Introduction#

nvattest is a command‑line tool built on the NVIDIA Attestation SDK to collect device attestation evidence and verify integrity for NVIDIA GPUs and Switches.

This CLI is built on a new and improved version of the NVIDIA nvtrust attestation SDK, redesigned to address key limitations. For the SDK documentation, see the NVIDIA Attestation C SDK.

  • Improved API flexibility and structure with better separation of concerns and reusability

  • Enhanced error handling and logging suitable for library use cases

  • Removed global state enabling proper unit testing and multi-instance support

  • Better security practices including secure JWT signing in local verifiers

  • Improved documentation with consistent, well-documented data structures

It supports:

  • Collecting evidence from live devices (via NVML or Corelib for GPUs, and NSCQ for Switch)

  • Verifying locally or via a remote verifier

  • Supplying pre‑serialized evidence from files (for offline/replay workflows)

  • Applying a custom Relying Party policy (Rego)

  • Emitting JSON output suitable for automation, with meaningful exit codes

Installation#

The CLI is built with CMake and links to the NVIDIA Attestation SDK (which is also built along with the CLI. The source for that lives here)

Prerequisites#

  • C++14 compiler

  • For GPU evidence collection:

    • libnvml is required for the NVML evidence source (used in CC mode). See Driver Installation for instructions.

    • Alternatively, Corelib can be used for GPU evidence collection outside of CC mode. See --gpu-evidence-source=corelib in the command reference.

  • libnvidia-nscq is required when compiling support for NVSwitch evidence collection. See here

  • For Confidential Computing (CC) attestation: Ubuntu 22.04 or 24.04 running in a CVM

From package manager#

Navigate to NVIDIA Attestation SDK Downloads and select the desired architecture and operating system.

Packages are available for multiple architectures (x86-64, aarch64) and operating systems.

The package nvattest provides the nvattest CLI tool, which depends on the library libnvat.

Note: Confidential Computing (CC) attestation is only supported on Ubuntu 22.04 and 24.04 within a CVM.

From source#

  • Install build dependencies

sudo apt-get update && \
sudo apt-get install -y cmake git pkg-config clang \
    libcurl4-openssl-dev libssl-dev libxml2-dev \
    libxmlsec1-dev libxmlsec1-openssl

# rust is a build dependency
# install from here - https://rust-lang.org/tools/install/
# For Linux/Unix or macOS, install Rust with:
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

  • Get the source

git clone https://github.com/NVIDIA/attestation-sdk.git
cd attestation-sdk/nv-attestation-cli

  • Build

make build-cli
make install-cli

Quick Start#

  • Show help

nvattest --help

  • Show version

nvattest version

  • Verify gpu evidence using local verifier

nvattest attest --device gpu --verifier local

  • Collect live gpu evidence

nvattest collect-evidence --device gpu

Next steps#

  • Refer to the Command Reference for detailed documentation of all commands and options.

  • Refer to the Development docs for development and contribution guidelines.