CHchutes
Servers

Verify Boot Attestation

Changed on

Verify boot attestation and return LUKS passphrase.

Both VM generations reach this route, so the hotkey proof is EXTRACTED rather than required: a presented signature is verified here and 401s if it does not hold, but its absence is left for the handler to judge once the quote names the attested image. See process_boot_attestation, which requires a proof from any image whose measured initramfs ships the signer.

Verifies the TDX quote against the expected boot measurements and returns the LUKS passphrase for disk decryption if valid. For VMs >= 1.3.0 it also returns a luks_quote_nonce for the following runtime call (POST /provision on 1.4.0+, POST /luks/attest on 1.3.x); for 1.4.0+ it additionally returns root_next + root_confirm_nonce and the VM's ephemeral auth SS58.

post/servers/boot/attestation

Request

  • Base URL
    https://api.chutes.ai (the document declares no server; this is the origin it was published from)
  • URL
    https://api.chutes.ai/servers/boot/attestation
  • Auth
    none declared

Headers

X-Chutes-Noncestring nullable
X-Chutes-Hotkeystring nullable

Request body

quotestring required

Base64 encoded TDX quote

miner_hotkeystring required

Miner hotkey that owns this VM

vm_namestring required

VM name/identifier

first_bootboolean

True when the VM detected a fresh (re-downloaded) image via its LUKS2 header token

Response

Successful Response

string required

Changes

  • 23e8895b217dRevision changes
    • breaking

      the response's body type changed from object to string for status

    • breaking

      removed the required property from the response with the status

    • warning

      removed the optional property from the response with the status

    • warning

      removed the optional property from the response with the status

    • warning

      removed the optional property from the response with the status

    • warning

      removed the optional property from the response with the status

    • info

      added the optional property // to the response with the status

    • info

      added the optional property // to the response with the status

  • 37e3c562aa28Revision changes
    • warning

      deleted the header request parameter X-Chutes-Signature

    • warning

      deleted the header request parameter X-Operator-Signature