mirror of
https://github.com/luxfi/mpc.git
synced 2026-09-24 00:26:24 +00:00
zeekay
41c32bd4a8
Adds the canonical TEE attestation verifier package at cc/attest. This
is the home for chain validation + trust anchor management; the
luxcpp/crypto/attestation parser primitives feed bytes here BEFORE
their measurement output is trusted.
Stage 1 — SEV-SNP — PRODUCTION:
- cc/attest/sev.go: SEVSNP{} verifier built on
github.com/google/go-sev-guest v0.14.1. Live VCEK fetch from AMD
KDS, ARK→ASK→VCEK chain validation, signature verify against the
leaf, MEASUREMENT/REPORT_DATA/HOST_DATA/CHIP_ID extraction,
caller-supplied policy gates (WithExpectedReportData,
WithExpectedMeasurement). 197 LOC.
- testdata/: real-vendor Milan attestation report + VCEK leaf
committed verbatim from the upstream go-sev-guest test corpus.
Tests replay the AMD KDS responses via SimpleGetter so CI never
hits the network.
- 9 SEV-SNP tests passing (happy path, dispatch, length reject,
tampered signature, wrong report_data, wrong measurement,
deterministic composite hash, unknown kind, stub-panic guard).
Stage 2 — TDX — STUB (#222 stage 2):
- cc/attest/tdx.go: TDX{}.Verify panics with ErrNotImplemented so
any caller routing TDX evidence during stage 1 fails LOUD. Plan
documented inline: go-tdx-guest + Intel PCS + QE/TDX module
identity pinning.
Stage 3 — NRAS — STUB (#222 stage 3):
- cc/attest/nras.go: NRAS{}.Verify panics with ErrNotImplemented.
Plan: lift the existing pkg/attestation/nvidia NRAS client into
the cc/attest contract with a JWKS cache.
Wire-in:
- pkg/attestation/composite.go gains VerifyEvidence(ctx, opts...)
which dispatches each Evidence blob to cc/attest by Issuer.
Callers (kms release gate, scheduler) MUST invoke this before
accepting parser output.
Doc:
- cc/attest/doc.go states the production/stub matrix and the
layering contract between the C-ABI parser and this package.
40 lines
1.9 KiB
Go
40 lines
1.9 KiB
Go
// Copyright (c) 2026, Lux Industries Inc.
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
// Package attest is the canonical TEE attestation verifier for the Lux
|
|
// confidential-compute control plane.
|
|
//
|
|
// Status:
|
|
// - SEV-SNP: PRODUCTION (live VCEK fetch from AMD KDS, full chain verify)
|
|
// - TDX: STUB (tracked at #222 stage 2; use go-tdx-guest + Intel PCS)
|
|
// - NRAS: STUB (tracked at #222 stage 3; use NRAS JWT + JWKS cache)
|
|
//
|
|
// luxcpp/crypto/attestation provides parser-only primitives. THIS package
|
|
// is where chain verification + trust anchor management lives. The two
|
|
// are connected via Go cgo binding into the C-ABI parser, then verifying
|
|
// the bytes here BEFORE accepting the parser's measurement output.
|
|
//
|
|
// Layering:
|
|
//
|
|
// caller (kms release gate, scheduler, indexer)
|
|
// └── cc/attest.Verifier.Verify(ctx, evidence, opts...) ◄── this package
|
|
// ├── SEV-SNP → google/go-sev-guest + AMD KDS (PROD)
|
|
// ├── Intel TDX → google/go-tdx-guest + Intel PCS (STUB)
|
|
// └── NVIDIA GPU → NRAS JWT + JWKS rotation (STUB)
|
|
//
|
|
// Wire format dispatch is by the leading magic / kind byte stamped by the
|
|
// C-ABI parser. The parser's output is NOT trusted until Verify returns
|
|
// without error: the parser only normalises framing; this package
|
|
// validates the chain to the vendor root and extracts measurements.
|
|
//
|
|
// Security invariants:
|
|
//
|
|
// - Trust anchors are pinned per-vendor in code (AMD ARK/ASK ship
|
|
// embedded with go-sev-guest; Intel/NVIDIA roots are fetched
|
|
// once and cached, never trusted from the evidence itself).
|
|
// - Tests do not hit the network. KDS responses are pre-fetched
|
|
// into testdata/ and replayed via a SimpleGetter map.
|
|
// - A failed verify never falls back to "best effort"; callers must
|
|
// treat (nil, err) as "refuse the request".
|
|
package attest
|