Create Annotations

Annotations make attestation reports human-friendly.

Set vHSM environment variables

Note: If the vHSM Nitride plugin is enabled in a specific namespace, be sure to include the appropriate namespace in the X-Vault-Namespace header when making curl requests.

Example

export VAULT_ADDR=https://vhsm.enclaive.cloud/
export VAULT_TOKEN=$(cat ~/.vault-token)/
export VAULT_NAMESPACE="test/"

Create individual annotations

After verifying an attestation, you may have multiple abstract values—such as PCRs or measurements—that are not directly human-readable. Annotations let you map each of these values to a clear description.

For example:

PCR8 / Kernel Command Line / Enclaive Buckypaper v1.0.0 / 2025-06-20

Note: Firmware versions are already human-readable and typically do not need annotations.

Key naming caveat

Due to how the storage interface works for plugins, keys containing slashes (/) are interpreted as file system paths. For example, a key named milan/pcrs/0 will appear in a listing as milan/. However, you must still use the full key (milan/pcrs/0) when retrieving it.

Example : PCR 0 value

vHSM CLI

1. Create a file named values.json with these content:

{
  "key": "8aFCxTWG5+IiPsdOX00aSUKVax/ZrHj6/N+FEXqjRdo=",
  "value": "Kernel Command Line / Enclaive Buckypaper v1.0.0 / 2025-06-20"
}

1. Now use this command to create the annotation:

vhsm nitride annotation create @values.json

cURL

Output

vHSM CLI

Key        Value
---        -----
created    1755497783
key        8aFCxTWG5+IiPsdOX00aSUKVax/ZrHj6/N+FEXqjRdo=
value      Kernel Command Line / Enclaive Buckypaper v1.0.0 / 2025-06-20

cURL

List all annotations

To verify which annotations exist:

vHSM CLI

 vhsm nitride annotation list

cURL

Output

vHSM CLI

Keys
----
8aFCxTWG5+IiPsdOX00aSUKVax/

cURL

Note:

Keys with slashes (/) are treated as file system paths by the storage interface for plugins. For instance, a key named a/bwill be listed as a/, but you must use the complete key (a/b) when retrieving it.

Delete an annotation (optional)

To delete an annotation:

vHSM CLI

vhsm nitride annotation delete <key>

cURL

Replace <key> with the actual annotation key for example 8aFCxTWG5+IiPsdOX00aSUKVax/ZrHj6/N+FEXqjRdo=

Output

vHSM CLI

Success! Data deleted (if it existed) at: auth/ratls/annotations/<key>

cURL