open-standards/sandbox/sandbox-rs/crates/sandbox-runtime/examples/confidential_run_tdx.rs

//! Seal a confidential run on TDX hardware and verify it as a third party
//! would (SPEC §7.6): the TDX counterpart of `confidential_run`.
//!
//! Run as root inside a TDX guest with `configfs-tsm`:
//!
//! ```text
//! confidential_run_tdx <challenge-hex> <intel-root.der>
//! ```
//!
//! `intel-root.der` is Intel's published root CA certificate, which the
//! verifier pins. The PCK anchor is derived from the chain a quote carries,
//! checked to that root, so the trust comes from the root and not from the
//! quote. The host seals an S6 run whose quote the platform makes over the
//! run's binding and the challenge, and the attestation is verified against
//! the challenge, against another, and against none. It prints the verdicts
//! and the attestation as JSON.

use ed25519_dalek::SigningKey;
use sandbox_attest::{DeviceIdentity, Outcome, TeeKind};
use sandbox_capability::Grants;
use sandbox_meter::{DeviceEnergy, Provenance};
use sandbox_runtime::{verify_run_evidence, Host, RunReport, TeeConfig};
use sandbox_schema::{ContentId, DeviceClass, Tier};
use sandbox_tee::policy::{TeeAnchor, TeePolicy};
use sandbox_tee::provider::{AttestationProvider, ConfigfsTsmProvider};

fn main() {
    let args: Vec<String> = std::env::args().collect();
    let (Some(challenge_hex), Some(root_path)) = (args.get(1), args.get(2)) else {
        eprintln!("usage: confidential_run_tdx <challenge-hex> <intel-root.der>");
        std::process::exit(2);
    };
    let challenge: [u8; 32] =
        hex::decode(challenge_hex).ok().and_then(|v| v.try_into().ok()).expect("a 32-byte hex challenge");
    let root = std::fs::read(root_path).expect("read Intel's root certificate");
    let now = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).expect("a clock after 1970");

    // A probe quote carries the platform's PCK chain; check it to the root.
    let probe = ConfigfsTsmProvider::for_kind(TeeKind::Tdx).report(&[0; 64]).expect("a TDX quote");
    let pck = sandbox_tee::intel_pcs::pck_from_quote(&probe, &root, now.as_secs()).expect("a PCK chain to Intel's root");
    let anchor = TeeAnchor::Tdx(pck);
    let policy = TeePolicy::tdx_baseline();

    let host = Host::new("confidential-vm", "steward.hardware-check", SigningKey::from_bytes(&[1; 32]), SigningKey::from_bytes(&[2; 32]))
        .with_tee(TeeConfig {
            provider: Box::new(ConfigfsTsmProvider::for_kind(TeeKind::Tdx)),
            policy: policy.clone(),
            anchor: anchor.clone(),
        });
    let report = RunReport {
        device_energy: vec![DeviceEnergy { class: DeviceClass::Cpu, measured_uj: None, estimated_uj: 1, provenance: Provenance::Estimator }],
        device_identity: vec![DeviceIdentity { class: DeviceClass::Cpu, model: "confidential guest".into(), driver: "host".into() }],
        outcome: Outcome::Completed,
        journal: None,
        storage: None,
    };
    let now_us = now.as_micros() as u64;
    let sealed = match host.seal_run_with_mechanism(
        ContentId::of_bytes(b"hardware check unit"),
        ContentId::of_bytes(b"hardware check image"),
        &Grants::default(),
        Tier::S6,
        report,
        0,
        [0; 8],
        now_us,
        now_us + 1,
        None,
        Some(challenge),
    ) {
        Ok(s) => s,
        Err(e) => {
            println!("{}", serde_json::json!({ "sealed": false, "error": e.to_string(), "probe_hex": hex::encode(&probe) }));
            std::process::exit(1);
        }
    };
    let a = &sealed.attestation;
    let tee = a.tee.as_ref().expect("an S6 run carries TEE evidence");
    let verified = verify_run_evidence(a, Some(&challenge), &policy, &anchor);
    let mut other = challenge;
    other[0] ^= 1;
    println!(
        "{}",
        serde_json::json!({
            "sealed": true,
            "verified": verified.is_ok(),
            "verify_error": verified.err().map(|e| e.to_string()),
            "refused_another_challenge": verify_run_evidence(a, Some(&other), &policy, &anchor).is_err(),
            "refused_no_challenge": verify_run_evidence(a, None, &policy, &anchor).is_err(),
            "kind": format!("{:?}", tee.kind),
            "measurement_hex": tee.measurement_hex,
            "tcb": tee.tcb,
            "attestation": a,
        })
    );
}