voltage-verify 0.1.0__tar.gz

voltage_verify-0.1.0/.gitignore

@@ -0,0 +1,11 @@
+.venv/
+__pycache__/
+*.pyc
+*.egg-info/
+build/
+dist/
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+manifest.json
+bundle.json

voltage_verify-0.1.0/CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog
+
+## 0.1.0 (2026-09-12)
+
+First release.
+
+* `manifest`: image digest resolution through the OCI registry API (no pull), artifact
+  hashing, free-form extras, verifier-side random challenge.
+* `attest`: TDX quote through configfs TSM with `report_data = SHA-512(manifest)`, NVIDIA
+  NRAS attestation with `nonce = SHA-256(manifest)`, single-GPU and multi-GPU Protected PCIe
+  modes, Intel and NVIDIA collateral embedded for offline verification.
+* `verify`: quote structure, attestation key signature, Quoting Enclave binding and signature,
+  PCK chain to the pinned Intel SGX Root CA, TCB level and TDX module identity against Intel's
+  signed TCB info, Quoting Enclave identity, CRLs, NRAS ES384 signatures, nonce, claims policy,
+  token freshness, challenge and image expectations.
+* `selftest`: six negative tests (image digest, artifact, manifest field, challenge replay,
+  quote tampering, GPU claim tampering).
+* Tests against real evidence captured on VoltageGPU Confidential VMs.

voltage_verify-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 VOLTAGE EI (VoltageGPU), Julien Aubry
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

