chio attest

chio attest

Verify offline attestation evidence and buyer proof packages.

chio attest [OPTIONS] <COMMAND>

• chio attest buyer Package, verify, and explain buyer-facing attestation evidence.
• chio attest supply-chain Verify Sigstore-backed supply-chain attestations.
• chio attest runtime-quote Verify runtime quote evidence.

chio attest buyer

Package, verify, and explain buyer-facing attestation evidence.

chio attest buyer [OPTIONS] <COMMAND>

• chio attest buyer packet Build a buyer review packet from a local runtime output directory.
• chio attest buyer verify Verify a buyer review package against verifier-owned inputs.
• chio attest buyer verify-proof Verify a Chio attest proof package directly.
• chio attest buyer verify-packet Verify a hash-only buyer packet as unresolved unless full DSSE review hydrates it.
• chio attest buyer explain Render a buyer review report as JSON or plain text.

chio attest buyer packet

Build a buyer review packet from a local runtime output directory.

chio attest buyer packet [OPTIONS] --run-output <DIR> --out <PATH>

• --run-output <DIR> Runtime output directory containing buyer review artifacts. Required.
• --out <PATH> Output path for buyer attestation review packet JSON. Required.

chio attest buyer verify

Verify a buyer review package against verifier-owned inputs.

chio attest buyer verify [OPTIONS] --package <PATH> --trust-bundle <PATH> --context <PATH> --report <PATH>

• --package <PATH> Buyer attestation review package JSON. Required.
• --trust-bundle <PATH> Verifier-owned trust bundle JSON. Required.
• --context <PATH> Verifier context JSON. Required.
• --report <PATH> Output path for buyer attestation review report JSON. Required.

chio attest buyer verify-proof

Verify a Chio attest proof package directly.

chio attest buyer verify-proof [OPTIONS] --package <PATH> --trust-bundle <PATH> --context <PATH> --report <PATH>

• --package <PATH> Chio attest proof package JSON. Required.
• --trust-bundle <PATH> Verifier-owned trust bundle JSON. Required.
• --context <PATH> Verifier context JSON. Required.
• --report <PATH> Output path for verifier report JSON. Required.

chio attest buyer verify-packet

Verify a hash-only buyer packet as unresolved unless full DSSE review hydrates it.

chio attest buyer verify-packet [OPTIONS] --packet <PATH> --lineage-statement <PATH> --continuation <PATH> --admission-report <PATH> --bilateral-invocation <PATH> --report <PATH>

• --packet <PATH> Buyer attestation packet JSON. Required.
• --lineage-statement <PATH> Receipt lineage statement JSON. Required.
• --continuation <PATH> Cross-kernel continuation JSON. Required.
• --admission-report <PATH> Cross-boundary admission report JSON. Required.
• --bilateral-invocation <PATH> Bilateral invocation JSON. Required.
• --report <PATH> Output path for buyer attestation verification report JSON. Required.

chio attest buyer explain

Render a buyer review report as JSON or plain text.

chio attest buyer explain [OPTIONS] --report <PATH> --out <PATH>

• --report <PATH> Buyer attestation review report JSON. Required.
• --format <FORMAT> Explanation format. Default text. Values json, text.
• --out <PATH> Output path for explanation. Required.

chio attest supply-chain

Verify Sigstore-backed supply-chain attestations.

chio attest supply-chain [OPTIONS] <COMMAND>

chio attest supply-chain verify

Verify a Sigstore bundle against the artifact bytes and expected identity.

chio attest supply-chain verify [OPTIONS] --artifact <PATH> --bundle <PATH> --issuer-san-regex <REGEX> --issuer-oidc <URL>

• --artifact <PATH> Artifact bytes covered by the Sigstore bundle. Required.
• --bundle <PATH> Sigstore bundle JSON. Required.
• --issuer-san-regex <REGEX> Fulcio certificate identity SAN regex expected on the signing cert. Required.
• --issuer-oidc <URL> Fulcio certificate OIDC issuer expected on the signing cert. Required.
• --report <PATH> Optional output path for a verification report. Defaults to stdout.

chio attest runtime-quote

Verify runtime quote evidence.

chio attest runtime-quote [OPTIONS] <COMMAND>

chio attest runtime-quote verify

Verify runtime quote evidence through chio-attest-verify.

chio attest runtime-quote verify [OPTIONS] --kernel-public-key <KEY> --receipt-root <HEX>

• --kernel-public-key <KEY> Kernel signing public key in Chio canonical text form. Required.
• --receipt-root <HEX> Receipt root as 64 lowercase hex characters. Required.
• --report-data <HEX> Optional observed runtime quote report-data bytes for diagnostic comparison.
• --tee-kind <KIND> TEE backend that produced the quote. Values intel-tdx, amd-sev-snp, aws-nitro.
• --quote <PATH> Raw quote bytes to verify.
• --collateral <PATH> Backend collateral JSON used to verify the quote.
• --report <PATH> Optional output path for a verification report. Defaults to stdout.