@super-protocol/pki-attestation-engine 0.0.0-nvidia-local-verifier

package/dist/mrEnclaveSignature.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyChallengeMrEnclaveSignature = void 0;
+const attestation_common_1 = require("@super-protocol/attestation-common");
+const pki_common_1 = require("@super-protocol/pki-common");
+const challengeTypeToEvidenceType = (challengeType) => {
+    switch (challengeType) {
+        case pki_common_1.ChallengeType.TDX:
+            return attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_QEMU;
+        case pki_common_1.ChallengeType.TDXGOOGLE:
+            return attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_GCP;
+        case pki_common_1.ChallengeType.TDXAZURE:
+            return attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_AZURE;
+        case pki_common_1.ChallengeType.SEVSNP:
+            return attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_AMD_SEV_SNP_QEMU;
+        case pki_common_1.ChallengeType.SEVSNPAZURE:
+            return attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_AMD_SEV_SNP_AZURE;
+        default:
+            throw new Error(`mrEnclave signature verification is not supported for challenge type ${challengeType}`);
+    }
+};
+/**
+ * Verifies that the mrEnclave of a TEE challenge is signed by Super Protocol
+ * and present in the trusted registry.
+ *
+ * @throws If the challenge type has no registry or the signature is missing or invalid.
+ */
+const verifyChallengeMrEnclaveSignature = async (mrEnclave, challengeType) => {
+    await (0, attestation_common_1.verifyMrEnclaveSignature)(mrEnclave, challengeTypeToEvidenceType(challengeType));
+};
+exports.verifyChallengeMrEnclaveSignature = verifyChallengeMrEnclaveSignature;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibXJFbmNsYXZlU2lnbmF0dXJlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL21yRW5jbGF2ZVNpZ25hdHVyZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSwyRUFHNEM7QUFDNUMsMkRBQTJEO0FBRTNELE1BQU0sMkJBQTJCLEdBQUcsQ0FDaEMsYUFBNEIsRUFDYixFQUFFO0lBQ2pCLFFBQVEsYUFBYSxFQUFFLENBQUM7UUFDcEIsS0FBSywwQkFBYSxDQUFDLEdBQUc7WUFDbEIsT0FBTyxvQ0FBZSxDQUFDLGdDQUFnQyxDQUFDO1FBQzVELEtBQUssMEJBQWEsQ0FBQyxTQUFTO1lBQ3hCLE9BQU8sb0NBQWUsQ0FBQywrQkFBK0IsQ0FBQztRQUMzRCxLQUFLLDBCQUFhLENBQUMsUUFBUTtZQUN2QixPQUFPLG9DQUFlLENBQUMsaUNBQWlDLENBQUM7UUFDN0QsS0FBSywwQkFBYSxDQUFDLE1BQU07WUFDckIsT0FBTyxvQ0FBZSxDQUFDLGtDQUFrQyxDQUFDO1FBQzlELEtBQUssMEJBQWEsQ0FBQyxXQUFXO1lBQzFCLE9BQU8sb0NBQWUsQ0FBQyxtQ0FBbUMsQ0FBQztRQUMvRDtZQUNJLE1BQU0sSUFBSSxLQUFLLENBQ1gsd0VBQXdFLGFBQWEsRUFBRSxDQUMxRixDQUFDO0lBQ1YsQ0FBQztBQUNMLENBQUMsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0ksTUFBTSxpQ0FBaUMsR0FBRyxLQUFLLEVBQ2xELFNBQWlCLEVBQ2pCLGFBQTRCLEVBQ2YsRUFBRTtJQUNmLE1BQU0sSUFBQSw2Q0FBd0IsRUFDMUIsU0FBUyxFQUNULDJCQUEyQixDQUFDLGFBQWEsQ0FBQyxDQUM3QyxDQUFDO0FBQ04sQ0FBQyxDQUFDO0FBUlcsUUFBQSxpQ0FBaUMscUNBUTVDIn0=

package/dist/swarmCertValidation.d.ts

@@ -0,0 +1,6 @@
+import { Log } from '@super-protocol/pki-common';
+export declare const validateClientCertificateChain: (certChainPem: string, rootCaPem: string, log?: Log) => Promise<{
+    isValid: boolean;
+    errorMessage?: string;
+    leafCertPem?: string;
+}>;

