Replay the reference run in five commands
The bundle below was captured on 12 September 2026 on a VoltageGPU h100-xlarge Confidential VM (8x H100, NVIDIA Protected PCIe mode). Every check passes on a laptop: platform TCB UpToDate, Quoting Enclave UpToDate, eight GH100 devices with measurements success, then six mutations rejected. The last command replays the same checks from the Intel and NVIDIA collateral embedded in the bundle, with no network.
nvidia-smi reports CC State: OFF next to Multi-GPU Mode: Protected PCIe; that is the normal reading for that mode and it is kept verbatim in the bundle’s environment section. NVIDIA’s service attested each of the eight GPUs individually (measurements, secure boot, debug off, on your nonce). The NVSwitch fabric is not attested, and this is not the single-GPU CC State: ON mode of the H200 VM. The verifier’s policy checks exactly those per-GPU claims and asserts nothing more.pip install voltage-verify curl -O https://voltagegpu.com/blog/two-proofs/voltage-verify/bundle-8xh100-2026-09-12.json voltage-verify verify bundle-8xh100-2026-09-12.json --challenge ef7f54c160627ee536a02b5e73896ac4b1ac2cdefdb7cfaaf2366a7d33cc8731 --hwmodel GH100 --gpus 8 voltage-verify selftest bundle-8xh100-2026-09-12.json voltage-verify verify bundle-8xh100-2026-09-12.json --challenge ef7f54c160627ee536a02b5e73896ac4b1ac2cdefdb7cfaaf2366a7d33cc8731 --offline
What it checks
You write a manifest: the container image digest (resolved from the registry without a pull), the digests of your model or files, a free-text statement and a fresh 32-byte challenge. Two hashes of that manifest become the commitments: SHA-512 goes into the TDX quote as report_data, SHA-256 is the nonce NVIDIA’s attestation service signs over. Back on your machine, verify checks:
- the quote structure, the attestation key signature, the Quoting Enclave binding and signature, and the PCK certificate chain up to the pinned Intel SGX Root CA;
- the platform TCB level and the TDX module identity against Intel’s signed TCB info, the Quoting Enclave identity, and both revocation lists;
- NVIDIA’s ES384 tokens against the NRAS JWKS, the per-GPU claims (measurements ok, secure boot on, debug off), the nonce and the freshness window;
- above all, that both proofs carry the commitments recomputed from your manifest, on your challenge.
selftest then applies six mutations (image digest, artifact, manifest field, replayed challenge, one byte of the quote, one GPU claim) and expects six rejections.
Use it on your own VM
# your machine: describe the workload, get a fresh challenge voltage-verify manifest --image ghcr.io/you/app:1.4.2 --artifact model.safetensors -o manifest.json # inside the Confidential VM, as root sudo -E python -m voltage_verify attest --manifest manifest.json -o bundle.json # your machine again voltage-verify verify bundle.json --challenge <printed by manifest> voltage-verify selftest bundle.json
Inside the VM, install the NVIDIA SDK first (pip install nv-attestation-sdk nvidia-ml-py), then the tool with --no-deps; details and the multi-GPU notes are in ATTEST_ON_VM.md and in the Confidential VM documentation.
Published files
Mirrored from the GitHub release with their SHA-256 sums (SHA256SUMS). The wheel and the source archive are the same bytes as on PyPI.
Where it fits
- Two proofs, yours, not ours: the article that shows both attestations generated by the tenant, with the raw outputs.
- Evidence folder: the 4 and 10 September artifacts the test suite replays.
- Confidential VM documentation: the manual five-step attestation and this tool next to it.
- GitHub for source, tests, issues and releases; found a hole? Open an issue or write to contact@voltagegpu.com, the report is credited by name.