open-standards/sandbox/sandbox-rs/crates/sandbox-runtime/examples/confidential_run.rs

//! Seal a confidential run on real hardware and verify it as a third party
//! would (SPEC §7.6).
//!
//! Run as root inside an SEV-SNP guest with `configfs-tsm`:
//!
//! ```text
//! confidential_run <challenge-hex> <vcek.der>
//! ```
//!
//! `vcek.der` is the chip's VCEK, from AMD's KDS. The host seals an S6 run whose
//! report the platform signs over the run's binding and the challenge. The
//! attestation is then verified through the VCEK alone, against the verifier's
//! own challenge, and against another challenge, which must fail. The run's
//! unit is a fixed placeholder: what this exercises is the binding and the
//! verifier on genuine silicon. It prints the verdicts and the attestation as
//! JSON.

use ed25519_dalek::SigningKey;
use sandbox_attest::{DeviceIdentity, Outcome};
use sandbox_capability::Grants;
use sandbox_meter::{DeviceEnergy, Provenance};
use sandbox_runtime::{verify_run_evidence, Host, RunReport, TeeConfig};
use sandbox_schema::{ContentId, DeviceClass, Tier};
use sandbox_tee::policy::{TeeAnchor, TeePolicy};
use sandbox_tee::provider::ConfigfsTsmProvider;

fn main() {
    let args: Vec<String> = std::env::args().collect();
    let (Some(challenge_hex), Some(vcek_path)) = (args.get(1), args.get(2)) else {
        eprintln!("usage: confidential_run <challenge-hex> <vcek.der>");
        std::process::exit(2);
    };
    let challenge: [u8; 32] =
        hex::decode(challenge_hex).ok().and_then(|v| v.try_into().ok()).expect("a 32-byte hex challenge");
    let der = std::fs::read(vcek_path).expect("read the VCEK");
    // The P-384 public point in the certificate's SubjectPublicKeyInfo: the
    // BIT STRING `03 62 00 04` followed by x ‖ y.
    let at = der.windows(4).position(|w| w == [0x03, 0x62, 0x00, 0x04]).expect("a P-384 point in the VCEK");
    let vcek = p384::ecdsa::VerifyingKey::from_sec1_bytes(&der[at + 3..at + 3 + 97]).expect("a P-384 key");
    let anchor = TeeAnchor::SevSnp(vcek);
    let policy = TeePolicy::sev_snp_baseline();

    let host = Host::new("gcp-confidential-vm", "steward.hardware-check", SigningKey::from_bytes(&[1; 32]), SigningKey::from_bytes(&[2; 32]))
        .with_tee(TeeConfig { provider: Box::new(ConfigfsTsmProvider::default()), policy: policy.clone(), anchor: anchor.clone() });
    let report = RunReport {
        device_energy: vec![DeviceEnergy { class: DeviceClass::Cpu, measured_uj: None, estimated_uj: 1, provenance: Provenance::Estimator }],
        device_identity: vec![DeviceIdentity { class: DeviceClass::Cpu, model: "confidential guest".into(), driver: "host".into() }],
        outcome: Outcome::Completed,
        journal: None,
        storage: None,
    };
    let now_us = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_micros() as u64);
    let sealed = match host.seal_run_with_mechanism(
        ContentId::of_bytes(b"hardware check unit"),
        ContentId::of_bytes(b"hardware check image"),
        &Grants::default(),
        Tier::S6,
        report,
        0,
        [0; 8],
        now_us,
        now_us + 1,
        None,
        Some(challenge),
    ) {
        Ok(s) => s,
        Err(e) => {
            println!("{}", serde_json::json!({ "sealed": false, "error": e.to_string() }));
            std::process::exit(1);
        }
    };
    let a = &sealed.attestation;
    let tee = a.tee.as_ref().expect("an S6 run carries TEE evidence");
    let verified = verify_run_evidence(a, Some(&challenge), &policy, &anchor);
    let mut other = challenge;
    other[0] ^= 1;
    let refused_other = verify_run_evidence(a, Some(&other), &policy, &anchor).is_err();
    let refused_none = verify_run_evidence(a, None, &policy, &anchor).is_err();
    println!(
        "{}",
        serde_json::json!({
            "sealed": true,
            "verified": verified.is_ok(),
            "verify_error": verified.err().map(|e| e.to_string()),
            "refused_another_challenge": refused_other,
            "refused_no_challenge": refused_none,
            "kind": format!("{:?}", tee.kind),
            "measurement_hex": tee.measurement_hex,
            "tcb": tee.tcb,
            "attestation": a,
        })
    );
}