vta-tee 0.3.2

VTA TEE bootstrap — Nitro/SEV-SNP attestation providers, KMS attest/decrypt + storage-key derivation, the anchor MAC, and first-boot DID autogen
docs.rs failed to build vta-tee-0.3.2
Please check the build logs for more information.
See Builds for ideas on how to fix a failed build, or Metadata for how to configure docs.rs builds.
If you believe this is docs.rs' fault, open an issue.
Visit the last successful build: vta-tee-0.3.1

vta-tee

The VTA's TEE (Trusted Execution Environment) bootstrap subsystem, extracted from vta-service. Only the vta-enclave binary exercises it at runtime; the local/dev VTA builds it behind the tee feature.

  • provider / nitro / sev_snp / simulated / detect — attestation provider abstraction and the concrete backends.
  • kms_bootstrap — KMS attest/decrypt, JWT-fingerprint check, storage-key derivation, and the CMS unwrap (aws-lc-rs).
  • anchor — the DynamoDB-backed anti-rollback anchor MAC.
  • admin_bootstrap — Mode-B first-boot admin provisioning + the single-use carve-out.
  • did_autogen — first-boot DID autogeneration.
  • mnemonic_guard — the one-shot, timed, zeroized mnemonic export window.

Depends only on the extracted leaf/foundation crates (vti-common, vta-keyspaces, vta-config, vta-keys, vta-support) plus the AWS SDK / crypto stack — never on vta-service. vta-service re-exports it as crate::tee (behind the tee feature), so vta_service::tee::… keeps resolving for vta-enclave and every existing call site.

Part of the Verifiable Trust Infrastructure workspace. Apache-2.0.