diff --git a/internal/attestation/vtpm/BUILD.bazel b/internal/attestation/vtpm/BUILD.bazel index 89d50868c..13a39f22c 100644 --- a/internal/attestation/vtpm/BUILD.bazel +++ b/internal/attestation/vtpm/BUILD.bazel @@ -12,6 +12,7 @@ go_library( deps = [ "//internal/attestation", "//internal/attestation/measurements", + "@com_github_google_go_sev_guest//proto/sevsnp", "@com_github_google_go_tpm//legacy/tpm2", "@com_github_google_go_tpm_tools//client", "@com_github_google_go_tpm_tools//proto/attest", diff --git a/internal/attestation/vtpm/attestation.go b/internal/attestation/vtpm/attestation.go index 0d907dd7f..a8a5e9b0f 100644 --- a/internal/attestation/vtpm/attestation.go +++ b/internal/attestation/vtpm/attestation.go @@ -14,6 +14,7 @@ import ( "fmt" "io" + "github.com/google/go-sev-guest/proto/sevsnp" tpmClient "github.com/google/go-tpm-tools/client" "github.com/google/go-tpm-tools/proto/attest" tpmProto "github.com/google/go-tpm-tools/proto/tpm" @@ -183,7 +184,18 @@ func (v *Validator) Validate(ctx context.Context, attDocRaw []byte, nonce []byte } }() - var attDoc AttestationDocument + // Explicitly initialize this struct, as TeeAttestation + // is a "oneof" protobuf field, which needs an explicit + // type to be set to be unmarshaled correctly. + // Note: this value is incompatible with TDX attestation! + // TODO(msanft): select the correct attestation type (SEV-SNP, TDX, ...) here. + attDoc := AttestationDocument{ + Attestation: &attest.Attestation{ + TeeAttestation: &attest.Attestation_SevSnpAttestation{ + SevSnpAttestation: &sevsnp.Attestation{}, + }, + }, + } if err := json.Unmarshal(attDocRaw, &attDoc); err != nil { return nil, fmt.Errorf("unmarshaling TPM attestation document: %w", err) }