sp-nvtrust-wrapper

A Node.js wrapper for the nvtrust library, designed to enable attestation for NVIDIA Confidential Computing.

📦 Build Instructions

The package supports CPython 3.11 and 3.12 on Linux amd64 with glibc 2.28 or newer. Other Python versions, operating systems, architectures, and musl-based distributions such as Alpine Linux are not supported by postinstall.

To build the project, run:

npm install
npm run postinstall
npm run build

Multi-GPU and NVSwitch attestation

As described by NVIDIA's Blackwell multi-GPU attestation guide, Blackwell systems use the regular GPU flow. The SDK automatically collects evidence for every GPU and returns one EAT bundle containing a GPU-0, GPU-1, ... detached token for each device. Blackwell NVLink fabric is not attested as a separate switch entity, so nvswitchCount is zero even when the platform contains QM3 NVSwitch hardware and CX7 management PFs.

import {
  defaultGPUpolicy,
  NvidiaDeviceType,
  NvtrustWrapper,
} from '@super-protocol/sp-nvtrust-wrapper';

const wrapper = new NvtrustWrapper();
const nonce = NvtrustWrapper.generateNonce();
const topology = await wrapper.getGPUTopology();
const token = await wrapper.getNvidiaToken({
  device: NvidiaDeviceType.GPU,
  nonce,
  ppcieMode: false,
});
await wrapper.validateToken({
  device: NvidiaDeviceType.GPU,
  token,
  policy: defaultGPUpolicy,
});

Hopper/PPCIE systems expose attestable LS10 switches through NSCQ. When nvswitchCount is greater than zero, obtain and validate their separate EAT bundle with the NVIDIA v4 switch policy. The Python SDK requires ppcieMode: false for this standalone evidence-collection call, including on a system whose GPUs and switches are configured in PPCIE/TNVL mode.

import {
  defaultNVSwitchPolicy,
  NvidiaDeviceType,
  NvtrustWrapper,
} from '@super-protocol/sp-nvtrust-wrapper';

const wrapper = new NvtrustWrapper();
const topology = await wrapper.getGPUTopology();
if (topology.nvswitchCount > 0) {
  const token = await wrapper.getNvidiaToken({
    device: NvidiaDeviceType.SWITCH,
    nonce: NvtrustWrapper.generateNonce(),
    ppcieMode: false,
  });
  await wrapper.validateToken({
    device: NvidiaDeviceType.SWITCH,
    token,
    policy: defaultNVSwitchPolicy,
  });
}

nvswitchCount is specifically the number of LS10 switches that can supply attestation evidence through NSCQ. It is not a count of all physical fabric components across NVIDIA architectures.

Certificate GPU interconnect information

After processing the client interconnect metadata and validating the NVIDIA tokens, a relying party can build the protobuf value intended for the GPU interconnect certificate extension:

import {
  NvidiaGpuInterconnectStatus,
  NvtrustWrapper,
} from '@super-protocol/sp-nvtrust-wrapper';

// switchToken has already passed defaultNVSwitchPolicy validation.
const switches = switchToken
  ? NvtrustWrapper.extractNVSwitchInfoFromToken(switchToken)
  : [];
const interconnectInfo = NvtrustWrapper.createNvidiaGpuInterconnectInfo(
  NvidiaGpuInterconnectStatus
    .NVIDIA_GPU_INTERCONNECT_NVLINK_SWITCH_ATTESTATION_VERIFIED,
  switches,
);

extractNVSwitchInfoFromToken() only decodes claims; it does not verify JWT signatures. Use it only after successful validation with defaultNVSwitchPolicy. createNvidiaGpuInterconnectInfo() ensures that switch details are present only for the verified LS10 status. The relying party chooses the final status from client-provided topology metadata and the token validation results; the wrapper does not treat NVML topology as an NVIDIA attested claim. The certificate issuer should omit the interconnect extension for a single GPU. For multiple GPUs, use DISCONNECTED when NVML reports no peer path, DIRECT_UNVERIFIED for a test-policy direct path, NVLINK_SWITCH_ATTESTATION_NOT_APPLICABLE for Blackwell, and NVLINK_SWITCH_ATTESTATION_VERIFIED only after LS10 token validation.

postinstall selects the lock file for the active Python minor version and installs only the exact wheel and SHA-256 hash recorded for every direct and transitive dependency.

Updating Python dependencies

Edit the direct dependencies in py/requirements.in, then regenerate both locks in the manylinux 2.28 image:

docker run --rm --platform linux/amd64 --user "$(id -u):$(id -g)" --env HOME=/tmp \
  -v "$PWD:/work" -w /work \
  quay.io/pypa/manylinux_2_28_x86_64 \
  /opt/python/cp311-cp311/bin/python tools/generate_python_lock.py

docker run --rm --platform linux/amd64 --user "$(id -u):$(id -g)" --env HOME=/tmp \
  -v "$PWD:/work" -w /work \
  quay.io/pypa/manylinux_2_28_x86_64 \
  /opt/python/cp312-cp312/bin/python tools/generate_python_lock.py

Validate the generated files before committing them:

python3 tools/verify_python_locks.py