mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-01-04 20:30:59 -05:00
8f21972aec
* variant: move into internal/attestation * attesation: move aws attesation into subfolder nitrotpm * config: add aws-sev-snp variant * cli: add tf option to enable AWS SNP For now the implementations in aws/nitrotpm and aws/snp are identical. They both contain the aws/nitrotpm impl. A separate commit will add the actual attestation logic.
47 lines
1.2 KiB
Go
47 lines
1.2 KiB
Go
/*
|
|
Copyright (c) Edgeless Systems GmbH
|
|
|
|
SPDX-License-Identifier: AGPL-3.0-only
|
|
*/
|
|
|
|
package qemu
|
|
|
|
import (
|
|
"context"
|
|
"crypto"
|
|
|
|
"github.com/edgelesssys/constellation/v2/internal/attestation"
|
|
"github.com/edgelesssys/constellation/v2/internal/attestation/variant"
|
|
"github.com/edgelesssys/constellation/v2/internal/attestation/vtpm"
|
|
"github.com/edgelesssys/constellation/v2/internal/config"
|
|
"github.com/google/go-tpm-tools/proto/attest"
|
|
"github.com/google/go-tpm/tpm2"
|
|
)
|
|
|
|
// Validator for QEMU VM attestation.
|
|
type Validator struct {
|
|
variant.QEMUVTPM
|
|
*vtpm.Validator
|
|
}
|
|
|
|
// NewValidator initializes a new QEMU validator with the provided PCR values.
|
|
func NewValidator(cfg *config.QEMUVTPM, log attestation.Logger) *Validator {
|
|
return &Validator{
|
|
Validator: vtpm.NewValidator(
|
|
cfg.Measurements,
|
|
unconditionalTrust,
|
|
func(vtpm.AttestationDocument, *attest.MachineState) error { return nil },
|
|
log,
|
|
),
|
|
}
|
|
}
|
|
|
|
// unconditionalTrust returns the given public key as the trusted attestation key.
|
|
func unconditionalTrust(_ context.Context, attDoc vtpm.AttestationDocument, _ []byte) (crypto.PublicKey, error) {
|
|
pubArea, err := tpm2.DecodePublic(attDoc.Attestation.AkPub)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return pubArea.Key()
|
|
}
|