(&self, boottime_mr: bool, vm_config: &str)
| 516 | /// Decode the app info from the event log with an optional external vm_config. |
| 517 | #[errify::errify("decode app info")] |
| 518 | pub fn decode_app_info_ex(&self, boottime_mr: bool, vm_config: &str) -> Result<AppInfo> { |
| 519 | let runtime_events = self.stack.runtime_events(); |
| 520 | let key_provider_info = if boottime_mr { |
| 521 | vec![] |
| 522 | } else { |
| 523 | find_event_payload(runtime_events, "key-provider").unwrap_or_default() |
| 524 | }; |
| 525 | let mr_key_provider = if key_provider_info.is_empty() { |
| 526 | [0u8; 32] |
| 527 | } else { |
| 528 | sha256(&key_provider_info) |
| 529 | }; |
| 530 | let os_image_hash = self |
| 531 | .decode_vm_config(vm_config) |
| 532 | .context("Failed to decode os image hash")? |
| 533 | .os_image_hash; |
| 534 | let mrs = match &self.platform { |
| 535 | PlatformEvidence::Tdx { quote, .. } => { |
| 536 | decode_mr_tdx_from_quote(boottime_mr, &mr_key_provider, quote, runtime_events)? |
| 537 | } |
| 538 | PlatformEvidence::GcpTdx | PlatformEvidence::NitroEnclave => { |
| 539 | bail!("Unsupported attestation quote"); |
| 540 | } |
| 541 | }; |
| 542 | let compose_hash = if platform_attestation_mode(&self.platform).is_composable() { |
| 543 | find_event_payload(runtime_events, "compose-hash").unwrap_or_default() |
| 544 | } else { |
| 545 | os_image_hash.clone() |
| 546 | }; |
| 547 | Ok(AppInfo { |
| 548 | app_id: find_event_payload(runtime_events, "app-id").unwrap_or_default(), |
| 549 | instance_id: find_event_payload(runtime_events, "instance-id").unwrap_or_default(), |
| 550 | device_id: sha256(Vec::<u8>::new()).to_vec(), |
| 551 | mr_system: mrs.mr_system, |
| 552 | mr_aggregated: mrs.mr_aggregated, |
| 553 | key_provider_info, |
| 554 | os_image_hash, |
| 555 | compose_hash, |
| 556 | }) |
| 557 | } |
| 558 | |
| 559 | /// Verify the quote with optional custom time (testing hook). |
| 560 | pub async fn verify_with_time( |
no test coverage detected