mirror of
https://github.com/luxfi/mpc.git
synced 2026-09-24 00:26:24 +00:00
zeekay
a80c75b0c6
TDX.Verify and NRAS.Verify panicked when reached during stage 1 of issue #222, taking the whole MPC process down whenever Dispatch was called from a request-handling goroutine. The fail-loud guarantee is preserved by returning ErrNotImplemented (a hard refusal — callers must not paper over it) so the release gate still refuses, but the process survives. Updates verifier_test.go's stub coverage from TestStubsPanic to TestStubsReturnNotImplemented and adds Dispatch-path coverage for the same behaviour.
49 lines
1.9 KiB
Go
49 lines
1.9 KiB
Go
// Copyright (c) 2026, Lux Industries Inc.
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
package attest
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
)
|
|
|
|
// NRAS is the NVIDIA Remote Attestation Service verifier.
|
|
//
|
|
// Status: STUB — tracked at issue #222 stage 3.
|
|
//
|
|
// Production plan (intentionally not yet implemented):
|
|
//
|
|
// - Parse the NRAS-signed JWT (RFC 7519) carrying the GPU device-state
|
|
// report.
|
|
// - Validate the JWS signature against the NRAS signing key fetched
|
|
// from the NRAS JWKS endpoint, with a TTL'd cache and a force-rotate
|
|
// hook for emergency key rotation.
|
|
// - Verify the EAT/JWT claims: nbf, exp, nonce binding, audience.
|
|
// - Cross-check the embedded device-state report against the RIM
|
|
// (Reference Integrity Manifest) for the asserted driver+VBIOS pair
|
|
// (see pkg/attestation/nvidia/rim.go for the existing RIM type).
|
|
// - Extract the per-GPU UUID, driver version, VBIOS version, and the
|
|
// per-GPU measurement digest.
|
|
// - Compose CompositeHash via the same domain-separated SHA-256 as
|
|
// the SEV path.
|
|
//
|
|
// pkg/attestation/nvidia already implements NRAS request/response shaping
|
|
// and JWT signature verification against a caller-supplied trust root.
|
|
// Stage 3 lifts that into the cc/attest contract: a single Verify(ctx,
|
|
// evidence, opts...) entry point with an internal JWKS cache and the
|
|
// canonical VerifiedReport output shape.
|
|
//
|
|
// Verify returns ErrNotImplemented so the call site refuses the release
|
|
// without crashing the process. See TDX.Verify for the rationale.
|
|
type NRAS struct{}
|
|
|
|
// Verify implements Verifier. NOT YET IMPLEMENTED — do not enable NRAS
|
|
// dispatch in production until #222 stage 3 lands.
|
|
func (NRAS) Verify(ctx context.Context, evidence []byte, opts ...Option) (*VerifiedReport, error) {
|
|
return nil, fmt.Errorf("%w: NRAS attestation envelope verification not configured for this build (tracked at #222 stage 3: NRAS JWT + JWKS cache)",
|
|
ErrNotImplemented)
|
|
}
|
|
|
|
var _ Verifier = NRAS{}
|