328d89b676
All checks were successful
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 5s
repository checks / lockfiles, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Successful in 47s
standards workspaces build + test / jcp-rs (jcp-conformance, jcp/jcp-rs, -p jcp-energy --features nvml, jcp-rs, linux) (pull_request) Successful in 1m43s
standards workspaces build + test / joule-ui-rs (joule-ui/joule-ui-rs, joule-ui-rs, linux) (pull_request) Successful in 1m14s
standards workspaces build + test / proof-rs (proof-conformance, proof/proof-rs, proof-rs, linux, true) (pull_request) Successful in 1m33s
standards workspaces build + test / sandbox-rs (sandbox-conformance, sandbox/sandbox-rs, sandbox-rs, linux) (pull_request) Successful in 2m47s
standards workspaces build + test / joulecontract-rs (joulecontract/joulecontract-rs, joulecontract-rs, linux-arm64, true) (pull_request) Successful in 1m57s
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 4m59s
standards workspaces build + test / macOS energy backends (pull_request) Successful in 7m46s
standards workspaces build + test / jouledesk-rs (jouledesk/jouledesk-rs, jouledesk-rs, macos) (pull_request) Successful in 2m50s
The run binding of #392 had only met software-grounded reports. This runs the reference host inside an SEV-SNP guest and records the result as evidence anyone can re-check offline. sandbox-runtime examples: - confidential_run, run inside the guest. It takes reports through configfs-tsm and seals an S6 run against a challenge; the report_data is the run binding of SPEC §7.6. It then checks the attestation through the chip's VCEK: verified against the challenge, refused against another and against none. - verify_run: the third party's check, from the attestation, the challenge issued and the VCEK alone. sandbox/proof/hardware/2026-10-21-sev-snp: the attestation (with the 1184-byte v5 report), the challenge, the chip's VCEK and AMD's cert chain, and a README saying what it shows and what it does not. The unit is a placeholder, so this exercises the binding and verifier on silicon, not isolation. Checked on our side, away from the guest: - The VCEK was fetched from AMD's KDS by the chip id and TCB inside the report, and openssl verifies it to ARK-Milan. - verify_run on the build host verifies the run, and refuses another challenge and no challenge. - An attestation with its outcome changed is refused ("report-data binding mismatch"): the AMD signature covers the outcome through the binding. sandbox-tee: the version comment now says what the code does (v2 layout and later; a v5 report verified on hardware). Co-Authored-By: Claude Opus 5.5 <[email protected]>
29 lines
3.2 KiB
JSON
29 lines
3.2 KiB
JSON
{
|
|
"audit_prev": null,
|
|
"devices": [
|
|
{
|
|
"class": "Cpu",
|
|
"driver": "host",
|
|
"model": "confidential guest"
|
|
}
|
|
],
|
|
"finished_at_us": 1792601988753099,
|
|
"grants_id": "b3:ej-h9yIoVIBjnlA-OMDiy95_Jlk7nqn6djvXYNv035w",
|
|
"host_id": "gcp-confidential-vm",
|
|
"image_id": "b3:sfsM4tYpFQT10UkAZVEdN5C2user1jDf-76b0oYeI8o",
|
|
"journal_root": null,
|
|
"locality": null,
|
|
"mechanism": null,
|
|
"outcome": "Completed",
|
|
"receipt_id": "b3:kCkhM2_jsKJyBwLL17ivdqhPhyPEIJaWjPUVDFRR6hU",
|
|
"started_at_us": 1792601988753098,
|
|
"tee": {
|
|
"challenge_hex": "f9a4ec56a429a6fed42839517a03745723a8317a70b737dbd78b98087ebfa6b7",
|
|
"kind": "SevSnp",
|
|
"measurement_hex": "0e017d2fba7c4964575fdd8c770061abf07f0753148d030f94e969a2d1fa5a5747ba0ced9174f2d44b5f6663fa2de00f",
|
|
"report_hex": "05000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000400000000001dde25000000000000000000000000000000ebf35a85d4fa49a70da07099763c8d8c299bd3beb5d8fa3a1b750c77adfa4d10a3090fd326f7ac07a686890c31ee2f3488e10a58e5dcb842a524b9bab29889460e017d2fba7c4964575fdd8c770061abf07f0753148d030f94e969a2d1fa5a5747ba0ced9174f2d44b5f6663fa2de00f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c575dabffb4e8e772ab8d8d531fd886c90ef814ca39680247c0a7efceba25d4affffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0400000000001dde190101000000000000000000000000000000000000000000c1928ae552b597a350103ac5999da841754ab728de34dd6feed77fb9d779f5e0570b1d194f707494b9349f6dc8930d12c1944bbd10938e7ad4c57997b1af2efa0400000000001dde013a0100013a01000400000000001dde0b000000000000000b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009c8f38068e4c86327fb0cc7f352c855ef49be254d45c4ec57e5a6667175a29804b0860bb83ed47f46b01fe8fae56754e00000000000000000000000000000000000000000000000049f2f008ed6ed6e75b44a397d6893fa882ab5c2a83471ca4af25816fe78ec66788705659fb0ae0d50b897f9756410fb30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
|
|
"tcb": "0xde1d000000000004"
|
|
},
|
|
"tier": "S6",
|
|
"unit_id": "b3:StLoFp1GgfFDM6RVELdOlbduOMrjpLZGE6kSdYoLFNg"
|
|
}
|