From cb9c21ffdf0a12a00c1be70b161deb48204fccf1 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Wed, 26 Aug 2026 01:45:14 +0000 Subject: [PATCH 1/2] fix(rvps): emit bare-metal SNP TCB reference values The bare-metal SNP attestation policy (default_bm.rego) computes hardware := 2 only if all four reported TCB components match RVPS reference values: snp_bootloader, snp_microcode, snp_snp_svn, snp_tee_svn The RVPS builder only passed through snp_launch_measurement from the firmware-reference-values secret, so those four keys were never present in the rvps-reference-values ConfigMap. query_reference_value() returned NULL for snp_bootloader and the hardware rule fell through to the default (97, contraindicated), producing PolicyDeny even when the VCEK signature/endorsement verified successfully. Pass the four SNP TCB keys through from $firmwareData, mirroring the existing snp_launch_measurement handling. Keys are optional (guarded by if), so existing TDX/Azure deployments are unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) --- templates/rvps-values-policies.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/templates/rvps-values-policies.yaml b/templates/rvps-values-policies.yaml index 42290d2..2a98836 100644 --- a/templates/rvps-values-policies.yaml +++ b/templates/rvps-values-policies.yaml @@ -75,6 +75,22 @@ spec: {{`{{- $e := dict "version" "0.1.0" "name" "snp_launch_measurement" "expiration" "2027-12-12T00:00:00Z" "value" $firmwareData.snp_launch_measurement -}}`}} {{`{{- $referenceValues = set $referenceValues "snp_launch_measurement" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}} {{`{{- end -}}`}} + {{`{{- if $firmwareData.snp_bootloader -}}`}} + {{`{{- $e := dict "version" "0.1.0" "name" "snp_bootloader" "expiration" "2027-12-12T00:00:00Z" "value" $firmwareData.snp_bootloader -}}`}} + {{`{{- $referenceValues = set $referenceValues "snp_bootloader" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}} + {{`{{- end -}}`}} + {{`{{- if $firmwareData.snp_microcode -}}`}} + {{`{{- $e := dict "version" "0.1.0" "name" "snp_microcode" "expiration" "2027-12-12T00:00:00Z" "value" $firmwareData.snp_microcode -}}`}} + {{`{{- $referenceValues = set $referenceValues "snp_microcode" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}} + {{`{{- end -}}`}} + {{`{{- if $firmwareData.snp_snp_svn -}}`}} + {{`{{- $e := dict "version" "0.1.0" "name" "snp_snp_svn" "expiration" "2027-12-12T00:00:00Z" "value" $firmwareData.snp_snp_svn -}}`}} + {{`{{- $referenceValues = set $referenceValues "snp_snp_svn" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}} + {{`{{- end -}}`}} + {{`{{- if $firmwareData.snp_tee_svn -}}`}} + {{`{{- $e := dict "version" "0.1.0" "name" "snp_tee_svn" "expiration" "2027-12-12T00:00:00Z" "value" $firmwareData.snp_tee_svn -}}`}} + {{`{{- $referenceValues = set $referenceValues "snp_tee_svn" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}} + {{`{{- end -}}`}} {{`{{- if $firmwareData.xfam -}}`}} {{`{{- $e := dict "version" "0.1.0" "name" "xfam" "expiration" "2027-12-12T00:00:00Z" "value" $firmwareData.xfam -}}`}} {{`{{- $referenceValues = set $referenceValues "xfam" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}} From e6aa02c360e8f9e23ded9954931d74d1a851019d Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Mon, 31 Aug 2026 15:37:11 +0530 Subject: [PATCH 2/2] fix: stuff Signed-off-by: Chris Butler --- Chart.yaml | 2 +- README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Chart.yaml b/Chart.yaml index b4bac1f..4e51e4d 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -6,4 +6,4 @@ keywords: - confidential-computing - confidential-containers name: trustee -version: 0.10.1 +version: 0.10.2 diff --git a/README.md b/README.md index e8a02f8..88aa7e6 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # trustee -![Version: 0.10.1](https://img.shields.io/badge/Version-0.10.1-informational?style=flat-square) +![Version: 0.10.2](https://img.shields.io/badge/Version-0.10.2-informational?style=flat-square) A Helm chart to provide an opinionated deployment of Trustee in a validated pattern