-
Notifications
You must be signed in to change notification settings - Fork 72
Expand file tree
/
Copy pathbundle-attestation-demo-slides.html
More file actions
497 lines (459 loc) · 27.9 KB
/
Copy pathbundle-attestation-demo-slides.html
File metadata and controls
497 lines (459 loc) · 27.9 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
<!DOCTYPE html>
<!--
Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<html lang="en">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>AICR · Bundle Attestation — slides</title>
<style>
:root {
--bg: #0b0d10;
--panel: #14181d;
--panel-2: #1b2026;
--border: #2a313a;
--text: #e6edf3;
--dim: #9aa7b4;
--green: #76b900;
--green-bright: #93d22a;
--green-tint: rgba(118, 185, 0, 0.12);
--amber: #e3a008;
--amber-tint: rgba(227, 160, 8, 0.12);
--red: #e5534b;
--sans: "NVIDIA Sans", "NVIDIASans", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
--mono: "JetBrains Mono", "SFMono-Regular", ui-monospace, Menlo, Consolas, "Liberation Mono", monospace;
}
* { box-sizing: border-box; }
html, body { height: 100%; }
body {
margin: 0; overflow: hidden;
background: var(--bg); color: var(--text);
font-family: var(--sans); font-size: 16px; line-height: 1.6;
-webkit-font-smoothing: antialiased;
}
a { color: var(--green-bright); text-decoration: none; }
a:hover { text-decoration: underline; }
code.inl { font-family: var(--mono); font-size: 0.9em; background: var(--panel-2); border: 1px solid var(--border); padding: 1px 6px; border-radius: 5px; }
strong { color: var(--text); }
em { color: var(--dim); }
/* ---- chrome ---- */
.deck-top {
position: fixed; top: 0; left: 0; right: 0; height: 48px; z-index: 30;
display: flex; align-items: center; gap: 12px; padding: 0 22px;
background: rgba(11,13,16,0.9); border-bottom: 1px solid var(--border);
}
.deck-top .brand { font-weight: 700; letter-spacing: 0.02em; font-size: 14px; }
.deck-top .brand .sub { color: var(--dim); font-weight: 500; }
.deck-top .sect { margin-left: auto; color: var(--green-bright); font-family: var(--mono); font-size: 12.5px; }
.deck-bottom {
position: fixed; bottom: 3px; left: 0; right: 0; height: 50px; z-index: 30;
display: flex; align-items: center; gap: 16px; padding: 0 22px;
background: rgba(11,13,16,0.9); border-top: 1px solid var(--border);
}
.navbtn {
font-size: 22px; line-height: 1; color: var(--text); background: var(--panel-2);
border: 1px solid var(--border); border-radius: 8px; width: 40px; height: 32px;
cursor: pointer; user-select: none;
}
.navbtn:hover { color: var(--green-bright); border-color: var(--green); }
.deck-bottom .meter { margin: 0 auto; display: flex; align-items: center; gap: 16px; }
.deck-bottom #counter { font-family: var(--mono); font-size: 13px; color: var(--text); }
.deck-bottom .hint { font-family: var(--mono); font-size: 11.5px; color: var(--dim); }
.progress { position: fixed; bottom: 0; left: 0; right: 0; height: 3px; background: var(--border); z-index: 31; }
.progress > i { display: block; height: 100%; width: 0; background: var(--green); transition: width 0.2s ease; }
/* ---- slides ---- */
.slide {
position: fixed; inset: 0; z-index: 10;
display: none; flex-direction: column; justify-content: center; align-items: center;
padding: 70px 48px 80px;
}
.slide.active { display: flex; }
.slide-inner { width: 100%; max-width: 1000px; max-height: 86vh; overflow-y: auto; }
.slide.center .slide-inner { text-align: center; }
.label { font-family: var(--mono); font-size: 12px; letter-spacing: 0.12em; text-transform: uppercase; color: var(--green); margin-bottom: 8px; }
.slide h1 { font-size: clamp(38px, 6vw, 62px); line-height: 1.08; margin: 0 0 18px; font-weight: 800; letter-spacing: -0.02em; }
.slide h2 { font-size: clamp(26px, 3.6vw, 40px); margin: 0 0 16px; font-weight: 750; letter-spacing: -0.01em; }
.slide p { color: #cdd6df; max-width: 74ch; }
