nitrum-node

Verify AWS Nitro Enclave attestation documents in Node.js.

Thin napi-rs bindings over crates/verify (COSE, certificate chain, PCRs, nonce, TLS leaf hash bind). High-level fetch / orchestration is left to the caller.

Installation

npm install nitrum-node

Native addon: published releases ship prebuilt *.node binaries via optional platform packages (nitrum-node-darwin-arm64, etc.). A Rust toolchain (MSRV 1.95+) is only needed when building from this repo.

Usage

const {
  verifyAttestation,
  verifyTlsLeafBindsAttestation,
} = require("nitrum-node");

const result = verifyAttestation(rawDocument, {
  expectedPcrs: { pcr0: EXPECTED_PCR0 },
  nonce,
  maxAgeMs: 5 * 60_000,
});

if (!result.valid) {
  throw new Error(result.reason);
}

const binds = verifyTlsLeafBindsAttestation(result.document.public_key, tlsLeafDer);
if (!binds) {
  throw new Error("TLS leaf does not match attestation public_key");
}

Development

npm install
npm run build -w nitrum-node
npm test -w nitrum-node

Requires a Rust toolchain (native addon build). Full verification coverage lives in crates/verify.