@super-protocol/pki-attestation-engine 5.0.4 → 5.0.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -2,6 +2,20 @@
|
|
|
2
2
|
import { NvidiaCCToken, Log } from '@super-protocol/pki-common';
|
|
3
3
|
export declare class ChallengeNvidiaCCHelper {
|
|
4
4
|
private static getNvidiaToken;
|
|
5
|
+
/**
|
|
6
|
+
* Reports how the GPUs can reach each other's memory.
|
|
7
|
+
*
|
|
8
|
+
* A PCIe or unidentified peer path carries traffic outside the encrypted
|
|
9
|
+
* CPU-GPU channel and nothing can vouch for it, so it is rejected here.
|
|
10
|
+
* NVLink is accepted here. Whether a separate NVSwitch token is required
|
|
11
|
+
* is determined from the LS10 count returned by getGPUTopology(): Hopper
|
|
12
|
+
* exposes attestable LS10 switches, while Blackwell does not.
|
|
13
|
+
*
|
|
14
|
+
* @returns whether any GPU pair is linked over NVLink
|
|
15
|
+
* @throws if a peer path bypasses the encrypted channel, or if NVML cannot
|
|
16
|
+
* be queried
|
|
17
|
+
*/
|
|
18
|
+
private static checkGpuInterconnect;
|
|
5
19
|
static getTokenHash(token: NvidiaCCToken): Buffer;
|
|
6
20
|
static getTokenAndCombinedChallengeData(baseUserData: Buffer, logger?: Log): Promise<{
|
|
7
21
|
nvidiaTokens: NvidiaCCToken | undefined;
|
|
@@ -9,7 +9,6 @@ class ChallengeNvidiaCCHelper {
|
|
|
9
9
|
helper: 'ChallengeNvidiaCCHelper',
|
|
10
10
|
});
|
|
11
11
|
try {
|
|
12
|
-
//TODO: add nvswitchToken here
|
|
13
12
|
const wrapper = new sp_nvtrust_wrapper_1.NvtrustWrapper();
|
|
14
13
|
log?.info('Checking for untrusted GPUs');
|
|
15
14
|
await wrapper.assertTrustedGpus();
|
|
@@ -19,6 +18,12 @@ class ChallengeNvidiaCCHelper {
|
|
|
19
18
|
gpuCount: topology.gpuCount,
|
|
20
19
|
nvswitchCount: topology.nvswitchCount,
|
|
21
20
|
});
|
|
21
|
+
if (topology.gpuCount > 1) {
|
|
22
|
+
const { hasNvlink } = await ChallengeNvidiaCCHelper.checkGpuInterconnect(wrapper, log);
|
|
23
|
+
if (hasNvlink && topology.nvswitchCount === 0) {
|
|
24
|
+
log?.warn('No attestable LS10 NVSwitch devices were found; continuing with GPU-only attestation (expected for Blackwell)');
|
|
25
|
+
}
|
|
26
|
+
}
|
|
22
27
|
if (!topology.gpuCount) {
|
|
23
28
|
log?.info('Challenge NVIDIA token present: false');
|
|
24
29
|
log?.info('NVIDIA token retrieval skipped: no GPUs detected in topology');
|
|
@@ -33,12 +38,30 @@ class ChallengeNvidiaCCHelper {
|
|
|
33
38
|
nonce,
|
|
34
39
|
ppcieMode: false,
|
|
35
40
|
});
|
|
41
|
+
let nvswitchToken;
|
|
42
|
+
if (topology.nvswitchCount > 0) {
|
|
43
|
+
log?.debug('Attempting NVIDIA NVSwitch token retrieval', {
|
|
44
|
+
nvswitchCount: topology.nvswitchCount,
|
|
45
|
+
});
|
|
46
|
+
const nvswitchTokenRaw = await wrapper.getNvidiaToken({
|
|
47
|
+
device: sp_nvtrust_wrapper_1.NvidiaDeviceType.SWITCH,
|
|
48
|
+
nonce,
|
|
49
|
+
ppcieMode: false,
|
|
50
|
+
});
|
|
51
|
+
nvswitchToken = nvswitchTokenRaw.jwt;
|
|
52
|
+
log?.info('NVIDIA NVSwitch token retrieved successfully', {
|
|
53
|
+
nvswitchCount: topology.nvswitchCount,
|
|
54
|
+
});
|
|
55
|
+
}
|
|
36
56
|
log?.info('Challenge NVIDIA token present: true');
|
|
37
57
|
log?.info('NVIDIA token retrieved successfully', {
|
|
38
58
|
gpuCount: topology.gpuCount,
|
|
39
59
|
nvswitchCount: topology.nvswitchCount,
|
|
40
60
|
});
|
|
41
|
-
return {
|
|
61
|
+
return {
|
|
62
|
+
gpuToken: gpuTokenRaw.jwt,
|
|
63
|
+
...(nvswitchToken ? { nvswitchToken } : {}),
|
|
64
|
+
};
|
|
42
65
|
}
|
|
43
66
|
catch (error) {
|
|
44
67
|
if (error instanceof sp_nvtrust_wrapper_1.NvtrustWrapperCallError) {
|
|
@@ -66,6 +89,50 @@ class ChallengeNvidiaCCHelper {
|
|
|
66
89
|
throw error;
|
|
67
90
|
}
|
|
68
91
|
}
|
|
92
|
+
/**
|
|
93
|
+
* Reports how the GPUs can reach each other's memory.