.lede { font-size: clamp(17px, 2.2vw, 22px); color: var(--dim); margin: 0 auto 22px; max-width: 60ch; }
.hint { color: var(--dim); font-family: var(--mono); font-size: 12.5px; }
.chips { display: flex; flex-wrap: wrap; gap: 10px; justify-content: center; margin-top: 8px; }
.chip { font-size: 14px; color: var(--text); background: var(--panel-2); border: 1px solid var(--border); padding: 6px 13px; border-radius: 999px; }
.chip b { color: var(--green-bright); font-weight: 600; }
.grid2 { display: grid; grid-template-columns: 1fr 1fr; gap: 16px; margin: 16px 0; }
@media (max-width: 820px) { .grid2 { grid-template-columns: 1fr; } }
.mini { background: var(--panel-2); border: 1px solid var(--border); border-radius: 10px; padding: 14px 16px; text-align: left; }
.mini h4 { margin: 0 0 6px; font-size: 15px; color: var(--green-bright); }
.mini p { font-size: 14px; color: var(--dim); margin: 0; }
.note { border-left: 3px solid var(--green); background: var(--green-tint); padding: 13px 18px; border-radius: 0 10px 10px 0; margin: 16px 0; text-align: left; }
.note.honest { border-left-color: var(--amber); background: var(--amber-tint); }
.note .t { font-weight: 700; display: block; margin-bottom: 4px; }
.note.honest .t { color: var(--amber); }
.note.honest .t::before { content: "⚖ "; }
.note .t.info { color: var(--green-bright); }
.code { position: relative; background: #0e1116; border: 1px solid var(--border); border-radius: 10px; margin: 14px 0; overflow: hidden; text-align: left; }
.code .bar { display: flex; align-items: center; gap: 8px; padding: 8px 12px; border-bottom: 1px solid var(--border); background: var(--panel-2); }
.code .dot { width: 11px; height: 11px; border-radius: 50%; }
.code .bar .name { margin-left: 6px; font-family: var(--mono); font-size: 12px; color: var(--dim); }
.code .bar .copy { margin-left: auto; font-family: var(--mono); font-size: 11.5px; color: var(--dim); background: transparent; border: 1px solid var(--border); border-radius: 6px; padding: 3px 9px; cursor: pointer; }
.code .bar .copy:hover { color: var(--green-bright); border-color: var(--green); }
pre { margin: 0; padding: 15px; overflow-x: auto; font-family: var(--mono); font-size: 13.5px; line-height: 1.6; color: #d7dee6; }
pre .p { color: var(--green-bright); } pre .c { color: #6b7785; } pre .g { color: var(--green); }
pre .a { color: var(--amber); } pre .r { color: var(--red); } pre .d { color: var(--dim); }
table.r { width: 100%; border-collapse: collapse; margin: 12px 0; font-size: 15px; }
table.r th, table.r td { text-align: left; padding: 9px 12px; border-bottom: 1px solid var(--border); }
table.r th { color: var(--dim); font-weight: 600; font-size: 12.5px; text-transform: uppercase; letter-spacing: 0.04em; }
table.r td code { font-family: var(--mono); font-size: 12.5px; }
.ok { color: var(--green-bright); } .warn { color: var(--amber); } .bad { color: var(--red); } .d { color: var(--dim); }
/* ---- diagrams ---- */
svg.diagram { display: block; margin: 4px auto; width: auto; height: auto; max-width: min(940px, 90vw); max-height: 52vh; }
figure.fig { margin: 0; }
.fig figcaption { color: var(--dim); font-size: 13.5px; text-align: center; padding: 8px 0 0; }
.diagram text { font-family: var(--sans); fill: var(--text); }
.diagram .nlabel { font-weight: 650; font-size: 14px; }
.diagram .nsub { fill: var(--dim); font-size: 11.5px; }
.diagram .mono { font-family: var(--mono); }
.diagram .edge { stroke: #46525f; stroke-width: 1.6; fill: none; }
.diagram .edge-g { stroke: var(--green); stroke-width: 2; fill: none; }
.diagram .elabel { fill: var(--dim); font-size: 11px; }
.diagram .node { fill: var(--panel-2); stroke: var(--border); }
.diagram .node-g { fill: rgba(118,185,0,0.10); stroke: var(--green); }
.diagram .node-a { fill: rgba(227,160,8,0.10); stroke: var(--amber); }
