Build Process

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• wasm/main.go
• attestation/tdx.go
• attestation/sev.go
• attestation/collateral/fetch.sh
• examples/verifier/main.go
• examples/client/main.go
• client/enclave_wasm.go

The build process for the Tinfoil Verifier project encompasses multiple target environments, including standard Go binaries, WebAssembly (WASM) for browser integration, and Swift bindings for mobile platforms. It relies heavily on Go's code generation (go:generate) and embedding (go:embed) features to bundle critical security artifacts, such as root certificates and hardware-specific collateral, directly into the resulting binaries.

Key components of the build include the retrieval of hardware-rooted trust anchors for AMD SEV-SNP and Intel TDX, the compilation of the Go logic into a portable WASM module, and the automation provided by GitHub Actions to ensure integrity and secure distribution.

Sources: README.md:10-20, README.md:95-105

Cross-Platform Build Targets

The project is designed to support multiple platforms through conditional compilation and specific build tags.

WebAssembly (WASM) Build

The WASM build target allows the verification logic to run in browser or Node.js environments. The build process for WASM involves:

1. Environment Setup: Copying the standard Go WASM execution script (wasm_exec.js) from the Go GOROOT.
2. Resource Embedding: Fetching and embedding the trusted_root.json file which contains the Sigstore trust anchors.
3. Compilation: Setting build tags js,wasm to include WASM-specific logic (e.g., using the native JavaScript fetch API via the syscall/js package).

Sources: wasm/main.go:12-19, util/fetch_wasm.go:1-10, client/enclave_wasm.go:1-5

Mobile and Native Bindings

The project supports Swift bindings via gomobile for iOS and macOS integration. This allows the core Go verification library to be utilized within native Apple ecosystem applications.

Sources: README.md:21-21

Automated Resource Retrieval

A significant portion of the build process involves go:generate directives that execute scripts or Go programs to fetch external dependencies before compilation.

Resource	Source	Purpose
trusted_root.json	Sigstore TUF / rootfetch	Hardware/Sigstore trust anchors
genoa_cert_chain.pem	AMD KDS	VCEK certificate chain for SEV-SNP
sgx_root_ca.pem	Intel	Root CA for TDX attestation
TDX Collateral	Intel PCS	QE Identity, CRLs, and TCB Info

Sources: wasm/main.go:18-20, attestation/sev.go:21-23, attestation/tdx.go:22-24, attestation/tdx.go:26-44

Intel TDX Collateral Fetching

For Intel TDX verification, the build process requires specific collateral from the Intel Provisioning Certification Service (PCS). This is handled by a shell script that retrieves:

• QE Identity: Validates the Quoting Enclave.
• CRL (Certificate Revocation Lists): For both Processor and Platform CAs.
• TCB Info: For specific FMSPCs (Family-Model-Stepping-Platform-Custom ID).

Continuous Integration and Deployment

GitHub Actions workflows automate the build and release cycle. When new versions are tagged, the workflow performs the following steps:

1. Compilation: Compiles Go verification logic to tinfoil-verifier.wasm.
2. Versioning: Generates versioned WASM files with integrity guarantees (setting the version variable in main.go).
3. Deployment: Deploys the artifacts to GitHub Pages for distribution.
4. Tagging: Updates version tags so clients (like the JS SDK) load the correct module.

Sources: README.md:95-103, wasm/main.go:16-16

Build Security and Integrity

The build process includes several checks to maintain the security of the verifier:

• TCB Evaluation Data Check: During initialization, the code validates that embedded Intel collateral meets a MinimumTcbEvaluationDataNumber (currently 18). If the embedded collateral is older than this value, the program will panic, preventing the build from producing an insecure verifier.
• Sigstore Integration: The build process fetches the Sigstore trust root, which is used at runtime to verify code provenance and measurements against GitHub Attestations.
• Trusted Root Generation: go:generate go run ../rootfetch/main.go is used to update the local trusted_root.json from the Sigstore TUF repository.

Sources: attestation/tdx.go:56-60, attestation/tdx.go:102-132, examples/client/main.go:3-3, wasm/main.go:18-18

Summary

The Tinfoil Verifier build process is a sophisticated pipeline that transitions from cloud-based trust anchors to embedded hardware collateral. By leveraging Go's build system and GitHub Actions, it produces platform-specific artifacts (Go binaries, WASM, and Swift frameworks) that carry the necessary cryptographic material to perform remote attestation without external dependencies at runtime.

Sources: README.md:12-15, README.md:95-105