|
|
94
|
+
*
|
|
95
|
+
* A PCIe or unidentified peer path carries traffic outside the encrypted
|
|
96
|
+
* CPU-GPU channel and nothing can vouch for it, so it is rejected here.
|
|
97
|
+
* NVLink is accepted here. Whether a separate NVSwitch token is required
|
|
98
|
+
* is determined from the LS10 count returned by getGPUTopology(): Hopper
|
|
99
|
+
* exposes attestable LS10 switches, while Blackwell does not.
|
|
100
|
+
*
|
|
101
|
+
* @returns whether any GPU pair is linked over NVLink
|
|
102
|
+
* @throws if a peer path bypasses the encrypted channel, or if NVML cannot
|
|
103
|
+
* be queried
|
|
104
|
+
*/
|
|
105
|
+
static async checkGpuInterconnect(wrapper, log) {
|
|
106
|
+
const links = await wrapper.getGpuInterconnect();
|
|
107
|
+
const describe = (type) => sp_nvtrust_wrapper_1.GpuInterconnectLinkType[type] ?? String(type);
|
|
108
|
+
const format = (subset) => subset
|
|
109
|
+
.map((link) => `${link.bdf1} <-> ${link.bdf2}: ${describe(link.type)}`)
|
|
110
|
+
.join('; ');
|
|
111
|
+
log?.debug('GPU interconnect checked', {
|
|
112
|
+
pairs: links.map((link) => ({
|
|
113
|
+
bdf1: link.bdf1,
|
|
114
|
+
bdf2: link.bdf2,
|
|
115
|
+
type: describe(link.type),
|
|
116
|
+
})),
|
|
117
|
+
});
|
|
118
|
+
const connected = links.filter((link) => link.type !==
|
|
119
|
+
sp_nvtrust_wrapper_1.GpuInterconnectLinkType.GPU_INTERCONNECT_LINK_TYPE_NONE);
|
|
120
|
+
if (connected.length === 0) {
|
|
121
|
+
log?.info('GPUs are isolated: no direct interconnect detected');
|
|
122
|
+
return { hasNvlink: false };
|
|
123
|
+
}
|
|
124
|
+
const bypassing = connected.filter((link) => link.type !==
|
|
125
|
+
sp_nvtrust_wrapper_1.GpuInterconnectLinkType.GPU_INTERCONNECT_LINK_TYPE_NVLINK);
|
|
126
|
+
if (bypassing.length > 0) {
|
|
127
|
+
const details = format(bypassing);
|
|
128
|
+
log?.error('GPU interconnect bypasses the encrypted channel', {
|
|
129
|
+
links: details,
|
|
130
|
+
});
|
|
131
|
+
throw new Error(`Unsupported direct GPU interconnect detected: ${details}`);
|
|
132
|
+
}
|
|
133
|
+
log?.warn('NVLink interconnect detected', { links: format(connected) });
|
|
134
|
+
return { hasNvlink: true };
|
|
135
|
+
}
|
|
69
136
|
static getTokenHash(token) {
|
|
70
137
|
const hash = (0, crypto_1.createHash)('sha256');
|
|
71
138
|
hash.update(JSON.stringify(token));
|
|
@@ -92,4 +159,4 @@ class ChallengeNvidiaCCHelper {
|
|
|
92
159
|
}
|
|
93
160
|
}
|
|
94
161
|
exports.ChallengeNvidiaCCHelper = ChallengeNvidiaCCHelper;