.diagram .node-r { fill: rgba(229,83,75,0.10); stroke: var(--red); }
.diagram .ttl-g { fill: var(--green-bright); }
.diagram .ttl-a { fill: var(--amber); }
.footlinks { margin-top: 18px; font-size: 14px; color: var(--dim); }
.footlinks a { margin: 0 8px; }
</style>
</head>
<body>
<div class="deck-top">
<span class="brand">NVIDIA AICR<span class="sub"> · Bundle Attestation</span></span>
<span class="sect" id="sect"></span>
</div>
<!-- 1 · TITLE -->
<section class="slide center" data-title="">
<div class="slide-inner">
<div class="label">NVIDIA AI Cluster Runtime</div>
<h1>Bundle attestation</h1>
<p class="lede">Signed proof of <strong>who</strong> created a deployment bundle and
<strong>which AICR CLI</strong> built it — chained back to NVIDIA CI, verifiable offline,
enforceable by trust level.</p>
<div class="chips">
<span class="chip"><b>SLSA Build Provenance v1</b></span>
<span class="chip"><b>Keyless</b> cosign + Fulcio</span>
<span class="chip"><b>Chained</b> to binary attestation</span>
<span class="chip"><b>Four trust levels</b> · policy-enforceable</span>
</div>
<p class="hint" style="margin-top:30px">← → or Space to navigate · F for fullscreen</p>
</div>
</section>
<!-- 2 · WHY -->
<section class="slide" data-title="Why">
<div class="slide-inner">
<div class="label">01 · The problem</div>
<h2>Generated artifacts have no upstream tag</h2>
<p class="lede">A deployment bundle is built locally from a recipe — there’s no
registry to anchor trust to. Two questions an operator still has to answer
before applying it to a production cluster.</p>
<table class="r">
<thead><tr><th>Question</th><th>What proves it</th></tr></thead>
<tbody>
<tr><td>Who built this bundle?</td><td>Sigstore signature pinned to the creator’s OIDC identity</td></tr>
<tr><td>Which AICR CLI built it — and was that CLI itself attested?</td><td>Bundle predicate references the binary’s SLSA attestation</td></tr>
</tbody>
</table>
<div class="grid2">
<div class="mini"><h4>Without attestation</h4><p><code class="inl">checksums.txt</code> detects accidental payload or tree changes, but provides no signed creator identity or provenance.</p></div>
<div class="mini"><h4>With <code class="inl">--attest</code></h4><p>The complete closed-world payload inventory, including <code class="inl">recipe.yaml</code>, is cryptographically bound to the creator <em>and</em> the binary that produced it. Recursive provenance.</p></div>
</div>
</div>
</section>
<!-- 3 · PIPELINE -->
<section class="slide" data-title="Sign the bundle">
<div class="slide-inner">
<div class="label">02 · Produce</div>
<h2><code class="inl">aicr bundle --attest</code></h2>
<figure class="fig">
<svg class="diagram" viewBox="0 0 860 380" role="img" aria-label="Recipe flows through aicr bundle --attest, producing a closed-world bundle inventory with checksums.txt and the two permitted attestation files">
<defs>
<marker id="bD1" markerWidth="9" markerHeight="9" refX="7" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 Z" fill="#46525f"/></marker>
<marker id="bD1g" markerWidth="9" markerHeight="9" refX="7" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 Z" fill="#76b900"/></marker>
</defs>
<g>
<rect class="node" x="14" y="26" width="150" height="54" rx="9"/>
<text class="nlabel" x="89" y="49" text-anchor="middle">Recipe</text>
<text class="nsub" x="89" y="67" text-anchor="middle">criteria + checks</text>
<rect class="node" x="234" y="26" width="170" height="54" rx="9"/>
<text class="nlabel" x="319" y="49" text-anchor="middle">aicr bundle</text>
<text class="nsub" x="319" y="67" text-anchor="middle">--attest</text>
<rect class="node" x="474" y="26" width="150" height="54" rx="9"/>
<text class="nlabel" x="549" y="49" text-anchor="middle">Sigstore</text>
<text class="nsub" x="549" y="67" text-anchor="middle">Fulcio + Rekor</text>
