Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cli: print attestation document during verification with constellation verify #1577

Merged
merged 11 commits into from
Apr 3, 2023
Merged

cli: print attestation document during verification with constellation verify #1577

merged 11 commits into from
Apr 3, 2023

Conversation

msanft
Copy link
Contributor

@msanft msanft commented Apr 3, 2023 •
edited

Proposed change(s)

  • Show attestation info when using constellation verify for attestation / verification demo purposes
  • Particularly the following:
    • Cluster endpoint (All CSPs)
    • Expected / Actual PCR comparison (All CSPs)
    • VCEK certificate (Azure only)
    • Certificate chain (Azure only)

Additional info

Example output for Azure:

Using endpoint from "constellation-id.json". Specify --node-endpoint to override this.
Using ID from "constellation-id.json". Specify --cluster-id to override this.
WARNING: the config key `attestationVariant` is not set. This key will be required in the next version.
WARNING: The config key "confidentialVM" is deprecated and will be removed in an upcoming version.
Warning: Encountered untrusted PCR value at index 5
Attestation Document:
        Quote:
                PCR 3 (Strict: false):
                        Expected:       3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
                        Actual:         3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
                PCR 8 (Strict: true):
                        Expected:       0000000000000000000000000000000000000000000000000000000000000000
                        Actual:         0000000000000000000000000000000000000000000000000000000000000000
                PCR 13 (Strict: true):
                        Expected:       0000000000000000000000000000000000000000000000000000000000000000
                        Actual:         0000000000000000000000000000000000000000000000000000000000000000
                PCR 15 (Strict: true):
                        Expected:       32de1b8d509f4770003f68958413bd9843600389fbda6a87d0f281db547ab17d
                        Actual:         32de1b8d509f4770003f68958413bd9843600389fbda6a87d0f281db547ab17d
                PCR 2 (Strict: false):
                        Expected:       3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
                        Actual:         3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
                PCR 4 (Strict: true):
                        Expected:       d23e293b73e5a9cd2bdd516762f3089f7f1613b7d37890aa0c3ee0b8c4af5e5c
                        Actual:         d23e293b73e5a9cd2bdd516762f3089f7f1613b7d37890aa0c3ee0b8c4af5e5c
                PCR 5 (Strict: false):
                        Expected:       b731e1a1c70e65e43a4ed54d668b7e585163d9c42f1ed4096174451ff0ba62f2
                        Actual:         af7e37eb743c27351ef8ebe15323900f883b4a12e09d6d26bde41f0c5e3b74c0
                PCR 7 (Strict: false):
                        Expected:       346547a8ce5957af27e552427d6b9e6d9cb502f0156e9155380451eea1b3f0ed
                        Actual:         346547a8ce5957af27e552427d6b9e6d9cb502f0156e9155380451eea1b3f0ed
                PCR 9 (Strict: true):
                        Expected:       a13d79910d9d98480c0d5c3f197d383d5d26895e350225e219bf286a7402e780
                        Actual:         a13d79910d9d98480c0d5c3f197d383d5d26895e350225e219bf286a7402e780
                PCR 11 (Strict: true):
                        Expected:       0000000000000000000000000000000000000000000000000000000000000000
