Testing Strategies

Testing within the Tinfoil Verifier project is structured to ensure the integrity of remote attestation, secure client communications, and hardware measurement validation. The strategy encompasses unit tests for core logic, integration tests for end-to-end enclave communication, and specialized validation for hardware-rooted security features like AMD SEV-SNP and Intel TDX.

The project utilizes standard Go testing frameworks and the testify library for assertions. Tests are categorized into isolated unit tests (e.g., configuration parsing), cryptographic validation (e.g., attestation report verification), and environmental integration tests that require live enclave connections.

Unit Testing and Logic Validation

Unit tests focus on validating the internal logic of the verifier without requiring external network calls or hardware access. This includes parsing configuration strings, comparing measurement registers, and validating fingerprinting logic.

Measurement Comparison Logic

The system must accurately compare runtime measurements against expected source measurements. Tests validate that different platform measurements (SEV-SNP vs. TDX) are correctly equated when using multi-platform formats.

The diagram above illustrates the logic tested in TestMeasurementEquals, where various platform measurement types are compared for equality.
Sources: attestation/attestation_test.go:11-63

Configuration and Hardware Validation

Testing also covers the validation of version constraints and hardware platform matching. This ensures that the verifier only accepts authorized versions of software and hardware.

Sources: config/config_test.go:9-23, attestation/hardware_test.go:10-82, attestation/attestation_test.go:121-177

Integration Testing

Integration tests verify the interaction between the SecureClient and remote enclaves. These tests often depend on environment variables and live network infrastructure.

Enclave Connectivity and Attestation

Tests in client_test.go and integration_test.go verify that a SecureClient can successfully perform a full attestation flow with real enclaves.

This flow represents the end-to-end verification process tested in TestVerify and TestBasicChatCompletion.
Sources: client/client_test.go:11-30, client/integration_test.go:56-100

External Dependency Testing

The testing suite includes specific checks for external integrations with GitHub and Sigstore to ensure that code provenance and hardware measurements can be retrieved and verified.

• GitHub Integration: Tests verify the retrieval of release digests and attestation bundles from GitHub repositories.
• Sigstore Integration: Validates the signature verification of bundles and the fetching of hardware measurements.

Sources: github/github_test.go:9-30, sigstore/sigstore_test.go:12-70

Specialized Attestation Tests

The project includes tests that use hardcoded attestation documents to verify the parsing and validation logic for specific hardware platforms (AMD SEV-SNP and Intel TDX).

Guest Verification

The TestGuestVerify function uses base64-encoded, GZIP-compressed attestation reports to ensure the verifier correctly extracts the TLS public key fingerprint and HPKE public key from both SEV-SNP and TDX reports.
Sources: attestation/attestation_test.go:65-103

ATC (Air Traffic Control) Bundles

The verifier supports a "bundled" verification flow where all necessary data (attestation, VCEK, Sigstore bundle) is fetched in a single request from an ATC service. Testing ensures that the SecureClient can process these JSON bundles.
Sources: client/client_test.go:95-156

Summary

The testing strategy for the Tinfoil Verifier project ensures that every step of the remote attestation process—from hardware-rooted report validation to high-level HTTP client integration—is verified. By combining unit tests for logic, mock-data tests for cryptographic parsing, and environment-dependent integration tests, the project maintains a high degree of confidence in its security guarantees.