<rect class="node-g" x="694" y="26" width="152" height="54" rx="9"/>
<text class="nlabel ttl-g" x="770" y="49" text-anchor="middle">Bundle dir</text>
<text class="nsub" x="770" y="67" text-anchor="middle">signed predicates</text>
<line class="edge" x1="164" y1="53" x2="228" y2="53" marker-end="url(#bD1)"/>
<line class="edge" x1="404" y1="53" x2="468" y2="53" marker-end="url(#bD1)"/>
<line class="edge-g" x1="624" y1="53" x2="688" y2="53" marker-end="url(#bD1g)"/>
</g>
<path class="edge-g" d="M770,80 L770,104 L430,104 L430,128" marker-end="url(#bD1g)"/>
<rect x="14" y="132" width="832" height="234" rx="11" fill="rgba(118,185,0,0.05)" stroke="#3a4754"/>
<text class="nlabel ttl-g mono" x="30" y="156">my-bundle/</text>
<rect class="node" x="30" y="170" width="386" height="186" rx="9"/>
<text class="nlabel mono" x="46" y="192">content</text>
<g class="mono nsub" font-size="12">
<text x="46" y="214">recipe.yaml · deploy.sh · README.md</text>
<text x="46" y="234"><component>/values.yaml · ...</text>
<text x="46" y="266" fill="#9aa7b4">checksums.txt</text>
<text x="46" y="282" fill="#6b7785" font-size="11">closed-world SHA256 inventory; covers recipe.yaml</text>
<text x="46" y="300" fill="#6b7785" font-size="11">additional filesystem entries are rejected</text>
</g>
<rect class="node-g" x="432" y="170" width="398" height="186" rx="9"/>
<text class="ttl-g nlabel" x="448" y="194">attestation/</text>
<g class="mono nsub" font-size="12">
<text x="448" y="220">bundle-attestation.sigstore.json</text>
<text x="448" y="238" fill="#6b7785" font-size="11">SLSA Provenance v1 — signs checksums.txt</text>
<text x="448" y="270">aicr-attestation.sigstore.json</text>
<text x="448" y="288" fill="#6b7785" font-size="11">binary SLSA attestation (copied in)</text>
<text x="448" y="324" fill="#93d22a">bundle ↔ binary chain</text>
<text x="448" y="340" fill="#6b7785" font-size="11">predicate references the binary digest</text>
</g>
</svg>
</figure>
<div class="code">
<div class="bar"><span class="dot" style="background:#e5534b"></span><span class="dot" style="background:#e3a008"></span><span class="dot" style="background:#76b900"></span><span class="name">producer</span><button class="copy">copy</button></div>
<pre><span class="p">$</span> aicr bundle --recipe recipe.yaml --output ./my-bundle --attest
<span class="d"># In GitHub Actions: ambient OIDC is detected automatically.</span>
<span class="d"># Locally: a browser opens for keyless OIDC sign-in.</span></pre>
</div>
</div>
</section>
<!-- 4 · CHAIN -->
<section class="slide" data-title="The chain">
<div class="slide-inner">
<div class="label">03 · The chain</div>
<h2>Bundle ↔ binary ↔ NVIDIA CI</h2>
<figure class="fig">
<svg class="diagram" viewBox="0 0 860 296" role="img" aria-label="Three-link trust chain: bundle attestation signed by the creator's identity references the binary attestation, which is signed by NVIDIA CI's identity">
<defs>
<marker id="bD2g" markerWidth="9" markerHeight="9" refX="7" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 Z" fill="#76b900"/></marker>
</defs>
<rect class="node-g" x="16" y="80" width="240" height="136" rx="10"/>
<text class="nlabel ttl-g" x="136" y="108" text-anchor="middle">Bundle attestation</text>
<g class="nsub" font-size="11.5">
<text x="32" y="134">subject: checksums.txt sha256</text>
<text x="32" y="152">creator: jdoe@company.com</text>
<text x="32" y="170">issuer: GitHub / Google / …</text>
<text x="32" y="194" fill="#93d22a">cliBinaryDigest: sha256:9a3f…</text>
</g>
<rect class="node-g" x="310" y="80" width="240" height="136" rx="10"/>
<text class="nlabel ttl-g" x="430" y="108" text-anchor="middle">Binary attestation</text>
<g class="nsub" font-size="11.5">
<text x="326" y="134">subject: aicr-linux-amd64 sha256</text>
<text x="326" y="152">signer: NVIDIA/aicr CI</text>
