{"id":18335804,"url":"https://github.com/evervault/attestation-doc-validation","last_synced_at":"2026-03-17T20:32:53.621Z","repository":{"id":65605487,"uuid":"557231888","full_name":"evervault/attestation-doc-validation","owner":"evervault","description":"A rust crate for validating attestation documents provided by Trusted Execution Environments. Current support is limited to AWS Nitro Enclaves.","archived":false,"fork":false,"pushed_at":"2024-10-28T14:16:30.000Z","size":4645,"stargazers_count":7,"open_issues_count":13,"forks_count":3,"subscribers_count":5,"default_branch":"main","last_synced_at":"2024-11-01T12:36:15.657Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/evervault.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-10-25T10:10:39.000Z","updated_at":"2024-09-04T17:32:29.000Z","dependencies_parsed_at":"2023-02-23T13:30:29.076Z","dependency_job_id":"68152c3e-9bab-4e17-970c-21a501e18901","html_url":"https://github.com/evervault/attestation-doc-validation","commit_stats":{"total_commits":118,"total_committers":11,"mean_commits":"10.727272727272727","dds":0.6186440677966102,"last_synced_commit":"4cdfd0ddc4659b625ec5230cfa793ee7fffa70c8"},"previous_names":[],"tags_count":34,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/evervault%2Fattestation-doc-validation","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/evervault%2Fattestation-doc-validation/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/evervault%2Fattestation-doc-validation/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/evervault%2Fattestation-doc-validation/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/evervault","download_url":"https://codeload.github.com/evervault/attestation-doc-validation/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":223238117,"owners_count":17111359,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-05T20:04:50.825Z","updated_at":"2026-03-17T20:32:53.576Z","avatar_url":"https://github.com/evervault.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Attestation Doc Validation\n\nThis repo contains several projects relating to the Remote Attestation Protocol used by Evervault Enclaves.\n\n- You can read more about the attestation protocol [here](https://docs.evervault.com/security/enclaves-attestation-in-tls).\n- [attestation-doc-validation](./attestation-doc-validation/) contains a rust crate which implements the core logic required for attesting an Enclave (validating certs, and attestation docs)\n- [node-attestation-bindings](./node-attestation-bindings/) contains an npm module which creates bindings for consuming the rust crate from node clients\n\n**Note: This crate cannot validate Attestation Documents which use p521r1.**\n\n## Getting Started\n\nTo get up and running with this project you'll need `rust`, `node`, `clippy`, `rustfmt`, and `cargo-make` installed.\n\nThere is more setup required to work with the python bindings. Please see the [python setup guide](#python-setup-guide) for details.\n\n## Python Setup Guide\n\nThe python project requires [maturin](https://github.com/PyO3/maturin).\n\nThe python project requires the use of virtual environments. To get started, create a virtual env in the `python-attestation-bindings` directory:\n\n```sh\ncd python-attestation-bindings ; python -m venv ./venv\n```\n\nActivate the virtual environment:\n\n```sh\nsource ./venv/bin/activate\n```\n\nYou can then run a python repl in the venv. First, build the python wheel:\n\n```sh\nmaturin develop\n```\n\nThen start a repl:\n\n```sh\npython\n```\n\nAnd import the project:\n\n```python\nimport python_attestation_bindings\n\npcrs = python_attestation_bindings.PCRs(\"\u003cpcr0\u003e\",\"\u003cpcr1\u003e\",\"\u003cpcr2\u003e\",\"\u003cpcr8\u003e\")\npython_attestation_bindings.attest_connection(\u003ccert\u003e, pcrs)\n```\n\nTo run tests \n```sh\nmaturin develop \u0026\u0026 pytest\n```\n\n## Wasm Setup Guide\n\nThe WASM project requires [wasm-pack](https://rustwasm.github.io/wasm-pack/).\n\nTo build the WASM bindings, you can run the following command:\n\n```sh\nwasm-pack build ./wasm-attestation-bindings -s evervault --out-name index --release --target=web\n```\n\nThis will:\n- Build the wasm lib, with the output going into `./wasm-attestation-bindings/pkg`\n- Sets the `scope` of the output JS package as `@evervault` (so the full name as `@evervault/wasm-attestation-bindings`)\n- Use `index` as the base for each file name e.g. `index.js`, `index_bg.js`, `index_bg.wasm` etc.\n- Sets the build to be a release build, targetting the web as its platform.\n\n### Compiling WASM on Mac\n\nIt's not possible to compile the wasm bindings on Mac using the version of Clang shipped in MacOS. \nOne approach to get around this is to install LLVM from homebrew, and set it as your C-Compiler using the `TARGET_CC` env var:\n\n```sh\nTARGET_CC=\"/opt/homebrew/opt/llvm/bin/clang\" wasm-pack build ./wasm-attestation-bindings -s evervault --out-name index --release --target=web\n```\n\n### A Note on Attesting from Web Browsers\n\nThe process of attesting an Enclave involves validating the attestation document structure, its signature, the embedded PCRs, and, *crucially* that it contains the public key of the current TLS\ncertificate as its challenge — this final step allows us to confidently assert that the TLS connection is being terminated by the Enclave, \nand acts as a bind between the code integrity of the attestation document, and the host identity of the TLS certificate.\n\nThe attestation process is slightly hindered when performed in a web browser. Web browsers do not expose any details of the remote server's TLS certificate to the client. This makes it impossible to perform our full attestation process as we cannot check that the TLS public key is in the returned attestation document. \n\nThis changes the trust model drastically, and should be deeply considered if integrating.\n\n## Makefile\n\nEach project has some useful tasks defined in their `Makefile.toml`:\n\n### Build the Project\n\n```sh\ncargo make build\n```\n\n### Run tests\n\n```sh\ncargo make test\n```\n\n### Format\n\n```sh\ncargo make format\n```\n\n### Run Clippy\n\n```sh\ncargo make lint\n```\n\n## Additional Notes\n\n- This project uses pedantic clippy, so please [run clippy](#run-clippy) before committing.\n- Due to the time sensitive nature of the attestation documents and their signatures, some tests require the use of libfaketime.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fevervault%2Fattestation-doc-validation","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fevervault%2Fattestation-doc-validation","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fevervault%2Fattestation-doc-validation/lists"}