Skip to content

Add SEVSNP plugin for Veraison server #333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
thomas-fossati merged 17 commits into from
Nov 26, 2025
Merged

Add SEVSNP plugin for Veraison server #333

thomas-fossati merged 17 commits into from
Nov 26, 2025
+2,136 −91

Conversation

@jraman567
Copy link
Collaborator

@jraman567 jraman567 commented Sep 3, 2025

This PR implements the SEVSNP scheme for Veraison.

@jraman567 jraman567 mentioned this pull request Sep 3, 2025
Closed
@jraman567 jraman567 force-pushed the upstream/sevsnp branch 2 times, most recently from f0bc831 to 80ddda3 Compare September 3, 2025 18:38
yogeshbdeshpande
yogeshbdeshpande reviewed Sep 26, 2025
View reviewed changes
yogeshbdeshpande
yogeshbdeshpande reviewed Sep 26, 2025
View reviewed changes
yogeshbdeshpande
yogeshbdeshpande reviewed Sep 26, 2025
View reviewed changes
yogeshbdeshpande
yogeshbdeshpande reviewed Sep 26, 2025
View reviewed changes
yogeshbdeshpande
yogeshbdeshpande reviewed Sep 26, 2025
View reviewed changes
yogeshbdeshpande
yogeshbdeshpande reviewed Sep 26, 2025
View reviewed changes
yogeshbdeshpande
yogeshbdeshpande reviewed Sep 26, 2025
View reviewed changes
yogeshbdeshpande
yogeshbdeshpande reviewed Sep 26, 2025
View reviewed changes
yogeshbdeshpande
yogeshbdeshpande reviewed Sep 26, 2025
View reviewed changes
Copy link
Collaborator

@yogeshbdeshpande yogeshbdeshpande left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in middle of review, just started today

@yogeshbdeshpande
Copy link
Collaborator

yogeshbdeshpande commented Sep 30, 2025

As we are adding new scheme, please refer to https://github.com/veraison/services/blob/main/README.md

  • Insert Sev-snp support in the suitable place for the text pertaining to Provisioning
  • Insert Sev-snp support in the suitable place for the text pertaining to Verification

Also remember to check the suitable places in docs repo and the Veraison book, to check where this comment is applicable.

yogeshbdeshpande
yogeshbdeshpande reviewed Sep 30, 2025
View reviewed changes
Copy link
Collaborator

@yogeshbdeshpande yogeshbdeshpande left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left some further comments.

@yogeshbdeshpande
Copy link
Collaborator

yogeshbdeshpande commented Sep 30, 2025

  • Also, I feel somewhere in the documentation of the Scheme, we should refer to the documentation on the Evidence Profile and also preferably the Reference Value Profile document, we have used to build this scheme!

thomas-fossati
thomas-fossati reviewed Sep 30, 2025
View reviewed changes
Copy link
Contributor

@thomas-fossati thomas-fossati left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, this is great.

I have left a few comments inline.

@jraman567
fix(rpm): add amd-kds and nvidia coserv plugins to spec file
0b03628 
Add amd-kds and nvidia coserv plugins to the spec file

Signed-off-by: Jagannathan Raman <[email protected]>
@jraman567 jraman567 changed the base branch from upstream/installation+rpm to main November 18, 2025 15:37
@jraman567
feat(scheme): create plugin for AMD SEV-SNP
2ea917e 
define SEV-SNP scheme for Veraison.

Signed-off-by: Jagannathan Raman <[email protected]>
@jraman567
feat(sevsnp): implement endorsement extractor
0351d9c 
store the trust anchors and reference values in the CoMID's
"Attest Key Triple" and "Reference Value Triple" formats.

Signed-off-by: Jagannathan Raman <[email protected]>
@jraman567
feat(sevsnp): implement an endorsement handler
5a76364 
accept CoRIM endorsements, reference values & trust anchors,
and save them in the database.

Signed-off-by: Jagannathan Raman <[email protected]>
@jraman567
Copy link
Collaborator Author

jraman567 commented Nov 19, 2025

As we are adding new scheme, please refer to https://github.com/veraison/services/blob/main/README.md

  • Insert Sev-snp support in the suitable place for the text pertaining to Provisioning
  • Insert Sev-snp support in the suitable place for the text pertaining to Verification

Also remember to check the suitable places in docs repo and the Veraison book, to check where this comment is applicable.

Done

@jraman567
Copy link
Collaborator Author

jraman567 commented Nov 19, 2025

  • Also, I feel somewhere in the documentation of the Scheme, we should refer to the documentation on the Evidence Profile and also preferably the Reference Value Profile document, we have used to build this scheme!

OK, I'll add this to the scheme's README.

@jraman567
feat(sevsnp): implement the store handler
536f2fd 
implement parts of the store handler that synthesize
keys from trust anchors and reference values.

Signed-off-by: Jagannathan Raman <[email protected]>
yogeshbdeshpande
yogeshbdeshpande reviewed Nov 25, 2025
View reviewed changes
@yogeshbdeshpande yogeshbdeshpande mentioned this pull request Nov 25, 2025
Closed
yogeshbdeshpande
yogeshbdeshpande approved these changes Nov 25, 2025
View reviewed changes
Copy link
Collaborator

@yogeshbdeshpande yogeshbdeshpande left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved, subjecting to checking whether two minor comments have been incorporated or not..?

@jraman567
Copy link
Collaborator Author

jraman567 commented Nov 25, 2025

Approved, subjecting to checking whether two minor comments have been incorporated or not..?

Thank you so much, @yogeshbdeshpande!

The lint error is because we're not using the return value of errors.New(). I'll update it quickly.