|
|
95
|
-
//# sourceMappingURL=data:application/json;base64,
|
|
162
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlTnZpZGlhQ0NIZWxwZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlUHJvdmlkZXIvY2hhbGxlbmdlTnZpZGlhQ0NIZWxwZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkVBTTRDO0FBRTVDLG1DQUFvQztBQUVwQyxNQUFhLHVCQUF1QjtJQUN4QixNQUFNLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FDL0IsTUFBWTtRQUVaLE1BQU0sR0FBRyxHQUFHLE1BQU0sRUFBRSxLQUFLLENBQUM7WUFDdEIsTUFBTSxFQUFFLHlCQUF5QjtTQUNwQyxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUM7WUFDRCxNQUFNLE9BQU8sR0FBRyxJQUFJLG1DQUFjLEVBQUUsQ0FBQztZQUNyQyxHQUFHLEVBQUUsSUFBSSxDQUFDLDZCQUE2QixDQUFDLENBQUM7WUFDekMsTUFBTSxPQUFPLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUNsQyxHQUFHLEVBQUUsSUFBSSxDQUFDLGtDQUFrQyxDQUFDLENBQUM7WUFFOUMsTUFBTSxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDaEQsR0FBRyxFQUFFLEtBQUssQ0FBQyw4QkFBOEIsRUFBRTtnQkFDdkMsUUFBUSxFQUFFLFFBQVEsQ0FBQyxRQUFRO2dCQUMzQixhQUFhLEVBQUUsUUFBUSxDQUFDLGFBQWE7YUFDeEMsQ0FBQyxDQUFDO1lBRUgsSUFBSSxRQUFRLENBQUMsUUFBUSxHQUFHLENBQUMsRUFBRSxDQUFDO2dCQUN4QixNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQ2YsTUFBTSx1QkFBdUIsQ0FBQyxvQkFBb0IsQ0FDOUMsT0FBTyxFQUNQLEdBQUcsQ0FDTixDQUFDO2dCQUNOLElBQUksU0FBUyxJQUFJLFFBQVEsQ0FBQyxhQUFhLEtBQUssQ0FBQyxFQUFFLENBQUM7b0JBQzVDLEdBQUcsRUFBRSxJQUFJLENBQ0wsK0dBQStHLENBQ2xILENBQUM7Z0JBQ04sQ0FBQztZQUNMLENBQUM7WUFFRCxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsRUFBRSxDQUFDO2dCQUNyQixHQUFHLEVBQUUsSUFBSSxDQUFDLHVDQUF1QyxDQUFDLENBQUM7Z0JBQ25ELEdBQUcsRUFBRSxJQUFJLENBQ0wsOERBQThELENBQ2pFLENBQUM7Z0JBQ0YsT0FBTztZQUNYLENBQUM7WUFFRCxNQUFNLEtBQUssR0FBRyxtQ0FBYyxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQzdDLEdBQUcsRUFBRSxLQUFLLENBQUMscURBQXFELEVBQUU7Z0JBQzlELFFBQVEsRUFBRSxRQUFRLENBQUMsUUFBUTthQUM5QixDQUFDLENBQUM7WUFDSCxNQUFNLFdBQVcsR0FBRyxNQUFNLE9BQU8sQ0FBQyxjQUFjLENBQUM7Z0JBQzdDLE1BQU0sRUFBRSxxQ0FBZ0IsQ0FBQyxHQUFHO2dCQUM1QixLQUFLO2dCQUNMLFNBQVMsRUFBRSxLQUFLO2FBQ25CLENBQUMsQ0FBQztZQUVILElBQUksYUFBaUMsQ0FBQztZQUN0QyxJQUFJLFFBQVEsQ0FBQyxhQUFhLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQzdCLEdBQUcsRUFBRSxLQUFLLENBQUMsNENBQTRDLEVBQUU7b0JBQ3JELGFBQWEsRUFBRSxRQUFRLENBQUMsYUFBYTtpQkFDeEMsQ0FBQyxDQUFDO2dCQUNILE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxPQUFPLENBQUMsY0FBYyxDQUFDO29CQUNsRCxNQUFNLEVBQUUscUNBQWdCLENBQUMsTUFBTTtvQkFDL0IsS0FBSztvQkFDTCxTQUFTLEVBQUUsS0FBSztpQkFDbkIsQ0FBQyxDQUFDO2dCQUNILGFBQWEsR0FBRyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUM7Z0JBQ3JDLEdBQUcsRUFBRSxJQUFJLENBQUMsOENBQThDLEVBQUU7b0JBQ3RELGFBQWEsRUFBRSxRQUFRLENBQUMsYUFBYTtpQkFDeEMsQ0FBQyxDQUFDO1lBQ1AsQ0FBQztZQUVELEdBQUcsRUFBRSxJQUFJLENBQUMsc0NBQXNDLENBQUMsQ0FBQztZQUNsRCxHQUFHLEVBQUUsSUFBSSxDQUFDLHFDQUFxQyxFQUFFO2dCQUM3QyxRQUFRLEVBQUUsUUFBUSxDQUFDLFFBQVE7Z0JBQzNCLGFBQWEsRUFBRSxRQUFRLENBQUMsYUFBYTthQUN4QyxDQUFDLENBQUM7WUFDSCxPQUFPO2dCQUNILFFBQVEsRUFBRSxXQUFXLENBQUMsR0FBRztnQkFDekIsR0FBRyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsRUFBRSxhQUFhLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2FBQzlDLENBQUM7UUFDTixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNiLElBQUksS0FBSyxZQUFZLDRDQUF1QixFQUFFLENBQUM7Z0JBQzNDLEdBQUcsRUFBRSxLQUFLLENBQUMsNEJBQTRCLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO2dCQUN4RCxJQUFJLEtBQUssQ0FBQyxTQUFTLEVBQUUsSUFBSSxFQUFFLEVBQUUsQ0FBQztvQkFDMUIsR0FBRyxFQUFFLEtBQUssQ0FBQyxlQUFlLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDO2dCQUNqRCxDQUFDO2dCQUNELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksSUFBSSxFQUFFLENBQUMsQ0FBQztnQkFDcEQsSUFBSSxVQUFVLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO29CQUN4QixHQUFHLEVBQUUsS0FBSyxDQUFDLDRCQUE0QixDQUFDLENBQUM7b0JBQ3pDLEtBQUssTUFBTSxDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUMsSUFBSSxVQUFVLEVBQUUsQ0FBQzt3QkFDOUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxPQUFPLFFBQVEsTUFBTSxDQUFDLENBQUM7d0JBQ2xDLEdBQUcsRUFBRSxLQUFLLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7b0JBQ25DLENBQUM7Z0JBQ0wsQ0FBQztZQUNMLENBQUM7aUJBQU0sSUFBSSxLQUFLLFlBQVksdUNBQWtCLEVBQUUsQ0FBQztnQkFDN0MsR0FBRyxFQUFFLEtBQUssQ0FBQyx5QkFBeUIsRUFBRTtvQkFDbEMsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNO2lCQUN2QixDQUFDLENBQUM7WUFDUCxDQUFDO2lCQUFNLENBQUM7Z0JBQ0osR0FBRyxFQUFFLEtBQUssQ0FBQyx3Q0FBd0MsS0FBSyxFQUFFLENBQUMsQ0FBQztZQUNoRSxDQUFDO1lBRUQsTUFBTSxLQUFLLENBQUM7UUFDaEIsQ0FBQztJQUNMLENBQUM7SUFFRDs7Ozs7Ozs7Ozs7O09BWUc7SUFDSyxNQUFNLENBQUMsS0FBSyxDQUFDLG9CQUFvQixDQUNyQyxPQUF1QixFQUN2QixHQUFTO1FBRVQsTUFBTSxLQUFLLEdBQUcsTUFBTSxPQUFPLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztRQUNqRCxNQUFNLFFBQVEsR0FBRyxDQUFDLElBQTZCLEVBQVUsRUFBRSxDQUN2RCw0Q0FBdUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDbEQsTUFBTSxNQUFNLEdBQUcsQ0FBQyxNQUFvQixFQUFVLEVBQUUsQ0FDNUMsTUFBTTthQUNELEdBQUcsQ0FDQSxDQUFDLElBQUksRUFBRSxFQUFFLENBQ0wsR0FBRyxJQUFJLENBQUMsSUFBSSxRQUFRLElBQUksQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUM5RDthQUNBLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUVwQixHQUFHLEVBQUUsS0FBSyxDQUFDLDBCQUEwQixFQUFFO1lBQ25DLEtBQUssRUFBRSxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxDQUFDO2dCQUN4QixJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUk7Z0JBQ2YsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJO2dCQUNmLElBQUksRUFBRSxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQzthQUM1QixDQUFDLENBQUM7U0FDTixDQUFDLENBQUM7UUFFSCxNQUFNLFNBQVMsR0FBRyxLQUFLLENBQUMsTUFBTSxDQUMxQixDQUFDLElBQUksRUFBRSxFQUFFLENBQ0wsSUFBSSxDQUFDLElBQUk7WUFDVCw0Q0FBdUIsQ0FBQywrQkFBK0IsQ0FDOUQsQ0FBQztRQUNGLElBQUksU0FBUyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN6QixHQUFHLEVBQUUsSUFBSSxDQUFDLG9EQUFvRCxDQUFDLENBQUM7WUFDaEUsT0FBTyxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUUsQ0FBQztRQUNoQyxDQUFDO1FBRUQsTUFBTSxTQUFTLEdBQUcsU0FBUyxDQUFDLE1BQU0sQ0FDOUIsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUNMLElBQUksQ0FBQyxJQUFJO1lBQ1QsNENBQXVCLENBQUMsaUNBQWlDLENBQ2hFLENBQUM7UUFDRixJQUFJLFNBQVMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDdkIsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ2xDLEdBQUcsRUFBRSxLQUFLLENBQUMsaURBQWlELEVBQUU7Z0JBQzFELEtBQUssRUFBRSxPQUFPO2FBQ2pCLENBQUMsQ0FBQztZQUNILE1BQU0sSUFBSSxLQUFLLENBQ1gsaURBQWlELE9BQU8sRUFBRSxDQUM3RCxDQUFDO1FBQ04sQ0FBQztRQUVELEdBQUcsRUFBRSxJQUFJLENBQUMsOEJBQThCLEVBQUUsRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN4RSxPQUFPLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDO0lBQy9CLENBQUM7SUFFRCxNQUFNLENBQUMsWUFBWSxDQUFDLEtBQW9CO1FBQ3BDLE1BQU0sSUFBSSxHQUFHLElBQUEsbUJBQVUsRUFBQyxRQUFRLENBQUMsQ0FBQztRQUNsQyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztRQUNuQyxPQUFPLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztJQUN6QixDQUFDO0lBRUQsTUFBTSxDQUFDLEtBQUssQ0FBQyxnQ0FBZ0MsQ0FDekMsWUFBb0IsRUFDcEIsTUFBWTtRQUtaLE1BQU0sR0FBRyxHQUFHLE1BQU0sRUFBRSxLQUFLLENBQUM7WUFDdEIsTUFBTSxFQUFFLHlCQUF5QjtTQUNwQyxDQUFDLENBQUM7UUFDSCxNQUFNLFlBQVksR0FDZCxNQUFNLHVCQUF1QixDQUFDLGNBQWMsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUN6RCxNQUFNLGVBQWUsR0FDakIsWUFBWSxJQUFJLHVCQUF1QixDQUFDLFlBQVksQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUV2RSxNQUFNLGFBQWEsR0FBRyxlQUFlO1lBQ2pDLENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsWUFBWSxFQUFFLGVBQWUsQ0FBQyxDQUFDO1lBQ2hELENBQUMsQ0FBQyxZQUFZLENBQUM7UUFFbkIsSUFBSSxhQUFhLENBQUMsTUFBTSxHQUFHLEVBQUUsRUFBRSxDQUFDO1lBQzVCLE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLENBQUMsQ0FBQztRQUM3RCxDQUFDO1FBQ0QsR0FBRyxFQUFFLEtBQUssQ0FBQyxrQ0FBa0MsRUFBRTtZQUMzQyxrQkFBa0IsRUFBRSxZQUFZLENBQUMsTUFBTTtZQUN2QyxtQkFBbUIsRUFBRSxhQUFhLENBQUMsTUFBTTtZQUN6QyxjQUFjLEVBQUUsT0FBTyxDQUFDLFlBQVksQ0FBQztTQUN4QyxDQUFDLENBQUM7UUFDSCxPQUFPLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxDQUFDO0lBQzNDLENBQUM7Q0FDSjtBQTFNRCwwREEwTUMifQ==