                        Actual:         0000000000000000000000000000000000000000000000000000000000000000
                PCR 12 (Strict: true):
                        Expected:       fd80e6d3692d7d39104a0058905feba2df5bc595586bfa0fbddf738b0b2d47e2
                        Actual:         fd80e6d3692d7d39104a0058905feba2df5bc595586bfa0fbddf738b0b2d47e2
                PCR 14 (Strict: false):
                        Expected:       d7c4cc7ff7933022f013e03bdee875b91720b5b86cf1753cad830f95e791926f
                        Actual:         d7c4cc7ff7933022f013e03bdee875b91720b5b86cf1753cad830f95e791926f
                PCR 1 (Strict: false):
                        Expected:       3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
                        Actual:         3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
        Raw VCEK certificate:
                -----BEGIN CERTIFICATE-----
                MIIFTDCCAvugAwIBAgIBADBGBgkqhkiG9w0BAQowOaAPMA0GCWCGSAFlAwQCAgUA
                oRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCAgUAogMCATCjAwIBATB7MRQwEgYD
                VQQLDAtFbmdpbmVlcmluZzELMAkGA1UEBhMCVVMxFDASBgNVBAcMC1NhbnRhIENs
                YXJhMQswCQYDVQQIDAJDQTEfMB0GA1UECgwWQWR2YW5jZWQgTWljcm8gRGV2aWNl
                czESMBAGA1UEAwwJU0VWLU1pbGFuMB4XDTIyMTEyMzIyMzM0N1oXDTI5MTEyMzIy
                MzM0N1owejEUMBIGA1UECwwLRW5naW5lZXJpbmcxCzAJBgNVBAYTAlVTMRQwEgYD
                VQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExHzAdBgNVBAoMFkFkdmFuY2Vk
                IE1pY3JvIERldmljZXMxETAPBgNVBAMMCFNFVi1WQ0VLMHYwEAYHKoZIzj0CAQYF
                K4EEACIDYgAEVGm4GomfpkiziqEYP61nfKaz5OjDLr8Y0POrv4iAnFVHAmBT81Ms
                gfSLKL5r3V3mNzl1Zh7jwSBft14uhGdwpARoK0YNQc4OvptqVIiv2RprV53DMzge
                rtwiumIargiCo4IBFjCCARIwEAYJKwYBBAGceAEBBAMCAQAwFwYJKwYBBAGceAEC
                BAoWCE1pbGFuLUIwMBEGCisGAQQBnHgBAwEEAwIBAzARBgorBgEEAZx4AQMCBAMC
                AQAwEQYKKwYBBAGceAEDBAQDAgEAMBEGCisGAQQBnHgBAwUEAwIBADARBgorBgEE
                AZx4AQMGBAMCAQAwEQYKKwYBBAGceAEDBwQDAgEAMBEGCisGAQQBnHgBAwMEAwIB
                CDARBgorBgEEAZx4AQMIBAMCAXMwTQYJKwYBBAGceAEEBEB80kCZ1oAyCjWC6w3m
                xOz+i4t6dFjk/Bqhm7+Jscf8D62CXtlwcKc4aM9CdO4LuKlwpdTU80VNQc6ZEuMF
                VzbRMEYGCSqGSIb3DQEBCjA5oA8wDQYJYIZIAWUDBAICBQChHDAaBgkqhkiG9w0B
                AQgwDQYJYIZIAWUDBAICBQCiAwIBMKMDAgEBA4ICAQCN1qBYOywoZWGnQvk6u0Oh
                5zkEKykXU6sK8hA6L65rQcqWUjEHDa9AZUpx3UuCmpPc24dx6DTHc58M7TxcyKry
                8s4CvruBKFbQ6B8MHnH6k07MzsmiBnsiIhAscZ0ipGm6h8e/VM/6ULrAcVSxZ+Mh
                D/IogZAuCQARsGQ4QYXBT8Qc5mLnTkx30m1rZVlp1VcN4ngOo/1tz1jj1mfpG2zv
                wNcQa9LwAzRLnnmLpxXA2OMbl7AaTWQenpL9rzBON2sg4OBl6lVhaSU0uBbFyCmR
                RvBqKC0iDD6TvyIikkMq05v5YwIKFYw++ICndz+fKcLEULZbziAsZ52qjM8iPVHC
                pN0yhVOr2g22F9zxlGH3WxTl9ymUytuv3vJL/aJiQM+n/Ri90Sc05EK4oIJ3+BS8
                yu5cVy9o2cQcOcQ8rhQh+Kv1sR9xrs25EXZF8KEETfhoJnN6KY1RwG7HsOfAQ3dV
                LWInQRaC/8JPyVS2zbd0+NRBJOnq4/quv/P3C4SBP98/ZuGrqN59uifyqC3Kodkl
                WkG/2UdhiLlCmOtsU+BYDZrSiYK1R9FNnlQCOGrkuVxpDwa2TbbvEEzQP7RXxotA
                KlxejvrY4VuK8agNqvffVofbdIIperK65K4+0mYIb+A6fU8QQHlCbti4ERSZ6UYD
                F/SjRih31+SAtWb42jueAA==
                -----END CERTIFICATE-----
        VCEK certificate (1):
                Serial Number: 0
                Subject: CN=SEV-VCEK,OU=Engineering,O=Advanced Micro Devices,L=Santa Clara,ST=CA,C=US
                Issuer: CN=SEV-Milan,OU=Engineering,O=Advanced Micro Devices,L=Santa Clara,ST=CA,C=US
