igvmfilegen: migrate SNP ID block to serializer + add-snp-id-block command (#3923)

Replace the in-tree signed_measurement module with the igvm crate's
IgvmSerializer for launch-measurement computation, and move SNP ID block
handling out of the build-time auto-write into an explicit
add-snp-id-block subcommand.

- Delete signed_measurement/{snp,tdx,vbs} and vbs_defs; compute launch
digests via IgvmSerializer::measurement_for.
- Add snp_id_block.rs: unsigned artifact emission, temp-key signing
(dev/test), and out-of-band DER signature + X.509/SPKI public-key
verification (production).
- manifest emits <base>-snp.idblock (raw SnpPspIdBlock) for SNP.
- Add crypto::ecdsa::verify_prehash (ECDSA P-384 verify) across openssl,
symcrypt, and BCrypt backends.
- Extract measurement_diag.rs (launch-measurement diagnostics) and
platform_mask.rs (compatibility-mask helpers).

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

Author: mingweishih

Cargo.lock

@@ -823,9 +823,9 @@ dependencies = [
 
 [[package]]
 name = "cmov"
-version = "0.5.4"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+checksum = "3f88a43d011fc4a6876cb7344703e297c71dda42494fee094d5f7c76bf13f746"
 
 [[package]]
 name = "cms"
@@ -943,6 +943,28 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
+[[package]]
+name = "corim"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18ae0dacf8af1ae85596c375df3bf848ff57712a8b07d5a9ba36863d901f78d7"
+dependencies = [
+ "corim-macros",
+ "serde",
+ "thiserror 2.0.16",
+]
+
+[[package]]
+name = "corim-macros"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c16ee2c7db3dde66570487ea3a6329bd07ca138652b57a3a442c200c75df495"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.106",
+]
+
 [[package]]
 name = "cpubits"
 version = "0.1.0"
@@ -3705,24 +3727,27 @@ dependencies = [
 [[package]]
 name = "igvm"
 version = "0.4.0"
-source = "git+https://github.com/microsoft/igvm?rev=3d1a950116d624746bf3342e09ea0a3416d89dd3#3d1a950116d624746bf3342e09ea0a3416d89dd3"
+source = "git+https://github.com/microsoft/igvm?rev=7184dce1086956342c1bf561f82ff268d06d2c73#7184dce1086956342c1bf561f82ff268d06d2c73"
 dependencies = [
  "bitfield-struct 0.12.1",
+ "corim",
  "crc32fast",
  "hex",
  "igvm_defs",
  "open-enum",
  "range_map_vec",
+ "sha2",
  "static_assertions",
  "thiserror 2.0.16",
  "tracing",
+ "uuid",
  "zerocopy",
 ]
 
 [[package]]
 name = "igvm_defs"
 version = "0.4.0"
-source = "git+https://github.com/microsoft/igvm?rev=3d1a950116d624746bf3342e09ea0a3416d89dd3#3d1a950116d624746bf3342e09ea0a3416d89dd3"
+source = "git+https://github.com/microsoft/igvm?rev=7184dce1086956342c1bf561f82ff268d06d2c73#7184dce1086956342c1bf561f82ff268d06d2c73"
 dependencies = [
  "bitfield-struct 0.12.1",
  "open-enum",
@@ -3736,8 +3761,10 @@ version = "0.0.0"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
+ "bitfield-struct 0.11.0",
  "clap",
  "crypto",
+ "der",
  "fs-err",
  "hex",
  "hvdef",
@@ -3751,11 +3778,12 @@ dependencies = [
  "range_map_vec",
  "serde",
  "serde_json",
- "thiserror 2.0.16",
+ "signature",
+ "test_with_tracing",
  "tracing",
  "tracing-subscriber",
  "underhill_confidentiality",
- "vbs_defs",
+ "x509-cert",
  "x86defs",
  "zerocopy",
 ]
@@ -9130,23 +9158,18 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
+[[package]]
+name = "uuid"
+version = "1.23.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "144d6b123cef80b301b8f72a9e2ca4370ddec21950d0a103dd22c437006d2db7"
+
 [[package]]
 name = "valuable"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
-[[package]]
-name = "vbs_defs"
-version = "0.0.0"
-dependencies = [
- "bitfield-struct 0.11.0",
- "igvm_defs",
- "open_enum",
- "static_assertions",
- "zerocopy",
-]
-
 [[package]]
 name = "vcpkg"
 version = "0.2.15"

