5nZVZhbGlkYXRvckNlcnRpZmljYXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7OztBQUFBLG9EQUE0QjtBQUM1QiwyREFNb0M7QUFFcEMsbURBT2dDO0FBR2hDLE1BQWEsNkJBQTZCO0lBQ1Q7SUFBN0IsWUFBNkIsR0FBUTtRQUFSLFFBQUcsR0FBSCxHQUFHLENBQUs7SUFBRyxDQUFDO0lBRXpDLEtBQUssQ0FBQyxRQUFRLENBQ1YsU0FBb0IsRUFDcEIsWUFBb0I7UUFFcEIsUUFBUSxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDckIsS0FBSywwQkFBYSxDQUFDLFdBQVc7Z0JBQzFCLElBQUksQ0FBQztvQkFDRCxNQUFNLDhCQUFxQixDQUFDLDBCQUEwQixDQUNsRCxTQUFTLENBQUMsZ0JBQWdCLEdBQUcsU0FBUyxDQUFDLGFBQWEsQ0FDdkQsQ0FBQztvQkFDRixJQUFJLENBQUMsY0FBYyxDQUNmLFlBQVksRUFDWixTQUFTLENBQUMsdUJBQXVCLEVBQ2pDLFNBQVMsQ0FBQyxnQkFBZ0IsQ0FDN0IsQ0FBQztvQkFDRixPQUFPO3dCQUNILE9BQU8sRUFBRSxJQUFJO3dCQUNiLGlCQUFpQixFQUFFLElBQUEsZ0NBQW1CLEVBQUMsWUFBWSxDQUFDO3dCQUNwRCxXQUFXLEVBQ1AsMkJBQWtCLENBQUMsaUJBQWlCLENBQ2hDLFNBQVMsQ0FBQyxnQkFBZ0IsRUFDMUIsOENBQWlDLENBQ3BDLElBQUksTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7d0JBQ3hCLGlCQUFpQixFQUFFLDJCQUFrQixDQUFDLGlCQUFpQixDQUNuRCxTQUFTLENBQUMsZ0JBQWdCLEVBQzFCLHFEQUF3QyxDQUMzQzt3QkFDRCxxQkFBcUIsRUFDakIsMkJBQWtCLENBQUMsaUJBQWlCLENBQ2hDLFNBQVMsQ0FBQyxnQkFBZ0IsRUFDMUIsa0JBQVMsQ0FBQyw4QkFBOEIsQ0FDM0M7cUJBQ1IsQ0FBQztnQkFDTixDQUFDO2dCQUFDLE9BQU8sQ0FBTSxFQUFFLENBQUM7b0JBQ2QsT0FBTzt3QkFDSCxPQUFPLEVBQUUsS0FBSzt3QkFDZCxLQUFLLEVBQUUsQ0FBQyxDQUFDLE9BQU87cUJBQ25CLENBQUM7Z0JBQ04sQ0FBQztRQUNULENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLHlCQUF5QixDQUFDLENBQUM7SUFDL0MsQ0FBQztJQUVPLEtBQUssQ0FBQyxjQUFjLENBQ3hCLFlBQW9CLEVBQ3BCLGVBQXVCLEVBQ3ZCLGNBQXNCO1FBRXRCLE1BQU0sSUFBSSxHQUNOLE1BQU0sNkJBQW9CLENBQUMsaUJBQWlCLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDakUsTUFBTSxnQkFBZ0IsR0FBRyxNQUFNLDhCQUFxQixDQUFDLGtCQUFrQixDQUNuRSxJQUFJLENBQUMsU0FBUyxDQUNqQixDQUFDO1FBQ0YsTUFBTSxtQkFBbUIsR0FBRyxnQkFBTSxDQUFDLGVBQWUsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBRXJFLE1BQU0sYUFBYSxHQUFHLElBQUEsZ0NBQW1CLEVBQUMsWUFBWSxDQUFDLENBQUM7UUFFeEQsTUFBTSxPQUFPLEdBQUcsTUFBTSxlQUFNLENBQUMsTUFBTSxDQUFDO1lBQ2hDLElBQUksRUFBRSxhQUFhO1lBQ25CLFNBQVMsRUFBRSxlQUFlO1lBQzFCLFNBQVMsRUFBRSxtQkFBbUI7WUFDOUIsZUFBZSxFQUFFLFFBQVE7U0FDNUIsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ1gsTUFBTSxLQUFLLENBQUMsK0JBQStCLENBQUMsQ0FBQztRQUNqRCxDQUFDO0lBQ0wsQ0FBQztDQUNKO0FBdEVELHNFQXNFQyJ9

package/dist/challengeValidator/challengeValidatorNvidia.d.ts

@@ -0,0 +1,10 @@
+/// <reference types="node" />
+import { NvtrustWrapperConfig } from './validatorConfig';
+import { Challenge, NetworkType, NvidiaVerification } from '@super-protocol/pki-common';
+import { Log } from '@super-protocol/pki-common';
+export declare class ChallengeValidatorNvidia {
+    private readonly log;
+    private readonly config?;
+    constructor(log: Log, config?: NvtrustWrapperConfig | undefined);
+    validate(challenge: Challenge, userData: Buffer, networkType?: NetworkType): Promise<NvidiaVerification | undefined>;
+}

package/dist/challengeValidator/challengeValidatorNvidia.js

@@ -0,0 +1,246 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeValidatorNvidia = void 0;
+const sp_nvtrust_wrapper_1 = require("@super-protocol/sp-nvtrust-wrapper");
+const pki_common_1 = require("@super-protocol/pki-common");
+const challengeProvider_1 = require("../challengeProvider");
+class ChallengeValidatorNvidia {
+    log;
+    config;
+    constructor(log, config) {
+        this.log = log;
+        this.config = config;
+    }
+    async validate(challenge, userData, networkType) {
+        const log = this.log.child({
+            validator: 'ChallengeValidatorNvidia',
+        });
+        const hasNvidiaToken = (0, pki_common_1.hasChallengeNvidiaToken)(challenge);
+        const hasNvidiaEvidence = (0, pki_common_1.hasChallengeNvidiaEvidence)(challenge);