                Not Before: 2022-11-23 22:33:47 +0000 UTC
                Not After: 2029-11-23 22:33:47 +0000 UTC
                Signature Algorithm: SHA384-RSAPSS
                Public Key Algorithm: ECDSA
        Raw Certificate chain:
                -----BEGIN CERTIFICATE-----
                MIIGiTCCBDigAwIBAgIDAQABMEYGCSqGSIb3DQEBCjA5oA8wDQYJYIZIAWUDBAIC
                BQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAICBQCiAwIBMKMDAgEBMHsxFDAS
                BgNVBAsMC0VuZ2luZWVyaW5nMQswCQYDVQQGEwJVUzEUMBIGA1UEBwwLU2FudGEg
                Q2xhcmExCzAJBgNVBAgMAkNBMR8wHQYDVQQKDBZBZHZhbmNlZCBNaWNybyBEZXZp
                Y2VzMRIwEAYDVQQDDAlBUkstTWlsYW4wHhcNMjAxMDIyMTgyNDIwWhcNNDUxMDIy
                MTgyNDIwWjB7MRQwEgYDVQQLDAtFbmdpbmVlcmluZzELMAkGA1UEBhMCVVMxFDAS
                BgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEfMB0GA1UECgwWQWR2YW5j
                ZWQgTWljcm8gRGV2aWNlczESMBAGA1UEAwwJU0VWLU1pbGFuMIICIjANBgkqhkiG
                9w0BAQEFAAOCAg8AMIICCgKCAgEAnU2drrNTfbhNQIllf+W2y+ROCbSzId1aKZft
                2T9zjZQOzjGccl17i1mIKWl7NTcB0VYXt3JxZSzOZjsjLNVAEN2MGj9TiedL+Qew
                KZX0JmQEuYjm+WKksLtxgdLp9E7EZNwNDqV1r0qRP5tB8OWkyQbIdLeu4aCz7j/S
                l1FkBytev9sbFGzt7cwnjzi9m7noqsk+uRVBp3+In35QPdcj8YflEmnHBNvuUDJh
                LCJMW8KOjP6++Phbs3iCitJcANEtW4qTNFoKW3CHlbcSCjTM8KsNbUx3A8ek5EVL
                jZWH1pt9E3TfpR6XyfQKnY6kl5aEIPwdW3eFYaqCFPrIo9pQT6WuDSP4JCYJbZne
                KKIbZjzXkJt3NQG32EukYImBb9SCkm9+fS5LZFg9ojzubMX3+NkBoSXI7OPvnHMx
                jup9mw5se6QUV7GqpCA2TNypolmuQ+cAaxV7JqHE8dl9pWf+Y3arb+9iiFCwFt4l
                AlJw5D0CTRTC1Y5YWFDBCrA/vGnmTnqG8C+jjUAS7cjjR8q4OPhyDmJRPnaC/ZG5
                uP0K0z6GoO/3uen9wqshCuHegLTpOeHEJRKrQFr4PVIwVOB0+ebO5FgoyOw43nyF
                D5UKBDxEB4BKo/0uAiKHLRvvgLbORbU8KARIs1EoqEjmF8UtrmQWV2hUjwzqwvHF
                ei8rPxMCAwEAAaOBozCBoDAdBgNVHQ4EFgQUO8ZuGCrD/T1iZEib47dHLLT8v/gw
                HwYDVR0jBBgwFoAUhawa0UP3yKxV1MUdQUir1XhK1FMwEgYDVR0TAQH/BAgwBgEB
                /wIBADAOBgNVHQ8BAf8EBAMCAQQwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cHM6Ly9r
                ZHNpbnRmLmFtZC5jb20vdmNlay92MS9NaWxhbi9jcmwwRgYJKoZIhvcNAQEKMDmg
                DzANBglghkgBZQMEAgIFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgIFAKID
                AgEwowMCAQEDggIBAIgeUQScAf3lDYqgWU1VtlDbmIN8S2dC5kmQzsZ/HtAjQnLE
                PI1jh3gJbLxL6gf3K8jxctzOWnkYcbdfMOOr28KT35IaAR20rekKRFptTHhe+DFr
                3AFzZLDD7cWK29/GpPitPJDKCvI7A4Ug06rk7J0zBe1fz/qe4i2/F12rvfwCGYhc
                RxPy7QF3q8fR6GCJdB1UQ5SlwCjFxD4uezURztIlIAjMkt7DFvKRh+2zK+5plVGG
                FsjDJtMz2ud9y0pvOE4j3dH5IW9jGxaSGStqNrabnnpF236ETr1/a43b8FFKL5QN
                mt8Vr9xnXRpznqCRvqjr+kVrb6dlfuTlliXeQTMlBoRWFJORL8AcBJxGZ4K2mXft
                l1jU5TLeh5KXL9NW7a/qAOIUs2FiOhqrtzAhJRg9Ij8QkQ9Pk+cKGzw6El3T3kFr
                Eg6zkxmvMuabZOsdKfRkWfhH2ZKcTlDfmH1H0zq0Q2bG3uvaVdiCtFY1LlWyB38J
                S2fNsR/Py6t5brEJCFNvzaDky6KeC4ion/cVgUai7zzS3bGQWzKDKU35SqNU2WkP
                I8xCZ00WtIiKKFnXWUQxvlKmmgZBIYPe01zD0N8atFxmWiSnfJl690B9rJpNR/fI
                ajxCW3Seiws6r1Zm+tCuVbMiNtpS9ThjNX4uve5thyfE2DgoxRFvY1CsoF5M
                -----END CERTIFICATE-----
                -----BEGIN CERTIFICATE-----
                MIIGYzCCBBKgAwIBAgIDAQAAMEYGCSqGSIb3DQEBCjA5oA8wDQYJYIZIAWUDBAIC
                BQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAICBQCiAwIBMKMDAgEBMHsxFDAS
                BgNVBAsMC0VuZ2luZWVyaW5nMQswCQYDVQQGEwJVUzEUMBIGA1UEBwwLU2FudGEg