voltage_verify-0.1.0/PKG-INFO

@@ -0,0 +1,191 @@
+Metadata-Version: 2.5
+Name: voltage-verify
+Version: 0.1.0
+Summary: Bind an Intel TDX quote and an NVIDIA GPU attestation to the workload you meant to run, then verify the bundle without trusting the cloud provider.
+Project-URL: Homepage, https://voltagegpu.com/blog/two-proofs-tdx-nvidia-h200-attestation-tenant
+Project-URL: Documentation, https://docs.voltagegpu.com/pods/confidential-vm
+Project-URL: Source, https://github.com/Jabsama/voltage-verify
+Project-URL: Issues, https://github.com/Jabsama/voltage-verify/issues
+Project-URL: Changelog, https://github.com/Jabsama/voltage-verify/blob/main/CHANGELOG.md
+Project-URL: Mirror, https://voltagegpu.com/blog/two-proofs/voltage-verify/
+Project-URL: Evidence, https://voltagegpu.com/blog/two-proofs/evidence/README.txt
+Author-email: "VoltageGPU (VOLTAGE EI)" <contact@voltagegpu.com>
+License: MIT License
+        
+        Copyright (c) 2026 VOLTAGE EI (VoltageGPU), Julien Aubry
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+License-File: LICENSE
+Keywords: attestation,confidential-computing,gpu,intel-tdx,nvidia,remote-attestation
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.10
+Requires-Dist: cryptography<47,>=42
+Requires-Dist: pyjwt<3,>=2.7
+Provides-Extra: attest
+Requires-Dist: nv-attestation-sdk>=2.7; extra == 'attest'
+Requires-Dist: nvidia-ml-py>=12; extra == 'attest'
+Provides-Extra: dev
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest>=7; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# voltage-verify
+
+Bind an Intel TDX quote and an NVIDIA GPU attestation to the workload you meant to run, then
+verify the bundle on your own machine, without trusting the cloud provider.
+
+`voltage-verify` is a small command line tool with three roles:
+
+1. **On your machine**, it writes a *manifest*: the container image digest, the digests of the
+   model or files you care about, a free-text statement, and a fresh random challenge. Two
+   hashes of that manifest become the *commitments*.
+2. **Inside the confidential VM**, it asks the hardware to sign those commitments: the Intel
+   TDX quote carries `SHA-512(manifest)` as its 64-byte `report_data`, and NVIDIA's Remote
+   Attestation Service (NRAS) signs GPU claims over the nonce `SHA-256(manifest)`. It writes
+   one JSON *bundle* with the quote, the NVIDIA tokens and the public collateral needed to
+   check them later.
+3. **Back on your machine**, it verifies the bundle: Intel's signature chain to the pinned
+   Intel SGX Root CA, the platform's TCB status against Intel's published TCB info, the
+   Quoting Enclave identity, revocation lists, NVIDIA's ES384 signatures against NRAS's JWKS,
+   the per-GPU claims (measurements ok, secure boot on, debug off), and above all that both
+   proofs carry *your* commitments. Then it runs six negative tests to show that any change
+   to the manifest, the challenge, the quote or a GPU claim is rejected.
+
+It was written by [VoltageGPU](https://voltagegpu.com) so that tenants of its Confidential VMs
+can verify more than "this is a TDX VM with a confidential GPU": they can verify that the two
+hardware proofs were produced *for the workload described in a manifest they wrote*, on a
+challenge they chose. The trust chain ends at Intel and NVIDIA, never at VoltageGPU.
+
+## What it proves, and what it does not
+
+Verified means:
+
+* the TDX quote was produced inside a genuine Intel TDX Trust Domain, on a platform whose
+  provisioning certificate chains to Intel's root, at an acceptable TCB level, by a genuine
+  Quoting Enclave, and it embeds `SHA-512` of your manifest;
+* NVIDIA's service signed, over `SHA-256` of your manifest, that the GPU(s) in that VM passed
+  attestation with secure boot on and debugging off;
+* both proofs were made after you issued the challenge, so they cannot be replayed from an
+  earlier session or copied from another tenant.
