FrOntRuNnEr

UPDATE · enclave check v4 is live. Eight checks. Replay the boot. Land on the hardware's numbers. A TDX quote signs the final value of each measurement register. The event log, served next to the quote, says what went into them. Until today you could read that log and believe it. Now your browser replays it: event by event, SHA-384 chained from forty-eight zero bytes, and it must land on the exact register values Intel signed. If one event were missing, altered or reordered, the register would not match. Live run, this evening: • RTMR0, 13 events, = quote (firmware configuration, boot services) • RTMR1, 5 events, = quote (kernel, boot loader) • RTMR2, 2 events, = quote (kernel command line, initrd) • RTMR3, 10 events, = quote (dstack app events) • inside RTMR3: app-id = our app id, compose-hash = our measured compose, os-image-hash = dstack-0.5.12, the non-dev image For dstack's application events the served log omits the digest, so the page rebuilds it: SHA-384 of the event type (as little-endian u32), a colon, the event name, a colon, the payload bytes. Then the register is SHA-384 of the previous value followed by the digest. Thirty events, under a second, WebCrypto only. One thing worth saying: the first deploy of this check scored 7/8. A hex-decoding bug on the page turned every digest into zeros, and the replay disagreed with the quote exactly as it should when the input is wrong. Fixed, 8/8. A check is only worth something if it can fail. Checks 1 to 7 are unchanged: published compose, literal pin, tarball bytes, receipt key and your nonce in report_data, freshness, DCAP chain to Intel with TCB UpToDate, mr_config_id equal to 0x01 followed by the compose hash. 0x4d3ace48b1590bc4c5dd46f05237c133be564eb3