Key Takeaways
- Five minutes, no account, no GPU rental. Download a real attestation bundle from a confidential VM, install one Python package, and check it on your own machine.
- Two independent roots of trust. The Intel TDX quote chains to Intel's root, the GPU tokens to NVIDIA's attestation service. Neither passes through us.
- Try to break it. A wrong challenge or one changed byte in the quote turns the result into NOT VERIFIED, and the output says which check failed.
Every confidential computing vendor says your workload runs in a sealed enclave. The useful question is whether you can check that claim without trusting the vendor. This tutorial does exactly that with a bundle captured on 9 October 2026 inside a VoltageGPU Confidential VM with one RTX PRO 6000 Blackwell GPU, rented through the public API like any customer would. You verify it with an open-source tool, on your laptop, with no network if you like.
What is in a bundle
Two proofs, both tied to the same manifest. The manifest holds a random challenge. The Intel TDX quote carries the SHA-512 of that manifest in its report_data, signed by the platform's quoting enclave with a key that chains to Intel. The NVIDIA tokens carry the SHA-256 of the same manifest as their nonce, signed by NVIDIA's attestation service after it checked the GPU's own report. The bundle also embeds the Intel collateral captured at attest time, which is what makes an offline check possible.
Step 1: download it and check the checksums
mkdir bundle && cd bundle curl -sO https://voltagegpu.com/blog/two-proofs/evidence/rtx6000b-2026-10-09/bundle.json curl -sO https://voltagegpu.com/blog/two-proofs/evidence/rtx6000b-2026-10-09/manifest.json curl -sO https://voltagegpu.com/blog/two-proofs/evidence/rtx6000b-2026-10-09/SHA256SUMS sha256sum -c SHA256SUMS --ignore-missing # manifest.json: OK # bundle.json: OK
The checksums were computed inside the VM before download. The folder also holds what the script printed inside the VM, nvidia-smi output and kernel details: README.txt.
Step 2: install the verifier
python3 -m venv .venv && . .venv/bin/activate pip install "voltage-verify>=0.2.1"
Step 3: verify, offline
voltage-verify verify bundle.json --offline \ --challenge 627ba9c51d4719038e917c7431675b183ac576c819d712178dc8a100f4409a45 \ --hwmodel GB20X --gpus 1
[PASS] manifest.format manifest is well formed [PASS] manifest.commitments bundle commitments match the manifest [PASS] manifest.challenge challenge is the one this verifier issued [PASS] tdx.structure TDX quote v4, TEE 0x81, 4940 bytes [PASS] tdx.report_data quote report_data equals SHA-512 of the manifest [PASS] tdx.signatures attestation key, QE binding, QE report and PCK chain verify up to the pinned Intel SGX Root CA [PASS] tdx.collateral TCB info and QE identity signed by Intel (bundle (fetched 2026-10-09T21:54:01+00:00)) [PASS] tdx.tcb platform TCB UpToDate, QE UpToDate, TDX_03 UpToDate [PASS] tdx.revocation PCK certificate not revoked (57 entries in CRL) [PASS] tdx.revocation PCK CA certificate not revoked (0 entries in CRL) [PASS] nvidia.signatures 2 NVIDIA-signed tokens verify, keys from the bundle chained to the pinned NRAS intermediate (offline) [PASS] nvidia.nonce NRAS eat_nonce equals SHA-256 of the manifest [PASS] nvidia.policy overall result true, every GPU: measurements ok, secure boot on, debug off, nonce matched, report signature and chain validated [PASS] nvidia.freshness token issued 0s from bundle creation TDX: MRTD eea8b6a814569a52bd1e12f6b869bb2d... TCB UpToDate QE UpToDate GPU: GPU-0 GB20X driver 595.71.05 vbios 98.02.9E.00.01 measurements success RESULT: VERIFIED
Read it in three groups. The manifest lines check that the bundle belongs to this manifest and to the challenge you passed. The tdx lines check the quote: its structure, that it embeds the manifest hash, its signature chain up to the pinned Intel SGX root, the Intel-signed platform status (TCB UpToDate) and that no certificate in the chain is revoked. The nvidia lines check the GPU side: NVIDIA's signatures, the nonce, and NVIDIA's own verdict on the GPU, measurements ok, secure boot on, debug off.
Step 4: try to fool it
A verifier that never says no is worth nothing. First, pretend the bundle answers a different challenge, which is what a replayed bundle looks like:
voltage-verify verify bundle.json --offline \ --challenge 0000000000000000000000000000000000000000000000000000000000000000 \ --hwmodel GB20X --gpus 1 # [FAIL] manifest.challenge challenge differs from the one this verifier issued (replay or foreign bundle) # RESULT: NOT VERIFIED (manifest.challenge)
Then change a single character inside the signed part of the quote:
# Change one base64 character inside the signed part of the TDX quote
python3 - <<'PY'
import json
b = json.load(open("bundle.json"))
q = b["tdx"]["quote_b64"]
b["tdx"]["quote_b64"] = q[:300] + ("A" if q[300] != "A" else "B") + q[301:]
json.dump(b, open("tampered.json", "w"))
PY
voltage-verify verify tampered.json --offline --challenge 627ba9c51d4719038e917c7431675b183ac576c819d712178dc8a100f4409a45 --hwmodel GB20X --gpus 1
# [FAIL] tdx.signatures quote signature does not verify with the attestation key
# RESULT: NOT VERIFIED (tdx.signatures)Both outputs above are the ones we got. Each failure names the exact check, so a broken bundle never passes as a vague warning.
What it proves, and what it does not
Proved: this manifest was bound by a genuine Intel TDX guest on a platform Intel rates up to date, with an NVIDIA GPU in confidential-computing mode whose measurements NVIDIA accepted, and the bundle has not been altered since.
Not proved by this check alone: which software ran in the guest (compare the printed MRTD and RTMR values with a reference you trust), and freshness relative to you, because here the challenge was drawn by our script. For your own guarantee, draw the challenge yourself on your own VM.
Do it on your own machine next
The quickstart rents the same tier in three API calls. Inside the VM, voltage-verify manifest --challenge auto and voltage-verify attest produce your own bundle, and the step-by-step run is in Confidential GPU by API alone. Every proof we publish, with the command to rerun it, is at /proofs.