+
+Verified does **not** mean:
+
+* that the GPU *executed* the image or model named in the manifest. Binding a manifest to a
+  quote proves the hardware signed your description of the workload; proving that this exact
+  code ran needs a measured launcher (for instance the Confidential Containers project with
+  a key broker), which is outside this tool;
+* anything about the VM's own software stack beyond what the TDX measurements (`MRTD`,
+  `RTMR0..3`) say. The tool prints them; comparing them against a reference image is your
+  policy, not the tool's;
+* anything about a VM you did not attest yourself.
+
+`docs/WHAT_IT_PROVES.md` goes through every check and its limit.
+
+## Install
+
+```
+# verifier machine: Python 3.10+, cryptography, PyJWT
+pip install voltage-verify
+# inside the VM: the NVIDIA SDK first (it pins cryptography and PyJWT), then the tool
+pip install nv-attestation-sdk nvidia-ml-py
+pip install --no-deps voltage-verify
+```
+
+Source and issues: https://github.com/Jabsama/voltage-verify. The same wheel and source
+archive are mirrored with SHA-256 sums at https://voltagegpu.com/blog/two-proofs/voltage-verify/
+for installs that must not touch PyPI (`pip install <wheel URL>`).
+
+## Reference run
+
+`examples/hello-workload/` holds a real bundle captured on 12 September 2026 on a VoltageGPU
+`h100-xlarge` Confidential VM (8x H100, NVIDIA Protected PCIe mode), with its manifest and the
+unedited run log. Replay the verification on your own machine:
+
+```
+voltage-verify verify examples/hello-workload/bundle-8xh100-2026-09-12.json \
+    --challenge ef7f54c160627ee536a02b5e73896ac4b1ac2cdefdb7cfaaf2366a7d33cc8731 --hwmodel GH100 --gpus 8
+voltage-verify selftest examples/hello-workload/bundle-8xh100-2026-09-12.json
+```
+
+Expected: every check `PASS`, platform TCB `UpToDate`, Quoting Enclave `UpToDate`, eight
+`GH100` devices with `measres success`, then six mutations rejected.
+
+## Use
+
+On your machine, describe the workload and generate a challenge:
+
+```
+voltage-verify manifest --image ghcr.io/you/app:1.4.2 --artifact model.safetensors \
+    --statement "inference run for customer X" -o manifest.json
+```
+
+Copy `manifest.json` into the VM (scp), then, as root inside the VM:
+
+```
+sudo -E python -m voltage_verify attest --manifest manifest.json -o bundle.json
+```
+
+Copy `bundle.json` back, then:
+
+```
+voltage-verify verify bundle.json --challenge <the challenge printed by `manifest`>
+voltage-verify selftest bundle.json --challenge <same>
+voltage-verify verify bundle.json --offline      # same checks, from the collateral in the bundle
+```
+
+Exit code 0 means verified, 1 means a required check failed, 2 means the bundle or arguments
+are unusable. `--json` prints the machine-readable report.
+
+## Bundle format
+
+Documented in `docs/BUNDLE_FORMAT.md`. In short: the manifest verbatim, both commitments, the
+raw TDX quote (base64), the NRAS token array as returned by the NVIDIA SDK, NRAS's JWKS and
+Intel's TCB info, QE identity and CRLs as fetched at attestation time, plus a few facts about
+the VM (kernel, driver, `nvidia-smi conf-compute -q`). The verifier trusts none of it: it
+recomputes the commitments from the manifest and checks every signature.
+
+## Development
+
+```
+python -m venv .venv && . .venv/bin/activate
+pip install -e ".[dev]"
+pytest
+ruff check src tests
+```
+
+The tests run offline against real evidence: a TDX quote captured on a VoltageGPU H200 VM on
+4 September 2026, NRAS tokens from 4 and 10 September 2026 (single H200, 8x H100 node in
+NVIDIA Protected PCIe mode), and a snapshot of Intel's collateral and NVIDIA's JWKS.
+
+## Security
+
+See `SECURITY.md`. In one line: report anything that would make `verify` say yes when it
+should say no to contact@voltagegpu.com, and expect an answer within two working days.
+
+## License
+
+MIT. Copyright 2026 VOLTAGE EI (VoltageGPU).

