Skip to content

cloud attestation

NAME

phyware cloud attestation — TPM quotes and attestation reference values.

SYNOPSIS

phyware cloud attestation get                <QUOTE_ID>
phyware cloud attestation references list    [--include-retired]
phyware cloud attestation references add     --file FILE
phyware cloud attestation references retire  <REFERENCE_ID>

DESCRIPTION

  • get: a stored quote with its verification status, PCR selection and digest, TPM firmware and its comparison with reference values (reference_status: match, mismatch, no_reference).
  • references: known-good PCR sets per device class and release. Each is signed by a release key the server trusts; add posts {device_class, pcr_selection, pcr_digest, release, signer_key_id, signature} from --file. retire withdraws a release.

OPTIONS

Flag Type Required Default Env
--url string No http://localhost:8000 PHYCLOUD_URL
--api-key string No — PHYCLOUD_API_KEY
--output enum No table —
--include-retired bool No false —
--file path Yes (references add) — —

ARGUMENTS

Name Required Description
QUOTE_ID Yes Quote ID
REFERENCE_ID Yes Reference value ID

EXIT CODES

Code Meaning
0 Success
1 Generic / connection error
2 Authentication / authorisation error
3 Resource not found
4 Validation error
5 Server-side error

EXAMPLES

phyware cloud attestation get 7c9d... -o json | jq '{status, reference_status}'
phyware cloud attestation references list --include-retired
phyware cloud attestation references add --file reference.json
phyware cloud attestation references retire 1b2c...

AGENT NOTES

get needs events:read; references need devices:read / devices:write. Reference values must be signed by a release key configured on the server (PHYCLOUD_REFERENCE_KEYS_FILE).

SEE ALSO

ERRORS

Code Message Remediation
NOT_FOUND Quote / reference not found Check the ID
VALIDATION Request rejected Unsigned or badly signed value