Cargo.toml

@@ -402,7 +402,6 @@ igvmfilegen_config = { path = "vm/loader/igvmfilegen_config" }
 loader_defs = { path = "vm/loader/loader_defs" }
 page_table = { path = "vm/loader/page_table" }
 page_pool_alloc = { path = "vm/page_pool_alloc" }
-vbs_defs = { path = "vm/vbs_defs" }
 vmgs = { path = "vm/vmgs/vmgs" }
 vmgs_broker = { path = "vm/vmgs/vmgs_broker" }
 vmgs_format = { path = "vm/vmgs/vmgs_format" }
@@ -614,8 +613,8 @@ iced-x86 = { version = "1.17", default-features = false, features = [
   "no_xop",
   "no_d3now",
 ] }
-igvm = { git = "https://github.com/microsoft/igvm", rev = "3d1a950116d624746bf3342e09ea0a3416d89dd3" }
-igvm_defs = { git = "https://github.com/microsoft/igvm", rev = "3d1a950116d624746bf3342e09ea0a3416d89dd3", default-features = false }
+igvm = { git = "https://github.com/microsoft/igvm", rev = "7184dce1086956342c1bf561f82ff268d06d2c73" }
+igvm_defs = { git = "https://github.com/microsoft/igvm", rev = "7184dce1086956342c1bf561f82ff268d06d2c73", default-features = false }
 kvm-bindings = "0.14.0"
 mshv-bindings = "0.6.8"
 mshv-ioctls = "0.6.8"

flowey/flowey_lib_hvlite/src/_jobs/local_build_igvm.rs

@@ -310,6 +310,7 @@ impl SimpleFlowNode for Node {
                     igvm_tdx_json,
                     igvm_snp_json,
                     igvm_vbs_json,
+                    igvm_snp_idblock,
                 }) = openhcl_igvm.endorsements()
                 {
                     if let Some(igvm_tdx_json) = igvm_tdx_json {
@@ -321,6 +322,9 @@ impl SimpleFlowNode for Node {
                     if let Some(igvm_vbs_json) = igvm_vbs_json {
                         fs_err::copy(igvm_vbs_json, output_dir.join("openhcl-vbs.json"))?;
                     }
+                    if let Some(igvm_snp_idblock) = igvm_snp_idblock {
+                        fs_err::copy(igvm_snp_idblock, output_dir.join("openhcl-snp.idblock"))?;
+                    }
                 }
                 for e in fs_err::read_dir(output_dir)? {
                     let e = e?;

flowey/flowey_lib_hvlite/src/build_openhcl_igvm_from_recipe.rs

@@ -88,6 +88,13 @@ pub enum OpenhclIgvmEndorsements {
         #[serde(rename = "openhcl-vbs.json")]
         #[serde(skip_serializing_if = "Option::is_none")]
         igvm_vbs_json: Option<PathBuf>,
+        /// The unsigned SNP ID block signing payload emitted by `manifest`.
+        /// This travels with the endorsements (rather than the debug-symbol
+        /// extras) because it is a release/signing input consumed alongside the
+        /// `.json` identity documents. SNP-only, so absent for other platforms.
+        #[serde(rename = "openhcl-snp.idblock")]
+        #[serde(skip_serializing_if = "Option::is_none")]
+        igvm_snp_idblock: Option<PathBuf>,
     },
 }
 
@@ -98,6 +105,10 @@ impl OpenhclIgvmEndorsements {
                 igvm_tdx_json,
                 igvm_snp_json,
                 igvm_vbs_json,
+                // Not part of completeness: the SNP ID block signing payload is
+                // an optional, SNP-only signing input, not one of the three
+                // required identity-document endorsements.
+                igvm_snp_idblock: _,
             } => igvm_tdx_json.is_some() && igvm_snp_json.is_some() && igvm_vbs_json.is_some(),
         }
     }
@@ -154,17 +165,22 @@ impl OpenhclIgvmOutput {
             igvm_tdx_json,
             igvm_snp_json,
             igvm_vbs_json,
+            igvm_snp_idblock,
         } = igvm;
-        let mut endorsements =
-            if igvm_tdx_json.is_some() || igvm_snp_json.is_some() || igvm_vbs_json.is_some() {
-                Some(OpenhclIgvmEndorsements::X64 {
-                    igvm_tdx_json,
-                    igvm_snp_json,
-                    igvm_vbs_json,
-                })
-            } else {
-                None
-            };
+        let mut endorsements = if igvm_tdx_json.is_some()
+            || igvm_snp_json.is_some()
+            || igvm_vbs_json.is_some()
+            || igvm_snp_idblock.is_some()
+        {
+            Some(OpenhclIgvmEndorsements::X64 {
+                igvm_tdx_json,
+                igvm_snp_json,
+                igvm_vbs_json,
+                igvm_snp_idblock,
+            })
+        } else {
+            None
+        };
         match recipe {
             None => OpenhclIgvmOutput::LocalOnlyCustom {
                 igvm_bin,
@@ -914,6 +930,10 @@ impl SimpleFlowNode for Node {
             resources,
             disable_secure_avic,
             confidential_debug,
+            // Open-source builds embed a temporary-key SNP ID block so the file
+            // launches with `id_block_en = 1`; production pipelines add a
+            // real-key ID block out-of-band instead.
+            add_temp_snp_id_block: true,
             igvm: v,
         });
 

flowey/flowey_lib_hvlite/src/run_igvmfilegen.rs

@@ -15,6 +15,9 @@ pub struct IgvmOutput {
     pub igvm_tdx_json: Option<PathBuf>,
     pub igvm_snp_json: Option<PathBuf>,
     pub igvm_vbs_json: Option<PathBuf>,
+    /// The unsigned SNP ID block signing payload (`<base>-snp.idblock`), if the
+    /// manifest produced a measurable SEV-SNP platform.
+    pub igvm_snp_idblock: Option<PathBuf>,
 }
 
