project-oak / oak

Meaningful control of data in distributed systems.
Apache License 2.0
1.32k stars 114 forks source link

Split the verify_kernel_measurement_data into get_expected/compare #4997

Closed jblebrun closed 7 months ago

jblebrun commented 7 months ago

This change is similar to the verify_measurement_digest split, but the retrieval of reference values is a bit different, since they come from the endorsement subject as serialized KernelAttachment data, and the endorsement subject itself must be verified.

Subsequent verifications can use the cached image and setup_data value, so the subject endorsement remains totally encapsulated in the get_verified_kernel_attachment helper function; the expected values from the endorsement itself does not need to be returned to the client.

Another step for b/324837692