+        const verifier = this.config?.verifier ?? 'remote';
+        if (hasNvidiaToken && hasNvidiaEvidence) {
+            throw new Error('NVIDIA challenge cannot contain both a token and evidence');
+        }
+        challengeProvider_1.ChallengeNvidiaCCHelper.assertLocalVerifierAllowsChallenge(verifier, challenge.type);
+        log.debug(`Challenge NVIDIA token present: ${hasNvidiaToken}, evidence present: ${hasNvidiaEvidence}, verifier: ${verifier}`);
+        if (!hasNvidiaToken && !hasNvidiaEvidence) {
+            log.debug('NVIDIA validation skipped: challenge does not contain NVIDIA token or evidence');
+            return;
+        }
+        if (verifier === 'local' && !hasNvidiaEvidence) {
+            throw new Error('NVIDIA local verifier requires evidence and rejects an NRAS token');
+        }
+        if (verifier === 'remote' && !hasNvidiaToken) {
+            throw new Error('NVIDIA remote verifier requires an NRAS token and rejects evidence');
+        }
+        log.debug(`NVIDIA validation started for networkType=${networkType ?? 'undefined'}`);
+        const tokenHash = (0, pki_common_1.hasChallengeNvidiaEvidence)(challenge)
+            ? challengeProvider_1.ChallengeNvidiaCCHelper.getEvidenceHash(challenge.nvidiaEvidence)
+            : (0, pki_common_1.hasChallengeNvidiaToken)(challenge)
+                ? challengeProvider_1.ChallengeNvidiaCCHelper.getTokenHash(challenge.nvidiaTokens)
+                : undefined;
+        if (!tokenHash) {
+            throw new Error('NVIDIA challenge payload is missing');
+        }
+        if (userData.length < 64) {
+            throw new Error('userData must be at least 64 bytes');
+        }
+        const expectedHash = userData.slice(32, 64);
+        const tokenHashHex = tokenHash.toString('hex');
+        const expectedHashHex = expectedHash.toString('hex');
+        log.debug(`NVIDIA tokenHash: ${tokenHashHex}, expectedHash: ${expectedHashHex}`);
+        if (tokenHashHex !== expectedHashHex) {
+            throw new Error('Nvidia hash included in the challenge does not match the hash of the nvidia token specified in the request');
+        }
+        log.info('NVIDIA validation passed: token hash matches attested userData hash');
+        const nvtrusWrapper = new sp_nvtrust_wrapper_1.NvtrustWrapper(this.config?.tmp ?? '/tmp/nvtrust-tmp', this.config?.timeout ?? 60000);
+        const localVerifier = nvtrusWrapper;
+        let nvidiaTokenValidationResult = {
+            success: false,
+        };
+        try {
+            let gpuToken;
+            let nvswitchToken;
+            let gpuInterconnectStatus;
+            const attestationMode = verifier === 'local' ? 2 : 1;
+            if ((0, pki_common_1.hasChallengeNvidiaEvidence)(challenge)) {
+                const evidence = challenge.nvidiaEvidence;
+                gpuInterconnectStatus = evidence.gpuInterconnectStatus;
+                const attested = await localVerifier.attestEvidence({
+                    device: sp_nvtrust_wrapper_1.NvidiaDeviceType.GPU,
+                    nonce: evidence.nonce,
+                    evidenceJson: evidence.gpuEvidence,
+                    rimUrl: this.config?.rimUrl ?? '',
+                    ocspUrl: this.config?.ocspUrl ?? '',
+                    policy: sp_nvtrust_wrapper_1.defaultGPUpolicy,
+                    ppcieMode: false,
+                });
+                gpuToken = attested.jwt;
+                if (gpuInterconnectStatus ===
+                    sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_NVLINK_SWITCH_ATTESTATION_VERIFIED) {
+                    if (!evidence.nvswitchEvidence) {
