search

google / go-tpm-tools

Go packages built on go-tpm providing a high-level API for using TPMs
Apache License 2.0
222 stars 68 forks source link

Use confidentialcomputing api v1.6.0 to send SEVSNP attestation #472

Closed yawangwang closed 1 month ago

yawangwang commented 1 month ago

This PR introduces the following changes:

  1. Upgrade confidentialcomputing client library to the latest version v1.6.0 with SEVSNP and TDX support.
  2. Convert sevsnp proto from go-sev-guest repo to API protos such that new confidentialcomputing client library can understand.
  3. Update some deprecated methods to the recommended version.
  4. Manual e2e tests - ran gotpm binary from a SNP machine to fetch token from the staging endpoint. Token successfully returned with {"aud":"https://sts.googleapis.com","exp":1722293238,"iat":1722289638,"iss":"https://staging-confidentialcomputing.sandbox.googleapis.com","nbf":1722289638,"sub":"https://www.googleapis.com/compute/v1/projects/yawangwang-test-project/zones/us-central1-a/instances/ubuntu2204-sevsnp-cvm2","eat_profile":"https://cloud.google.com/confidential-computing/confidential-vm/docs/token-claims","secboot":true,"oemid":11129,"hwmodel":"GCP_AMD_SEV_SNP","swname":"GCE","attester_tcb":["AMD","GOOGLE"],"dbgstat":"enabled","submods":{},"google_service_accounts":["1090918545711-compute@developer.gserviceaccount.com"]}
yawangwang commented 1 month ago

/gcbrun