Download/Verify Firmware from GCP and Derive HOB from Firmware#13
Conversation
ameba23
left a comment
ameba23
left a comment
There was a problem hiding this comment.
⭐ Great to have HOB digest built for GCP.
I don't see any red flags, and i see that build_hob_template_from_blobis not yet actually used in the GCP verifier path. But still i would not approve this without tests covering build_hob_template_from_blob.
|
Yeah makes sense. I have some tests for |
alexhulbert
changed the title
alexhulbert
changed the title
|
@ameba23 Added another commit to this PR that implements |
6f92c9e to
21ce073
Compare
There was a problem hiding this comment.
🪩 Great work.
Approving as this does all work, but i think theres still some work needed to be able to test against stored assets. Happy to have this merged as is and changes done in followups.
Ive updated flashbots/attested-tls#47 to use this branch, and currently adding a cache for known GCP MRTDs.
| for (gib, expected) in cases { | ||
| assert_eq!(firmware.hob.digest(gib * GIB).unwrap(), expected, "ram={gib} GiB"); | ||
| for (mrtd, cfv) in releases { | ||
| let firmware = DcapFirmware::from_google(mrtd).unwrap(); |
There was a problem hiding this comment.
Do we want to actually fetch the firmware in tests? I think this test is not guaranteed to continue to work in the future.
Maybe we want to test a pre-fetched observed response from the endorsement bucket against these April 2026 MRTDs / CFVs / HOB values.
2 participants
This is in preparation for the GCP endorsement verification PR. This allows me to fully remove
td_hob_template.binin that PR. It future proofs us in case GCP makes significant enough changes to their OVMF fork that it alters the accepted memory layout.