Metadata-Version: 2.4
Name: attested-relay
Version: 0.2.0a1
Summary: Nitro-attested inner TLS over retry-safe HTTPS GET messages
License-Expression: MIT
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: cryptography>=45
Requires-Dist: pyOpenSSL>=25
Requires-Dist: cbor2>=5.6
Dynamic: license-file

# attested-relay

A Python client for an AWS Nitro-attested relay. It carries an inner TLS 1.3
connection in ordinary HTTPS GET messages. The outer HTTPS server transports
ciphertext; the inner peer is authenticated by Nitro before an upstream URL is
sent.

```python
from attested_relay import Relay

relay = Relay("https://YOUR-RELAY", expected_pcr0="YOUR_INDEPENDENTLY_VERIFIED_96_HEX_PCR0")
relay.verify()
response = relay.get("https://example.com/")
print(response.status_code, response.text)
```

The client checks the bundled AWS Nitro root, certificate chain, COSE signature,
fresh client nonce and timestamp, pinned image measurement, debug PCR rejection,
the actual inner TLS peer key, measured protocol parameters, Graviton5 readiness
and current epoch state. Do not obtain the PCR0 pin solely from an untrusted
relay operator; independently reproduce or audit the measured image.

The relay encrypts audit records under daily keys recoverable through public
seven-segment native RandomX v2.0.1 puzzles. The intended delay is approximate
sequential work from epoch activation, not a guaranteed wall-clock deadline or
proven VDF. A deployment requires actual calibration and reviewed measurements.
AWS Nitro and its attestation PKI are trusted.

This is an early prerelease. It does not silently accept a development server,
an arbitrary enclave measurement, or an expired/nonready live attestation. A
literal URL-fetch-only agent cannot independently calculate TLS or validate
cryptographic signatures without additional execution capability.

The separate `attested-relay-timelock` distribution bundles the native solver.
Archive verification is intentionally separate from live verification so that
old, correctly signed records remain verifiable after certificate expiration.

CLI:

```
attested-relay verify https://YOUR-RELAY --pcr0 YOUR_PIN
attested-relay get https://YOUR-RELAY https://example.com/ --pcr0 YOUR_PIN
```