                Q2xhcmExCzAJBgNVBAgMAkNBMR8wHQYDVQQKDBZBZHZhbmNlZCBNaWNybyBEZXZp
                Y2VzMRIwEAYDVQQDDAlBUkstTWlsYW4wHhcNMjAxMDIyMTcyMzA1WhcNNDUxMDIy
                MTcyMzA1WjB7MRQwEgYDVQQLDAtFbmdpbmVlcmluZzELMAkGA1UEBhMCVVMxFDAS
                BgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEfMB0GA1UECgwWQWR2YW5j
                ZWQgTWljcm8gRGV2aWNlczESMBAGA1UEAwwJQVJLLU1pbGFuMIICIjANBgkqhkiG
                9w0BAQEFAAOCAg8AMIICCgKCAgEA0Ld52RJOdeiJlqK2JdsVmD7FktuotWwX1fNg
                W41XY9Xz1HEhSUmhLz9Cu9DHRlvgJSNxbeYYsnJfvyjx1MfU0V5tkKiU1EesNFta
                1kTA0szNisdYc9isqk7mXT5+KfGRbfc4V/9zRIcE8jlHN61S1ju8X93+6dxDUrG2
                SzxqJ4BhqyYmUDruPXJSX4vUc01P7j98MpqOS95rORdGHeI52Naz5m2B+O+vjsC0
                60d37jY9LFeuOP4Meri8qgfi2S5kKqg/aF6aPtuAZQVR7u3KFYXP59XmJgtcog05
                gmI0T/OitLhuzVvpZcLph0odh/1IPXqx3+MnjD97A7fXpqGd/y8KxX7jksTEzAOg
                bKAeam3lm+3yKIcTYMlsRMXPcjNbIvmsBykD//xSniusuHBkgnlENEWx1UcbQQrs
                +gVDkuVPhsnzIRNgYvM48Y+7LGiJYnrmE8xcrexekBxrva2V9TJQqnN3Q53kt5vi
                Qi3+gCfmkwC0F0tirIZbLkXPrPwzZ0M9eNxhIySb2npJfgnqz55I0u33wh4r0ZNQ
                eTGfw03MBUtyuzGesGkcw+loqMaq1qR4tjGbPYxCvpCq7+OgpCCoMNit2uLo9M18
                fHz10lOMT8nWAUvRZFzteXCm+7PHdYPlmQwUw3LvenJ/ILXoQPHfbkH0CyPfhl1j
                WhJFZasCAwEAAaN+MHwwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSFrBrRQ/fI
                rFXUxR1BSKvVeErUUzAPBgNVHRMBAf8EBTADAQH/MDoGA1UdHwQzMDEwL6AtoCuG
                KWh0dHBzOi8va2RzaW50Zi5hbWQuY29tL3ZjZWsvdjEvTWlsYW4vY3JsMEYGCSqG
                SIb3DQEBCjA5oA8wDQYJYIZIAWUDBAICBQChHDAaBgkqhkiG9w0BAQgwDQYJYIZI
                AWUDBAICBQCiAwIBMKMDAgEBA4ICAQC6m0kDp6zv4Ojfgy+zleehsx6ol0ocgVel
                ETobpx+EuCsqVFRPK1jZ1sp/lyd9+0fQ0r66n7kagRk4Ca39g66WGTJMeJdqYriw
                STjjDCKVPSesWXYPVAyDhmP5n2v+BYipZWhpvqpaiO+EGK5IBP+578QeW/sSokrK
                dHaLAxG2LhZxj9aF73fqC7OAJZ5aPonw4RE299FVarh1Tx2eT3wSgkDgutCTB1Yq
                zT5DuwvAe+co2CIVIzMDamYuSFjPN0BCgojl7V+bTou7dMsqIu/TW/rPCX9/EUcp
                KGKqPQ3P+N9r1hjEFY1plBg93t53OOo49GNI+V1zvXPLI6xIFVsh+mto2RtgEX/e
                pmMKTNN6psW88qg7c1hTWtN6MbRuQ0vm+O+/2tKBF2h8THb94OvvHHoFDpbCELlq
                HnIYhxy0YKXGyaW1NjfULxrrmxVW4wcn5E8GddmvNa6yYm8scJagEi13mhGu4Jqh
                3QU3sf8iUSUr09xQDwHtOQUVIqx4maBZPBtSMf+qUDtjXSSq8lfWcd8bLr9mdsUn
                JZJ0+tuPMKmBnSH860llKk+VpVQsgqbzDIvOLvD6W1Umq25boxCYJ+TuBoa4s+HH
                CViAvgT9kf/rBq1d+ivj6skkHxuzcxbk1xv6ZGxrteJxVH7KlX7YRdZ6eARKwLe4
                AFZEAwoKCQ==
                -----END CERTIFICATE-----
        Certificate chain (1):
                Serial Number: 65537
                Subject: CN=SEV-Milan,OU=Engineering,O=Advanced Micro Devices,L=Santa Clara,ST=CA,C=US
                Issuer: CN=ARK-Milan,OU=Engineering,O=Advanced Micro Devices,L=Santa Clara,ST=CA,C=US
                Not Before: 2020-10-22 18:24:20 +0000 UTC
                Not After: 2045-10-22 18:24:20 +0000 UTC
                Signature Algorithm: SHA384-RSAPSS
                Public Key Algorithm: RSA
        Certificate chain (2):
                Serial Number: 65536
                Subject: CN=ARK-Milan,OU=Engineering,O=Advanced Micro Devices,L=Santa Clara,ST=CA,C=US
                Issuer: CN=ARK-Milan,OU=Engineering,O=Advanced Micro Devices,L=Santa Clara,ST=CA,C=US
                Not Before: 2020-10-22 17:23:05 +0000 UTC
                Not After: 2045-10-22 17:23:05 +0000 UTC
                Signature Algorithm: SHA384-RSAPSS
                Public Key Algorithm: RSA