<text x="326" y="170">issuer: token.actions.githubusercontent.com</text>
<text x="326" y="194">workflow: on-tag.yaml@vX.Y.Z</text>
</g>
<rect class="node" x="604" y="80" width="240" height="136" rx="10"/>
<text class="nlabel" x="724" y="108" text-anchor="middle">Sigstore + Rekor</text>
<g class="nsub" font-size="11.5">
<text x="620" y="134">Fulcio: short-lived certs</text>
<text x="620" y="152">Rekor: public log of both</text>
<text x="620" y="170">witness: third-party monitors</text>
<text x="620" y="194">no NVIDIA contact at verify</text>
</g>
<path class="edge-g" d="M256,148 L308,148" marker-end="url(#bD2g)"/>
<text class="elabel" x="262" y="138">references</text>
<path class="edge-g" d="M550,148 L602,148" marker-end="url(#bD2g)"/>
<text class="elabel" x="556" y="138">verified by</text>
</svg>
</figure>
<div class="note">
<span class="t info">Why both halves matter</span>
The bundle signature alone proves a creator made a bundle. The chain to the binary
attestation proves the bundle was built by an attested NVIDIA-CI-released AICR CLI —
not by a fork, an alpha build, or a tampered binary. AICR generates manifest entries
sorted, but validates valid entries in any order; reordering a signed manifest changes its
signed bytes and invalidates this chain.
</div>
</div>
</section>
<!-- 5 · VERIFY -->
<section class="slide" data-title="Verify">
<div class="slide-inner">
<div class="label">04 · Verify</div>
<h2><code class="inl">aicr verify</code> — clean pass</h2>
<div class="code">
<div class="bar"><span class="dot" style="background:#e5534b"></span><span class="dot" style="background:#e3a008"></span><span class="dot" style="background:#76b900"></span><span class="name">happy path</span><button class="copy">copy</button></div>
<pre><span class="p">$</span> aicr verify ./my-bundle
<span class="g">✓</span> Checksums verified (12 files)
<span class="g">✓</span> Bundle attested by: <span class="g">jdoe@company.com</span>
<span class="g">✓</span> Binary built by: https://github.com/NVIDIA/aicr/.github/workflows/on-tag.yaml@refs/tags/v1.0.0
<span class="g">✓</span> Identity pinned to NVIDIA CI
<span class="g"> Trust level: verified</span>
<span class="g">Bundle verification: PASSED</span></pre>
</div>
<p>Five gates ran: closed-world inventory, bundle signature, bundle predicate, binary
attestation chain, identity pin. Additional files or directories, symlinks, other
non-regular objects, and failed attestations report <code class="inl">unknown</code>.</p>
</div>
</section>
<!-- 6 · TRUST LEVELS -->
<section class="slide" data-title="Trust levels">
<div class="slide-inner">
<div class="label">05 · Policy</div>
<h2>Four trust levels</h2>
<table class="r">
<thead><tr><th>Level</th><th>Name</th><th>Criteria</th></tr></thead>
<tbody>
<tr><td class="ok">4</td><td><code>verified</code></td><td>Checksums + bundle attestation + binary attestation pinned to NVIDIA CI</td></tr>
<tr><td class="ok">3</td><td><code>attested</code></td><td>Bundle attestation verified; binary attestation missing, or external data used</td></tr>
<tr><td class="warn">2</td><td><code>unverified</code></td><td>Closed-world checksum inventory valid, no <code class="inl">--attest</code> was passed</td></tr>
<tr><td class="bad">1</td><td><code>unknown</code></td><td>Missing, invalid, or incomplete manifest; unexpected filesystem entry; or failed attestation</td></tr>
</tbody>
</table>
<div class="note">
<span class="t info">Why levels, not pass/fail</span>
Different bundles live under different threats. CI-built production bundles must be
<code class="inl">verified</code>; an on-call engineer’s emergency hotfix bundle might only
reach <code class="inl">attested</code>. Legacy bundles with incomplete manifests remain
<code class="inl">unknown</code> and must be regenerated. Operators pick the floor per environment.
