Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2024-12-25 07:29:38 -05:00
Code Issues Packages Projects Releases Wiki Activity
c51694a51a
constellation/hack/azure-snp-report-verify
History
Fabian Kammel 0d12e37c96
Document exported funcs,types,interfaces and enable check. (#475) 
* Include EXC0014 and fix issues.
* Include EXC0012 and fix issues.
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Co-authored-by: Otto Bittner <cobittner@posteo.net>
2022-11-09 15:57:54 +01:00
..
Dockerfile AB#2413: Add workflow for snp-report-verify 2022-09-21 10:58:10 +02:00
README.md AB#2413: Add workflow for snp-report-verify 2022-09-21 10:58:10 +02:00
verify.go Document exported funcs,types,interfaces and enable check. (#475) 2022-11-09 15:57:54 +01:00

README.md

Obtain current Azure SNP ID key digest & firmware versions

On Azure, Constellation verifies that the SNP attestation report contains Azure's ID key digest. Additionally, some firmware security version numbers (SVNs) are validated. Currently, the only way to verify the digest's origin is to perform guest attestation with the help of the Microsoft Azure Attestation (MAA) service. There's a sample on how to do this, but it's not straightforward. So we created tooling to make things easier.

Perform the following steps to get the ID key digest & firmware versions:

  1. Create an Ubuntu CVM on Azure with secure boot enabled and ssh into it.
  2. Run 
    docker run --rm --privileged -v/sys/kernel/security:/sys/kernel/security ghcr.io/edgelesssys/constellation/azure-snp-reporter
    This executes the guest attestation and prints the JWT received from the MAA. (It's the long base64 blob.)
  3. Copy the JWT and run on your local trusted machine: 
    go run verify.go <jwt>
    On success it prints the ID key digest and relevant firmware SVNs.