Repository navigation
docs: explain NitroTPM runner authorization - #100
Merged
Merged
Conversation
aledbf
force-pushed
the
docs/nitrotpm-attestation
branch
2 times, most recently
from
November 10, 2026 14:52
f657b30 to
87622f4
Compare
…site is The page drew an SVG of its own and a component to show it, which the build refuses: a component the Markdown twin cannot say. The module draws it now, in D2 with the installation's palette and AWS's icons (spin-stack/spin-terraform-aws#110), and the page shows it with Figure, whose words the twin carries. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
aledbf
force-pushed
the
docs/nitrotpm-attestation
branch
from
November 11, 2026 23:32
87622f4 to
64dbdbb
Compare
…ys what the join does The page showed <Figure name="nitrotpm">, which refgen draws from spin-terraform-aws's docs/diagrams/nitrotpm.svg. That file is on the module's main (21ba51f) and in no release, and the site pins v20261027.02, so the build stopped at /llms-full.txt. Pinning the module at main would move every AWS page onto an unreleased module (24 refgen findings, instance_types among them), so the figure returns with the module's next release. Read against spin v20261110.01 and spin-terraform-aws v20261027.02: - OpenTofu, not the control plane, writes host_attestation.runner (config.tf), each build with what its release signed; a build with nothing signed is not admitted (join.go admitted). - A runner joins at every boot, again only from the same instance and the same build. - The builds accepted are the installed release's revisions not revoked (attested_key.tf). - The limits link spin's "What this does not protect": user data is unmeasured, and a control plane running other code. - reads stamped at v20261110.01, with docs/security/README.md and volume_keys.tf added. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The diagram
The page has no figure for now. Its picture is spin-terraform-aws's
docs/diagrams/nitrotpm.svg(spin-terraform-aws#110), which is on the module's main and in no release yet, and the site pins v20261027.02. Pinning the module at main would move every AWS page onto an unreleased module, so the<Figure name="nitrotpm">and itsdiagramsentry intools/refgen/diagrams.goreturn with the next spin-terraform-aws release.Validation
task checkexits 0;task reference:checkexits 0🤖 Generated with Claude Code