v0.2.0

Release Notes

This release focuses on improving GCP TDX attestation verification, strengthening certificate validation, and keeping the project dependencies and CI infrastructure up to date.

Highlights

• Added validation for malformed downloaded GCP golden launch endorsements.
• Added support for downloading the GCP TCB signing root certificate on the fly.
• Added a new verification command for GCP TDX attestation flows.
• Improved X.509 certificate verification by checking certificate validity periods.
• Updated core Rust dependencies, including clap, serde, serde_json, openssl, rand, reqwest, thiserror, and vmm-sys-util.
• Updated GitHub Actions used by the project, including actions/checkout, actions/upload-artifact, and ossf/scorecard-action.

Verification and Attestation Improvements

• Detect malformed GCP golden launch endorsements before using them in verification.
• Fetch the GCP TCB signing root certificate dynamically instead of relying only on pre-provided local material.
• Add a dedicated verification command to simplify validation workflows.
• Enforce X.509 certificate validity period checks during certificate verification.

Dependency Updates

The release includes regular maintenance updates for Rust dependencies:

• clap updated across multiple versions, up to 4.6.1
• serde updated up to 1.0.228
• serde_json updated up to 1.0.150
• openssl updated up to 0.10.81
• rand updated up to 0.10.1
• reqwest updated from 0.13.2 to 0.13.4
• thiserror updated up to 2.0.18
• vmm-sys-util updated from 0.14.0 to 0.15.0

CI and Supply Chain Maintenance

• actions/checkout updated up to 6.0.3
• actions/upload-artifact updated up to 7.0.1
• ossf/scorecard-action updated from 2.4.2 to 2.4.3

Contributors

Thanks to:

• @marcelamelara for the GCP attestation and certificate verification improvements.