</div>
</div>
</section>
<!-- 7 · ENFORCE -->
<section class="slide" data-title="Enforce">
<div class="slide-inner">
<div class="label">06 · Enforce</div>
<h2>Policy from one flag</h2>
<div class="code">
<div class="bar"><span class="dot" style="background:#e5534b"></span><span class="dot" style="background:#e3a008"></span><span class="dot" style="background:#76b900"></span><span class="name">policy flags</span><button class="copy">copy</button></div>
<pre><span class="c"># Floor on trust level — fail any bundle below the threshold.</span>
<span class="p">$</span> aicr verify ./my-bundle --min-trust-level verified
<span class="c"># Require a specific creator (or set of identities).</span>
<span class="p">$</span> aicr verify ./my-bundle --require-creator jdoe@company.com
<span class="c"># Constrain the CLI version that produced the bundle.</span>
<span class="p">$</span> aicr verify ./my-bundle --cli-version-constraint ">= 1.0.0"
<span class="c"># CI: keep the verify exit code; failed integrity or attestation reports unknown</span>
<span class="p">$</span> set -o pipefail; aicr verify ./my-bundle --format json | jq '.trustLevel, .trustReason'</pre>
</div>
<div class="grid2">
<div class="mini"><h4 class="ok"><code class="inl">--min-trust-level verified</code></h4><p>Production gate. Demands the full chain back to NVIDIA CI.</p></div>
<div class="mini"><h4 class="warn"><code class="inl">--min-trust-level attested</code></h4><p>Pre-prod gate. Allows external data sources while still requiring a signature.</p></div>
</div>
</div>
</section>
<!-- 8 · TAMPER -->
<section class="slide" data-title="Tamper">
<div class="slide-inner">
<div class="label">06 · Enforce</div>
<h2>Tamper-evident</h2>
<div class="code">
<div class="bar"><span class="dot" style="background:#e5534b"></span><span class="dot" style="background:#e3a008"></span><span class="dot" style="background:#76b900"></span><span class="name">tampered bundle</span><button class="copy">copy</button></div>
<pre><span class="p">$</span> f=$(ls my-bundle/[0-9]*-*/values.yaml | head -1)
<span class="p">$</span> echo '# tampered' >> "$f"
<span class="p">$</span> aicr verify ./my-bundle
<span class="r">✗</span> Checksums failed: 1 file mismatch
<span class="d"> <NNN-component>/values.yaml — sha256 mismatch (got 3f9a…, want 7b21…)</span>
<span class="d"> Trust level: <span class="r">unknown</span></span>
<span class="r">Bundle verification: FAILED (non-zero exit)</span></pre>
</div>
<p>The signature’s subject is the digest of <code class="inl">checksums.txt</code>, and
<code class="inl">checksums.txt</code> pins every regular payload file. Mutating a listed
file breaks the checksum; mutating or reordering <code class="inl">checksums.txt</code>
breaks the signature. Adding any unlisted file, directory, symlink, or other
non-regular object fails exact-tree verification.</p>
</div>
</section>
<!-- 9 · WHERE IT FITS -->
<section class="slide" data-title="Where it fits">
<div class="slide-inner">
<div class="label">07 · Where it fits</div>
<h2>One trust model, three subjects</h2>
<div class="grid2">
<div class="mini"><h4>Images & binaries</h4><p>SLSA provenance + signed SPDX SBOM on every published image (CLI binaries ship a separate, unsigned SBOM asset), signed by NVIDIA CI. <code class="inl">demos/provenance.md</code></p></div>
<div class="mini"><h4>Deployment bundles</h4><p><code class="inl">aicr bundle --attest</code> signs the generated bundle with build provenance + trust levels. <em>You are here.</em></p></div>
<div class="mini"><h4>Recipe evidence</h4><p>A signer-bound validation result for a recipe (proves who signed it, not cluster physicality), OCI-distributed with an in-tree pointer. <code class="inl">demos/evidence.md</code></p></div>
<div class="mini"><h4>Same primitives</h4><p>Sigstore keyless + Fulcio + Rekor + in-toto across the board — different subjects, one verification model.</p></div>
</div>
<div class="note">
<span class="t info">Summary</span>
<code class="inl">aicr bundle --attest</code> → <code class="inl">aicr verify --min-trust-level verified</code>. Two commands, signed proof of who built it, which CLI built it, and an enforceable policy boundary at apply time.