 flowey_request! {
@@ -31,6 +34,13 @@ flowey_request! {
         /// command line, enabling confidential diagnostics on CVM builds even
         /// in release builds.
         pub confidential_debug: bool,
+        /// For SEV-SNP builds, add an SNP ID block signed by an ephemeral key
+        /// (via `igvmfilegen add-snp-id-block --manifest`). This restores the
+        /// pre-migration behavior for open-source builds, where every SNP IGVM
+        /// carried a temporary-key ID block so that `id_block_en = 1` at launch.
+        /// Production pipelines set this to `false` and instead add an ID block
+        /// signed with a real key out-of-band.
+        pub add_temp_snp_id_block: bool,
         /// Output path of generated igvm file
         pub igvm: WriteVar<IgvmOutput>,
     }
@@ -50,6 +60,7 @@ impl SimpleFlowNode for Node {
             resources,
             disable_secure_avic,
             confidential_debug,
+            add_temp_snp_id_block,
             igvm,
         } = request;
 
@@ -106,6 +117,27 @@ impl SimpleFlowNode for Node {
                     let path = igvm_path.with_file_name(format!("{igvm_file_stem}-vbs.json"));
                     path.exists().then_some(path)
                 };
+                let igvm_snp_idblock = {
+                    let path = igvm_path.with_file_name(format!("{igvm_file_stem}-snp.idblock"));
+                    path.exists().then_some(path)
+                };
+
+                // For open-source SEV-SNP builds, embed an ID block signed by an
+                // ephemeral key so the file launches with `id_block_en = 1`, as
+                // it did before the ID block was split into a separate step.
+                // The presence of `<stem>-snp.idblock` means the manifest built
+                // a measurable SNP platform.
+                if add_temp_snp_id_block && igvm_snp_idblock.is_some() {
+                    flowey::shell_cmd!(
+                        rt,
+                        "{igvmfilegen} add-snp-id-block
+                                --input {igvm_path}
+                                --output {igvm_path}
+                                --manifest {manifest}
+                            "
+                    )
+                    .run()?;
+                }
 
                 rt.write(
                     igvm,
@@ -115,6 +147,7 @@ impl SimpleFlowNode for Node {
                         igvm_tdx_json,
                         igvm_snp_json,
                         igvm_vbs_json,
+                        igvm_snp_idblock,
                     },
                 );
 

openhcl/underhill_attestation/src/jwt.rs

@@ -53,7 +53,9 @@ pub(crate) enum CertificateChainValidationError {
     #[error("certificate chain is empty")]
     CertChainIsEmpty,
     #[error("failed to get public key from the certificate")]
-    GetPublicKeyFromCertificate(#[source] crypto::rsa::RsaError),
+    GetPublicKeyFromCertificate(#[source] crypto::x509::X509Error),
+    #[error("certificate public key is not an RSA key")]
+    PublicKeyNotRsa,
     #[error("failed to verify the child certificate signature with parent public key")]
     VerifyChildSignatureWithParentPublicKey(#[source] crypto::rsa::RsaError),
     #[error("cert chain validation failed -- signature mismatch")]
@@ -244,7 +246,9 @@ fn validate_cert_chain(
             let parent = &cert_chain[i + 1];
             let public_key = parent
                 .public_key()
-                .map_err(CertificateChainValidationError::GetPublicKeyFromCertificate)?;
+                .map_err(CertificateChainValidationError::GetPublicKeyFromCertificate)?
+                .rsa()
+                .ok_or(CertificateChainValidationError::PublicKeyNotRsa)?;
 
             let verified = child.verify(&public_key).map_err(
                 CertificateChainValidationError::VerifyChildSignatureWithParentPublicKey,
@@ -264,7 +268,9 @@ fn validate_cert_chain(
 
     cert_chain[0]
         .public_key()
-        .map_err(CertificateChainValidationError::GetPublicKeyFromCertificate)
+        .map_err(CertificateChainValidationError::GetPublicKeyFromCertificate)?
+        .rsa()
+        .ok_or(CertificateChainValidationError::PublicKeyNotRsa)
 }
 
 #[cfg(test)]
@@ -400,7 +406,7 @@ mod tests {
             .unwrap();
 
         let cert = crate::test_helpers::generate_x509(&rsa_key);
-        let public = cert.public_key().unwrap();
+        let public = cert.public_key().unwrap().rsa().unwrap();
 
         let verification_succeeded = verify_jwt_signature(
             &JwtAlgorithm::RS256,

support/crypto/Cargo.toml

@@ -107,6 +107,7 @@ signature = { workspace = true, features = ["alloc"] }
 x509-cert.workspace = true
 
 [dev-dependencies]
+der = { workspace = true, features = ["derive", "alloc"] }
 hex.workspace = true
 x509-cert = { workspace = true, features = ["builder"] }