Skip to content

Project Structure

The repository contains five module groups:

  1. /supreme contains the Supreme integrated key and app attestation suite, building upon group 2.
  2. /serverside contains the server-side foundations with all the low-level logic to verify attestations.
  3. /utils contains the published Attestation Generator and the unpublished helpers used to analyse attestation errors in an IDE.
  4. /dependencies contains external dependencies that are not published to Maven Central or anywhere else and are thus compiled into group 2 or used for testing.
  5. /collector contains the source code for the Attestation Collector.

Quick navigation

  • For the recommended end-to-end flow (mobile client + verifier + unified wire format), start at the Integration Guide.
  • For using the server-side libraries directly (without integrated clients), see Usage without Integrated Clients.
  • For WARDEN / WARDEN-roboto migration notes, see Migration.

/supreme

Name Info
Supreme verifier Supreme verifier to be integrated into back-end services that want to remotely establish trust in mobile clients through key and app attestation.
Supreme client Supreme client to be integrated into mobile apps that need to prove their integrity and trustworthiness to back-end services.
Supreme common Commons containing shared client and verifier logic, data classes, etc.

/supreme/config-hoplite

Lightweight JVM helper module that adds Hoplite decoders for AttestationConfiguration and routes loading through the canonical configuration readers. See also Externalising Configuration.

Maven: at.asitplus.warden:config-hoplite

/supreme/config-spring

Lightweight JVM helper module that binds Spring Boot configuration into a map and feeds it through the canonical fromJsonObject() path. See also Externalising Configuration.

Maven: at.asitplus.warden:config-spring

/serverside

These modules can be used without the integrated Supreme attestation suite.

If you come from the legacy projects: WARDEN → Warden makoto (at.asitplus.warden:makoto, entry point Makoto) and WARDEN-roboto → Warden roboto (at.asitplus.warden:roboto, entry point Roboto).

Warden roboto Warden makoto
Android-only server-side key and app attestation library developed by A-SIT Plus. Used to be a separate project, now integrated here as a module. Unified server-side Android and iOS key and app attestation library providing a common API to remotely establish trust in Android and iOS devices. Depends on Warden roboto and Vincent Haupert's excellent DeviceCheck/AppAttest library.
Location: /serverside/roboto Location: /serverside/makoto
Maven: at.asitplus.warden:roboto Maven: at.asitplus.warden:makoto

/utils

This group contains the unpublished diagnostic utilities described in Debugging, plus the published attestation generator.

/utils/generator

Creates Android key attestation statements and matching factory-provisioned or remotely provisioned certificate chains. It is intended for automated tests, reproducing device quirks, and feeding malformed statements to the parser without having to convince a real device to produce them. See Attestation Generator for the Kotlin API and stand-alone command-line tool.

Maven: at.asitplus.warden:generator

/dependencies

Google released reference Android attestation parsers and PKIX certificate-path validators, but not complete verifiers for remotely establishing trust in Android devices. These artefacts are unavailable from Maven Central, so Warden Supreme includes them as Git submodules and compiles them into Warden roboto.

The group also contains an HTTP proxy used for testing. It is not included in release artefacts.

/collector

This group contains the source code for the Attestation Collector: a quick-and-dirty Compose Multiplatform (CMP) app and its Ktor-based back-end. The collector makes it easy to produce and inspect an Android attestation without first integrating Warden Supreme into another app and back end.

The collector is currently Android-only because iOS apps cannot be deployed outside Apple's App Store. iOS app sources exist in the repository, but the collector's business logic is currently implemented only for Android.