voltage_verify-0.1.0/README.md

@@ -0,0 +1,136 @@
+# voltage-verify
+
+Bind an Intel TDX quote and an NVIDIA GPU attestation to the workload you meant to run, then
+verify the bundle on your own machine, without trusting the cloud provider.
+
+`voltage-verify` is a small command line tool with three roles:
+
+1. **On your machine**, it writes a *manifest*: the container image digest, the digests of the
+   model or files you care about, a free-text statement, and a fresh random challenge. Two
+   hashes of that manifest become the *commitments*.
+2. **Inside the confidential VM**, it asks the hardware to sign those commitments: the Intel
+   TDX quote carries `SHA-512(manifest)` as its 64-byte `report_data`, and NVIDIA's Remote
+   Attestation Service (NRAS) signs GPU claims over the nonce `SHA-256(manifest)`. It writes
+   one JSON *bundle* with the quote, the NVIDIA tokens and the public collateral needed to
+   check them later.
+3. **Back on your machine**, it verifies the bundle: Intel's signature chain to the pinned
+   Intel SGX Root CA, the platform's TCB status against Intel's published TCB info, the
+   Quoting Enclave identity, revocation lists, NVIDIA's ES384 signatures against NRAS's JWKS,
+   the per-GPU claims (measurements ok, secure boot on, debug off), and above all that both
+   proofs carry *your* commitments. Then it runs six negative tests to show that any change
+   to the manifest, the challenge, the quote or a GPU claim is rejected.
+
+It was written by [VoltageGPU](https://voltagegpu.com) so that tenants of its Confidential VMs
+can verify more than "this is a TDX VM with a confidential GPU": they can verify that the two
+hardware proofs were produced *for the workload described in a manifest they wrote*, on a
+challenge they chose. The trust chain ends at Intel and NVIDIA, never at VoltageGPU.
+
+## What it proves, and what it does not
+
+Verified means:
+
+* the TDX quote was produced inside a genuine Intel TDX Trust Domain, on a platform whose
+  provisioning certificate chains to Intel's root, at an acceptable TCB level, by a genuine
+  Quoting Enclave, and it embeds `SHA-512` of your manifest;
+* NVIDIA's service signed, over `SHA-256` of your manifest, that the GPU(s) in that VM passed
+  attestation with secure boot on and debugging off;
+* both proofs were made after you issued the challenge, so they cannot be replayed from an
+  earlier session or copied from another tenant.
+
+Verified does **not** mean:
+
+* that the GPU *executed* the image or model named in the manifest. Binding a manifest to a
+  quote proves the hardware signed your description of the workload; proving that this exact
+  code ran needs a measured launcher (for instance the Confidential Containers project with
+  a key broker), which is outside this tool;
+* anything about the VM's own software stack beyond what the TDX measurements (`MRTD`,
+  `RTMR0..3`) say. The tool prints them; comparing them against a reference image is your
+  policy, not the tool's;
+* anything about a VM you did not attest yourself.
+
+`docs/WHAT_IT_PROVES.md` goes through every check and its limit.
+
+## Install
+
+```
+# verifier machine: Python 3.10+, cryptography, PyJWT
+pip install voltage-verify
+# inside the VM: the NVIDIA SDK first (it pins cryptography and PyJWT), then the tool
+pip install nv-attestation-sdk nvidia-ml-py
+pip install --no-deps voltage-verify
+```
+
+Source and issues: https://github.com/Jabsama/voltage-verify. The same wheel and source
+archive are mirrored with SHA-256 sums at https://voltagegpu.com/blog/two-proofs/voltage-verify/
+for installs that must not touch PyPI (`pip install <wheel URL>`).
+
+## Reference run
+
+`examples/hello-workload/` holds a real bundle captured on 12 September 2026 on a VoltageGPU
+`h100-xlarge` Confidential VM (8x H100, NVIDIA Protected PCIe mode), with its manifest and the
+unedited run log. Replay the verification on your own machine:
+
+```
+voltage-verify verify examples/hello-workload/bundle-8xh100-2026-09-12.json \
+    --challenge ef7f54c160627ee536a02b5e73896ac4b1ac2cdefdb7cfaaf2366a7d33cc8731 --hwmodel GH100 --gpus 8
+voltage-verify selftest examples/hello-workload/bundle-8xh100-2026-09-12.json
+```
+
+Expected: every check `PASS`, platform TCB `UpToDate`, Quoting Enclave `UpToDate`, eight
+`GH100` devices with `measres success`, then six mutations rejected.
+
+## Use
+
+On your machine, describe the workload and generate a challenge:
+
+```
+voltage-verify manifest --image ghcr.io/you/app:1.4.2 --artifact model.safetensors \
+    --statement "inference run for customer X" -o manifest.json
+```
+
+Copy `manifest.json` into the VM (scp), then, as root inside the VM:
+
+```
+sudo -E python -m voltage_verify attest --manifest manifest.json -o bundle.json
+```
+
+Copy `bundle.json` back, then:
+
+```
+voltage-verify verify bundle.json --challenge <the challenge printed by `manifest`>
+voltage-verify selftest bundle.json --challenge <same>
+voltage-verify verify bundle.json --offline      # same checks, from the collateral in the bundle
+```
+
+Exit code 0 means verified, 1 means a required check failed, 2 means the bundle or arguments
+are unusable. `--json` prints the machine-readable report.
+
+## Bundle format
+
+Documented in `docs/BUNDLE_FORMAT.md`. In short: the manifest verbatim, both commitments, the
+raw TDX quote (base64), the NRAS token array as returned by the NVIDIA SDK, NRAS's JWKS and
+Intel's TCB info, QE identity and CRLs as fetched at attestation time, plus a few facts about
+the VM (kernel, driver, `nvidia-smi conf-compute -q`). The verifier trusts none of it: it
+recomputes the commitments from the manifest and checks every signature.
+
+## Development
+
+```
+python -m venv .venv && . .venv/bin/activate
+pip install -e ".[dev]"
+pytest
+ruff check src tests
+```
+
+The tests run offline against real evidence: a TDX quote captured on a VoltageGPU H200 VM on
+4 September 2026, NRAS tokens from 4 and 10 September 2026 (single H200, 8x H100 node in
+NVIDIA Protected PCIe mode), and a snapshot of Intel's collateral and NVIDIA's JWKS.
+
+## Security
+
+See `SECURITY.md`. In one line: report anything that would make `verify` say yes when it
+should say no to contact@voltagegpu.com, and expect an answer within two working days.
+
+## License
+
+MIT. Copyright 2026 VOLTAGE EI (VoltageGPU).

