Retrieve a remote attestation quote and certificates.

For retrieving a remote attestation quote over the whole cluster and the root certificate. The quote is an SGX-DCAP quote, you can learn more about DCAP in the official Intel DCAP orientation. Both the provider and the users of the confidential application can use this endpoint to verify the integrity of the Coordinator and the cluster at any time.

The returned certificate chain is PEM-encoded, contains the Coordinator's Root CA and Intermediate CA, and can be used for trust establishment between a client and the Coordinator. The quote is base64-encoded and can be used for Remote Attestation, as described in Verifying a deployment.

We provide a tool to automatically verify the quote and output the trusted certificate:

# Either install era for the current user
wget -P ~/.local/bin https://github.com/edgelesssys/era/releases/latest/download/era
chmod +x ~/.local/bin/era

# Or install it globally on your machine (requires root permissions)
sudo wget -O /usr/local/bin/era https://github.com/edgelesssys/era/releases/latest/download/era
sudo chmod +x /usr/local/bin/era

era -c coordinator-era.json -h $MARBLERUN -o marblerun.crt

On Ubuntu, ~/.local/bin is added to PATH only if the directory exists when the bash environment is initialized during login. You might need to re-login after creating the directory. Also, non-default shells such as zsh do not add this path by default. Therefore, if you receive command not found: era as an error message for a local user installation, either make sure ~/.local/bin was added to your PATH successfully, or simply use the machine-wide installation method.

The file coordinator-era.json contains the Packages information for the Coordinator. The example coordinator-era.json for our provided testing image can be downloaded from GitHub:

wget https://github.com/edgelesssys/marblerun/releases/latest/download/coordinator-era.json

{
  "Status": "success"
}