augmentev-verify: command-line offline verifier for Linux ========================================================= The same verification code as the browser verifier (augmentev-verify.html), built as a static binary for Linux. It gives the same results and the same problem codes as the page on the same inputs. It opens no network connections: every input is a file you supply. Files (each listed in SHA256SUMS): augmentev-verify-linux-x86_64 64-bit Intel/AMD augmentev-verify-linux-aarch64 64-bit ARM Both are statically linked and need no libraries. 1. Install ---------- On any machine, download the binary for your architecture, SHA256SUMS and the three pins (pins/expected-td.json, pins/intel-collateral.json, pins/sigsum-generic-2025-1.policy) from https://augmentev.com/verifier/. Then check them and make the binary executable: sha256sum --ignore-missing -c SHA256SUMS chmod +x augmentev-verify-linux-x86_64 ./augmentev-verify-linux-x86_64 --help SHA256SUMS is only as trustworthy as where you got it. Compare its own SHA-256 with the value we give you out of band. pins/README.txt explains how to check each pin without trusting us. 2. Fetch the evidence (the only step that uses the network) ----------------------------------------------------------- API=https://api.augmentev.ai/v1/attestation curl -fsS $API/live-key -o live-key.json KID=$(python3 -c 'import json,hashlib; print(hashlib.sha256(bytes.fromhex(json.load(open("live-key.json"))["public_key_hex"])).hexdigest())') curl -fsS $API/live-keys/$KID/receipt -o receipt.json curl -fsS $API/live-keys/$KID/log-evidence -o log-evidence.json curl -fsS $API/live-keys/$KID/timestamp -o stamp.json python3 -c 'import json; print(json.load(open("receipt.json"))["public_key_hex"], end="")' > key.hex Copy these files and the binary to the machine you verify on. It can be disconnected from any network. 3. Verify (offline) ------------------- V=./augmentev-verify-linux-x86_64 P="--snapshot pins/intel-collateral.json --expected pins/expected-td.json" # Level 2: Intel's root attests the key was generated and held in a TDX # trust domain with the measurements you pinned. $V key-receipt receipt.json --key key.hex $P # RESULT: VALID # Log evidence: that receipt was in public Sigsum logs (and Rekor) before # the key signed anything. $V log-evidence receipt.json --evidence log-evidence.json # RESULT: VALID # RFC 3161 timestamps over the exact receipt bytes. $V timestamp receipt.json --stamp stamp.json # RESULT: VALID key.hex comes from the receipt itself. That is safe here only because key-receipt checks that Intel's quote binds exactly this key to the trust domain you pinned. The pin is the trust domain, not the key. Add --json to any command for machine-readable output. 4. See it fail (tamper checks) ------------------------------ Each of these must print RESULT: INVALID and exit with status 1. # One bit of the Intel-signed quote flipped [QUOTE_INVALID] python3 -c 'import json; r=json.load(open("receipt.json")); q=bytearray.fromhex(r["quote_hex"]); q[600]^=1; r["quote_hex"]=q.hex(); json.dump(r,open("t-quote.json","w"))' $V key-receipt t-quote.json --key key.hex $P # Deployment manifest hash swapped in the event log [EVENT_LOG_MISMATCH] python3 -c 'import json; r=json.load(open("receipt.json")); [e.update(event_payload="00"*32) for e in r["event_log"] if e["event"]=="compose-hash"]; json.dump(r,open("t-manifest.json","w"))' $V key-receipt t-manifest.json --key key.hex $P # Genuine quote, checked against a different deployment [MEASUREMENT_MISMATCH] python3 -c 'import json; e=json.load(open("pins/expected-td.json")); e["compose_hash"]="ab"*32; e["mr_config_id"]="01"+"ab"*32+"0"*30; json.dump(e,open("t-other-td.json","w"))' $V key-receipt receipt.json --key key.hex --snapshot pins/intel-collateral.json --expected t-other-td.json # Someone else's signing key presented as ours [EMBEDDED_KEY_MISMATCH] python3 -c 'import os; print(os.urandom(1952).hex(), end="")' > t-other-key.hex $V key-receipt receipt.json --key t-other-key.hex $P # Receipt edited after logging [SIGSUM] python3 -c 'import json; r=json.load(open("receipt.json")); r["issued_at"]=r["issued_at"][:-2]+("1Z" if r["issued_at"][-2]!="1" else "2Z"); json.dump(r,open("t-edited.json","w"))' $V log-evidence t-edited.json --evidence log-evidence.json Intel's collateral is evaluated at your computer's clock. After the date shown as "Intel collateral valid until", key-receipt reports COLLATERAL_EXPIRED; download a newer pins/intel-collateral.json. 5. Exit status -------------- 0 valid 1 invalid (the problem codes say why) 2 refused or usage error (missing or wrong pin, unknown format) 6. What a valid result proves, and what it does not --------------------------------------------------- A valid key receipt proves that a genuine Intel TDX trust domain, with the measurements you pinned, generated and held our live signing key. Valid log evidence proves that receipt was public before the key signed anything. It does not prove what the software computed. It says nothing about GPUs or any machine other than the attested one. It cannot see revocations Intel published after the collateral's date. It also does not prove that we cannot access that machine: today we keep administrative (SSH) access to it for operations, and the measured deployment manifest shows this. The hardware boundary protects the workload from the cloud host and its operators, not yet from us. Questions: security@augmentev.com