A registration-and-voting service normally asks users to trust whoever runs the server. This reference implementation removes most of that trust by running the critical steps inside Google Confidential Space — a cloud environment that cryptographically attests exactly which code is running — so an outsider can verify who registered, that every ballot was authorized for exactly one question, and that the tally matches the accepted ballots.
Registered members are published as a signed list, together with the attested receipts from their registration. Votes live in a separate record that contains no names or account identifiers, and nothing links one person's votes across different questions. A member can optionally attach their name to a vote with a signature and detach it again later. Deleting an account removes the person from the public list and blocks future votes, while their already-counted anonymous votes remain verifiable.
What the attestation proves — and doesn't: it proves registration and vote authorization ran inside the exact published code, against the exact published member list, and that only casting, replacing, and withdrawing can ever appear in a ballot's history. It does not prove anyone's real-world identity or mailbox ownership; those checks belong to the application built on top, as the docs spell out.
Requires Bun 1.3.12+ and Node.js 22+.
bun install --frozen-lockfile
bun run release:checkRun the demo server, which uses synthetic keys and data:
docker compose -f compose.example.yaml up --build
curl -X POST http://127.0.0.1:18080/verify-conformancebun conformance:google:cloud performs one real end-to-end run on Google
Cloud: it builds and pushes the image, boots a Confidential Space VM,
completes a registration and a vote with real attestation, recomputes the
tally, keeps one sanitized evidence file, and deletes the VM. The required
GCS_TEST_* settings are described in docs/DEPLOYMENT.md.
You provide the email check, the qualification check, storage, and secrets through small interfaces; the code ships with no country, profession, registry, or vendor built in. The bundled in-memory store exists for tests, not production. See protocol, privacy, threat model, and conformance.