CUBE-148 - Fix attestation policy doc and bugs#177
Open
WashingtonKK wants to merge 5 commits intoultravioletrs:mainfrom
Open
CUBE-148 - Fix attestation policy doc and bugs#177WashingtonKK wants to merge 5 commits intoultravioletrs:mainfrom
WashingtonKK wants to merge 5 commits intoultravioletrs:mainfrom
Conversation
Signed-off-by: WashingtonKK <washingtonkigan@gmail.com>
SammyOina
requested changes
Feb 9, 2026
Comment on lines
108
to
111
| # Method depends on your platform and kernel version | ||
| # The SEV-SNP guest device is typically at /dev/sev-guest | ||
| # Use a SNP attestation tool or library to produce the report | ||
| # For example, using snpguest or configfs-tsm: |
Contributor
There was a problem hiding this comment.
just be specific to cube HAL and ubuntu images
Comment on lines
148
to
151
| # The TDX guest device is typically at /dev/tdx_guest | ||
| # Use a TDX quote generation tool or library to produce the quote | ||
| # For example, using the go-tdx-guest library or configfs-tsm: | ||
| cd /sys/kernel/config/tsm/report/report0 |
Contributor
There was a problem hiding this comment.
same as above, examples should be reproducible with our environments
Comment on lines
172
to
179
| - `--mr_config_id <hex>`: Expected MR_CONFIG_ID (48 bytes hex) | ||
| - `--mr_owner <hex>`: Expected MR_OWNER (48 bytes hex) | ||
| - `--mr_config_owner <hex>`: Expected MR_OWNER_CONFIG (48 bytes hex) | ||
| - `--rtmrs <hex,hex,hex,hex>`: Comma-separated RTMR values (4 values, 48 bytes each) | ||
| - `--minimum_tee_tcb_svn <hex>`: Minimum TEE_TCB_SVN (16 bytes hex) | ||
| - `--minimum_qe_svn <value>`: Minimum QE_SVN | ||
| - `--minimum_pce_svn <value>`: Minimum PCE_SVN | ||
| - `--minimum_qe_svn <value>`: Minimum QE_SVN (uint32) | ||
| - `--minimum_pce_svn <value>`: Minimum PCE_SVN (uint32) | ||
| - `--trusted_root <paths>`: Comma-separated paths to PEM CA bundles for Intel TDX root certificates |
Contributor
There was a problem hiding this comment.
is this the command output
Replace generic Linux commands (configfs-tsm, sev-guest device) with cocos-cli attestation commands specific to Cube's HAL and ubuntu images. Signed-off-by: WashingtonKK <washington@ultraviolet.rs>
The deploy workflow calls `make down-cloud` which runs `restore-cloud-config`, restoring `.env.backup` from a previous deployment. This overwrites the fresh `.env` pulled from git, causing any newly added env variables (like CUBE_AI_ATTESTATION_URL) to be permanently lost. Fix by removing stale backup files before `make down-cloud` so `restore-cloud-config` is a no-op and the fresh `.env` is preserved. Signed-off-by: WashingtonKK <washington@ultraviolet.rs>
SammyOina
requested changes
Feb 10, 2026
| ```bash | ||
| # Inside the CVM | ||
| sudo cat /sys/kernel/security/tpm0/binary_bios_measurements > attestation.bin | ||
| cocos-cli attestation get snp-vtpm --tee <512-bit-hex-nonce> --vtpm <256-bit-hex-nonce> |
Contributor
There was a problem hiding this comment.
cocos cli cannot to connect to cube, use working examples that are actually reproducible
Replace cocos-cli attestation get commands with Cube Proxy API curl examples. cocos-cli cannot connect directly to Cube's CVM; the proxy API (POST /<domain_id>/attestation) is the correct way to retrieve attestation reports in Cube's environment. Signed-off-by: WashingtonKK <washington@ultraviolet.rs>
SammyOina
requested changes
Feb 11, 2026
| ```bash | ||
| # Inside the CVM | ||
| sudo cat /sys/kernel/security/tpm0/binary_bios_measurements > attestation.bin | ||
| curl -X POST http://<proxy-host>:<proxy-port>/<domain_id>/attestation \ |
Contributor
There was a problem hiding this comment.
if curl is to be used make sure it is configured correctly and you give proper restart info. or you have chicken and the egg problem, atls needs attestation policy which is what you're trying to find here
| curl -X POST http://<proxy-host>:<proxy-port>/<domain_id>/attestation \ | ||
| -H "Authorization: Bearer <access_token>" \ | ||
| -H "Content-Type: application/json" \ | ||
| -d '{"report_data": "", "nonce": "", "attestation_type": "snp", "to_json": true}' \ |
Contributor
There was a problem hiding this comment.
this will not return azure token, go through the code and test in this environment. some of the options in this request are no longer supported. This is supposed to be a working tutorial
- Remove invalid attestation_type field from all curl examples (agent auto-detects TEE platform at startup, field is not accepted) - Add upfront section about aTLS chicken-and-egg problem: proxy must have aTLS disabled for initial attestation report retrieval - Add API reference table documenting request/response format - Fix Azure section: API returns vTPM protobuf, not MAA token. Document that cocos-cli policy azure requires the MAA JWT token obtained directly from the CVM - Consolidate proxy configuration section (remove duplicate aTLS steps) - All curl examples tested and verified on TDX deployment Signed-off-by: WashingtonKK <washington@ultraviolet.rs>
SammyOina
requested changes
Feb 13, 2026
| # Use Azure's attestation client to get the MAA token | ||
| # Save the token to a file | ||
| echo "<maa_token>" > maa_token.txt | ||
| cocos-cli attestation get --maa-token -o maa_token.txt |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
What does this do?
Which issue(s) does this PR fix/relate to?
Have you included tests for your changes?
Did you document any new/modified features?
Notes