package/dist/swarmCertValidation.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateClientCertificateChain = void 0;
+const pki_common_1 = require("@super-protocol/pki-common");
+const sdk_js_1 = require("@super-protocol/sdk-js");
+const validateClientCertificateChain = async (certChainPem, rootCaPem, log) => {
+    try {
+        const { isValid, errorMessage } = await sdk_js_1.CertificatesHelper.validateCertChain(certChainPem, rootCaPem);
+        if (!isValid) {
+            const message = errorMessage || 'Certificate chain validation failed';
+            log?.warn('Certificate validation failed', { error: message });
+            return {
+                isValid: false,
+                errorMessage: message,
+            };
+        }
+        // Sort certificates from leaf to root to get leaf certificate
+        const sortedCertPems = (0, pki_common_1.sortCertsFromLeafToRootWrapper)(certChainPem, (pem) => sdk_js_1.CertificatesHelper.sortCertsFromLeafToRoot(pem).map((c) => sdk_js_1.CertificatesHelper.derToPem(c.cert.toSchema().toBER(false))));
+        if (sortedCertPems.length === 0) {
+            const message = 'No certificates found in chain';
+            log?.warn('Certificate validation failed', { error: message });
+            return {
+                isValid: false,
+                errorMessage: message,
+            };
+        }
+        // First certificate after sorting is leaf
+        const leafCertPem = sortedCertPems[0];
+        // Check for OID_CUSTOM_EXTENSION_CHALLENGE_VALIDATED in leaf certificate
+        const challengeValidated = sdk_js_1.CertificatesHelper.getExtensionValue(leafCertPem, pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_VALIDATED);
+        if (!challengeValidated) {
+            const message = 'Certificate is missing challenge validation extension';
+            log?.warn('Certificate validation failed', { error: message });
+            return {
+                isValid: false,
+                errorMessage: message,
+            };
+        }
+        return { isValid: true, leafCertPem };
+    }
+    catch (error) {
+        log?.error('Error validating certificate', {
+            error: error.message,
+        });
+        return {
+            isValid: false,
+            errorMessage: `Certificate validation error: ${error.message}`,
+        };
+    }
+};
+exports.validateClientCertificateChain = validateClientCertificateChain;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3dhcm1DZXJ0VmFsaWRhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9zd2FybUNlcnRWYWxpZGF0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDJEQUlvQztBQUNwQyxtREFBNEQ7QUFFckQsTUFBTSw4QkFBOEIsR0FBRyxLQUFLLEVBQy9DLFlBQW9CLEVBQ3BCLFNBQWlCLEVBQ2pCLEdBQVMsRUFLVixFQUFFO0lBQ0QsSUFBSSxDQUFDO1FBQ0QsTUFBTSxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsR0FDM0IsTUFBTSwyQkFBa0IsQ0FBQyxpQkFBaUIsQ0FBQyxZQUFZLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFFeEUsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ1gsTUFBTSxPQUFPLEdBQ1QsWUFBWSxJQUFJLHFDQUFxQyxDQUFDO1lBQzFELEdBQUcsRUFBRSxJQUFJLENBQUMsK0JBQStCLEVBQUUsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztZQUMvRCxPQUFPO2dCQUNILE9BQU8sRUFBRSxLQUFLO2dCQUNkLFlBQVksRUFBRSxPQUFPO2FBQ3hCLENBQUM7UUFDTixDQUFDO1FBRUQsOERBQThEO1FBQzlELE1BQU0sY0FBYyxHQUFHLElBQUEsMkNBQThCLEVBQ2pELFlBQVksRUFDWixDQUFDLEdBQUcsRUFBRSxFQUFFLENBQ0osMkJBQWtCLENBQUMsdUJBQXVCLENBQUMsR0FBRyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FDdEQsMkJBQWtCLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQzlELENBQ1IsQ0FBQztRQUVGLElBQUksY0FBYyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUM5QixNQUFNLE9BQU8sR0FBRyxnQ0FBZ0MsQ0FBQztZQUNqRCxHQUFHLEVBQUUsSUFBSSxDQUFDLCtCQUErQixFQUFFLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7WUFDL0QsT0FBTztnQkFDSCxPQUFPLEVBQUUsS0FBSztnQkFDZCxZQUFZLEVBQUUsT0FBTzthQUN4QixDQUFDO1FBQ04sQ0FBQztRQUVELDBDQUEwQztRQUMxQyxNQUFNLFdBQVcsR0FBRyxjQUFjLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFFdEMseUVBQXlFO1FBQ3pFLE1BQU0sa0JBQWtCLEdBQUcsMkJBQWtCLENBQUMsaUJBQWlCLENBQzNELFdBQVcsRUFDWCxxREFBd0MsQ0FDM0MsQ0FBQztRQUVGLElBQUksQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO1lBQ3RCLE1BQU0sT0FBTyxHQUNULHVEQUF1RCxDQUFDO1lBQzVELEdBQUcsRUFBRSxJQUFJLENBQUMsK0JBQStCLEVBQUUsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztZQUMvRCxPQUFPO2dCQUNILE9BQU8sRUFBRSxLQUFLO2dCQUNkLFlBQVksRUFBRSxPQUFPO2FBQ3hCLENBQUM7UUFDTixDQUFDO1FBQ0QsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLENBQUM7SUFDMUMsQ0FBQztJQUFDLE9BQU8sS0FBVSxFQUFFLENBQUM7UUFDbEIsR0FBRyxFQUFFLEtBQUssQ0FBQyw4QkFBOEIsRUFBRTtZQUN2QyxLQUFLLEVBQUUsS0FBSyxDQUFDLE9BQU87U0FDdkIsQ0FBQyxDQUFDO1FBQ0gsT0FBTztZQUNILE9BQU8sRUFBRSxLQUFLO1lBQ2QsWUFBWSxFQUFFLGlDQUFpQyxLQUFLLENBQUMsT0FBTyxFQUFFO1NBQ2pFLENBQUM7SUFDTixDQUFDO0FBQ0wsQ0FBQyxDQUFDO0FBckVXLFFBQUEsOEJBQThCLGtDQXFFekMifQ==

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@super-protocol/pki-attestation-engine",
+  "version": "0.0.0-nvidia-local-verifier",
+  "description": "",
+  "main": "dist/index.js",
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "directories": {
+    "lib": "dist"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "lint": "eslint --max-warnings=0 src",
+    "lint:fix": "eslint --fix src"
+  },
+  "author": "Super Protocol",
+  "license": "ISC",
+  "dependencies": {
+    "@sinclair/typebox": "0.33.22",
+    "@super-protocol/addons-tee": "^4.2.0",
+    "@super-protocol/attestation-common": "^0.3.1",
+    "@super-protocol/attestation-wasm": "^0.3.0",
+    "@super-protocol/pki-common": "0.0.0-nvidia-local-verifier",
+    "@super-protocol/sp-nvtrust-wrapper": "0.0.0-nvidia-local-verifier"
+  },
+  "peerDependencies": {
+    "@super-protocol/sdk-js": "*"
+  }
+}