(
&self,
vm_config: &VmConfig,
attestation: &VerifiedAttestation,
debug: bool,
details: &mut VerificationDetails,
)
| 513 | } |
| 514 | |
| 515 | async fn verify_os_image_hash_for_dstack_tdx( |
| 516 | &self, |
| 517 | vm_config: &VmConfig, |
| 518 | attestation: &VerifiedAttestation, |
| 519 | debug: bool, |
| 520 | details: &mut VerificationDetails, |
| 521 | ) -> Result<()> { |
| 522 | let Some(report) = &attestation.report.tdx_report() else { |
| 523 | bail!("No TDX report"); |
| 524 | }; |
| 525 | let Some(tdx_quote) = attestation.tdx_quote() else { |
| 526 | bail!("No TDX quote"); |
| 527 | }; |
| 528 | let event_log = &tdx_quote.event_log; |
| 529 | // Get boot info from attestation |
| 530 | let report = report |
| 531 | .report |
| 532 | .as_td10() |
| 533 | .context("Failed to decode TD report")?; |
| 534 | |
| 535 | // Extract the verified MRs from the report |
| 536 | let verified_mrs = Mrs { |
| 537 | mrtd: report.mr_td.to_vec(), |
| 538 | rtmr0: report.rt_mr0.to_vec(), |
| 539 | rtmr1: report.rt_mr1.to_vec(), |
| 540 | rtmr2: report.rt_mr2.to_vec(), |
| 541 | }; |
| 542 | |
| 543 | // Compute expected measurements (reusing the public API) |
| 544 | let (mrs, expected_logs) = if debug { |
| 545 | // For debug mode, we need detailed logs and ACPI tables |
| 546 | let image_paths = self.ensure_image_downloaded(vm_config).await?; |
| 547 | |
| 548 | let TdxMeasurementDetails { |
| 549 | measurements, |
| 550 | rtmr_logs, |
| 551 | acpi_tables, |
| 552 | } = self |
| 553 | .compute_measurement_details( |
| 554 | vm_config, |
| 555 | &image_paths.fw_path, |
| 556 | &image_paths.kernel_path, |
| 557 | &image_paths.initrd_path, |
| 558 | &image_paths.kernel_cmdline, |
| 559 | ) |
| 560 | .context("Failed to compute expected measurements")?; |
| 561 | |
| 562 | details.acpi_tables = Some(AcpiTables { |
| 563 | tables: hex::encode(&acpi_tables.tables), |
| 564 | rsdp: hex::encode(&acpi_tables.rsdp), |
| 565 | loader: hex::encode(&acpi_tables.loader), |
| 566 | }); |
| 567 | |
| 568 | (measurements, Some(rtmr_logs)) |
| 569 | } else { |
| 570 | // For non-debug mode, reuse the public API with caching |
| 571 | ( |
| 572 | self.compute_measurements_for_config(vm_config) |
no test coverage detected