voltage_verify-0.1.0/SECURITY.md

@@ -0,0 +1,32 @@
+# Security policy
+
+`voltage-verify` is a verifier. The bugs that matter are the ones that make it accept
+evidence it should reject: a signature check that can be skipped, a commitment that can be
+recomputed without the hardware noticing, a policy claim that is read but not enforced, a
+collateral document accepted without its signature.
+
+## Reporting
+
+Write to contact@voltagegpu.com with the subject `voltage-verify security`. Include the bundle
+or the minimal input that triggers the behaviour, the version (`voltage-verify --version`) and
+what you expected. You will get a human answer within two working days, a fix or a documented
+limitation within thirty, and credit in the changelog if you want it.
+
+Please do not open a public issue for a bypass before it is fixed.
+
+## Scope
+
+In scope: everything under `src/voltage_verify`, the bundle format, the documented checks in
+`docs/WHAT_IT_PROVES.md`.
+
+Out of scope: the security of Intel TDX or NVIDIA confidential computing themselves, the
+availability of Intel's PCS or NVIDIA's NRAS, and the `attest` command running on a machine
+that is already compromised at the hypervisor level (that is what the hardware proofs detect).
+
+## What the tool pins
+
+* Intel SGX Root CA, by SHA-256 fingerprint, shipped in the package
+  (`src/voltage_verify/data/intel_sgx_root_ca.pem`).
+* NVIDIA NRAS issuer `https://nras.attestation.nvidia.com` and its JWKS, fetched over TLS or
+  embedded in the bundle at attestation time.
+* Accepted JWT algorithms: ES384 and ES256 only. `none`, HMAC and RSA are rejected.

voltage_verify-0.1.0/docs/ATTEST_ON_VM.md

@@ -0,0 +1,62 @@
+# Running `attest` inside a Confidential VM
+
+`attest` needs three things the VM must expose: the TDX guest device and configfs TSM
+(`/sys/kernel/config/tsm/report`), an NVIDIA GPU in confidential-computing mode with the
+driver's attestation support, and outbound HTTPS to NVIDIA (NRAS, OCSP, RIM) and Intel (PCS).
+On a VoltageGPU Confidential VM all three are there at boot.
+
+## One-time setup in the VM
+
+```
+sudo apt-get update
+sudo apt-get install -y python3-venv python3-pip
+python3 -m venv ~/vv
+. ~/vv/bin/activate
+pip install nv-attestation-sdk nvidia-ml-py
+pip install --no-deps voltage-verify
+```
+
+Install the NVIDIA SDK first: it pins `cryptography==43.0.1` and `PyJWT 2.7`, both inside the
+ranges this tool accepts, and pulls the NVIDIA local verifier and `nvidia-ml-py`. The first
+install takes a minute. `pip install "voltage-verify[attest]"` in one step also works, but
+letting pip resolve both at once is slower on the VM than the two commands above. Without
+PyPI access, install the wheel mirrored at
+https://voltagegpu.com/blog/two-proofs/voltage-verify/ with `--no-deps`.
+
+## Multi-GPU nodes (NVIDIA Protected PCIe mode)
+
+On an 8-GPU Hopper node the GPUs run in NVIDIA's multi-GPU *Protected PCIe* mode. `nvidia-smi
+conf-compute -q` shows `CC State: OFF` next to `Multi-GPU Mode: Protected PCIe`; that is the
+normal reading for that mode, not a failure. Two things differ from a single-GPU VM:
+
+* the ready state has to be set once after boot: `sudo nvidia-smi conf-compute -srs 1`;
+* the NVIDIA SDK refuses "standalone" attestation on such a node, so `attest` calls it with
+  `ppcie_mode=False` (this SDK flag means "not standalone"). `--mode auto` picks this when
+  more than one GPU is present.
+
+## Produce the bundle
+
+Copy the manifest your verifier produced, then run as root (TSM needs it):
+
+```
+sudo -E ~/vv/bin/python -m voltage_verify attest --manifest manifest.json -o bundle.json
+```
+
+What happens, in order:
+
+1. the manifest is validated and both commitments are computed;
+2. `report_data = SHA-512(manifest)` is written to a fresh entry under
+   `/sys/kernel/config/tsm/report/`, the quote is read from `outblob` (retry only on
+   `EINVAL`, which signals a concurrent request; any other error stops);
+3. the NVIDIA SDK is called with `nonce = SHA-256(manifest)` against NRAS;
+4. NRAS's JWKS and Intel's TCB info, QE identity and CRLs are fetched and embedded;
+5. `bundle.json` is written. Nothing secret is in it: quote, public tokens, public collateral,
+   and a few `nvidia-smi` lines.
+
+Copy `bundle.json` back to your machine and verify it there. The VM's own opinion of the
+bundle is worth nothing; that is the point.
+
+## Timing and cost
+
+On a single-H200 VM the whole `attest` step takes about one minute after the SDK is installed.
+Release the VM when you have the bundle; the evidence does not depend on the VM staying up.

