mirror of
https://github.com/luxfi/mpc.git
synced 2026-09-24 00:26:24 +00:00
zeekay
be7fa85a9b
Red Final N1 fix. Release() previously called only Attestation.Verify(nonce) and ReleasePolicy.Permits() before sealing the session key. Neither step performs the actual SEV-SNP / TDX / NRAS chain verification — AMD KDS lookup, ARK→ASK→VCEK chain, NRAS JWT — leaving the #222 go-sev-guest verifier as dead code on the release path. A worker that fabricates a CompositeAttestation envelope whose Verify(nonce) returns true and whose RIM/HW/issuer membership matches policy could harvest a session key without ever presenting AMD-signed evidence. Wire-in: - kms.CompositeAttestation gains VerifyEvidence(ctx, opts...) returning []*attest.VerifiedReport. *attestation.CompositeAttestation already implements this method (composite.go:320 → attest.Dispatch per blob). - ReleaseRequest gains optional Ctx + AttestOptions for context plumbing + per-call policy (e.g. attest.WithExpectedReportData(nonce[:])). - Release() calls VerifyEvidence between the cheap nonce check and the policy permit step. Any chain failure → ErrAttestationChain joined with ErrPolicyRefused via errors.Join. No silent acceptance. - New sentinel ErrAttestationChain. Tests (go test -v -short -race -count=1 -timeout 60s ./pkg/kms/...): - all 14 existing TestRelease_/TestNonce_/TestAAD_ remain green - NEW TestRelease_RefusesOnChainFailure: Verify(nonce)=true but VerifyEvidence returns ErrChainInvalid → MUST surface ErrAttestationChain wrapped under ErrPolicyRefused - NEW TestRelease_AcceptsOnChainPass: paired happy-path so the chain-step is the only difference, not a wiring regression Also pulled in cherry-pick of canonical go-sev-guest sums (c4f1e22) so cc/attest builds reproducibly outside the dirty local cache.