# Test Data for Confidential Space Example

This directory contains keys and tokens used for the Confidential Space
client/server example.

## ⚠️ Security Warning

**DO NOT USE THESE ARTIFACTS OUTSIDE OF THIS EXAMPLE.**

The private keys and tokens in this directory are for testing and demonstration
purposes only. They are checked into a public repository and provide no
security. They **MUST NOT** be used in any production environment.

## Artifact Descriptions

### Generated Artifacts

The following artifacts are generated by Bazel during the build process.

- **`token.jwt`**: A sample endorsement JWT. In a real-world scenario, this
  token would be fetched from the instance metadata server. For this example, it
  is generated during the build. The claims within the token are sourced from
  `claims.json`, and it is signed by a generated private key, whose certificate
  is `root_ca_cert.pem`.

- **`root_ca_cert.pem`**: A generated X.509 root certificate. In this example,
  it represents the root of trust for our simulated Confidential Space
  environment. The client uses this certificate to verify the signature on
  `token.jwt`.

### Static Artifacts

- **`claims.json`**: A JSON file containing the claims that are embedded into
  the `token.jwt` when it is generated. This allows for easily inspecting and
  modifying the token's payload for testing.

- **`binding_key.pem`**: A static private key used by the server for the secure
  session handshake (session binding). In a real deployment, this key would be
  generated within the TEE.
