Releases: EternisAI/attestation-server
Releases · EternisAI/attestation-server
v1.3.1
v1.3.0
v1.2.0
1.2.0 (2026-03-26)
Features
- make private TLS certificate optional for public-cert-only deployments (a4349b1)
- verify dependency server TLS certificate against attestation report (42dd053)
Bug Fixes
- preserve handler-controlled error messages for 5xx responses (bc3c407)
- return 500 instead of 503 for TLS certificate verification failures (d2855c9)
Refactoring
- extract makeTestReport helper in dependency tests (e723373)
Documentation
- document config validation rules and Nix closure stripping in CLAUDE.md (1600ee0)
v1.1.0
1.1.0 (2026-03-26)
Features
- make HTTP cache default TTL configurable (http.cache.default_ttl) (6e46691)
Bug Fixes
- clamp defaultTTL to 24h cap in parseCacheTTL (50b3025)
- default bind address to 127.0.0.1 instead of 0.0.0.0 (4ead045)
- fail on invalid duration and byte-size config values (ad7ddbf)
- guard parseByteSize against uint64-to-int64 overflow (97ef623)
- reject negative durations in parseDuration (ae5e012)
- reject zero durations for timeout and interval config values (11b3304)
- respect no-cache/no-store TTL=0 from parseCacheTTL (8b20cae)
Refactoring
- use dustin/go-humanize for http.cache.size parsing (98d895b)
Documentation
- fix parseDuration comment to reflect actual behavior (c601b56)
v1.0.0
1.0.0 (2026-03-26)
⚠ BREAKING CHANGES
- AttestationReportData JSON schema changed.
Features
- add background CRL fetching for TEE endorsement key revocation checking (6df4203)
- add CI and release workflows with Nix-built Docker image (9eb73b0)
- add configurable VMPL level for SEV-SNP attestation (4de9b13)
- add debug logging with duration for evidence retrieval and TPM PCR reads (8407737)
- add duration and cache TTL logging to HTTP fetch paths (e098d27)
- add generic TPM PCR reading via google/go-tpm (402ea6f)
- add GET /api/v1/attestation handler with Nitro NSM evidence (ca6979f)
- add http.allow_proxy setting for ambient proxy support (d787137)
- add Intel TDX attestation via go-tdx-guest library (40d3c30)
- add NitroTPM attestation via raw TPM2 protocol over /dev/tpm0 (7e025df)
- add Nix flake for reproducible hermetic builds (5972380)
- add report configuration section with evidence and user_data.env settings (024bb60)
- add SEV-SNP attestation via go-sev-guest library (8f4add5)
- add timestamp to report data, flatten TLS fingerprints, verify public cert (d29ac78)
- add TLS certificate loading with inotify-based hot reload (f73dea3)
- add transitive dependency attestation (eeb092b)
- add UEFI Secure Boot state verification (6a3e929)
- cache TDX collateral fetches via shared ristretto cache (4c88029)
- enforce mTLS and end-to-end encryption for dependency attestation (5f857d7)
- implement initial server scaffold (eb19b79)
- load build info and endorsements files on startup (eaff8a7)
- replace AD-flag DNSSEC check with cryptographic chain-of-trust validation (2310474)
- replace encoding/json with goccy/go-json for better performance (4ef0561)
- replace report.evidence string list with boolean flags per evidence type (82d2d35)
- security hardening across error handling, rate limiting, trust verification, and TLS (c1cf403)
- switch configuration to TOML config file with env var prefix (b8a3818)
- validate endorsement documents against TEE evidence measurements (f2d6a0a)
- validate PCR endorsement HashAlgorithm and digest lengths at parse time (07979cb)
- verify cosign signatures on endorsement documents (39e378a)
- verify NitroTPM attestation document and decode CBOR fields (a1ff785)
Bug Fixes
- add environment variable binding for report.evidence.sevsnp_vmpl (8c8a552)
- add missing env var binding for tls.public.skip_verify (3f170f8)
- auto-disable TPM PCR reads when NitroNSM evidence is enabled (4ae24dd)
- clone IP string before storing as rate limiter map key (68849d3)
- eliminate errgroup context cancellation race in dependency tests (32c7508)
- ensure attestation response data matches nonce digest bytes (4565bc7)
- fetch SEV-SNP CRLs when dependencies are configured (ebd4cb3)
- interrupt fetch backoff and rate limit stalls on graceful shutdown (ef114cd)
- log per-attempt errors during endorsement/signature fetch retries (6293f93)
- self-verify TDX and SEV-SNP evidence before returning from handler (7681f68)
- skip UEFI secure boot detection in Nitro Enclaves (574990f)
- use ConfigFS QuoteProvider for TDX attestation (2796238)
- work around go-sev-guest issues preventing SEV-SNP attestation on AWS (8add34b)
Miscellaneous
Refactoring
- classify upstream errors into distinct HTTP status codes (2a6f694)
- consistent public API for TEE evidence packages (06c68ca)
- embed Intel SGX Root CA and pass as TrustedRoots for TDX verification (850b25a)
- extract Nitro NSM into separate NitroNSM struct (e067758)
- extract shared HexBytes type into pkg/hexbytes (a1dfde2)
- extract TEE attestation code into reusable pkg/ packages (7d45e73)
- generalize Nitro attestation verification for both NSM and TPM (7d3b74a)
- restructure TPM PCR data to include hash algorithm (2b017ee)
- route early startup errors through slog JSON logger (59ddc70)
- scope rate limiting to the attestation endpoint only (7f10966)
- simplify PCR endorsement format and types (1c0dfdb)
- use map[int]HexBytes for TPM PCRs to match other TEE packages (726084f)
Documentation
- add comments for security implications, architectural decisions, and caveats ([34dad14](https://github.com/EternisAI/attes...