PVATTEST-CHECK(1)

💖 NAME 💖

okay bestie, welcome to PVATTEST-CHECK(1) — straight from the Attestation Manual 💅. pvattest-check checks if the attestation result matches the policies you defined. No cap. 🫶

🦋 SYNOPSIS 🦋

pvattest check [OPTIONS] [IN] [OUT]

🌸 DESCRIPTION 🌸

After the attestation verification, this bestie checks whether the attestation result complies with user-defined policies. Verification first, policy vibe check second, periodt. ✨

🎀 OPTIONS 🎀

• <IN> — specify the attestation response to check whether the policies are validated. 💖
• <OUT> — specify the output file for the check result. 🎀
• -i, --input <FILE> — specify the attestation response to check whether the policies are validated. 💅
• -o, --output <FILE> — specify the output file for the check result. ✨
• --format <FORMAT> — define the output format. [default: 'yaml']. Possible values:
  • yaml: use yaml format.
• -k, --host-key-document <FILE> — use FILE to check for a host-key document. Verifies that the attestation response contains the host-key hash of one of the specified host keys. The check fails if none of the host-keys match the hash in the response. Can be specified multiple times. 🔥
• --host-key-check <HOST_KEY_CHECKS> — define the host-key check policy. By default, all host-key hashes are checked, and it is not considered a failure if a hash is missing from the attestation response. Use this policy switch to trigger a failure if no corresponding hash is found. Requires at least one host-key document. 😭 Possible values:
  • att-key-hash: check the host-key used for the attestation request.
  • boot-key-hash: check the host-key used to boot the image.
• -u, --user-data <FILE> — check if the provided user data matches the data from the attestation response. 🦋
• --secret <FILE> — use FILE to include as a successful Add-secret request. Checks whether the attestation response contains the hash of all specified add-secret request tags. The hash depends on the order in which the secrets were added. So if the order you add them here is different from the order the add-secret requests were sent to the UV, this check fails even though the same secrets are in the UV secret store. Can be specified multiple times. 💀
• --secret-store-locked <BOOL> — check whether the guest’s secret store is locked or not. Compares the hash of the secret store state to the one calculated by this option and optionally specified add-secret-requests in the correct order. If the attestation response does not contain a secret store hash, this check fails. Required if add-secret-requests are specified. 💜
• --firmware — check whether the firmware is supported by IBM. Requires internet access. 🌈
• --firmware-check-version, --fw-ver <FIRMWARE_CHECK_VERSION> — specify the firmware verification request version. [default: '1']. Possible values:
  • 1: use firmware check API version 1.0.
  • 2: use firmware check API version 2.0.
• --firmware-verify-url <URL> — specify the endpoint to use for firmware version verification. Use an endpoint you trust. Requires the --firmware option. 🧚
• -h, --help — print help (see a summary with -h). 👑

🌟 SEE ALSO 🌟

pvattest(1) — go say hi to the main character. 👑

---

Shoutout to s390-tools, dated 2026-08-11 — that’s the source/version and date, bestie. bye! 🫶💖