About Attestium
Attestium is an open-source library and evidence format for remote attestation, built and maintained by the team behind Forward Email, an open-source, privacy-focused email service. It exists so that anyone can check that a service runs the code it has published.
Why it exists#
An open-source service asks its users to trust that the hosted version runs the published code. Publishing the source does not prove that. Attestium turns the claim into evidence a third party can check: an attesterThe component on the machine being checked. It collects facts and reports them; it never decides the result. on the server reports what it runs, and a verifierThe component that runs elsewhere, typically in CI: it sends a nonce, obtains references itself and compares. compares every fact with a public reference such as the git commit, the packages a lockfile pins or a signed release.
Forward Email uses Attestium, through Audit Status, to publish verification results for its own production servers on status.forwardemail.net. The whitepaper describes that deployment in its adoption section.
Who builds it#
| Maintainer | The Forward Email team, Forward Email LLC |
|---|---|
| Source code | github.com/attestium/attestium.com |
| Package | attestium on npm |
| License | MIT |
| Runtime | Node.js 18 or later, checks on Linux |
| Tests | End to end, with 100% statement, branch, function and line coverage required |
Attestium and Audit Status#
The two projects have different purposes and separate repositories. Attestium is the library and the format: the pieces to collect facts, the evidence schema and the checks against each kind of reference. Audit Status is a ready-made tool built on it: one binary with an attester and a verifier that runs in CI and publishes reports and a status badge.
Contact#
- Questions, bugs and feature requests: open an issue on GitHub.
- Security vulnerabilities: report them privately as described in the Forward Email security policy. The site also publishes
/.well-known/security.txt. - Contributions: pull requests are welcome, as are independent implementations of the evidence format in other languages.
This website#
The site is static HTML built from the repository by scripts/build-site.js and hosted on GitHub Pages. It sets no cookies and loads no analytics, trackers or third-party resources. See the privacy notice.