+                        throw new Error('Verified NVIDIA NVLink switch interconnect requires switch evidence');
+                    }
+                    const switchAttested = await localVerifier.attestEvidence({
+                        device: sp_nvtrust_wrapper_1.NvidiaDeviceType.SWITCH,
+                        nonce: evidence.nonce,
+                        evidenceJson: evidence.nvswitchEvidence,
+                        rimUrl: this.config?.rimUrl ?? '',
+                        ocspUrl: this.config?.ocspUrl ?? '',
+                        policy: sp_nvtrust_wrapper_1.defaultNVSwitchPolicy,
+                        ppcieMode: false,
+                    });
+                    nvswitchToken = switchAttested.jwt;
+                }
+                nvidiaTokenValidationResult = { success: true };
+                log.info('NVIDIA validation passed: local verifier accepted the evidence');
+            }
+            else {
+                if (!(0, pki_common_1.hasChallengeNvidiaToken)(challenge)) {
+                    throw new Error('NVIDIA remote verifier requires an NRAS token');
+                }
+                gpuToken = challenge.nvidiaTokens.gpuToken;
+                nvswitchToken = challenge.nvidiaTokens.nvswitchToken;
+                gpuInterconnectStatus =
+                    challenge.nvidiaTokens.gpuInterconnectStatus;
+                nvidiaTokenValidationResult = await nvtrusWrapper.validateToken({
+                    device: sp_nvtrust_wrapper_1.NvidiaDeviceType.GPU,
+                    policy: sp_nvtrust_wrapper_1.defaultGPUpolicy,
+                    token: { jwt: gpuToken },
+                });
+                if (nvidiaTokenValidationResult.success !== true) {
+                    throw new Error('Failed to verify Nvidia GPU token: validateToken returned success=false');
+                }
+                log.info('NVIDIA validation passed: nvtrust token verification succeeded');
+            }
+            const gpusInfo = sp_nvtrust_wrapper_1.NvtrustWrapper.extractGPUInfoFromToken({
+                jwt: gpuToken,
+            });
+            const gpuCount = gpusInfo.gpus.length;
+            if (gpuCount === 0) {
+                throw new Error('Validated NVIDIA GPU token does not contain any GPU claims');
+            }
+            const hasGpuInterconnectStatus = gpuInterconnectStatus !== undefined;
+            const hasNVSwitchToken = nvswitchToken !== undefined;
+            if (gpuCount === 1) {
+                if (hasGpuInterconnectStatus || hasNVSwitchToken) {
+                    throw new Error('NVIDIA GPU interconnect status and NVSwitch token must be omitted for a single GPU');
+                }
+            }
+            else if (!hasGpuInterconnectStatus) {
+                throw new Error('NVIDIA GPU interconnect status is required when the validated GPU token contains multiple GPUs');
+            }
+            if (gpuInterconnectStatus !==
+                sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_NVLINK_SWITCH_ATTESTATION_VERIFIED &&
+                hasNVSwitchToken) {
+                throw new Error('NVIDIA NVSwitch token is only allowed for a verified NVLink switch interconnect');
+            }
+            switch (gpuInterconnectStatus) {
+                case undefined:
+                    break;
+                case sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_DISCONNECTED:
+                    log.info('Multiple disconnected NVIDIA GPUs were reported by TEE-bound interconnect metadata');
+                    break;
+                case sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_DIRECT_UNVERIFIED:
