Sylica v1.1.0

Sylica v1.1.0

Environment

Built from a pinned Ubuntu 22.04 snapshot with exact package versions in tools-manifest.txt inside each package.

Measurements

Each package contains measurements.json with the firmware hash and precomputed launch digests for common setups.

Compare against the MEASUREMENT/MRTD field of the attestation report. See docs/verification.md for more information.

Firmware

Platform	SHA256
debug-sev	3651e4a2077a411f9c763c4d5df1818652cc6b824f9efb095e5aabcd69f03f0b
debug-tdx	48c3a18691b199aca596c36bdb979d82859c7d7fe764de6738c2269c6ea97fc4
sylica-sev-oss	9a97a52257cfcdd22c5271ef6a119d43fb4ba76b71e505748c02367ea43b2fae
sylica-tdx-oss	9e76edd0a5fc0625a4b9b3c263f88efcc83abe49fdc8f7a90851e234abf62f3e
sylica-x86	9a97a52257cfcdd22c5271ef6a119d43fb4ba76b71e505748c02367ea43b2fae

Verify

gh attestation trusted-root > trusted_root.json

for sums in sha256sums b2sums; do
gh attestation verify -b attestation.json -R enclaive/sylica \
  --custom-trusted-root trusted_root.json \
  --source-digest 9e2684d5606b5aa67509060caa49e47c2baebc1b \
  --signer-digest 9e2684d5606b5aa67509060caa49e47c2baebc1b \
  "$sums"
done

sha256sum -c --ignore-missing < sha256sums
b2sum     -c --ignore-missing < b2sums

Extract

mkdir -p v1.1.0

tar -C v1.1.0 -xf platform-debug-sev-v1.1.0.tar.zst
tar -C v1.1.0 -xf platform-debug-tdx-v1.1.0.tar.zst
tar -C v1.1.0 -xf platform-sylica-sev-oss-v1.1.0.tar.zst
tar -C v1.1.0 -xf platform-sylica-tdx-oss-v1.1.0.tar.zst
tar -C v1.1.0 -xf platform-sylica-x86-v1.1.0.tar.zst

for dir in v1.1.0/*/; do
  (cd "$dir" && b2sum -c b2sums && sha256sum -c sha256sums)
done

Reproduce

export BUILD_ENV=ghcr.io/enclaive/sylica/build-env@sha256:67c89af826981b6dcbe5605f558458e245b1a3fbbaa4d180c008a8bb912a50c4
git checkout v1.1.0
scripts/verify-reproducibility.sh <platform>

Measure

TARGET=v1.1.0/platform-<platform>
verify/file.sh $TARGET/CVMF.fd <mode> > measurements.json
diff -s \
  measurements.json \
  $TARGET/measurements.json

Test

Extract kernel, initrd and instructions to launch a VM:

tar -C v1.1.0 -xf sylica-x86-test-v1.1.0.tar.zst

Testing the firmware does not require a CPU with SNP/TDX support.

Dump

If your host supports SNP or TDX, the test will print a report and the event log as hex.
Drag-and-drop the files to quickly verify the attestation against your workload: https://enclaive.github.io/sylica/

xxd -r -p report.hex > report.bin
xxd -r -p ccel.hex > ccel.bin

---

Convenvience helper to verify artifact attestation:

echo "e3834ac9969965183fa06c13a94b2ab7efba2216bc0fa7262537e9c7bf707aed  attestation.json" | sha256sum -c

See tools/verify-offline on how to verify the release attestation without gh.

What's Changed

• platform: add non-confidential x86 target by @nicu-enclaive in #2

New Contributors

• @nicu-enclaive made their first contribution in #2

Full Changelog: v1.0.1...v1.1.0

Sylica v1.0.1

Sylica v1.0.1

Environment

Built from a pinned Ubuntu 22.04 snapshot with exact package versions in tools-manifest.txt inside each package.

Measurements

Each package contains measurements.json with the firmware hash and precomputed launch digests for common setups.

Compare against the MEASUREMENT/MRTD field of the attestation report. See docs/verification.md for more information.

Firmware

Platform	SHA256
debug-sev	3651e4a2077a411f9c763c4d5df1818652cc6b824f9efb095e5aabcd69f03f0b
debug-tdx	48c3a18691b199aca596c36bdb979d82859c7d7fe764de6738c2269c6ea97fc4
sylica-sev-oss	9a97a52257cfcdd22c5271ef6a119d43fb4ba76b71e505748c02367ea43b2fae
sylica-tdx-oss	9e76edd0a5fc0625a4b9b3c263f88efcc83abe49fdc8f7a90851e234abf62f3e

Verify

gh attestation trusted-root > trusted_root.json

for sums in sha256sums b2sums; do
gh attestation verify -b attestation.json -R enclaive/sylica \
  --custom-trusted-root trusted_root.json \
  --source-digest ebebd425ab8c6155d20e771f3e96ce37905bddfd \
  --signer-digest ebebd425ab8c6155d20e771f3e96ce37905bddfd \
  "$sums"
done

sha256sum -c --ignore-missing < sha256sums
b2sum     -c --ignore-missing < b2sums

