Secure HTTP Client

The Secure HTTP Client is a specialized wrapper around the standard Go net/http library designed to provide hardware-rooted remote attestation and TLS pinning for enclave-backed services. It ensures that outgoing requests are only dispatched to verified environments by binding the verification of AMD SEV-SNP or Intel TDX enclaves to the underlying TLS connection.

The client automates the complex flow of fetching runtime attestations, verifying signature chains, and comparing measurements against code provenance data from Sigstore. This creates a transparent security layer where the first request triggers an attestation gate, and subsequent communications are restricted to the validated enclave.
Sources: README.md:1-20, client/client.go:13-35

Architecture and Components

The SecureClient acts as the primary orchestrator for the verification and communication lifecycle. It maintains the state of the "Ground Truth," which includes verified measurements and public key fingerprints.

Key Data Structures

The client relies on two primary structures to manage state and identity:

Sources: client/client.go:16-35

Verification Logic Flow

The following diagram illustrates the internal process when Verify() is invoked:

Attestation and Verification

The Secure HTTP Client implements multiple layers of verification to ensure the integrity of the remote service.

Multi-Platform Verification

The system supports both AMD SEV-SNP and Intel TDX platforms. It utilizes platform-specific logic to validate the hardware report against the Intel or AMD root of trust.
Sources: attestation/attestation.go:275-285, README.md:38-44

Measurement Comparison

Verification is completed by comparing the runtime measurements (registers like MRTD or SNP measurements) against the source measurements retrieved from Sigstore.

func (s *SecureClient) Verify() (*GroundTruth, error) {
    // ... logic to fetch codeMeasurement and enclaveVerification ...
    if err = codeMeasurement.Equals(enclaveVerification.Measurement); err != nil {
        return nil, fmt.Errorf("measurements: %v", err)
    }
    // ... fingerprinting and state storage ...
}

Sources: client/client.go:183-185, attestation/attestation.go:121-177

TLS Pinning

Once an enclave is verified, its TLS public key fingerprint is extracted from the attestation report data. The SecureClient uses a TLSBoundRoundTripper to ensure the actual TLS certificate used by the server matches this verified fingerprint.
Sources: client/client.go:283-294, attestation/attestation.go:235-245

Core API and Usage

The client provides high-level methods that handle the verification gate automatically.

Initialization Methods

• NewSecureClient(enclave, repo string): Standard initialization using an enclave hostname and a GitHub repository for source verification.
• NewDefaultClient(): Attempts to fetch a list of routers from a central service (atc.tinfoil.sh) and returns the first one that passes verification.
• NewPinnedSecureClient(...): Used for environments where measurements are pre-known and do not require GitHub/Sigstore lookup.

Sources: client/client.go:67-115

Request Lifecycle

When a request is made via Get or Post, the client checks if verification has occurred. If not, it triggers the full Verify() flow before initializing the http.Client with the TLSBoundRoundTripper.

Summary

The Secure HTTP Client serves as the bridge between standard web protocols and hardware-enforced security. By integrating Sigstore-based code provenance with hardware-rooted remote attestation, it provides a cryptographically verifiable channel to confidential computing environments. The implementation ensures that developers can interact with secure enclaves using familiar HTTP patterns while maintaining rigorous security guarantees.
Sources: README.md:5-15, client/client.go:142-205