Replay the reference run in five commands
The bundle below was captured on 12 September 2026 on a VoltageGPU h100-xlarge Confidential VM (8x H100, NVIDIA Protected PCIe mode). Every check passes on a laptop: platform TCB UpToDate, Quoting Enclave UpToDate, eight GH100 devices with measurements success, then every selftest mutation rejected (nine with 0.2.1). The last command replays the same checks from the Intel and NVIDIA collateral embedded in the bundle, with no network. Re-checked with 0.2.2 on 21 October 2026, online and offline: RESULT: VERIFIED, debug mode off. Every published run this tool re-verifies, with its command, is indexed at /proofs.
nvidia-smi reports CC State: OFF next to Multi-GPU Mode: Protected PCIe; that is the normal reading for that mode and it is kept verbatim in the bundle’s environment section. NVIDIA’s service attested each of the eight GPUs individually (measurements, secure boot, debug off, on your nonce). The NVSwitch fabric is not attested, and this is not the single-GPU CC State: ON mode of the H200 VM. The verifier’s policy checks exactly those per-GPU claims and asserts nothing more.pip install "voltage-verify>=0.2.3" curl -O https://voltagegpu.com/blog/two-proofs/voltage-verify/bundle-8xh100-2026-09-12.json voltage-verify verify bundle-8xh100-2026-09-12.json --challenge ef7f54c160627ee536a02b5e73896ac4b1ac2cdefdb7cfaaf2366a7d33cc8731 --hwmodel GH100 --gpus 8 voltage-verify selftest bundle-8xh100-2026-09-12.json voltage-verify verify bundle-8xh100-2026-09-12.json --challenge ef7f54c160627ee536a02b5e73896ac4b1ac2cdefdb7cfaaf2366a7d33cc8731 --offline
What it checks
You write a manifest: the container image digest (resolved from the registry without a pull), the digests of your model or files, a free-text statement and a fresh 32-byte challenge. Two hashes of that manifest become the commitments: SHA-512 goes into the TDX quote as report_data, SHA-256 is the nonce NVIDIA’s attestation service signs over. Back on your machine, verify checks:
- the quote structure, the attestation key signature, the Quoting Enclave binding and signature, and the PCK certificate chain up to the pinned Intel SGX Root CA;
- the platform TCB level and the TDX module identity against Intel’s signed TCB info, the Quoting Enclave identity, and both revocation lists;
- NVIDIA’s ES384 tokens against the NRAS JWKS carried by the bundle (since 0.2.1 each key is trusted only through its x5c chain to a pinned NRAS intermediate, 004 or, since 0.2.3, 005, and must be listed once), the per-GPU claims (measurements ok, secure boot on, debug off), the nonce and the freshness window;
- above all, that both proofs carry the commitments recomputed from your manifest, on your challenge.
selftest then applies nine mutations (image digest, artifact, manifest field, replayed challenge, one byte of the quote, one GPU claim, and since 0.2.1 tokens re-signed with a key shipped in the bundle, a signing key id listed twice, key chains stripped) and expects nine rejections.
The quote fields behind the tdx.* lines (MRTD, RTMR0 to RTMR3, REPORTDATA, the debug bit, the TCB status and the certificate chain) are read one by one on a published bundle, each with what it proves and what it does not, in Read an Intel TDX Quote, Field by Field.
Use it on your own VM
# your machine: describe the workload, get a fresh challenge voltage-verify manifest --image ghcr.io/you/app:1.4.2 --artifact model.safetensors -o manifest.json # inside the Confidential VM, as root sudo -E python -m voltage_verify attest --manifest manifest.json -o bundle.json # your machine again voltage-verify verify bundle.json --challenge <printed by manifest> voltage-verify selftest bundle.json
Inside the VM, install the NVIDIA SDK first (pip install nv-attestation-sdk nvidia-ml-py), then the tool with --no-deps; details and the multi-GPU notes are in ATTEST_ON_VM.md and in the Confidential VM documentation.
Published files
Mirrored from the GitHub release with their SHA-256 sums (SHA256SUMS). The wheel and the source archive are the same bytes as on PyPI.
Where it fits
- Two proofs, yours, not ours: the article that shows both attestations generated by the tenant, with the raw outputs.
- Evidence folder: the 4 and 10 September artifacts the test suite replays.
- Evidence repository: every dated bundle (H200, 8x H100, RTX PRO 6000, the NVSwitch limit) as one git repository, re-verifiable with this tool.
- Publish your own bundle: your voltage-verify bundle on a page of its own, unlisted and removable.
- Confidential VM documentation: the manual five-step attestation and this tool next to it.
- GitHub for source, tests, issues and releases; found a hole? Open an issue or write to contact@voltagegpu.com, the report is credited by name.
- Press and mentions: where voltage-verify and the evidence have been listed or discussed in public, with dates.