Skip to content

INVAR v0.1.8 — verdicts, agreement, OpenPCC envelope

Choose a tag to compare

View all tags
@rybruscoe rybruscoe released this 05 Sep 06:53
· 32 commits to main since this release
v0.1.8
568aa04
  • invar verify ... --verdict-out verdict.cose: the verifier's conclusion (worldline digest, per-entry verdicts, checks run incl. the spot-check challenge, summary) as a certified COSE_Sign1 signed by the verifier's software or TPM key; registrable in the transparency log; REJECT runs produce one too.
  • invar scitt agree a.cose b.cose: independent verifiers (distinct keys) must reach the same per-entry verdicts on the same worldline — N-version verification across implementations, machines, or vendors.
  • receipt.openpcc on every signed response: an OpenPCC-shaped {type: ExecutionReceipt, data, signature} evidence piece; go/crverify VerifyExecutionReceipt performs the four client checks (certificate+chain, attestation-bundle digest + nonce, node key signature, prompt/output digests), tested on a real bound, signed worldline with five negative controls.
  • Go spot-check gains -units (all 7 matmuls per layer, 6,720 rows in 0.20 s); verify --units uses it when present.
  • 265 offline unit assertions.
Assets 6
Loading