AMD KDS is queried with wrong TCB version

[msanft]

The library currently uses the CurrentTCB values of a report when querying the AMD KDS for the VCEK certificate, as opposed to the AMD SEV-SNP ABI spec, which says:

The firmware maintains a TCB_VERSION called the ReportedTcb. ReportedTcb is used to derive
the VCEK that signs the attestation report.

go-sev-guest/verify/verify.go

Line 618 in d8660ce

vcekURL := kds.VCEKCertURL(product, report.GetChipId(), kds.TCBVersion(report.GetCurrentTcb()))

When ReportedTCB != CurrentTCB, this results in a signature verification error when checking the report's signature with the VCEK certificate's public key here:

go-sev-guest/verify/verify.go

Lines 463 to 464 in d8660ce

	if err := vcek.CheckSignature(x509.ECDSAWithSHA384, abi.SignedComponent(report), der); err != nil {
	return fmt.Errorf("report signature verification error: %v", err)