feat(release-policy): Add trustee policy flow

[shariqahmed-cohere]

This PR adds everything required to get this repo to generate and release trustee-compatible policies for Azure SEV-SNP nodes.

---

Note

High Risk
Changes attestation policy generation, release signing subjects, and GPU/SEV-SNP admission rules—security-critical paths where mistakes could admit wrong nodes or break releases.

Overview
Adds Trustee as a second policy type in generate-policy, producing trustee_policy_cpu.rego and trustee_policy_gpu.rego for Azure SEV-SNP (az-snp-vtpm) targets via cvm-measure azure-snp PCR prediction, while ITA continues on the TDX path.

The release-policy workflow now requests ita trustee, extends Sigstore attestation to all three policy files plus the manifest, ships Trustee assets on GitHub releases, and records trustee_policies digests in the signed predicate. The action gains Trustee outputs (trustee-cpu-policy-file, trustee-gpu-policy-file, trustee-policy-dir, counts) and bumps the pinned cvm-measure ref in the Docker image.

ITA GPU rules are tightened with dbgstat == "disabled" and OCSP “good” checks on device and RIM certificate chains (mirrored in new Trustee GPU template). CI adds an ITA-only guard (no Azure measurement when Trustee is not requested), dual-target test manifest, and appraisal-focused Trustee unit tests with live claim fixtures.

^{Reviewed by Cursor Bugbot for commit afb5996. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale comment

Agentic security review of this Trustee policy PR found one net-new HIGH issue: diagnostic print() of full Kata agent request input in the new Azure SNP initdata, which can leak secret-bearing OCI env to host-visible logs. Other issues already covered on this PR (test targets in the production manifest; release path filter omitting trustee.py) were not re-posted.

  

_{Sent by Cursor Security Agent: Security Reviewer}

The merge-base changed after approval.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit afb5996. Configure here.}

[cursor]

Duplicate machine-type helper functions

Low Severity

load_machine_types and resolve_machine are defined twice in the same module with identical bodies. Python keeps only the second copy, so the first pair is dead code that can drift if one definition is edited later.

 

^{Reviewed by Cursor Bugbot for commit afb5996. Configure here.}

[cursor]

Release path filter misses toolchain

Medium Severity

The release workflow now watches the Trustee templates, but not Dockerfile, measure.py, or trustee.py. Bumping CVM_MEASURE_REF or changing PCR mapping and block generation would rewrite every Trustee (and ITA) reference value without starting a release, so production would keep attesting against stale pins.

Additional Locations (2)

• .github/actions/generate-policy/Dockerfile#L12-L17
• .github/actions/generate-policy/generate_policy/trustee.py#L1-L67

 

^{Reviewed by Cursor Bugbot for commit afb5996. Configure here.}