pub struct NvidiaEatKey(/* private fields */);Expand description
Resolves the NVIDIA NRAS EAT verification key. Wraps jsonwebtoken so
callers (the daemon, the CLI, third parties) don’t take a direct
jsonwebtoken dependency. NVIDIA rotates its signing keys, so the right one
is selected per request by the EAT’s kid — use Self::fetch_jwks
(NVIDIA_NRAS_JWKS_URL) for that. Self::from_ec_pem pins a single key.
Pin/fetch in the trusted process — never through the untrusted cloud (§1.5).
Implementations§
Source§impl NvidiaEatKey
impl NvidiaEatKey
Sourcepub fn from_ec_pem(pem: &[u8]) -> Result<Self, VerifyError>
pub fn from_ec_pem(pem: &[u8]) -> Result<Self, VerifyError>
Pin a single EC public-key PEM (NRAS signs EATs with ES384/ES256). Used
regardless of the EAT kid — fragile against NVIDIA’s key rotation;
prefer Self::fetch_jwks.
Sourcepub fn from_jwks_json(bytes: &[u8]) -> Result<Self, VerifyError>
pub fn from_jwks_json(bytes: &[u8]) -> Result<Self, VerifyError>
Build a kid-keyed resolver from an NVIDIA JWKS document. Keys without a
kid or in an unsupported form are skipped; errors if none are usable.
Sourcepub async fn fetch_jwks(url: &str) -> Result<Self, VerifyError>
pub async fn fetch_jwks(url: &str) -> Result<Self, VerifyError>
Fetch NVIDIA’s JWKS and build a kid-keyed resolver. Online; the daemon
calls NVIDIA directly (Decision 4).
Sourcepub fn unconfigured() -> Self
pub fn unconfigured() -> Self
No key configured — every GPU check fails closed (gpu_nras_pass=false),
never a silent pass.