Extract

mkdir -p v1.0.1

tar -C v1.0.1 -xf platform-debug-sev-v1.0.1.tar.zst
tar -C v1.0.1 -xf platform-debug-tdx-v1.0.1.tar.zst
tar -C v1.0.1 -xf platform-sylica-sev-oss-v1.0.1.tar.zst
tar -C v1.0.1 -xf platform-sylica-tdx-oss-v1.0.1.tar.zst

for dir in v1.0.1/*/; do
  (cd "$dir" && b2sum -c b2sums && sha256sum -c sha256sums)
done

Reproduce

export BUILD_ENV=ghcr.io/enclaive/sylica/build-env@sha256:37af342c0910aff34099bb607858c089bb0a0c62d004401f7383f86d23f470a6
git checkout v1.0.1
scripts/verify-reproducibility.sh <platform>

Measure

TARGET=v1.0.1/platform-<platform>
verify/file.sh $TARGET/CVMF.fd <mode> > measurements.json
diff -s \
  measurements.json \
  $TARGET/measurements.json

Test

Extract kernel, initrd and instructions to launch a VM:

tar -C v1.0.1 -xf sylica-x86-test-v1.0.1.tar.zst

Testing the firmware does not require a CPU with SNP/TDX support.

Dump

If your host supports SNP or TDX, the test will print a report and the event log as hex.
Drag-and-drop the files to quickly verify the attestation against your workload: https://enclaive.github.io/sylica/

xxd -r -p report.hex > report.bin
xxd -r -p ccel.hex > ccel.bin

---

Convenvience helper to verify artifact attestation:

echo "0cd3c7fb6dadaec7025d7a715e4e3a865f89ca4733427a4d0c1fa92b9751f748  attestation.json" | sha256sum -c

See tools/verify-offline on how to verify the release attestation without gh.

What's Changed

• Revise README for verify-offline tool by @sebastiangajek in #1

New Contributors

• @sebastiangajek made their first contribution in #1

Full Changelog: v1.0.0...v1.0.1

Sylica v1.0.0

Sylica v1.0.0

Environment

Built from a pinned Ubuntu 22.04 snapshot with exact package versions in tools-manifest.txt inside each package.

Measurements

Each package contains measurements.json with the firmware hash and precomputed launch digests for common setups.

Compare against the MEASUREMENT/MRTD field of the attestation report. See docs/verification.md for more information.

Firmware

Platform	SHA256
debug-sev	3651e4a2077a411f9c763c4d5df1818652cc6b824f9efb095e5aabcd69f03f0b
debug-tdx	48c3a18691b199aca596c36bdb979d82859c7d7fe764de6738c2269c6ea97fc4
sylica-sev-oss	9a97a52257cfcdd22c5271ef6a119d43fb4ba76b71e505748c02367ea43b2fae
sylica-tdx-oss	9e76edd0a5fc0625a4b9b3c263f88efcc83abe49fdc8f7a90851e234abf62f3e

Verify

gh attestation trusted-root > trusted_root.json

for sums in sha256sums b2sums; do
gh attestation verify -b attestation.json -R enclaive/sylica \
  --custom-trusted-root trusted_root.json \
  --source-digest dcb18ed4645ee947b7fced8e28c8de2d693aabe7 \
  --signer-digest dcb18ed4645ee947b7fced8e28c8de2d693aabe7 \
  "$sums"
done

sha256sum -c --ignore-missing < sha256sums
b2sum     -c --ignore-missing < b2sums

Extract

mkdir -p v1.0.0

tar -C v1.0.0 -xf platform-debug-sev-v1.0.0.tar.zst
tar -C v1.0.0 -xf platform-debug-tdx-v1.0.0.tar.zst
tar -C v1.0.0 -xf platform-sylica-sev-oss-v1.0.0.tar.zst
tar -C v1.0.0 -xf platform-sylica-tdx-oss-v1.0.0.tar.zst

for dir in v1.0.0/*/; do
  (cd "$dir" && b2sum -c b2sums && sha256sum -c sha256sums)
done

Reproduce

export BUILD_ENV=ghcr.io/enclaive/sylica/build-env@sha256:63239724e11a0b28a1ea399ac4abfef1129fb4b0059392159a340f2165715d4a
git checkout v1.0.0
scripts/verify-reproducibility.sh <platform>

Measure

TARGET=v1.0.0/platform-<platform>
verify/file.sh $TARGET/CVMF.fd <mode> > measurements.json
diff -s \
  measurements.json \
  $TARGET/measurements.json

Test

Extract kernel, initrd and instructions to launch a VM:

tar -C v1.0.0 -xf sylica-x86-test-v1.0.0.tar.zst

Testing the firmware does not require a CPU with SNP/TDX support.

Dump

If your host supports SNP or TDX, the test will print a report and the event log as hex.
Drag-and-drop the files to quickly verify the attestation against your workload: https://enclaive.github.io/sylica/

xxd -r -p report.hex > report.bin
xxd -r -p ccel.hex > ccel.bin

---

Convenvience helper to verify artifact attestation:

echo "6fee749afe9e81a694f040b6ca9b895777b856e074fc1e1a1349864715e302d4  attestation.json" | sha256sum -c

See tools/verify-offline on how to verify the release attestation without gh.

Full Changelog: https://github.com/enclaive/sylica/commits/v1.0.0