Skip to content

Commit d84c486

Browse files
arvindskumar99DGonzalezVillal
authored andcommitted
Docs: Adding verify measure, host-data, report-data to docs
Adding instructions and changes to documentation on how to use the optional features measure, host-data, and report-data features added to the verify attestation command. Signed-off-by: Arvind Kumar <arvinkum@amd.com>
1 parent 0dd6eb9 commit d84c486

File tree

6 files changed

+26
-47
lines changed

6 files changed

+26
-47
lines changed

.Cargo.toml.un~

-544 Bytes
Binary file not shown.

Cargo.lock

Lines changed: 0 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Cargo.toml~

Lines changed: 0 additions & 41 deletions
This file was deleted.

README.md

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -306,7 +306,7 @@ snpguest verify <SUBCOMMAND>
306306
307307
**Usage**
308308
```bash
309-
snpguest verify attestation $CERTS_DIR $ATT_REPORT_PATH [-t, --tcb] [-s, --signature]
309+
snpguest verify attestation $CERTS_DIR $ATT_REPORT_PATH [-t, --tcb] [-s, --signature] [-m, --measurement] [-d, --host-data] [-r, --report-data]
310310
```
311311
**Arguments**
312312
@@ -318,6 +318,9 @@ snpguest verify <SUBCOMMAND>
318318
319319
- `-t, --tcb`: Verify the Reported TCB section of the report only.
320320
- `-s, --signature`: Verify the signature of the report only.
321+
- `-m, --measurement`: Verify the measurement from the attestation report.
322+
- `-d, --host-data`: Verify the host-data from the attestation report.
323+
- `-r, --report-data`: Verify the report-data from the attestation report.
321324
322325
**Example**
323326
```bash
@@ -327,6 +330,12 @@ snpguest verify <SUBCOMMAND>
327330
snpguest verify attestation ./certs attestation-report.bin --tcb
328331
# Verify Attestation Signature only
329332
snpguest verify attestation ./certs attestation-report.bin --signature
333+
# Verify Attestation Measurement only
334+
snpguest verify attestation --measurement 0xf28aac58964258d8ae0b2e88a706fc7afd0bb524f6a291ac3eedeccb73f89d7cfcf2e4fb6045e7d5201e41d1726afa02 /home/amd/certs /home/amd/report.bin
335+
# Verify Attestation host-data only
336+
snpguest verify attestation --host-data 0x7e4a3f9c1b82a056d39f0d44e5c8a7b1f02394de6b58ac0d7e3c11af0042bd59 /home/amd/certs /home/amd/report.bin
337+
# Verify Attestation report-data only
338+
snpguest verify attestation --report-data 0x5482c1ffe29145d47cf678f7681e3b64a89909d6cf8ec0104cfacb0b0418f005f564ad14f5c1381c99b74903a780ea340e887c9b445e9c760bf0b74115b26d45 /home/amd/certs /home/amd/report.bin
330339
```
331340
332341
### Global Options

docs/snpguest.1.adoc

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,12 +120,25 @@ COMMANDS
120120
An error will be raised if the attestation verification fails at any point.
121121
The user can use the [-t, --tcb] flag to only validate the tcb contents of the report.
122122
The user can use the [-s, --signature] flag to only validate the report signature.
123+
The user can use the [-m, --measurement] flag to verify that the measurement in the attestation
124+
report matches the expected measurement value (prefix with 0x for hex, without prefix it assumes
125+
decimal values).
126+
The user can use the [-d, --host-data] flag to verify that the host-data in the attestation
127+
report matches the expected host-data value (prefix with 0x for hex, without prefix it assumes
128+
decimal values).
129+
The user can use the [-r, --report-data] flag to verify that the report-data in the attestation
130+
report matches the expected report-data value (prefix with 0x for hex, without prefix it assumes
131+
decimal values).
132+
If the optional flags are not passed, just the signature will be verified.
123133

124134
options:
125135
-h, --help show a help message
126136
-p, --processor_model Specify the processor model to use for verification
127137
-t, --tcb verify the tcb section of the report only
128138
-s, --signature verify the signature of the report only
139+
-m, --measurement provide an expected measurement to verify the measurement field in the attestation report
140+
-d, --host-data provide the expected host-data to verify the host-data field in the attestation report
141+
-r, --report-data provide the expected report-data to verify the report-data in the attestation report
129142

130143
*snpguest key*::
131144
usage: snpguest key $KEY_PATH $ROOT_KEY_SELECT [-g, --guest_field_select] [-s, --guest_svn] [-t, --tcb_version] [-v, --vmpl]

src/verify.rs

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -472,13 +472,12 @@ mod attestation {
472472
fn decode_hex_or_decimal(input: &str) -> Result<Vec<u8>> {
473473
// Look for "0x" at beginning. If it exists, treat as a hex.
474474
if let Some(hex_str) = input.strip_prefix("0x") {
475-
return Ok(Vec::from_hex(hex_str)?);
476-
}
477-
else {
475+
Ok(Vec::from_hex(hex_str)?)
476+
} else {
478477
Ok(input.as_bytes().to_vec())
479478
}
480479
}
481-
480+
482481
fn verify_field(
483482
field_name: &str,
484483
expected: &[u8],

0 commit comments

Comments
 (0)