Documentation
¶
Overview ¶
Package agent coordinates the communication between the TPM and the remote attestation service. It handles:
- All TPM-related functionality (quotes, logs, certs, etc...)
- Fetching the relevant principal ID tokens
- Calling VerifyAttestation on the remote service
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AcpiOpts ¶
type AcpiOpts struct {
RetrieveAcpiData bool
}
AcpiOpts contains options for platform ACPI data.
type AttestAgentOpts ¶
type AttestAgentOpts struct {
TokenOptions *models.TokenOptions
*DeviceReportOpts
*AcpiOpts
}
AttestAgentOpts contains user generated options when calling the VerifyAttestation API
type AttestationAgent ¶
type AttestationAgent interface {
MeasureEvent(gecel.Content) error
Attest(context.Context, AttestAgentOpts) ([]byte, error)
AttestWithClient(ctx context.Context, opts AttestAgentOpts, client verifier.Client) ([]byte, error)
AttestationEvidence(ctx context.Context, challenge []byte, extraData []byte, opts AttestAgentOpts) (*attestationpb.VmAttestation, error)
Refresh(context.Context) error
Close() error
AttestHost(ctx context.Context, challenge []byte) ([]byte, error)
}
AttestationAgent is an agent that interacts with GCE's Attestation Service to Verify an attestation message. It is an interface instead of a concrete struct to make testing easier.
func CreateAttestationAgent ¶
func CreateAttestationAgent(tpm io.ReadWriteCloser, akFetcher util.TpmKeyFetcher, verifierClient verifier.Client, principalFetcher principalIDTokenFetcher, sigsFetcher SignatureFetcher, exps Experiments, logger Logger, deviceROTManager *device.ROTManager, signedImageRepos []string) (AttestationAgent, error)
CreateAttestationAgent returns an agent capable of performing remote attestation using the machine's (v)TPM to GCE's Attestation Service. - tpm is a handle to the TPM on the instance - akFetcher is a func to fetch an attestation key: see go-tpm-tools/client. - principalFetcher is a func to fetch GCE principal tokens for a given audience. - signaturesFetcher is a func to fetch container image signatures associated with the running workload. - logger will log any partial errors returned by VerifyAttestation.
type DeviceReportOpts ¶
type DeviceReportOpts = device.ReportOpts
DeviceReportOpts contains options for runtime device attestations.
type Experiments ¶
type Experiments struct {
// EnableGpuGcaSupport enables the GPU attestation.
EnableGpuGcaSupport bool
// EnableGpuItaSupport enables the GPU attestation with ITA.
EnableGpuItaSupport bool
// EnableAttestationEvidence enables the attestation evidence endpoint.
EnableAttestationEvidence bool
// BcMode enables baremetal execution mode.
BcMode bool
// GB300CCMode enables the GB300 Confidential Computing mode.
GB300CCMode bool
}
Experiments contains the experiment flags for the AttestationAgent.
type GB300EvidenceProvider ¶
type GB300EvidenceProvider interface {
AttestGB300(ctx context.Context, challenge []byte) (*bmsaiagentpb.Gb300Evidence, error)
}
GB300EvidenceProvider is an optional interface implemented by agents that provide GB300 platform attestation evidence.
Source Files
Directories