This page lists all COCOON artifacts you can download or generate, and where to find the respective usage docs.

Official Worker Distribution (For GPU owners)

What: Prebuilt TDX worker image + launch scripts + example configs.
Where: https://ci.cocoon.org/cocoon-worker-release-latest.tar.xz

Docs:

• GPU owners guide (How to unpack, configure and run a worker):
• Hardware + Deployment details → “Prerequisites” and “Use Case 2: Test Images with Fake-TON”
• GPU → GPU passthrough and attestation
• Architecture → high‑level system layout

This is the recommended starting point if you want to run a worker and earn TON.

---

Source Code Repository

What: Full COCOON source tree (core services, scripts, docs).
Where:

• https://github.com/TelegramMessenger/cocoon
• https://github.com/TelegramMessenger/cocoon-contracts

Docs:

• Build from source

---

Guest VM Images (TDX)

COCOON VM images are usually bundled inside the worker distribution, but you can also build them locally for verification.

Production Image (prod)

What: Reproducible TDX guest image used for production workers
Where:

• Prebuilt: Included in the official worker release archive.
• Reproducible build: Generated from source via ./scripts/build-image prod.

Docs:

• Reproducible builds
• Image structure and TDX measurements

You can always independnetly confirm that a release matches the published sources.

---

Test Image (test)

What: TDX guest image for local testing with fake TON
Where: Built from source via ./scripts/build-image test (outputs to images/test/).

Docs:

• Test deployment flow
• Image internals and security notes

Intended for integration tests and debugging. This mode does not enforce image-hash verification and uses a constant disk key, so it must not be exposed as a public/production service.

---

Generated Binaries and Tools

All runtime binaries and tools (e.g., cocoon-launch, proxy-cli, health-client, SGX/TDX helpers) are built from the main repository; they are not currently distributed as separate downloads.

Docs:

• Build & run
• RA‑TLS tooling (router, certificate generation):
• Seal protocol helpers (seal-client, seal-server, enclave):

After building, these tools live in your chosen build directory (default: build/).

---

Reproducible Builds

Anyone can verify the worker distribution by rebuilding from source. Note that this step is not needed to run your own workers.

# 1. Build the VM image (reproducible)
./scripts/build-image prod

# 2. Generate distribution
./scripts/prepare-worker-dist ../cocoon-worker-dist

# 3. Verify the TDX image matches the published release
cd ../cocoon-worker-dist
sha256sum images/prod/{OVMF.fd,image.vmlinuz,image.initrd,image.cmdline}
# Compare with the published checksums

The same goes for model images:

# 1. This will generate a model tar file with the full model name, which includes hash and commit.
./scripts/build-model Qwen/Qwen3-0.6B
# Compare with the published model name

---

External Downloads

• Intel TDX enabling guide – hardware selection and platform enablement.
• Canonical TDX reference setup – example host configs and scripts.
• NVIDIA GPU admin tools – utilities for enabling CC mode and managing GPUs.
• Hugging Face access tokens – tokens used by workers to download models.

---

Further Reading

• Architecture - Detailed COCOON architecture documentation
• RA-TLS - Remote attestation over TLS, proxy-cli, and certificate generation
• Seal Keys - Persistent key derivation via SGX/TDX interaction
• Deployment - Deployment, testing, and debugging
• TDX and Images - Intel TDX fundamentals, boot sequence, and image generation
• Smart Contracts - Payment system and TON blockchain integration
• GPU - GPU passthrough and confidential computing validation

---

Cocoon welcomes security researchers to audit its code and protocol. Relevant findings can be submitted here.