zeekay adf365df9a feat(attest): genesis leaf module — one attestation verifier, orthogonal Kinds ...

Extract the canonical vendor-neutral attestation verifier out of luxfi/mpc
into its own orthogonal leaf module github.com/luxfi/cc so the MPC custody
system, the TEE custody extension, and the confidential-AI / proof-of-AI
system can all depend on ONE verifier and the verifier depends on none of
their domains.

- attest: Verifier interface, VerifiedReport, Option, Dispatch.
  KindSEVSNP (PROD, go-sev-guest + AMD KDS), KindTDX (fail-loud stub),
  KindNVTrust (NEW, PROD local-RIM mode).
- attest/nvidia: GPU evidence parser, signed-RIM verifier + measurement
  matcher, NRAS remote JWS client (moved verbatim from mpc/pkg/attestation/
  nvidia — clean stdlib-only leaf).
- KindNVTrust replaces the former KindNRAS stub with a real, cloud-free
  verify: parse GPU evidence, verify the NVIDIA-signed RIM against an
  operator-pinned key, match every measurement to the signed golden value.
  No insecure mode; empty RIM/roots is refused.

Leaf builds + tests green standalone (GOWORK=off).

2026-06-27 12:11:46 -07:00

1.2 KiB

Raw Permalink History

View Raw