voltage_verify-0.1.0/docs/BUNDLE_FORMAT.md

@@ -0,0 +1,69 @@
+# Bundle format `voltage-verify-bundle/1`
+
+A bundle is one JSON document. Keys are sorted when written; readers must not rely on order.
+
+```json
+{
+  "format": "voltage-verify-bundle/1",
+  "tool": {"name": "voltage-verify", "version": "0.1.0"},
+  "created_at": "2026-09-12T01:02:03+00:00",
+  "manifest": {
+    "format": "voltage-verify-manifest/1",
+    "created_at": "2026-09-12T00:58:11+00:00",
+    "challenge": "<64 hex chars, chosen by the verifier>",
+    "workload": {
+      "image": {"reference": "ghcr.io/you/app:1.4.2", "digest": "sha256:<64 hex>"},
+      "artifacts": [{"name": "model.safetensors", "sha256": "<64 hex>", "size": 123456}],
+      "extra": {"any": "string"}
+    },
+    "statement": "free text or null"
+  },
+  "commitments": {"sha256": "<64 hex>", "sha512": "<128 hex>"},
+  "tdx": {"quote_b64": "<base64 of the raw quote, padding removed>", "report_data_hex": "<128 hex>"},
+  "nvidia": {
+    "mode": "single-gpu | multi-gpu-ppcie",
+    "nras": [["JWT", "<overall>"], {"REMOTE_GPU_CLAIMS": [["JWT", "<verifier>"], {"GPU-0": "<jwt>"}]}],
+    "jwks": {"keys": [ ... ]}
+  },
+  "collateral": {
+    "intel": {
+      "tcb_info": {"kind": "tcb_info", "body": "<exact PCS response>", "issuer_chain_pem": "<PEM chain>"},
+      "qe_identity": {"kind": "qe_identity", "body": "<exact PCS response>", "issuer_chain_pem": "<PEM chain>"},
+      "pck_crl_pem": "<PEM CRL or null>",
+      "root_crl_der_b64": "<base64 DER CRL or null>",
+      "fetched_at": "2026-09-12T01:02:00+00:00"
+    }
+  },
+  "environment": {"kernel": "...", "gpus": "...", "conf_compute": "..."}
+}
+```
+
+## Commitments
+
+`canonical = JSON(manifest)` with keys sorted by code point, separators `,` and `:` with no
+spaces, UTF-8, non-ASCII characters kept as is, no floats anywhere. This matches RFC 8785 for
+the value types a manifest contains.
+
+* `commitments.sha256 = SHA-256(canonical)`, hex. This is the NVIDIA nonce: the SDK passes it
+  to NRAS, which returns it in the verifier token as `eat_nonce`.
+* `commitments.sha512 = SHA-512(canonical)`, hex. This is the TDX `report_data`: written to
+  the configfs TSM `inblob`, returned verbatim at byte offset 568 of the quote.
+
+A verifier recomputes both from `manifest` and ignores the stored values except to flag a
+mismatch. Everything binding is inside the signed evidence.
+
+## Why the collateral travels with the bundle
+
+Intel's TCB info and QE identity are re-issued regularly and NVIDIA rotates its JWKS keys
+within days. A bundle verified six months later would otherwise fail for reasons unrelated
+to the evidence. The embedded copies are signed by Intel (ECDSA P-256 over the exact response
+body, issuer chain to the pinned Intel SGX Root CA) and by NVIDIA (x5c chain in the JWKS),
+so `verify --offline` still ends at a hardware vendor's key. `verify` without `--offline`
+refetches everything and reports which source it used.
+
+## Compatibility rules
+
+* A reader must reject any `format` it does not know.
+* Fields may be added in later minor formats; unknown fields are ignored.
+* `nras` is stored exactly as the NVIDIA SDK returns it, so any change in the SDK layout
+  shows up as a verification failure rather than a silent reinterpretation.

