WASM Verifier Logic

Relevant source files

The following files were used as context for generating this wiki page:

• wasm/main.go
• util/fetch_wasm.go
• client/enclave_wasm.go
• wasm/index.html
• README.md
• attestation/attestation.go

The WASM Verifier Logic enables hardware-rooted remote attestation verification to run natively within web browsers and Node.js environments. It serves as a bridge between the core Go-based verification library and JavaScript-based client applications, allowing users to verify the integrity of remote enclaves (AMD SEV-SNP and Intel TDX) directly from their client-side interface.

The system is compiled from Go source code into a WebAssembly (WASM) module. It provides a set of asynchronous functions exposed to the JavaScript global scope, facilitating operations such as fetching attestation documents, verifying code provenance via Sigstore, and performing end-to-end enclave validation.

Sources: README.md:104-106, wasm/main.go:138-144

Architecture and Component Overview

The WASM implementation relies on the Go syscall/js package to interact with the browser's environment. It wraps core library functions into JavaScript-compatible promises.

Core WASM Functions

The following table describes the primary functions exposed to the JavaScript environment:

Function	Purpose	Logic Derived From
verify(enclave, repo)	Performs full end-to-end verification of an enclave and its code.	client.VerifyJSON
verifyEnclave(hostname)	Fetches and verifies the hardware attestation document from a specific host.	attestation.VerifyAttestationJSON
verifyCode(repo, digest)	Fetches a Sigstore bundle and verifies code provenance for a repository.	sigstore.VerifyAttestation

Sources: wasm/main.go:138-142, wasm/main.go:88-136

Data Flow for Browser Verification

The following diagram illustrates the high-level flow when a browser-side application initiates verification using the WASM module.

The flow starts with a JS call to the exported WASM function, which then handles network requests and cryptographic validation internally before returning a JSON result.

Sources: wasm/main.go:119-136, wasm/index.html:314-338

Implementation Details

JavaScript Interop and Networking

Because standard Go networking (like http.Get) may not behave as expected in all WASM environments (e.g., standard tls.Dial is disabled), the project uses a specialized fetch utility.

• Utility Fetching: The util.Get function for WASM utilizes the native JavaScript fetch API to handle binary data and headers correctly. It converts JavaScript ArrayBuffer results into Go []byte slices using js.CopyBytesToGo.
• Promise Handling: An internal awaitPromise helper manages the asynchronous nature of JavaScript promises, using Go channels (resultChan, errorChan) to block until the JS promise resolves or rejects.
• Security Restrictions: In WASM builds, direct TLS certificate validation (enclaveValidPubKey) is explicitly disabled because the tls package's low-level socket access is unavailable in the browser sandbox.

Sources: util/fetch_wasm.go:12-46, util/fetch_wasm.go:53-81, client/enclave_wasm.go:12-15

Verification Logic Breakdown

The WASM module encapsulates three distinct verification pathways:

1. Enclave Verification (verifyEnclave):
   • Constructs a URL pointing to /.well-known/tinfoil-attestation.
   • Retrieves the JSON attestation document.
   • Calls attestation.VerifyAttestationJSON to validate hardware signatures.
   • Returns a map containing the TLS public key fingerprint and HPKE public key.
2. Code Verification (verifyCode):
   • Connects to gh-attestation-proxy.tinfoil.sh.
   • Retrieves the attestation bundle for a specific repository and digest.
   • Uses a bundled trusted_root.json to verify the Sigstore signature.
3. Unified Verification (verify):
   • Combines both hardware and code verification into a single "Ground Truth" object.

Sources: wasm/main.go:88-117, wasm/main.go:41-86, wasm/main.go:119-136

Integration and Usage

Loading the Module

To use the verifier in a web page, the Go WASM runtime (wasm_exec.js) must be included. The module is instantiated via WebAssembly.instantiateStreaming.

The module sets global variables like verify and verifierVersion upon successful execution of its main function.

Sources: wasm/index.html:289-301, wasm/main.go:138-144

Data Models

Verification results are returned to JavaScript as JSON strings or JS objects.

Field	Type	Description
tls_public_key	String	Hex-encoded fingerprint of the enclave's TLS certificate.
hpke_public_key	String	Hex-encoded public key for Encrypted HTTP Body Protocol (EHBP).
measurement	String	JSON-encoded hardware measurement registers (RTMRs/Measurement).

Sources: wasm/main.go:108-113, attestation/attestation.go:94-98

Conclusion

The WASM Verifier Logic provides a secure, client-side implementation of remote attestation. By leveraging Go's cross-compilation capabilities and wrapping the core logic in JavaScript Promises, it enables web applications to verify confidential computing environments without relying on a centralized, trusted intermediary for the final verification step.

Sources: README.md:104-108, wasm/main.go:119-136