Verification OK

Checklist

  • Add labels (e.g., for changelog category)
  • Link to Milestone

@msanft msanft added the feature This introduces new functionality label Apr 3, 2023
@msanft msanft added this to the v2.7.0 milestone Apr 3, 2023
@msanft msanft requested a review from 3u13r April 3, 2023 09:09
@msanft msanft requested a review from katexochen as a code owner April 3, 2023 09:09
@netlify
Copy link

netlify bot commented Apr 3, 2023 •
edited

✅ Deploy Preview for constellation-docs canceled.

Name Link
🔨 Latest commit 2e88ad3
🔍 Latest deploy log https://app.netlify.com/sites/constellation-docs/deploys/642acde0253f5c00082e4b46

katexochen
katexochen reviewed Apr 3, 2023
View reviewed changes
cli/internal/cmd/verify.go Outdated Show resolved Hide resolved
cli/internal/cmd/verify.go Outdated Show resolved Hide resolved
@msanft msanft requested a review from thomasten as a code owner April 3, 2023 10:23
@msanft msanft force-pushed the feat/cli/attestation-output branch from 08b2603 to d2066b3 Compare April 3, 2023 10:34
3u13r
3u13r requested changes Apr 3, 2023
View reviewed changes
cli/internal/cmd/verify.go Outdated Show resolved Hide resolved
@msanft msanft requested a review from 3u13r April 3, 2023 13:02
3u13r
3u13r approved these changes Apr 3, 2023
View reviewed changes
Copy link
Member

@3u13r 3u13r left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@msanft msanft merged commit e71c33c into main Apr 3, 2023
13 of 14 checks passed
@msanft msanft deleted the feat/cli/attestation-output branch April 3, 2023 13:06
@katexochen katexochen changed the title cli: print attestation document with constellation verify cli: print attestation document during verification with constellation verify Apr 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@katexochen katexochen katexochen left review comments

@3u13r 3u13r 3u13r approved these changes

@thomasten thomasten Awaiting requested review from thomasten thomasten is a code owner

Assignees
No one assigned
Labels
feature This introduces new functionality
Projects
None yet
Milestone
v2.7.0
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@msanft @3u13r @katexochen