decode

Decode and display an attestation report in human-readable format.

vhsm nitride attestation decode <path-or-json>

---

Examples

Decode from file:

vhsm nitride attestation decode @attestation.json

Decode raw JSON string:

vhsm nitride attestation decode '{"Version":1,"Provider":"sev-snp-raw","Attestation":{...}}'

---

Input format

The command expects an attestation wrapper JSON with the following structure:

{
  "Version": 1,
  "Provider": "sev-snp-raw",
  "Attestation": {
    "Report": "<base64-encoded-snp-report>",
    ...
  }
}

Supported providers

Provider	Description
sev-snp-raw	Raw SEV-SNP attestation (VMPL 0)
sev-snp-vtpm	SVSM-based SEV-SNP attestation (VMPL 1)
aws-sev-snp-raw	AWS Nitro SEV-SNP attestation
gcp-sev-snp-raw	Google Cloud SEV-SNP attestation
azure-sev-snp-vtpm	Azure SEV-SNP with vTPM

Output

The command outputs a human-readable representation of the SNP report:

SNP Report:
    Version: 2
    Guest SVN: 0
    Policy:
        ABI Minor: 31
        ABI Major: 0
        Symmetric Multithreading enabled: true
        Migration agent enabled: false
        Debugging enabled (host decryption of VM): false
        Single socket enabled: false
    Family ID: 00000000000000000000000000000000
    Image ID: 00000000000000000000000000000000
    VMPL: 0
    Signature Algorithm: 1
    Current TCB:
        Secure Processor bootloader SVN: 3
        Secure Processor operating system SVN: 0
        SVN 4 (reserved): 0
        SVN 5 (reserved): 0
        SVN 6 (reserved): 0
        SVN 7 (reserved): 0
        SEV-SNP firmware SVN: 8
        Microcode SVN: 115
    Platform Info:
        Symmetric Multithreading enabled (SMT): true
        Transparent secure memory encryption (TSME): true
    Signer Info:
        Author Key Enabled: false
        Chip ID Masking: false
        Signing Type: VCEK
    Report Data: <64 bytes hex>
    Measurement: <48 bytes hex>
    Host Data: <32 bytes hex>
    ID Key Digest: <48 bytes hex>
    Author Key Digest: <48 bytes hex>
    Report ID: <32 bytes hex>
    Report ID MA: <32 bytes hex>
    Reported TCB:
        ...
    Chip ID: <64 bytes hex>
    Committed TCB:
        ...
    Current Build: 3
    Current Minor: 51
    Current Major: 1
    Committed Build: 3
    Committed Minor: 51
    Committed Major: 1
    Launch TCB:
        ...
    Signature (DER):
        <signature bytes hex>