PVATTEST(1)

✨ pvattest(1) — the attestation manual, but make it make sense ✨

okay so this whole page lives in the Attestation Manual, and it's literally the main character of attestation tooling. Sit down, grab a strawberry 🍓, and let's get into it.

---

🎀 NAME 🎀

pvattest — create, perform, and verify attestation measurements. that's the whole vibe, no cap.

---

🦋 SYNOPSIS 🦋

pvattest [OPTIONS] <COMMAND>

---

🌸 DESCRIPTION 🌸

Create, perform, and verify attestation measurements for IBM Secure Execution guest systems. that's it, that's the mission 💅

---

👑 PVATTEST COMMANDS 👑

🧚 pvattest-create(1)

Create an attestation measurement request.

Create attestation measurement requests to attest an IBM Secure Execution guest. Only build attestation requests in a trusted environment such as your Workstation. To avoid compromising the attestation do not publish the attestation request protection key and shred it after verification. Every create will generate a new, random protection key 🔥

ngl bestie, that protection key is not for the group chat. Do not publish it, and shred it after verification fr fr.

🦋 pvattest-perform(1)

Send the attestation request to the Ultravisor (s390x only.)

Run a measurement of this system through /dev/uv. This device must be accessible and the attestation Ultravisor facility must be present. The input must be an attestation request created with pvattest create. Output will contain the original request and the response from the Ultravisor. Only available on s390x. 💀 like, only s390x. no gatekeeping, just facts.

⭐ pvattest-verify(1)

Verify an attestation response.

Verify that a previously generated attestation measurement of an IBM Secure Execution guest is as expected. Only verify attestation requests in a trusted environment, such as your workstation. Input must contain the response as produced by pvattest perform. The protection key must be the one that was used to create the request by pvattest create. Shred the protection key after the verification. The header must be the IBM Secure Execution header of the image that was attested during pvattest perform. The verify command solely verifies that the Attestation measurement is correct. It does not check for the content of additional data or user data. See pvattest check for policy checks after you verified the Attestation measurement. 🫶

okay so lowkey important: verify is a measurement girlie only — it does not look at the content of additional data or user data. that's pvattest check's job, periodt.

💜 pvattest-check(1)

Check if the attestation result matches defined policies.

After the attestation verification, check whether the attestation result complies with user-defined policies. the post-verify vibe check 😌✨

---

💅 OPTIONS 💅

• -v, --verbose — Provide more detailed output. give me all the lore 👀
• -q, --quiet — Provide less output. shhh, minimal energy 🤫
• --version — Print version information and exit. identity check, then bye ✌️
• -h, --help — Print help (see a summary with -h). like, the summary version 🎀

---

🌈 EXAMPLES 🌈

For details refer to the man page of the command. 💖

Create the request on a trusted system.

trusted:~$ pvattest create -k hkd.crt --cert CA.crt --cert ibmsk.crt --arpk arp.key -o attreq.bin

On the SE-guest, perform the attestation.

seguest:~$ pvattest perform attreq.bin attresp.bin

On a trusted system, verify that the response is correct. Here, the protection key from the creation and the SE-guest’s header is used to verify the measurement.

trusted:~$ pvattest verify -i attresp.bin --arpk arp.key --hdr se_guest.hdr
trusted:~$ echo $?
0

If the measurements do not match pvattest exits with code 2 and emits an error message. The SE-guest attestation failed. 😭

trusted:~$ pvattest verify -i wrongresp.bin --arpk arp.key --hdr se_guest.hdr
ERROR: Attestation measurement verification failed:
       Calculated and received attestation measurement are not the same.
trusted:~$ echo $?
2

that 2 is the "it's giving mismatch" exit code. if you see it, the verification did not slay. 💀

---

🐚 SEE ALSO 🐚

pvattest-create(1), pvattest-perform(1), pvattest-verify(1), pvattest-check(1)

---

aaaand that's the page bestie 💖 this iconic little manual is brought to you by s390-tools, dated 2026-08-11, and honestly it ate. go verify something, and remember to shred that key 🎀✨