Evidence Bundle
Understand the public snapshot used to verify Stogas gateways.
The Stogas evidence bundle is a public, continuously updated snapshot of the confidential gateway fleet. It tells a verifier which gateway releases and connection keys can currently be trusted.
Verification happens locally. A client downloads one JSON file, checks its embedded evidence, and receives a trusted set of gateways without contacting GitHub, AMD, Sigstore, or drand.
Endpoints
Production https://evidence.stogas.ai/bundles/latest.json
Staging https://evidence-staging.stogas.ai/bundles/latest.jsonBoth endpoints support public browser GET and HEAD requests.
What a verified bundle provides
- Gateway releases proven to come from the public Stogas gateway repository and authorized by Stogas.
- Confidential gateway nodes running an approved release on AMD SEV-SNP hardware.
- The attested certificate, TLS, response-signing, and encryption keys for each trusted gateway.
- An
expires_atdeadline after which the snapshot must not be used.
The verifier returns fresh gateways under nodes. Cryptographically valid records that are too old for the selected freshness policy appear under excluded_nodes and are not trusted for connections.
Refreshing
Use expires_at as the only refresh deadline. There is no fixed polling interval.
stogas-verify serve normally begins fetching a replacement 40–70 seconds before expiry. It retries transient failures every 4–8 seconds and activates a replacement only after complete verification. Application SDKs leave retrieval and scheduling to the application.
Refreshing early does not shorten the current trust window: a verified replacement has its own later expiry. If no valid replacement is available by the current deadline, the client must stop opening new trusted connections.
Freshness policy
The default verifier policy accepts node evidence that remains no more than three minutes old through bundle expiry. Applications that require a tighter window may select one to three minutes.
Changing this policy affects which gateways enter the local trusted set. It does not change the validity of the bundle or other verified gateways.
For installation and code examples, continue with the verification quickstart. For the underlying guarantees, see the security model.