|
|
@@ -48,6 +48,18 @@ class ChallengeValidatorNvidia {
|
|
|
48
48
|
throw new Error('Failed to verify Nvidia GPU token: validateToken returned success=false');
|
|
49
49
|
}
|
|
50
50
|
log.info('NVIDIA validation passed: nvtrust token verification succeeded');
|
|
51
|
+
const { nvswitchToken } = challenge.nvidiaTokens;
|
|
52
|
+
if (nvswitchToken) {
|
|
53
|
+
nvidiaTokenValidationResult = await nvtrusWrapper.validateToken({
|
|
54
|
+
device: sp_nvtrust_wrapper_1.NvidiaDeviceType.SWITCH,
|
|
55
|
+
policy: sp_nvtrust_wrapper_1.defaultNVSwitchPolicy,
|
|
56
|
+
token: { jwt: nvswitchToken },
|
|
57
|
+
});
|
|
58
|
+
if (nvidiaTokenValidationResult.success !== true) {
|
|
59
|
+
throw new Error('Failed to verify Nvidia NVSwitch token: validateToken returned success=false');
|
|
60
|
+
}
|
|
61
|
+
log.info('NVIDIA NVSwitch validation passed: nvtrust token verification succeeded');
|
|
62
|
+
}
|
|
51
63
|
if (networkType === 'trusted') {
|
|
52
64
|
const gpusInfo = sp_nvtrust_wrapper_1.NvtrustWrapper.extractGPUInfoFromToken({
|
|
53
65
|
jwt: challenge.nvidiaTokens.gpuToken,
|
|
@@ -90,4 +102,4 @@ class ChallengeValidatorNvidia {
|
|
|
90
102
|
}
|
|
91
103
|
}
|
|
92
104
|
exports.ChallengeValidatorNvidia = ChallengeValidatorNvidia;
|
|
93
|
-
//# sourceMappingURL=data:application/json;base64,
|
|
105
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlVmFsaWRhdG9yTnZpZGlhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NoYWxsZW5nZVZhbGlkYXRvci9jaGFsbGVuZ2VWYWxpZGF0b3JOdmlkaWEudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkVBTzRDO0FBRTVDLDJEQUlvQztBQUNwQyw0REFBK0Q7QUFHL0QsTUFBYSx3QkFBd0I7SUFFWjtJQUNBO0lBRnJCLFlBQ3FCLEdBQVEsRUFDUixNQUE2QjtRQUQ3QixRQUFHLEdBQUgsR0FBRyxDQUFLO1FBQ1IsV0FBTSxHQUFOLE1BQU0sQ0FBdUI7SUFDL0MsQ0FBQztJQUVKLEtBQUssQ0FBQyxRQUFRLENBQ1YsU0FBb0IsRUFDcEIsUUFBZ0IsRUFDaEIsV0FBeUI7UUFFekIsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUM7WUFDdkIsU0FBUyxFQUFFLDBCQUEwQjtTQUN4QyxDQUFDLENBQUM7UUFDSCxNQUFNLGNBQWMsR0FBRyxJQUFBLG9DQUF1QixFQUFDLFNBQVMsQ0FBQyxDQUFDO1FBRTFELEdBQUcsQ0FBQyxLQUFLLENBQUMsbUNBQW1DLGNBQWMsRUFBRSxDQUFDLENBQUM7UUFDL0QsSUFBSSxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQ2xCLEdBQUcsQ0FBQyxLQUFLLENBQ0wsb0VBQW9FLENBQ3ZFLENBQUM7WUFDRixPQUFPO1FBQ1gsQ0FBQztRQUNELEdBQUcsQ0FBQyxLQUFLLENBQ0wsNkNBQTZDLFdBQVcsSUFBSSxXQUFXLEVBQUUsQ0FDNUUsQ0FBQztRQUVGLE1BQU0sU0FBUyxHQUFHLDJDQUF1QixDQUFDLFlBQVksQ0FDbEQsU0FBUyxDQUFDLFlBQVksQ0FDekIsQ0FBQztRQUVGLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxFQUFFLEVBQUUsQ0FBQztZQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLG9DQUFvQyxDQUFDLENBQUM7UUFDMUQsQ0FBQztRQUNELE1BQU0sWUFBWSxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQzVDLE1BQU0sWUFBWSxHQUFHLFNBQVMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDL0MsTUFBTSxlQUFlLEdBQUcsWUFBWSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNyRCxHQUFHLENBQUMsS0FBSyxDQUNMLHFCQUFxQixZQUFZLG1CQUFtQixlQUFlLEVBQUUsQ0FDeEUsQ0FBQztRQUNGLElBQUksWUFBWSxLQUFLLGVBQWUsRUFBRSxDQUFDO1lBQ25DLE1BQU0sSUFBSSxLQUFLLENBQ1gsNEdBQTRHLENBQy9HLENBQUM7UUFDTixDQUFDO1FBQ0QsR0FBRyxDQUFDLElBQUksQ0FDSixxRUFBcUUsQ0FDeEUsQ0FBQztRQUVGLE1BQU0sYUFBYSxHQUFHLElBQUksbUNBQWMsQ0FDcEMsSUFBSSxDQUFDLE1BQU0sRUFBRSxHQUFHLElBQUksa0JBQWtCLEVBQ3RDLElBQUksQ0FBQyxNQUFNLEVBQUUsT0FBTyxJQUFJLEtBQUssQ0FDaEMsQ0FBQztRQUVGLElBQUksMkJBQTJCLEdBQXVCO1lBQ2xELE9BQU8sRUFBRSxLQUFLO1NBQ2pCLENBQUM7UUFDRixJQUFJLENBQUM7WUFDRCwyQkFBMkIsR0FBRyxNQUFNLGFBQWEsQ0FBQyxhQUFhLENBQUM7Z0JBQzVELE1BQU0sRUFBRSxxQ0FBZ0IsQ0FBQyxHQUFHO2dCQUM1QixNQUFNLEVBQUUscUNBQWdCO2dCQUN4QixLQUFLLEVBQUUsRUFBRSxHQUFHLEVBQUUsU0FBUyxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUU7YUFDbEQsQ0FBQyxDQUFDO1lBQ0gsSUFBSSwyQkFBMkIsQ0FBQyxPQUFPLEtBQUssSUFBSSxFQUFFLENBQUM7Z0JBQy9DLE1BQU0sSUFBSSxLQUFLLENBQ1gseUVBQXlFLENBQzVFLENBQUM7WUFDTixDQUFDO1lBQ0QsR0FBRyxDQUFDLElBQUksQ0FDSixnRUFBZ0UsQ0FDbkUsQ0FBQztZQUVGLE1BQU0sRUFBRSxhQUFhLEVBQUUsR0FBRyxTQUFTLENBQUMsWUFBWSxDQUFDO1lBQ2pELElBQUksYUFBYSxFQUFFLENBQUM7Z0JBQ2hCLDJCQUEyQixHQUFHLE1BQU0sYUFBYSxDQUFDLGFBQWEsQ0FDM0Q7b0JBQ0ksTUFBTSxFQUFFLHFDQUFnQixDQUFDLE1BQU07b0JBQy9CLE1BQU0sRUFBRSwwQ0FBcUI7b0JBQzdCLEtBQUssRUFBRSxFQUFFLEdBQUcsRUFBRSxhQUFhLEVBQUU7aUJBQ2hDLENBQ0osQ0FBQztnQkFDRixJQUFJLDJCQUEyQixDQUFDLE9BQU8sS0FBSyxJQUFJLEVBQUUsQ0FBQztvQkFDL0MsTUFBTSxJQUFJLEtBQUssQ0FDWCw4RUFBOEUsQ0FDakYsQ0FBQztnQkFDTixDQUFDO2dCQUNELEdBQUcsQ0FBQyxJQUFJLENBQ0oseUVBQXlFLENBQzVFLENBQUM7WUFDTixDQUFDO1lBRUQsSUFBSSxXQUFXLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQzVCLE1BQU0sUUFBUSxHQUFHLG1DQUFjLENBQUMsdUJBQXVCLENBQUM7b0JBQ3BELEdBQUcsRUFBRSxTQUFTLENBQUMsWUFBWSxDQUFDLFFBQVE7aUJBQ3ZDLENBQUMsQ0FBQztnQkFDSCxNQUFNLGVBQWUsR0FBRyxRQUFRLENBQUMsSUFBSTtxQkFDaEMsR0FBRyxDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLEdBQUcsRUFBRSxTQUFTLEVBQUUsS0FBSyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