voltage_verify-0.1.0/docs/WHAT_IT_PROVES.md

@@ -0,0 +1,49 @@
+# What each check proves, and what it does not
+
+`voltage-verify verify` prints one line per check. This page is the honest reading of each.
+
+## Manifest
+
+| Check | Passes when | Proves | Does not prove |
+|---|---|---|---|
+| `manifest.format` | the manifest has the expected shape | the bundle is parseable | anything |
+| `manifest.commitments` | SHA-256 and SHA-512 of the canonical manifest equal the stored values | bookkeeping is consistent | anything: an attacker can recompute them |
+| `manifest.challenge` | the challenge equals the one you passed with `--challenge` | the bundle was made for this session | anything without the TDX and NVIDIA checks below |
+| `manifest.image` | the image digest equals `--image-digest` | the manifest names the image you expect | that the image ran |
+
+## Intel TDX
+
+| Check | Passes when | Proves | Does not prove |
+|---|---|---|---|
+| `tdx.structure` | version 4 quote, TEE type TDX, ECDSA-P256 key, QE report and PCK chain present | it is a TDX quote | anything about its origin |
+| `tdx.report_data` | the quote's 64-byte `report_data` equals `SHA-512(manifest)` | the quote was requested with your manifest hash, so after your challenge | who requested it |
+| `tdx.signatures` | attestation key signs header+report; QE report binds the key; PCK certificate signs the QE report; PCK chain verifies to the pinned Intel SGX Root CA and is within validity | the quote was produced by a genuine Intel TDX Quoting Enclave on Intel-provisioned hardware | that the platform's firmware is current |
+| `tdx.collateral` | TCB info and QE identity carry Intel's signature and chain to the root | the collateral is Intel's | freshness (see `tdx.collateral_fresh`) |
+| `tdx.tcb` | the platform's SVNs (from the PCK certificate and the quote's `tee_tcb_svn`) reach a level Intel rates `UpToDate` or `SWHardeningNeeded`; the TDX module identity matches; the Quoting Enclave identity matches and is `UpToDate` | the platform is patched to a level Intel accepts | that no unknown vulnerability exists |
+| `tdx.revocation` | the PCK certificate and its CA are absent from Intel's CRLs | Intel has not revoked this platform's provisioning identity | anything if CRLs are missing (then the line says NOT checked) |
+
+The quote's `MRTD` and `RTMR0..3` are printed as facts. They measure the VM's initial state
+and boot chain. This tool does not compare them to a reference: whether a given `MRTD` is the
+image you expect is a policy decision that belongs to you.
+
+## NVIDIA
+
+| Check | Passes when | Proves | Does not prove |
+|---|---|---|---|
+| `nvidia.jwks` | a JWKS is available (live or embedded) | keys can be looked up | anything |
+| `nvidia.signatures` | the verifier token and every device token verify (ES384) with a key from NVIDIA's JWKS, issuer is NRAS | NVIDIA issued these claims | when, until `nvidia.freshness` |
+| `nvidia.nonce` | `eat_nonce` equals `SHA-256(manifest)` | the claims were issued for your manifest hash, after your challenge | which VM: the TDX side does that |
+| `nvidia.policy` | overall result true; every GPU: `measres` success, `secboot` true, `dbgstat` disabled, nonce matched, report signature verified, certificate chain validated; optional `--hwmodel` and `--gpus` | NVIDIA's service accepted the GPU's measurements and configuration | that the GPU executed your workload |
+| `nvidia.freshness` | the verifier token's `iat` is within 15 minutes of the bundle's `created_at` | the token belongs to this attestation session | anything if the VM clock is wrong (the check then fails, which is the safe direction) |
+
+On a multi-GPU node in NVIDIA Protected PCIe mode, the GPUs are attested as a set through the
+same flow (`nvidia.mode = multi-gpu-ppcie`). NVSwitch attestation is not part of the bundle.
+
+## The gap this tool does not close
+
+Both proofs are bound to a description of the workload. Neither proof says that the
+described image or model was what the GPU computed on. Closing that gap requires a measured
+launch: a component inside the VM that measures the container image and the model before
+starting them and extends a TDX runtime measurement (`RTMR`) with the result, so that the
+quote itself carries the measurement. The Confidential Containers project (Kata + Trustee)
+and similar stacks do this. `voltage-verify` stops one step earlier on purpose, and says so.