+                    if (networkType !== 'untrusted') {
+                        throw new Error('Unverified direct NVIDIA GPU interconnect is only allowed on an untrusted network');
+                    }
+                    log.warn('Allowing unverified direct NVIDIA GPU interconnect on an untrusted network');
+                    break;
+                case sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_NVLINK_SWITCH_ATTESTATION_NOT_APPLICABLE:
+                    // TODO(NVIDIA NVLink attestation): Revisit this branch if NVIDIA
+                    // introduces or requires separate NVLink/NVSwitch attestation for
+                    // Blackwell. NOT_APPLICABLE currently has no switch token and relies
+                    // on the validated GPU token plus TEE-bound interconnect metadata.
+                    log.info('Separate NVIDIA NVSwitch attestation is not applicable to this NVLink topology');
+                    break;
+                case sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_NVLINK_SWITCH_ATTESTATION_VERIFIED:
+                    if (!nvswitchToken) {
+                        throw new Error('Verified NVIDIA NVLink switch interconnect requires a non-empty NVSwitch token');
+                    }
+                    break;
+                default:
+                    throw new Error(`Unknown NVIDIA GPU interconnect status: ${gpuInterconnectStatus}`);
+            }
+            if (gpuInterconnectStatus ===
+                sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_NVLINK_SWITCH_ATTESTATION_VERIFIED) {
+                if (verifier !== 'local') {
+                    nvidiaTokenValidationResult =
+                        await nvtrusWrapper.validateToken({
+                            device: sp_nvtrust_wrapper_1.NvidiaDeviceType.SWITCH,
+                            policy: sp_nvtrust_wrapper_1.defaultNVSwitchPolicy,
+                            token: { jwt: nvswitchToken },
+                        });
+                    if (nvidiaTokenValidationResult.success !== true) {
+                        throw new Error('Failed to verify Nvidia NVSwitch token: validateToken returned success=false');
+                    }
+                    log.info('NVIDIA NVSwitch validation passed: nvtrust token verification succeeded');
+                }
+                const switchesInfo = sp_nvtrust_wrapper_1.NvtrustWrapper.extractNVSwitchInfoFromToken({
+                    jwt: nvswitchToken,
+                });
+                if (switchesInfo.length === 0) {
+                    throw new Error('Validated NVIDIA NVSwitch token does not contain any switch claims');
+                }
+                if (networkType === 'trusted') {
+                    const insecureSwitchNumbers = switchesInfo
+                        .map((nvSwitch, index) => ({
+                        nvSwitch,
+                        switchNumber: index + 1,
+                    }))
+                        .filter(({ nvSwitch }) => !nvSwitch.secureBoot || nvSwitch.debugEnabled)
+                        .map(({ switchNumber }) => switchNumber);
+                    if (insecureSwitchNumbers.length > 0) {
+                        throw new Error(`Trusted network requires secure boot and disabled debug mode on every NVIDIA NVSwitch. Invalid switch(es): ${insecureSwitchNumbers.join(', ')}`);
+                    }
+                    log.info(`NVIDIA trusted policy check passed: secure boot is enabled and debug mode is disabled on all ${switchesInfo.length} NVSwitch(es)`);
+                }
+            }
