Documentation
¶
Overview ¶
Package agent coordinates the communication between the TPM and the remote attestation service. It handles:
- All TPM-related functionality (quotes, logs, certs, etc...)
- Fetching the relevant principal ID tokens
- Calling VerifyAttestation on the remote service
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AttestAgentOpts ¶
type AttestAgentOpts struct {
TokenOptions *models.TokenOptions
*DeviceReportOpts
}
AttestAgentOpts contains user generated options when calling the VerifyAttestation API
type AttestationAgent ¶
type AttestationAgent interface {
MeasureEvent(gecel.Content) error
Attest(context.Context, AttestAgentOpts) ([]byte, error)
AttestWithClient(ctx context.Context, opts AttestAgentOpts, client verifier.Client) ([]byte, error)
AttestationEvidence(ctx context.Context, challenge []byte, extraData []byte, opts AttestAgentOpts) (*attestationpb.VmAttestation, error)
Refresh(context.Context) error
Close() error
}
AttestationAgent is an agent that interacts with GCE's Attestation Service to Verify an attestation message. It is an interface instead of a concrete struct to make testing easier.
func CreateAttestationAgent ¶
func CreateAttestationAgent(tpm io.ReadWriteCloser, akFetcher util.TpmKeyFetcher, verifierClient verifier.Client, principalFetcher principalIDTokenFetcher, sigsFetcher SignatureFetcher, exps Experiments, logger Logger, deviceROTs []DeviceROT, signedImageRepos []string) (AttestationAgent, error)
CreateAttestationAgent returns an agent capable of performing remote attestation using the machine's (v)TPM to GCE's Attestation Service. - tpm is a handle to the TPM on the instance - akFetcher is a func to fetch an attestation key: see go-tpm-tools/client. - principalFetcher is a func to fetch GCE principal tokens for a given audience. - signaturesFetcher is a func to fetch container image signatures associated with the running workload. - logger will log any partial errors returned by VerifyAttestation.
type DeviceROT ¶
type DeviceROT interface {
// Attest fetches an attestation from the attached device detected by launcher.
Attest(nonce []byte) (any, error)
}
DeviceROT defines an interface for all attached devices to collect attestation.
type DeviceReportOpts ¶
type DeviceReportOpts struct {
EnableRuntimeGPUAttestation bool
}
DeviceReportOpts contains options for runtime device attestations.
type Experiments ¶
type Experiments struct {
// EnableGpuGcaSupport enables the GPU attestation.
EnableGpuGcaSupport bool
// EnableAttestationEvidence enables the attestation evidence endpoint.
EnableAttestationEvidence bool
}
Experiments contains the experiment flags for the AttestationAgent.
Source Files