(&self, request: VerificationRequest)
| 398 | } |
| 399 | |
| 400 | pub async fn verify(&self, request: VerificationRequest) -> Result<VerificationResponse> { |
| 401 | let attestation = if let Some(attestation) = &request.attestation { |
| 402 | VersionedAttestation::from_bytes(attestation).context("Failed to decode attestaion")? |
| 403 | } else if let Some(tdx_quote) = request.quote { |
| 404 | let event_log = request |
| 405 | .event_log |
| 406 | .as_ref() |
| 407 | .context("Event log is required")?; |
| 408 | Attestation::from_tdx_quote(tdx_quote, event_log.as_bytes()) |
| 409 | .context("Failed to create attestation")? |
| 410 | .into_versioned() |
| 411 | } else { |
| 412 | bail!("Quote is required"); |
| 413 | }; |
| 414 | let mut details = VerificationDetails { |
| 415 | quote_verified: false, |
| 416 | event_log_verified: false, |
| 417 | os_image_hash_verified: false, |
| 418 | report_data: None, |
| 419 | tcb_status: None, |
| 420 | advisory_ids: vec![], |
| 421 | app_info: None, |
| 422 | acpi_tables: None, |
| 423 | rtmr_debug: None, |
| 424 | }; |
| 425 | |
| 426 | let debug = request.debug.unwrap_or(false); |
| 427 | let verified = attestation.into_v1().verify(self.pccs_url.as_deref()).await; |
| 428 | let verified_attestation = match verified { |
| 429 | Ok(att) => { |
| 430 | details.quote_verified = true; |
| 431 | details.tcb_status = att.report.tdx_report().map(|r| r.status.clone()); |
| 432 | details.advisory_ids = att |
| 433 | .report |
| 434 | .tdx_report() |
| 435 | .map(|r| r.advisory_ids.clone()) |
| 436 | .unwrap_or_default(); |
| 437 | details.report_data = Some(hex::encode(att.report_data)); |
| 438 | att |
| 439 | } |
| 440 | Err(e) => { |
| 441 | return Ok(VerificationResponse { |
| 442 | is_valid: false, |
| 443 | details, |
| 444 | reason: Some(format!("Quote verification failed: {e:#}")), |
| 445 | }); |
| 446 | } |
| 447 | }; |
| 448 | // Step 3: Verify os-image-hash matches using dstack-mr |
| 449 | let verified = self |
| 450 | .verify_os_image_hash( |
| 451 | request.vm_config.clone().unwrap_or_default(), |
| 452 | &verified_attestation, |
| 453 | debug, |
| 454 | &mut details, |
| 455 | ) |
| 456 | .await; |
| 457 | let vm_config = match verified { |
no test coverage detected