# Attestium > Open-source Node.js library for remote attestation: evidence that a server runs the published code, checked against public references. Attestium is a Node.js library and an open, language-independent evidence format for runtime attestation: proving that production servers run the published source code. An attester collects facts about a server (files, installed packages, processes, containers, TPM quotes, confidential VM reports); a verifier compares every fact with references it fetches itself. It is built by the Forward Email team and is MIT licensed. Each link below is the Markdown source of a page. - [Overview](https://attestium.com/index.md): what Attestium is, an example, what it verifies and the evidence levels ## Documentation - [Attestium documentation](https://attestium.com/docs/index.md): The guides and reference for Attestium, the library for collecting and verifying runtime evidence: what each page covers and where to start. - [Getting started](https://attestium.com/docs/getting-started/index.md): Install Attestium, collect evidence about a directory and a running process on your own machine, check that evidence, and then build a minimal… - [Concepts](https://attestium.com/docs/concepts/index.md): This page explains the ideas behind Attestium: who produces evidence and who checks it, what evidence and references are, how a nonce and a… - [Ecosystems and references](https://attestium.com/docs/ecosystems/index.md): For each kind of code a server runs, this page says what the attester reads on the machine, which reference the verifier obtains, and what makes… - [Hardware-backed evidence](https://attestium.com/docs/hardware/index.md): Bind evidence to hardware so that a verifier does not have to trust the attester alone: TPM 2.0 quotes signed by an attestation key, enrollment… - [Forged answers](https://attestium.com/docs/forged-answers/index.md): The attester runs on the machine being checked. Whatever answers the verifier, the forced SSH command in Getting started and in Audit Status or… - [Signatures and trust](https://attestium.com/docs/signatures/index.md): A verifier explains a binary or a release by a reference someone signed. This page covers the trust modules: Sigstore bundles (DSSE envelopes… - [Other languages](https://attestium.com/docs/other-languages/index.md): Write an attester or a verifier in another language that interoperates with Attestium. The contract is SPEC.md and schema/evidence.schema.json… - [Security model and limits](https://attestium.com/docs/security/index.md): What Attestium defends against, what it cannot, and how to deploy it so its results mean what they say. Read this before you rely on a result: a… - [API reference](https://attestium.com/docs/api/index.md): Every module Attestium exports, with each function's signature, parameters, return value and errors, and a short example per module. Types are… ## Specification - [Attestium evidence format, version 2](https://attestium.com/spec/index.md): Evidence is what an attester reports about a machine so that a verifier, running somewhere else, can decide whether the machine runs what it… - [JSON Schema](https://attestium.com/schema/evidence.schema.json): the machine-readable definition of the evidence format, JSON Schema 2020-12 ## Guides - [Remote attestation for servers](https://attestium.com/remote-attestation/index.md): What remote attestation is, how an attester and a verifier prove what a server runs, and what each kind of evidence can and cannot show. - [Integration guide by language and stack](https://attestium.com/integrations/index.md): How to make a Node.js, Python, Ruby, Elixir, PHP, Java, .NET, Go, Rust or container deployment verifiable with Attestium, and what each check needs. - [Attestium compared with related approaches](https://attestium.com/comparison/index.md): How Attestium relates to reproducible builds, SLSA, in-toto, Sigstore, Keylime, System Transparency, TPM and TEE attestation, and file integrity tools. - [TPM attestation and IMA for Linux servers](https://attestium.com/tpm-attestation/index.md): TPM 2.0 quotes, attestation key enrollment and IMA log replay: how Attestium binds evidence to a machine and its boot state, and what root still controls. - [Supply chain verification at run time](https://attestium.com/supply-chain-verification/index.md): How runtime attestation relates to SLSA, Sigstore, in-toto and reproducible builds, and how Attestium checks deployed code against them. - [Confidential computing attestation with SEV-SNP and TDX](https://attestium.com/confidential-computing/index.md): Verify AMD SEV-SNP and Intel TDX confidential VM reports bound to fresh evidence: launch measurement, vendor certificate chains, debug policy and limits. - [An open evidence format for remote attestation](https://attestium.com/evidence-format/index.md): The Attestium evidence format, version 2: a language-independent JSON format with a JSON Schema, canonical digest, hardware binding and verifier obligations. - [Frequently asked questions](https://attestium.com/faq/index.md): Answers about Attestium: remote attestation, TPM requirements, languages, containers, root on the server, other tools such as SLSA and Keylime, and the license. ## Reference - [Glossary](https://attestium.com/glossary/index.md): Definitions of remote attestation terms: attester, verifier, nonce, evidence digest, TPM quote, PCR, IMA, SEV-SNP, TDX, Sigstore, SLSA and more. - [Attestium: A Framework for Verifiable Runtime Integrity](https://attestium.com/whitepaper/index.md): The Attestium whitepaper in HTML and PDF: architecture, evidence format, security and threat model, related work and adoption of runtime attestation. - [Whitepaper (PDF)](https://attestium.com/attestium-whitepaper.pdf): the same whitepaper as a PDF ## About - [About Attestium](https://attestium.com/about/index.md): Who builds Attestium, why it exists, how it relates to Audit Status, its license and source code, and how to contact the team or report a vulnerability. - [Privacy notice](https://attestium.com/privacy/index.md): attestium.com sets no cookies and loads no analytics, trackers or third-party resources. What the site stores in your browser and what its host logs. ## Optional - [All documentation in one file](https://attestium.com/llms-full.txt): every page above, concatenated - [Audit Status](https://auditstatus.com/llms.txt): a ready-made attester and verifier built on Attestium - [Source code](https://github.com/attestium/attestium.com): the library, tests and examples