platformmodule

Documentation

Overview

Package platformmodule contains the experimental compatibility adapter that connects platform evidence appraisal to ASB's platform-neutral evidence verifier interface. A verifier is pinned to one locally configured platform; peer-provided EAT claims are checked for consistency and never select an appraiser.

This package is not production qualification. It preserves the repository's legacy platform appraisers. Deployments remain responsible for qualifying each selected appraiser's quote-signature, endorsement-chain, collateral, revocation, TCB, debug-policy, measurement-policy, and freshness behavior.

Index

• Variables
• func LoadSNPPlatformPolicy(path string) (*sevverify.Options, *sevvalidate.Options, error)
• func LoadTDXPlatformPolicy(path string) (*tdxcheck.Config, error)
• func NewEvidenceVerifier(config VerifierConfig) (eaattestation.EvidenceVerifier, error)
• type Platform
• type VerifierConfig

Variables

var (
	ErrUnsupportedPlatform = errors.New("attestation platform module: unsupported locally configured platform")
	ErrPlatformMismatch    = errors.New("attestation platform module: evidence platform does not match locally configured platform")
	ErrPolicyUnavailable   = errors.New("attestation platform module: policy file is unavailable")
	ErrInvalidSNPEvidence  = errors.New("attestation platform module: invalid direct SNP evidence")
	ErrEATTrustUnavailable = errors.New("attestation platform module: EAT trust configuration is unavailable")
	ErrSNPPolicyRequired   = errors.New("attestation platform module: direct SNP verification policy is required")
	ErrSNPVerification     = errors.New("attestation platform module: direct SNP cryptographic verification failed")
	ErrSNPValidation       = errors.New("attestation platform module: direct SNP policy validation failed")
	ErrTDXPolicyRequired   = errors.New("attestation platform module: TDX verification policy is required")
	ErrTDXVerification     = errors.New("attestation platform module: TDX quote verification failed")
	ErrCoRIMTrustRequired  = errors.New("attestation platform module: signed CoRIM verification key is required")
	ErrCoRIMVerification   = errors.New("attestation platform module: signed CoRIM verification failed")
)

Functions

func LoadSNPPlatformPolicy

func LoadSNPPlatformPolicy(path string) (*sevverify.Options, *sevvalidate.Options, error)

LoadSNPPlatformPolicy loads the go-sev-guest check.Config JSON used for signature, revocation, TCB, debug, VMPL, and other report validation.

func LoadTDXPlatformPolicy

func LoadTDXPlatformPolicy(path string) (*tdxcheck.Config, error)

LoadTDXPlatformPolicy loads the go-tdx-guest checkconfig.Config JSON used for quote, PCS collateral, TCB, debug, and report-field validation.

func NewEvidenceVerifier

func NewEvidenceVerifier(config VerifierConfig) (eaattestation.EvidenceVerifier, error)

NewEvidenceVerifier constructs a compatibility verifier for exactly one locally selected platform. Evidence claiming a different platform is rejected; the claim never causes dispatch to another appraiser.

Types

type Platform

type Platform string

Platform identifies the appraiser selected by trusted local configuration. Its zero value is invalid. It is not a wire value and must not be populated from peer-provided evidence.

const (
	PlatformSNP Platform = "snp"
	PlatformTDX Platform = "tdx"
)

type VerifierConfig

type VerifierConfig struct {
	Platform               Platform
	PolicyPath             string
	EATVerificationKey     *ecdsa.PublicKey
	CoRIMVerificationKey   *ecdsa.PublicKey
	ExpectedIssuer         string
	SNPVerificationOptions *sevverify.Options
	SNPValidationOptions   *sevvalidate.Options
	TDXPolicy              *tdxcheckconfig.Config
	// TDXRuntimeOptions permits a reviewed collateral getter and fixed clock
	// for deterministic qualification. Nil uses the module's bounded HTTPS
	// getter and current time.
	TDXRuntimeOptions *tdxmodule.RuntimeOptions
}

VerifierConfig contains trust configuration selected by the local ASB deployment. None of these values may be derived from peer evidence.