Magnus Kulke

Added integration test for pcr_extend

3

I didn't find a test for extending PCRs in the repo, it would be useful also as a reference

errors: replace anyhow with thiserror

8

hey there @anakrish I took a stab at this one, PTAL. note: this would be breaking change. fixes #161 This change replaces stringly-typed anyhow errors with thiserror-constructed explicit error enums....

At the moment we conflate user errors (policy fails to pass, requested policy does not exist) with internal errors (io errors). Signatures and code of those functions should be adapted,...

Should we be concerned about "Big Ball of Mud" error messages?

1

When performing API requests to the kbs/as services (REST, gRPC) I often found it curious that consumers were exposed to a lot of internals of the service that is being...

Use of RPITIT vs async-trait macro in the project

2

In Rust 1.75 Return-Position-Impl-Trait-In-Traits (RPITIT) has been stabilized. In principle (w/ a few restrictions still) it'll enable "native" async traits, since this is allowed now: ```rust trait Foo { fn...

Attestation-Service: Should the SNP verifier claim set include more than REPORTED_TCB?

4

On SEV_SNP microcode-only updates to a PSP might not be reflected in an snp report's `reported_tcb.microcode` field, but only in `current_tcb.microcode`. Currently we are only including the `reported_tcb.*` fields in...

In e2e test we probably also want to cover an attestation that failed due to invalid evidence. I think we can do this in a generic fashion, for each TEE...

agent: added param to provide auth for guest-pull

6

fixes #9802 The parameter is required for the `guest-pull` feature. While the metadata is pulled on the hosting node, the image layers are being pulled from the registry within the...

We should have an option to specify a cert + key to the deployment and switch the config to https

What to do if a policy body is too large for a k8s annotation value?

1

k8s annotations have an upper limit of 256kb for a given annotation value, which needs to hold the base64 encoded value of a policy. The policies generated by the genpolicy...