Bundled Verification (ATC)
Relevant source files
The following files were used as context for generating this wiki page:
Bundled Verification, facilitated by Tinfoil ATC (Air-Traffic-Control), is an optimized remote attestation flow that aggregates all necessary verification data into a single request. This mechanism allows a client to verify the integrity of an enclave-backed service by fetching a pre-aggregated bundle containing hardware attestation reports, software provenance data, and cryptographic identity materials.
Sources: README.md:113-115, client/client.go:175-177
By using a bundle, the client avoids multiple round-trips to various services like GitHub, AMD Key Delivery Service (KDS), or Sigstore's transparency logs. The client performs the cryptographic verification locally using the components provided in the bundle to establish "Ground Truth" for the enclave connection.
Sources: README.md:117-119, client/client.go:180-218
Architecture and Data Flow
The Bundled Verification flow streamlines the process where the client traditionally interacts with several third-party trust roots. Instead, the ATC service acts as an aggregator.
Verification Sequence
The following diagram illustrates how the client utilizes the ATC bundle to perform verification in a single logic flow.
The client fetches a bundle from an ATC endpoint, decodes the embedded AMD SEV-SNP VCEK certificate, and validates the hardware report against the software measurements found in the Sigstore bundle.
Sources: README.md:83-91, client/client.go:277-285, attestation/attestation.go:237-248
Data Structures
The Attestation Bundle
The Bundle struct is the core data container for this feature. It encapsulates all cryptographic proof required for standalone verification.
| Field | Type | Description |
|---|---|---|
Domain | string | The enclave hostname (e.g., inference.tinfoil.sh). |
EnclaveAttestationReport | *Document | The raw hardware attestation report (SNP/TDX). |
Digest | string | The expected software artifact digest (SHA-256). |
SigstoreBundle | json.RawMessage | Software provenance and signing data. |
VCEK | string | Base64 DER encoded AMD Versioned Chip Endorsement Key. |
EnclaveCert | string | The enclave-generated TLS certificate. |
Sources: attestation/attestation.go:193-200, client/client.go:204-207
Ground Truth
Upon successful verification of a bundle, the client generates a GroundTruth object which is used to pin the session.
Sources: client/client.go:21-32
Implementation Logic
The implementation focuses on the SecureClient and its ability to process bundles via the VerifyFromBundle method.
Single-Request API Methods
The library provides several entry points for bundled verification:
VerifyFromATCJSON(repo, trustedRoot): Fetches from the defaulthttps://atc.tinfoil.shendpoint.VerifyFromATCURLJSON(url, repo, trustedRoot): Allows specifying a custom bundle proxy or ATC instance.VerifyFromBundleJSON(json, repo, trustedRoot): Processes a bundle that has already been fetched by the caller.
Sources: client/client.go:303-333, client/client_test.go:132-155
Hardware Verification (AMD SEV-SNP)
Bundled verification currently emphasizes AMD SEV-SNP support. The client decodes the VCEK provided in the bundle and passes it to the SEV verification logic, bypassing the need to fetch it from AMD's KDS.
// From client/client.go:189-195
vcekDER, err := base64.StdEncoding.DecodeString(bundle.VCEK)
if err != nil {
return nil, fmt.Errorf("verifyEnclave: failed to decode VCEK certificate: %v", err)
}
enclaveVerification, err := bundle.EnclaveAttestationReport.VerifyWithVCEK(vcekDER)
Sources: client/client.go:189-195, attestation/sev.go:73-86
Provenance and Measurement Comparison
The client extracts the SigstoreBundle and uses a sigstore.Client to verify that the software measurements (RTMRs for TDX or Measurement for SNP) match the "known good" measurements recorded during the build process on GitHub Actions.
Configuration and Defaults
The system uses specific default endpoints for ATC operations.
| Constant | Value | Description |
|---|---|---|
defaultRouterURL | https://atc.tinfoil.sh/routers | Endpoint to discover available enclave routers. |
defaultATCBaseURL | https://atc.tinfoil.sh | Base URL for fetching attestation bundles. |
attestationEndpoint | /.well-known/tinfoil-attestation | Standard path for fetching enclave reports. |
Sources: client/client.go:42-44, attestation/attestation.go:232, attestation/attestation.go:35
Conclusion
Bundled Verification (ATC) significantly reduces the latency and complexity of remote attestation. By aggregating hardware reports (SNP/TDX), VCEK certificates, and Sigstore provenance data into a single Bundle, the eval-verifier library enables high-performance secure connections to confidential enclaves with a single network request to the ATC service.
Sources: README.md:113-116, client/client.go:175-179