Sync upstream (3284e24) — needs conflict resolution

[guest-components-upstream-sync]

Upstream sync — manual merge needed

Upstream has new commits to merge into vijay/sync-cohere-test, but there are conflicts.

Upstream HEAD: 3284e24

How to resolve

The sync branch already contains the upstream commits (it points at
origin/main). To make it mergeable into vijay/sync-cohere-test,
merge cohere into the sync branch and resolve conflicts there:

git fetch origin
git checkout sync/upstream-2026-06-23-3284e24
git merge origin/vijay/sync-cohere-test
# Git will show conflicts — resolve them in your IDE, then:
git add -A && git commit
git push origin sync/upstream-2026-06-23-3284e24

Your IDE will show the native merge conflict UI with accept-theirs /
accept-ours / accept-both options for each conflict. Once the push
succeeds, the PR will become mergeable.

Review checklist

• Resolve all conflicts
• Verify CI passes
• Check if any upstream changes obsolete our patches

---

Note

High Risk
Large dependency and attestation/crypto surface area (AES-GCM RC, TDX/SE evidence paths, Resource URI → KBS URL mapping) can affect image decrypt, KBS resource fetch, and CI release flows if fork-specific patches conflict during merge.

Overview
This sync brings upstream guest-components changes into the fork: broader Resource URI support (kbs+<plugin>://, variable path segments, plugin-aware KBS HTTP paths), refreshed api-server-rest behavior, attester/crypto updates, and routine CI/dependency bumps.

Resource URIs and KBS clients replace the fixed three-segment repository/type/tag model with plugin names and joined path segments. KBS fetch URLs become /kbs/v0/<plugin>/<path>. Docs move from KBS_URI.md to RESOURCE_URI.md. Call sites (KBCs, CDH, image-rs, coco_keyprovider, trustee-attester) are updated to parse URIs via ResourceUri / ResourcePluginPath where a classic resource plugin layout is required.

api-server-rest adds GET /aa/additional-evidence (mirroring evidence) and optional query encoding=base64 so runtime_data can be URL-safe base64 instead of raw UTF-8 bytes. OpenAPI and README examples are updated; decode_runtime_data and rstest coverage are added.

Attestation / crypto: TDX quoting favors TSM reports with optional sysfs RTMR/MRCONFIGID when kernel ≥ 6.16, otherwise ioctl fallbacks. IBM SE runtime digest binding moves to 64-byte (SHA-512) padding via shared validate_and_pad_data. Workspace crypto moves to aes 0.9 / aes-gcm 0.11-rc / ctr 0.10 with corresponding API fixes in crypto, ocicrypt-rs, and coco_keyprovider. csv-rs is pulled from crates.io; online SEV KBC drops local tonic-build protos in favor of shared protos.

CI: GitHub Actions pin bumps (actions/checkout v7, harden-runner v2.19.4, CodeQL v4.36.2, Docker build/login actions, etc.); publish-artifacts adjusts checkout (fetch-depth: 0, tags).

^{Reviewed by Cursor Bugbot for commit 3284e24. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3284e24. Configure here.}

[cursor]

TDX quote ioctl fallback removed

High Severity

get_evidence now always uses TsmReportPath and no longer falls back to the DCAP ioctl quote path when TSM setup fails. TDX guests that only expose /dev/tdx_guest (or lack a working TSM report provider) can attestation-fail even though platform detection still treats them as TDX-capable.

 

^{Reviewed by Cursor Bugbot for commit 3284e24. Configure here.}

[cursor]

ResourceUri new path mangled

Medium Severity

ResourceUri::new splits a leading-slash path into segments that retain an empty first element, so resource_path() becomes a string with a leading /. KBS URLs built as {plugin}/{resource_path} then contain a double slash and no longer match paths produced by TryFrom parsing of the same logical resource.

 

^{Reviewed by Cursor Bugbot for commit 3284e24. Configure here.}