@reclaimprotocol/attestor-core
Version:
<div> <div> <img src="https://raw.githubusercontent.com/reclaimprotocol/.github/main/assets/banners/Attestor-Core.png" /> </div> </div>
14 lines (13 loc) • 614 B
TypeScript
/**
* SEV-SNP base-image allowlist (the pin point for base UKI hashes).
*
* The attestor pins only the per-cloud base UKI (PCR 11: SHA-256 on GCP,
* SHA-384 on AWS) — that is its root of trust. The cross-cloud app bundle
* digest (PCR 8) is NOT pinned here; it is published into the claim context
* for the claim consumer to verify against its own policy.
*
* Rotate by editing this list or by setting SNP_BASE_ALLOWLIST (comma-separated,
* with or without the snp-base: prefix).
*/
/** Throws unless the base UKI hash is pinned. */
export declare function assertSevSnpBaseAllowed(base: string): void;