+            if (networkType === 'trusted') {
+                const debugGpuNumbers = gpusInfo.gpus
+                    .map((gpu, index) => ({ gpu, gpuNumber: index + 1 }))
+                    .filter(({ gpu }) => gpu.dbgStat === true)
+                    .map(({ gpuNumber }) => gpuNumber);
+                const hasDebugEnabledGpu = debugGpuNumbers.length > 0;
+                if (hasDebugEnabledGpu) {
+                    const debugGpuNumbersText = debugGpuNumbers.join(', ');
+                    throw new Error(`Trusted network does not allow NVIDIA GPUs with dbgStat=true. Debug enabled on GPU(s): ${debugGpuNumbersText}`);
+                }
+                log.info(`NVIDIA trusted policy check passed: dbgStat=false on all ${gpusInfo.gpus.length} GPU(s)`);
+            }
+            else {
+                log.info(`NVIDIA trusted-only GPU debug policy check skipped for networkType=${networkType ?? 'undefined'}`);
+            }
+            return {
+                gpuToken,
+                ...(nvswitchToken !== undefined ? { nvswitchToken } : {}),
+                ...(gpuInterconnectStatus !== undefined
+                    ? { gpuInterconnectStatus }
+                    : {}),
+                attestationMode,
+            };
+        }
+        catch (error) {
+            if (error instanceof sp_nvtrust_wrapper_1.NvtrustWrapperCallError) {
+                log.error(`NvtrustWrapperCallError: ${error.message}`);
+                if (error.traceback?.trim()) {
+                    log.debug(`Traceback:\n${error.traceback}`);
+                }
+                const logEntries = Object.entries(error.logs ?? {});
+                if (logEntries.length > 0) {
+                    log.debug('Logs from nvtrust wrapper:');
+                    for (const [fileName, logContent] of logEntries) {
+                        log.debug(`--- ${fileName} ---`);
+                        log.debug(String(logContent));
+                    }
+                }
+            }
+            else {
+                log.error(`Error during NVIDIA token validation: ${error}`);
+            }
+            throw error;
+        }
+    }
+}
+exports.ChallengeValidatorNvidia = ChallengeValidatorNvidia;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlVmFsaWRhdG9yTnZpZGlhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NoYWxsZW5nZVZhbGlkYXRvci9jaGFsbGVuZ2VWYWxpZGF0b3JOdmlkaWEudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkVBUTRDO0FBRTVDLDJEQU1vQztBQUNwQyw0REFBK0Q7QUFHL0QsTUFBYSx3QkFBd0I7SUFFWjtJQUNBO0lBRnJCLFlBQ3FCLEdBQVEsRUFDUixNQUE2QjtRQUQ3QixRQUFHLEdBQUgsR0FBRyxDQUFLO1FBQ1IsV0FBTSxHQUFOLE1BQU0sQ0FBdUI7SUFDL0MsQ0FBQztJQUVKLEtBQUssQ0FBQyxRQUFRLENBQ1YsU0FBb0IsRUFDcEIsUUFBZ0IsRUFDaEIsV0FBeUI7UUFFekIsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUM7WUFDdkIsU0FBUyxFQUFFLDBCQUEwQjtTQUN4QyxDQUFDLENBQUM7UUFDSCxNQUFNLGNBQWMsR0FBRyxJQUFBLG9DQUF1QixFQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzFELE1BQU0saUJBQWlCLEdBQUcsSUFBQSx1Q0FBMEIsRUFBQyxTQUFTLENBQUMsQ0FBQztRQUNoRSxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsTUFBTSxFQUFFLFFBQVEsSUFBSSxRQUFRLENBQUM7UUFFbkQsSUFBSSxjQUFjLElBQUksaUJBQWlCLEVBQUUsQ0FBQztZQUN0QyxNQUFNLElBQUksS0FBSyxDQUNYLDJEQUEyRCxDQUM5RCxDQUFDO1FBQ04sQ0FBQztRQUNELDJDQUF1QixDQUFDLGtDQUFrQyxDQUN0RCxRQUFRLEVBQ1IsU0FBUyxDQUFDLElBQUksQ0FDakIsQ0FBQztRQUVGLEdBQUcsQ0FBQyxLQUFLLENBQ0wsbUNBQW1DLGNBQWMsdUJBQXVCLGlCQUFpQixlQUFlLFFBQVEsRUFBRSxDQUNySCxDQUFDO1FBQ0YsSUFBSSxDQUFDLGNBQWMsSUFBSSxDQUFDLGlCQUFpQixFQUFFLENBQUM7WUFDeEMsR0FBRyxDQUFDLEtBQUssQ0FDTCxnRkFBZ0YsQ0FDbkYsQ0FBQztZQUNGLE9BQU87UUFDWCxDQUFDO1FBQ0QsSUFBSSxRQUFRLEtBQUssT0FBTyxJQUFJLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUM3QyxNQUFNLElBQUksS0FBSyxDQUNYLG1FQUFtRSxDQUN0RSxDQUFDO1FBQ04sQ0FBQztRQUNELElBQUksUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQzNDLE1BQU0sSUFBSSxLQUFLLENBQ1gsb0VBQW9FLENBQ3ZFLENBQUM7UUFDTixDQUFDO1FBQ0QsR0FBRyxDQUFDLEtBQUssQ0FDTCw2Q0FBNkMsV0FBVyxJQUFJLFdBQVcsRUFBRSxDQUM1RSxDQUFDO1FBRUYsTUFBTSxTQUFTLEdBQUcsSUFBQSx1Q0FBMEIsRUFBQyxTQUFTLENBQUM7WUFDbkQsQ0FBQyxDQUFDLDJDQUF1QixDQUFDLGVBQWUsQ0FBQyxTQUFTLENBQUMsY0FBYyxDQUFDO1lBQ25FLENBQUMsQ0FBQyxJQUFBLG9DQUF1QixFQUFDLFNBQVMsQ0FBQztnQkFDbEMsQ0FBQyxDQUFDLDJDQUF1QixDQUFDLFlBQVksQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDO2dCQUM5RCxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ2xCLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUNiLE1BQU0sSUFBSSxLQUFLLENBQUMscUNBQXFDLENBQUMsQ0FBQztRQUMzRCxDQUFDO1FBRUQsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLEVBQUUsRUFBRSxDQUFDO1lBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsb0NBQW9DLENBQUMsQ0FBQztRQUMxRCxDQUFDO1FBQ0QsTUFBTSxZQUFZLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDNUMsTUFBTSxZQUFZLEdBQUcsU0FBUyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMvQyxNQUFNLGVBQWUsR0FBRyxZQUFZLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3JELEdBQUcsQ0FBQyxLQUFLLENBQ0wscUJBQXFCLFlBQVksbUJBQW1CLGVBQWUsRUFBRSxDQUN4RSxDQUFDO1FBQ0YsSUFBSSxZQUFZLEtBQUssZUFBZSxFQUFFLENBQUM7WUFDbkMsTUFBTSxJQUFJLEtBQUssQ0FDWCw0R0FBNEcsQ0FDL0csQ0FBQztRQUNOLENBQUM7UUFDRCxHQUFHLENBQUMsSUFBSSxDQUNKLHFFQUFxRSxDQUN4RSxDQUFDO1FBRUYsTUFBTSxhQUFhLEdBQUcsSUFBSSxtQ0FBYyxDQUNwQyxJQUFJLENBQUMsTUFBTSxFQUFFLEdBQUcsSUFBSSxrQkFBa0IsRUFDdEMsSUFBSSxDQUFDLE1BQU0sRUFBRSxPQUFPLElBQUksS0FBSyxDQUNoQyxDQUFDO1FBQ0YsTUFBTSxhQUFhLEdBQUcsYUFVckIsQ0FBQztRQUVGLElBQUksMkJBQTJCLEdBQXVCO1lBQ2xELE9BQU8sRUFBRSxLQUFLO1NBQ2pCLENBQUM7UUFDRixJQUFJLENBQUM7WUFDRCxJQUFJLFFBQWdCLENBQUM7WUFDckIsSUFBSSxhQUFpQyxDQUFDO1lBQ3RDLElBQUkscUJBQWdELENBQUM7WUFDckQsTUFBTSxlQUFlLEdBQUcsUUFBUSxLQUFLLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFFckQsSUFBSSxJQUFBLHVDQUEwQixFQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7Z0JBQ3hDLE1BQU0sUUFBUSxHQUFHLFNBQVMsQ0FBQyxjQUFjLENBQUM7Z0JBQzFDLHFCQUFxQixHQUFHLFFBQVEsQ0FBQyxxQkFBcUIsQ0FBQztnQkFDdkQsTUFBTSxRQUFRLEdBQUcsTUFBTSxhQUFhLENBQUMsY0FBYyxDQUFDO29CQUNoRCxNQUFNLEVBQUUscUNBQWdCLENBQUMsR0FBRztvQkFDNUIsS0FBSyxFQUFFLFFBQVEsQ0FBQyxLQUFLO29CQUNyQixZQUFZLEVBQUUsUUFBUSxDQUFDLFdBQVc7b0JBQ2xDLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLE1BQU0sSUFBSSxFQUFFO29CQUNqQyxPQUFPLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxPQUFPLElBQUksRUFBRTtvQkFDbkMsTUFBTSxFQUFFLHFDQUFnQjtvQkFDeEIsU0FBUyxFQUFFLEtBQUs7aUJBQ25CLENBQUMsQ0FBQztnQkFDSCxRQUFRLEdBQUcsUUFBUSxDQUFDLEdBQUcsQ0FBQztnQkFDeEIsSUFDSSxxQkFBcUI7b0JBQ3JCLGdEQUEyQixDQUFDLDBEQUEwRCxFQUN4RixDQUFDO29CQUNDLElBQUksQ0FBQyxRQUFRLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQzt3QkFDN0IsTUFBTSxJQUFJLEtBQUssQ0FDWCxxRUFBcUUsQ0FDeEUsQ0FBQztvQkFDTixDQUFDO29CQUNELE1BQU0sY0FBYyxHQUFHLE1BQU0sYUFBYSxDQUFDLGNBQWMsQ0FBQzt3QkFDdEQsTUFBTSxFQUFFLHFDQUFnQixDQUFDLE1BQU07d0JBQy9CLEtBQUssRUFBRSxRQUFRLENBQUMsS0FBSzt3QkFDckIsWUFBWSxFQUFFLFFBQVEsQ0FBQyxnQkFBZ0I7d0JBQ3ZDLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLE1BQU0sSUFBSSxFQUFFO3dCQUNqQyxPQUFPLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxPQUFPLElBQUksRUFBRTt3QkFDbkMsTUFBTSxFQUFFLDBDQUFxQjt3QkFDN0IsU0FBUyxFQUFFLEtBQUs7cUJBQ25CLENBQUMsQ0FBQztvQkFDSCxhQUFhLEdBQUcsY0FBYyxDQUFDLEdBQUcsQ0FBQztnQkFDdkMsQ0FBQztnQkFDRCwyQkFBMkIsR0FBRyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQztnQkFDaEQsR0FBRyxDQUFDLElBQUksQ0FDSixnRUFBZ0UsQ0FDbkUsQ0FBQztZQUNOLENBQUM7aUJBQU0sQ0FBQztnQkFDSixJQUFJLENBQUMsSUFBQSxvQ0FBdUIsRUFBQyxTQUFTLENBQUMsRUFBRSxDQUFDO29CQUN0QyxNQUFNLElBQUksS0FBSyxDQUNYLCtDQUErQyxDQUNsRCxDQUFDO2dCQUNOLENBQUM7Z0JBQ0QsUUFBUSxHQUFHLFNBQVMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDO2dCQUMzQyxhQUFhLEdBQUcsU0FBUyxDQUFDLFlBQVksQ0FBQyxhQUFhLENBQUM7Z0JBQ3JELHFCQUFxQjtvQkFDakIsU0FBUyxDQUFDLFlBQVksQ0FBQyxxQkFBcUIsQ0FBQztnQkFDakQsMkJBQTJCLEdBQUcsTUFBTSxhQUFhLENBQUMsYUFBYSxDQUMzRDtvQkFDSSxNQUFNLEVBQUUscUNBQWdCLENBQUMsR0FBRztvQkFDNUIsTUFBTSxFQUFFLHFDQUFnQjtvQkFDeEIsS0FBSyxFQUFFLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRTtpQkFDM0IsQ0FDSixDQUFDO2dCQUNGLElBQUksMkJBQTJCLENBQUMsT0FBTyxLQUFLLElBQUksRUFBRSxDQUFDO29CQUMvQyxNQUFNLElBQUksS0FBSyxDQUNYLHlFQUF5RSxDQUM1RSxDQUFDO2dCQUNOLENBQUM7Z0JBQ0QsR0FBRyxDQUFDLElBQUksQ0FDSixnRUFBZ0UsQ0FDbkUsQ0FBQztZQUNOLENBQUM7WUFFRCxNQUFNLFFBQVEsR0FBRyxtQ0FBYyxDQUFDLHVCQUF1QixDQUFDO2dCQUNwRCxHQUFHLEVBQUUsUUFBUTthQUNoQixDQUFDLENBQUM7WUFDSCxNQUFNLFFBQVEsR0FBRyxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQztZQUN0QyxJQUFJLFFBQVEsS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFDakIsTUFBTSxJQUFJLEtBQUssQ0FDWCw0REFBNEQsQ0FDL0QsQ0FBQztZQUNOLENBQUM7WUFFRCxNQUFNLHdCQUF3QixHQUMxQixxQkFBcUIsS0FBSyxTQUFTLENBQUM7WUFDeEMsTUFBTSxnQkFBZ0IsR0FBRyxhQUFhLEtBQUssU0FBUyxDQUFDO1lBRXJELElBQUksUUFBUSxLQUFLLENBQUMsRUFBRSxDQUFDO2dCQUNqQixJQUFJLHdCQUF3QixJQUFJLGdCQUFnQixFQUFFLENBQUM7b0JBQy9DLE1BQU0sSUFBSSxLQUFLLENBQ1gsb0ZBQW9GLENBQ3ZGLENBQUM7Z0JBQ04sQ0FBQztZQUNMLENBQUM7aUJBQU0sSUFBSSxDQUFDLHdCQUF3QixFQUFFLENBQUM7Z0JBQ25DLE1BQU0sSUFBSSxLQUFLLENBQ1gsZ0dBQWdHLENBQ25HLENBQUM7WUFDTixDQUFDO1lBRUQsSUFDSSxxQkFBcUI7Z0JBQ2pCLGdEQUEyQixDQUFDLDBEQUEwRDtnQkFDMUYsZ0JBQWdCLEVBQ2xCLENBQUM7Z0JBQ0MsTUFBTSxJQUFJLEtBQUssQ0FDWCxpRkFBaUYsQ0FDcEYsQ0FBQztZQUNOLENBQUM7WUFFRCxRQUFRLHFCQUFxQixFQUFFLENBQUM7Z0JBQzVCLEtBQUssU0FBUztvQkFDVixNQUFNO2dCQUNWLEtBQUssZ0RBQTJCLENBQUMsb0NBQW9DO29CQUNqRSxHQUFHLENBQUMsSUFBSSxDQUNKLG9GQUFvRixDQUN2RixDQUFDO29CQUNGLE1BQU07Z0JBQ1YsS0FBSyxnREFBMkIsQ0FBQyx5Q0FBeUM7b0JBQ3RFLElBQUksV0FBVyxLQUFLLFdBQVcsRUFBRSxDQUFDO3dCQUM5QixNQUFNLElBQUksS0FBSyxDQUNYLG1GQUFtRixDQUN0RixDQUFDO29CQUNOLENBQUM7b0JBQ0QsR0FBRyxDQUFDLElBQUksQ0FDSiw0RUFBNEUsQ0FDL0UsQ0FBQztvQkFDRixNQUFNO2dCQUNWLEtBQUssZ0RBQTJCLENBQUMsZ0VBQWdFO29CQUM3RixpRUFBaUU7b0JBQ2pFLGtFQUFrRTtvQkFDbEUscUVBQXFFO29CQUNyRSxtRUFBbUU7b0JBQ25FLEdBQUcsQ0FBQyxJQUFJLENBQ0osZ0ZBQWdGLENBQ25GLENBQUM7b0JBQ0YsTUFBTTtnQkFDVixLQUFLLGdEQUEyQixDQUFDLDBEQUEwRDtvQkFDdkYsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO3dCQUNqQixNQUFNLElBQUksS0FBSyxDQUNYLGdGQUFnRixDQUNuRixDQUFDO29CQUNOLENBQUM7b0JBQ0QsTUFBTTtnQkFDVjtvQkFDSSxNQUFNLElBQUksS0FBSyxDQUNYLDJDQUEyQyxxQkFBcUIsRUFBRSxDQUNyRSxDQUFDO1lBQ1YsQ0FBQztZQUVELElBQ0kscUJBQXFCO2dCQUNyQixnREFBMkIsQ0FBQywwREFBMEQsRUFDeEYsQ0FBQztnQkFDQyxJQUFJLFFBQVEsS0FBSyxPQUFPLEVBQUUsQ0FBQztvQkFDdkIsMkJBQTJCO3dCQUN2QixNQUFNLGFBQWEsQ0FBQyxhQUFhLENBQUM7NEJBQzlCLE1BQU0sRUFBRSxxQ0FBZ0IsQ0FBQyxNQUFNOzRCQUMvQixNQUFNLEVBQUUsMENBQXFCOzRCQUM3QixLQUFLLEVBQUUsRUFBRSxHQUFHLEVBQUUsYUFBYyxFQUFFO3lCQUNqQyxDQUFDLENBQUM7b0JBQ1AsSUFBSSwyQkFBMkIsQ0FBQyxPQUFPLEtBQUssSUFBSSxFQUFFLENBQUM7d0JBQy9DLE1BQU0sSUFBSSxLQUFLLENBQ1gsOEVBQThFLENBQ2pGLENBQUM7b0JBQ04sQ0FBQztvQkFDRCxHQUFHLENBQUMsSUFBSSxDQUNKLHlFQUF5RSxDQUM1RSxDQUFDO2dCQUNOLENBQUM7Z0JBRUQsTUFBTSxZQUFZLEdBQ2QsbUNBQWMsQ0FBQyw0QkFBNEIsQ0FBQztvQkFDeEMsR0FBRyxFQUFFLGFBQWM7aUJBQ3RCLENBQUMsQ0FBQztnQkFDUCxJQUFJLFlBQVksQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7b0JBQzVCLE1BQU0sSUFBSSxLQUFLLENBQ1gsb0VBQW9FLENBQ3ZFLENBQUM7Z0JBQ04sQ0FBQztnQkFFRCxJQUFJLFdBQVcsS0FBSyxTQUFTLEVBQUUsQ0FBQztvQkFDNUIsTUFBTSxxQkFBcUIsR0FBRyxZQUFZO3lCQUNyQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO3dCQUN2QixRQUFRO3dCQUNSLFlBQVksRUFBRSxLQUFLLEdBQUcsQ0FBQztxQkFDMUIsQ0FBQyxDQUFDO3lCQUNGLE1BQU0sQ0FDSCxDQUFDLEVBQUUsUUFBUSxFQUFFLEVBQUUsRUFBRSxDQUNiLENBQUMsUUFBUSxDQUFDLFVBQVUsSUFBSSxRQUFRLENBQUMsWUFBWSxDQUNwRDt5QkFDQSxHQUFHLENBQUMsQ0FBQyxFQUFFLFlBQVksRUFBRSxFQUFFLEVBQUUsQ0FBQyxZQUFZLENBQUMsQ0FBQztvQkFDN0MsSUFBSSxxQkFBcUIsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7d0JBQ25DLE1BQU0sSUFBSSxLQUFLLENBQ1gsOEdBQThHLHFCQUFxQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUNuSixDQUFDO29CQUNOLENBQUM7b0JBQ0QsR0FBRyxDQUFDLElBQUksQ0FDSixnR0FBZ0csWUFBWSxDQUFDLE1BQU0sZUFBZSxDQUNySSxDQUFDO2dCQUNOLENBQUM7WUFDTCxDQUFDO1lBRUQsSUFBSSxXQUFXLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQzVCLE1BQU0sZUFBZSxHQUFHLFFBQVEsQ0FBQyxJQUFJO3FCQUNoQyxHQUFHLENBQUMsQ0FBQyxHQUFHLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLFNBQVMsRUFBRSxLQUFLLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztxQkFDcEQsTUFBTSxDQUFDLENBQUMsRUFBRSxHQUFHLEVBQUUsRUFBRSxFQUFFLENBQUMsR0FBRyxDQUFDLE9BQU8sS0FBSyxJQUFJLENBQUM7cUJBQ3pDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsU0FBUyxFQUFFLEVBQUUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO2dCQUN2QyxNQUFNLGtCQUFrQixHQUFHLGVBQWUsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDO2dCQUN0RCxJQUFJLGtCQUFrQixFQUFFLENBQUM7b0JBQ3JCLE1BQU0sbUJBQW1CLEdBQUcsZUFBZSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztvQkFDdkQsTUFBTSxJQUFJLEtBQUssQ0FDWCwwRkFBMEYsbUJBQW1CLEVBQUUsQ0FDbEgsQ0FBQztnQkFDTixDQUFDO2dCQUNELEdBQUcsQ0FBQyxJQUFJLENBQ0osNERBQTRELFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxTQUFTLENBQzVGLENBQUM7WUFDTixDQUFDO2lCQUFNLENBQUM7Z0JBQ0osR0FBRyxDQUFDLElBQUksQ0FDSixzRUFBc0UsV0FBVyxJQUFJLFdBQVcsRUFBRSxDQUNyRyxDQUFDO1lBQ04sQ0FBQztZQUVELE9BQU87Z0JBQ0gsUUFBUTtnQkFDUixHQUFHLENBQUMsYUFBYSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxhQUFhLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2dCQUN6RCxHQUFHLENBQUMscUJBQXFCLEtBQUssU0FBUztvQkFDbkMsQ0FBQyxDQUFDLEVBQUUscUJBQXFCLEVBQUU7b0JBQzNCLENBQUMsQ0FBQyxFQUFFLENBQUM7Z0JBQ1QsZUFBZTthQUNsQixDQUFDO1FBQ04sQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDYixJQUFJLEtBQUssWUFBWSw0Q0FBdUIsRUFBRSxDQUFDO2dCQUMzQyxHQUFHLENBQUMsS0FBSyxDQUFDLDRCQUE0QixLQUFLLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQztnQkFDdkQsSUFBSSxLQUFLLENBQUMsU0FBUyxFQUFFLElBQUksRUFBRSxFQUFFLENBQUM7b0JBQzFCLEdBQUcsQ0FBQyxLQUFLLENBQUMsZUFBZSxLQUFLLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQztnQkFDaEQsQ0FBQztnQkFDRCxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLElBQUksRUFBRSxDQUFDLENBQUM7Z0JBQ3BELElBQUksVUFBVSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztvQkFDeEIsR0FBRyxDQUFDLEtBQUssQ0FBQyw0QkFBNEIsQ0FBQyxDQUFDO29CQUN4QyxLQUFLLE1BQU0sQ0FBQyxRQUFRLEVBQUUsVUFBVSxDQUFDLElBQUksVUFBVSxFQUFFLENBQUM7d0JBQzlDLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxRQUFRLE1BQU0sQ0FBQyxDQUFDO3dCQUNqQyxHQUFHLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO29CQUNsQyxDQUFDO2dCQUNMLENBQUM7WUFDTCxDQUFDO2lCQUFNLENBQUM7Z0JBQ0osR0FBRyxDQUFDLEtBQUssQ0FBQyx5Q0FBeUMsS0FBSyxFQUFFLENBQUMsQ0FBQztZQUNoRSxDQUFDO1lBRUQsTUFBTSxLQUFLLENBQUM7UUFDaEIsQ0FBQztJQUNMLENBQUM7Q0FDSjtBQTFWRCw0REEwVkMifQ==

package/dist/challengeValidator/challengeValidatorSevSnp.d.ts

@@ -0,0 +1,13 @@
+import { Challenge, Log } from '@super-protocol/pki-common';
+import { ChallengeResult, ChallengeValidator } from './challengeValidator';
+import { SevValidationConfig } from './validatorConfig';
+export declare class ChallengeValidatorSevSnp implements ChallengeValidator {
+    private readonly log;
+    private measureInstance;
+    private readonly sevTmp;
+    private static instance;
+    private readonly securityPolicy;
+    static getInstance(log: Log, config?: SevValidationConfig): ChallengeValidatorSevSnp;
+    private constructor();
+    validate(challenge: Challenge): Promise<ChallengeResult>;
+}