#!/usr/bin/env bash
# Phase 4 : quote Intel TDX + NRAS liees a un manifeste dont le defi est tire HORS de la VM
# (variable CHALLENGE), avec voltage-verify, comme le script publie mais en mode multi-GPU.
set -uo pipefail
export PATH="$HOME/.local/bin:$PATH"
cd "$HOME"
case "${CHALLENGE:-}" in
  [0-9a-f][0-9a-f]*) ;;
  *) echo "CHALLENGE missing or not hex" >&2; exit 4 ;;
esac
sudo rm -f manifest.json bundle.json
echo "=== 1. manifest with the challenge drawn outside the VM ==="
voltage-verify manifest --challenge "$CHALLENGE" \
  --statement "VoltageGPU h200-xlarge Confidential VM (8x H200, NVIDIA Protected PCIe mode), proof run of 2026-11-04" \
  --extra run=ppcie-8x-h200-2026-11-04 -o manifest.json 2>&1
echo "=== 2. attestation (TDX quote + NRAS), as root, --mode multi-gpu-ppcie ==="
sudo env PATH="$PATH" PYTHONPATH="$(python3 -c 'import site;print(site.getusersitepackages())')" \
  voltage-verify attest --manifest manifest.json --mode multi-gpu-ppcie -o bundle.json 2>&1
echo "attest exit code: $?"
ls -l manifest.json bundle.json 2>&1
echo "=== 3. verification INSIDE the VM (informational; the one that counts is done outside) ==="
voltage-verify verify bundle.json --challenge "$CHALLENGE" --hwmodel GH100 --gpus 8 2>&1
echo "verify exit code: $?"
sha256sum manifest.json bundle.json 2>&1
echo "=== end of phase 4 ==="