mirror of
https://github.com/luxfi/mpc.git
synced 2026-10-30 14:45:41 +00:00
zeekay
41c32bd4a8
Adds the canonical TEE attestation verifier package at cc/attest. This
is the home for chain validation + trust anchor management; the
luxcpp/crypto/attestation parser primitives feed bytes here BEFORE
their measurement output is trusted.
Stage 1 — SEV-SNP — PRODUCTION:
- cc/attest/sev.go: SEVSNP{} verifier built on
github.com/google/go-sev-guest v0.14.1. Live VCEK fetch from AMD
KDS, ARK→ASK→VCEK chain validation, signature verify against the
leaf, MEASUREMENT/REPORT_DATA/HOST_DATA/CHIP_ID extraction,
caller-supplied policy gates (WithExpectedReportData,
WithExpectedMeasurement). 197 LOC.
- testdata/: real-vendor Milan attestation report + VCEK leaf
committed verbatim from the upstream go-sev-guest test corpus.
Tests replay the AMD KDS responses via SimpleGetter so CI never
hits the network.
- 9 SEV-SNP tests passing (happy path, dispatch, length reject,
tampered signature, wrong report_data, wrong measurement,
deterministic composite hash, unknown kind, stub-panic guard).
Stage 2 — TDX — STUB (#222 stage 2):
- cc/attest/tdx.go: TDX{}.Verify panics with ErrNotImplemented so
any caller routing TDX evidence during stage 1 fails LOUD. Plan
documented inline: go-tdx-guest + Intel PCS + QE/TDX module
identity pinning.
Stage 3 — NRAS — STUB (#222 stage 3):
- cc/attest/nras.go: NRAS{}.Verify panics with ErrNotImplemented.
Plan: lift the existing pkg/attestation/nvidia NRAS client into
the cc/attest contract with a JWKS cache.
Wire-in:
- pkg/attestation/composite.go gains VerifyEvidence(ctx, opts...)
which dispatches each Evidence blob to cc/attest by Issuer.
Callers (kms release gate, scheduler) MUST invoke this before
accepting parser output.
Doc:
- cc/attest/doc.go states the production/stub matrix and the
layering contract between the C-ABI parser and this package.
45 lines
1.7 KiB
Go
45 lines
1.7 KiB
Go
// Copyright (c) 2026, Lux Industries Inc.
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
package attest
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
)
|
|
|
|
// TDX is the Intel TDX verifier.
|
|
//
|
|
// Status: STUB — tracked at issue #222 stage 2.
|
|
//
|
|
// Production plan (intentionally not yet implemented):
|
|
//
|
|
// - Parse the TDREPORT / quote via github.com/google/go-tdx-guest/abi.
|
|
// - Fetch the PCK (Provisioning Certification Key) chain from the
|
|
// Intel PCS at api.trustedservices.intel.com using the report's
|
|
// FMSPC + PCEID.
|
|
// - Validate the chain to Intel's pinned root certificate and check
|
|
// the report signature against the PCK.
|
|
// - Cross-check the QE Identity and TDX Module Identity against the
|
|
// pinned values published by Intel.
|
|
// - Extract MRTD, RTMRs, REPORTDATA, and the platform identity.
|
|
// - Compose CompositeHash via the same domain-separated SHA-256 as
|
|
// the SEV path (see verifier.go::computeCompositeHash).
|
|
//
|
|
// Verify panics so any caller routing TDX evidence to it during stage 1
|
|
// fails LOUD. A silent no-op or error-return would let the release gate
|
|
// accidentally accept evidence the verifier has not actually checked;
|
|
// panic + recover at the Dispatch site is cheaper to diagnose and
|
|
// impossible to ignore in CI. Callers that want to soft-skip TDX should
|
|
// gate on a feature flag at their layer rather than here.
|
|
type TDX struct{}
|
|
|
|
// Verify implements Verifier. NOT YET IMPLEMENTED — do not enable TDX
|
|
// dispatch in production until #222 stage 2 lands.
|
|
func (TDX) Verify(ctx context.Context, evidence []byte, opts ...Option) (*VerifiedReport, error) {
|
|
panic(fmt.Sprintf("%v: TDX verifier; tracked at #222 stage 2 (use go-tdx-guest + Intel PCS)",
|
|
ErrNotImplemented))
|
|
}
|
|
|
|
var _ Verifier = TDX{}
|