google / go-sev-guest

go-sev-guest offers a library to wrap the /dev/sev-guest device in Linux, as well as a library for attestation verification of fundamental components of an attestation report.
Apache License 2.0
52 stars 19 forks source link

Remove ASK from badroot construction #38

Closed deeglaze closed 1 year ago

deeglaze commented 1 year ago

The change from VCEK checked-by ASK to VCEK checked-by ProductCerts.X509Options caused the bad root test to succeed unexpectedly in go-tpm-tools. Add a test here for the same condition and remove ASK from the bad root entirely so the VCEK can't be verified in the bad root tests.