DET-G7: GPU attestation went stale¶
The gap since the previous capture exceeds the allowed maximum, so the GPU ran unattested for longer than the re-attestation policy permits.
| Property | Value |
|---|---|
| Severity | medium |
| Platform | NVIDIA GPU CC |
| Group | tee |
| Log source | GPU evidence capture |
| Policy | P-04 |
| Related check | GPUCC-REATTEST-01: Attestation is continuous, not one-shot (post-attest drift is caught) |
Fires when¶
now - last successful GPU attestation > max allowed gap
How it runs¶
untrust detect --platform gpu-cc compares successive GPU evidence captures, each passed with --capture.
This rule needs:
untrust detect --max-gap-hours: Longest allowed gap between captures (DET-G7).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.