@yogeshbdeshpande
Copy link
Collaborator

yogeshbdeshpande commented Nov 25, 2025

me know about the unresolved, so I can address them and close out this PR. Thank you so much! :)

Yes, we can resolve the same and move quickly, this PR has been waiting for some time now.
I believe most of the comments you have already addressed!

@thomas-fossati
Copy link
Contributor

thomas-fossati commented Nov 25, 2025

Hi @yogeshbdeshpande and @thomas-fossati , I've addressed most of your comments. The ones I needed more clarification aren't resolved.

Please let me know about the unresolved, so I can address them and close out this PR. Thank you so much! :)

I have a couple of comments that should probably be acted upon. They are both very simple.

@jraman567
Copy link
Collaborator Author

jraman567 commented Nov 25, 2025

Hi @yogeshbdeshpande and @thomas-fossati , I've addressed most of your comments. The ones I needed more clarification aren't resolved.
Please let me know about the unresolved, so I can address them and close out this PR. Thank you so much! :)

I have a couple of comments that should probably be acted upon. They are both very simple.

I'm working on your comments, @thomas-fossati . Will update the PR shortly. Thank you!

yogeshbdeshpande
yogeshbdeshpande reviewed Nov 25, 2025
View reviewed changes
yogeshbdeshpande
yogeshbdeshpande approved these changes Nov 25, 2025
View reviewed changes
Copy link
Collaborator

@yogeshbdeshpande yogeshbdeshpande left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@jraman567
feat(scheme): implement evidence handler
69305ad 
Implement an evidence handler to extract claims from the evidence token
and store them in an internal representation format ( CoRIM for SEV-SNP).

Signed-off-by: Jagannathan Raman <[email protected]>
@jraman567
feat(sevsnp): get keys from evidence
fb9b045 
Update the store handler to get Trust Anchor and Reference Value
keys from evidence.

Add helper routines to parse the TSM report's auxblob to extract
AMD keys.

Signed-off-by: Jagannathan Raman <[email protected]>
@jraman567
feat(sevsnp): validate integrity of evidence
3c7a82c 
Implement the ValidateEvidenceIntegrity routine of the EvidenceHandler interface.

Ensure the root key in auxblob matches the ARK in provisioned trust anchors.
Confirm the integrity of the certificate chain in the auxblob and the
validity of the signature in the evidence.

Signed-off-by: Jagannathan Raman <[email protected]>
@jraman567
feat(sevsnp): appraise the evidence
f1e6d1e 
Implement the AppraiseEvidence routine in the EvidenceHandler interface
to confirm the claims match with the evidence.

Signed-off-by: Jagannathan Raman <[email protected]>
@jraman567
sevsnp tests: add unit tests
94631b1 
Add unit tests for endorsement, evidence and storage handlers

Signed-off-by: Jagannathan Raman <[email protected]>
yogeshbdeshpande
yogeshbdeshpande reviewed Nov 25, 2025
View reviewed changes
jraman567 and others added 7 commits November 25, 2025 12:12
@jraman567
sevsnp: Add README
d991fdf 
Add README document for SEVSNP scheme

Signed-off-by: Jagannathan Raman <[email protected]>
@jraman567
feat(sevsnp): allow CMW collection evidence type
c92f21f 
Allow SEVSNP scheme to accept evidence in CMW collection format

Signed-off-by: Jagannathan Raman <[email protected]>
@jraman567
fix(sevsnp): update matching of REPORTED_TCB
962a8a3 
REPORTED_TCB is a bitfield of versions. Extract individual versions
for comparison. REPORTED_TCB in evidence should be greater than or
equal to the reference value.

Signed-off-by: Jagannathan Raman <[email protected]>
@jraman567
fix(sevsnp): skip unused claims
057abef 
Some claims in the SEV-SNP profile aren't relevant for
verification, so skipping them

Signed-off-by: Jagannathan Raman <[email protected]>
@jraman567
sevsnp: validate evidence nonce
94d80a1 
The nonce in the evidence must match the session nonce that veraison
generated

Signed-off-by: Jagannathan Raman <[email protected]>
@jraman567
fix(sevsnp/tests): test more media types
836e3d1 
Add TSM report evidence in JSON & CBOR formats for testing

Signed-off-by: Jagannathan Raman <[email protected]>
@yogeshbdeshpande @jraman567
fix(sevsnp/evidence): fix error reporting in TCB comparion function
1e5b81d 
Add global variables to log errors in the compareTcb function

Signed-off-by: Yogesh Deshpande <[email protected]>
Signed-off-by: Jagannathan Raman <[email protected]>
@yogeshbdeshpande yogeshbdeshpande mentioned this pull request Nov 25, 2025
Open
yogeshbdeshpande
yogeshbdeshpande approved these changes Nov 25, 2025
View reviewed changes
Copy link
Collaborator

@yogeshbdeshpande yogeshbdeshpande left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for incorporating my comments!
LGTM!

@yogeshbdeshpande
Copy link
Collaborator

yogeshbdeshpande commented Nov 25, 2025

@thomas-fossati : Please give a final look and provide your approval...

thomas-fossati
thomas-fossati approved these changes Nov 26, 2025
View reviewed changes
Copy link
Contributor

@thomas-fossati thomas-fossati left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot for the execellent contribution!

@thomas-fossati thomas-fossati merged commit f1ccf18 into veraison:main Nov 26, 2025
5 checks passed
@jraman567
Copy link
Collaborator Author

jraman567 commented Nov 26, 2025

Thank you so much for reviewing, @yogeshbdeshpande and @thomas-fossati !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@thomas-fossati thomas-fossati thomas-fossati approved these changes

@yogeshbdeshpande yogeshbdeshpande yogeshbdeshpande approved these changes

@setrofim setrofim Awaiting requested review from setrofim

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jraman567 @yogeshbdeshpande @thomas-fossati