</div>
<div class="footlinks">
<a href="bundle-attestation.md">bundle-attestation.md</a> ·
<a href="bundle-attestation-demo.sh">demo script</a> ·
<a href="../SECURITY.md">SECURITY.md</a> ·
<a href="../docs/user/cli-reference.md#aicr-verify">CLI reference</a>
</div>
</div>
</section>
<div class="deck-bottom">
<button class="navbtn" id="prev" aria-label="Previous slide">‹</button>
<div class="meter">
<span id="counter">1 / 9</span>
<span class="hint">← → · Space · F fullscreen</span>
</div>
<button class="navbtn" id="next" aria-label="Next slide">›</button>
</div>
<div class="progress"><i id="pfill"></i></div>
<script>
var slides = Array.prototype.slice.call(document.querySelectorAll('.slide'));
var counter = document.getElementById('counter');
var pfill = document.getElementById('pfill');
var sect = document.getElementById('sect');
var i = 0;
function clamp(n) { return Math.max(0, Math.min(slides.length - 1, n)); }
function show(n) {
i = clamp(n);
slides.forEach(function (s, k) { s.classList.toggle('active', k === i); });
counter.textContent = (i + 1) + ' / ' + slides.length;
pfill.style.width = ((i + 1) / slides.length * 100) + '%';
sect.textContent = slides[i].getAttribute('data-title') || '';
var h = '#' + (i + 1);
if (location.hash !== h) history.replaceState(null, '', h);
slides[i].querySelector('.slide-inner').scrollTop = 0;
}
function next() { show(i + 1); }
function prev() { show(i - 1); }
document.getElementById('next').addEventListener('click', next);
document.getElementById('prev').addEventListener('click', prev);
document.addEventListener('keydown', function (e) {
if (e.key === 'ArrowRight' || e.key === ' ' || e.key === 'PageDown' || e.key === 'n') { e.preventDefault(); next(); }
else if (e.key === 'ArrowLeft' || e.key === 'PageUp' || e.key === 'p') { e.preventDefault(); prev(); }
else if (e.key === 'Home') { e.preventDefault(); show(0); }
else if (e.key === 'End') { e.preventDefault(); show(slides.length - 1); }
else if (e.key === 'f' || e.key === 'F') {
if (!document.fullscreenElement) { (document.documentElement.requestFullscreen || function () {}).call(document.documentElement); }
else { (document.exitFullscreen || function () {}).call(document); }
}
});
// Copy buttons.
document.querySelectorAll('.code .copy').forEach(function (btn) {
btn.addEventListener('click', function () {
var pre = btn.closest('.code').querySelector('pre');
navigator.clipboard.writeText(pre.innerText).then(function () {
var prev = btn.textContent; btn.textContent = 'copied';
setTimeout(function () { btn.textContent = prev; }, 1200);
});
});
});
var start = parseInt((location.hash || '').slice(1), 10);
show(isNaN(start) ? 0 : start - 1);
window.addEventListener('hashchange', function () {
var n = parseInt((location.hash || '').slice(1), 10);
if (!isNaN(n) && n - 1 !== i) show(n - 1);
});
</script>
</body>
</html>