pi-privacy 0.2.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +10 -4
- package/src/attest/attestation.ts +6 -1
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "pi-privacy",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.1",
|
|
4
4
|
"description": "Privacy posture + TEE attestation for Pi providers: cryptographically verified confidential-enclave (TEE) inference, enforced/labeled zero-data-retention (ZDR), and on-device detection — honestly graded so a verified guarantee never reads like a claimed one.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "MIT",
|
|
@@ -25,7 +25,9 @@
|
|
|
25
25
|
"sev-snp"
|
|
26
26
|
],
|
|
27
27
|
"pi": {
|
|
28
|
-
"extensions": [
|
|
28
|
+
"extensions": [
|
|
29
|
+
"./extensions"
|
|
30
|
+
]
|
|
29
31
|
},
|
|
30
32
|
"exports": {
|
|
31
33
|
".": "./src/index.ts",
|
|
@@ -54,8 +56,12 @@
|
|
|
54
56
|
"@earendil-works/pi-ai": ">=0.80.0"
|
|
55
57
|
},
|
|
56
58
|
"peerDependenciesMeta": {
|
|
57
|
-
"@earendil-works/pi-coding-agent": {
|
|
58
|
-
|
|
59
|
+
"@earendil-works/pi-coding-agent": {
|
|
60
|
+
"optional": true
|
|
61
|
+
},
|
|
62
|
+
"@earendil-works/pi-ai": {
|
|
63
|
+
"optional": true
|
|
64
|
+
}
|
|
59
65
|
},
|
|
60
66
|
"dependencies": {
|
|
61
67
|
"undici": "^7.28.0"
|
|
@@ -115,7 +115,12 @@ export function interpretReport(modelId: string, nonce: string, raw: unknown): A
|
|
|
115
115
|
const hardware: string[] = [];
|
|
116
116
|
if (/nvidia|gpu/.test(blob)) hardware.push("NVIDIA");
|
|
117
117
|
if (/intel|tdx/.test(blob)) hardware.push("Intel TDX");
|
|
118
|
-
|
|
118
|
+
// Freshness/anti-replay: our nonce must appear in the report. Require a non-trivial
|
|
119
|
+
// nonce — a real attestation nonce is 32 bytes (64 hex, see randomNonce). Guard
|
|
120
|
+
// against an empty/short nonce, since blob.includes("") is vacuously true and would
|
|
121
|
+
// score a missing nonce as "echoed" (matters when the nonce is externally supplied,
|
|
122
|
+
// e.g. a server-proxied report rather than one bound to our own randomNonce).
|
|
123
|
+
const nonceEchoed = nonce.length >= 16 && blob.includes(nonce.toLowerCase());
|
|
119
124
|
|
|
120
125
|
return { model: modelId, nonce, signingAddress, nonceEchoed, hardware, raw };
|
|
121
126
|
}
|