9f6e6f7fb3
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
Signals CI & Image / signals-ci (push) Has been cancelled
Policy Lint & Smoke / policy-lint (push) Has been cancelled
Policy Simulation / policy-simulate (push) Has been cancelled
SDK Publish & Sign / sdk-publish (push) Has been cancelled
AOC Guard CI / aoc-guard (push) Has been cancelled
AOC Guard CI / aoc-verify (push) Has been cancelled
Concelier Attestation Tests / attestation-tests (push) Has been cancelled
devportal-offline / build-offline (push) Has been cancelled
2.2 KiB
2.2 KiB
Attestor Air-Gap Guide (DOCS-ATTEST-75-001)
Last updated: 2025-11-25
Goal
Run attestation verification entirely offline while keeping determinism and tenant safety intact.
Inputs & prerequisites
- Trust bundle: DSSE signing keys + certificate chains packaged under
out/offline/attestor/trust-bundle/(hash manifest included). - Transparency checkpoints (optional): Rekor or equivalent checkpoints mirrored to
out/offline/attestor/transparency/. - Authority scopes:
attest:verifyand tenant scoping (X-Stella-Tenant) are still required even in sealed mode. - No external calls: Outbound network must be disabled; attestor uses only the provided bundles.
Configuration (sealed mode)
Set the following environment flags on WebService/Worker:
Attestor__Offline__Enabled=trueAttestor__TrustBundlePath=/app/offline/trust-bundleAttestor__Transparency__CheckpointPath=/app/offline/transparency(optional)Attestor__Verification__DisableHttpFetch=true
Mount the bundle directories read-only; keep hashes alongside the payloads for audit.
Verification flow (offline)
- Client submits a DSSE envelope to
/api/v1/attestations/verifywith tenant header. - Service loads keys from the offline trust bundle; issuer lookup is strictly local.
- If transparency data is present, the server verifies inclusion against the mirrored checkpoint; otherwise it records
transparency=skippedin the rationale. - Result is returned with deterministic fields:
subject,statementDigest,verified=true|false,transparency=passed|skipped|failed,rationale[].
Determinism safeguards
- All hashes are lowercase hex; timestamps are UTC ISO-8601.
- Sorting: multiple statements are ordered by
subjectthenstatementDigest. - No network retries or clock drift compensation; rely on bundle timestamps.
Operations checklist
- Refresh trust bundle hashes before each deploy; compare against signed manifest.
- Rotate keys by replacing the bundle atomically; restart workers to pick up changes.
- Record verification results in the delivery ledger for replay/audit.
Related docs
docs/modules/attestor/overview.mddocs/modules/attestor/keys-and-issuers.mddocs/modules/attestor/transparency.md