7cUJBQ3BELE1BQU0sQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLEVBQUUsRUFBRSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFDO3FCQUN6QyxHQUFHLENBQUMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDdkMsTUFBTSxrQkFBa0IsR0FBRyxlQUFlLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQztnQkFDdEQsSUFBSSxrQkFBa0IsRUFBRSxDQUFDO29CQUNyQixNQUFNLG1CQUFtQixHQUFHLGVBQWUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7b0JBQ3ZELE1BQU0sSUFBSSxLQUFLLENBQ1gsMEZBQTBGLG1CQUFtQixFQUFFLENBQ2xILENBQUM7Z0JBQ04sQ0FBQztnQkFDRCxHQUFHLENBQUMsSUFBSSxDQUNKLDREQUE0RCxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sU0FBUyxDQUM1RixDQUFDO1lBQ04sQ0FBQztpQkFBTSxDQUFDO2dCQUNKLEdBQUcsQ0FBQyxJQUFJLENBQ0osc0VBQXNFLFdBQVcsSUFBSSxXQUFXLEVBQUUsQ0FDckcsQ0FBQztZQUNOLENBQUM7UUFDTCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNiLElBQUksS0FBSyxZQUFZLDRDQUF1QixFQUFFLENBQUM7Z0JBQzNDLEdBQUcsQ0FBQyxLQUFLLENBQUMsNEJBQTRCLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO2dCQUN2RCxJQUFJLEtBQUssQ0FBQyxTQUFTLEVBQUUsSUFBSSxFQUFFLEVBQUUsQ0FBQztvQkFDMUIsR0FBRyxDQUFDLEtBQUssQ0FBQyxlQUFlLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDO2dCQUNoRCxDQUFDO2dCQUNELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksSUFBSSxFQUFFLENBQUMsQ0FBQztnQkFDcEQsSUFBSSxVQUFVLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO29CQUN4QixHQUFHLENBQUMsS0FBSyxDQUFDLDRCQUE0QixDQUFDLENBQUM7b0JBQ3hDLEtBQUssTUFBTSxDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUMsSUFBSSxVQUFVLEVBQUUsQ0FBQzt3QkFDOUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLFFBQVEsTUFBTSxDQUFDLENBQUM7d0JBQ2pDLEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7b0JBQ2xDLENBQUM7Z0JBQ0wsQ0FBQztZQUNMLENBQUM7aUJBQU0sQ0FBQztnQkFDSixHQUFHLENBQUMsS0FBSyxDQUFDLHlDQUF5QyxLQUFLLEVBQUUsQ0FBQyxDQUFDO1lBQ2hFLENBQUM7WUFFRCxNQUFNLEtBQUssQ0FBQztRQUNoQixDQUFDO0lBQ0wsQ0FBQztDQUNKO0FBdklELDREQXVJQyJ9
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@super-protocol/pki-attestation-engine",
|
|
3
|
-
"version": "5.0.
|
|
3
|
+
"version": "5.0.6",
|
|
4
4
|
"description": "",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|
|
@@ -22,7 +22,7 @@
|
|
|
22
22
|
"@sinclair/typebox": "0.33.22",
|
|
23
23
|
"@super-protocol/addons-tee": "^4.1.0",
|
|
24
24
|
"@super-protocol/pki-common": "^5.0.1",
|
|
25
|
-
"@super-protocol/sp-nvtrust-wrapper": "^2.
|
|
25
|
+
"@super-protocol/sp-nvtrust-wrapper": "^2.4.0"
|
|
26
26
|
},
|
|
27
27
|
"peerDependencies": {
|
|
28
28
|
"@super-protocol/sdk-js": "*"
|