Verify Your Application

// Fetch attestation quote
const attestResponse = await fetch('https://your-app.example.com/attestation');
const attestData = await attestResponse.json();

const quote = attestData.quote;
const eventLog = attestData.event_log;
const reportData = attestData.report_data;

// Fetch application configuration
const infoResponse = await fetch('https://your-app.example.com/info');
const appInfo = await infoResponse.json();
const appComposeConfig = appInfo.tcb_info.app_compose;

import assert from 'assert';

const expectedChallenge = 'your-expected-challenge-hex';
assert(reportData.startsWith(expectedChallenge), 'reportData mismatch');

import assert from 'assert';
import { createHash } from 'crypto';

// Calculate SHA-256 hash of app-compose
const calculatedHash = createHash('sha256')
  .update(appComposeConfig)
  .digest('hex');

// Extract attested hash from RTMR3 event log
const events = JSON.parse(eventLog);
const composeEvent = events.find(e => e.event === 'compose-hash');
const attestedHash = composeEvent.event_payload;

// Verify hashes match
assert.strictEqual(calculatedHash, attestedHash, 'compose-hash mismatch');

import assert from 'assert';

const verifyResponse = await fetch('https://cloud-api.phala.network/api/v1/attestations/verify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ hex: quote })
});

const result = await verifyResponse.json();
assert(result.quote.verified, 'Hardware verification failed');

import assert from 'assert';

// Parse app-compose and extract docker-compose
const appCompose = JSON.parse(appComposeConfig);
const dockerComposeYaml = appCompose.docker_compose_file;

// Check all image lines use @sha256 digests
const imageLines = dockerComposeYaml.split('\n').filter(line =>
  line.trim().startsWith('image:')
);

for (const line of imageLines) {
  assert(
    line.includes('@sha256:'),
    `Image not pinned by digest: ${line.trim()}`
  );
}