rust/pvattest: Improve check and verifiy documentation

Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>

rust/pvattest/README.md

@@ -71,7 +71,7 @@ protection key.
 `-k`, `--host-key-document <FILE>`
 <ul>
 Use FILE as a host-key document. Can be specified multiple times and must be
-used at least once.
+specified at least once.
 </ul>
 
 
@@ -94,9 +94,9 @@ intermediate CA certificate (signed by the root CA).
 
 `--crl <FILE>`
 <ul>
-Use FILE as a certificate revocation list. The list is used to check whether a
-certificate of the chain of trust is revoked. Specify this option multiple times
-to use multiple CRLs.
+Use FILE as a certificate revocation list (CRL). The list is used to check
+whether a certificate of the chain of trust is revoked. Specify this option
+multiple times to use multiple CRLs.
 </ul>
 
 
@@ -197,7 +197,10 @@ must contain the response as produced by ’pvattest perform’. The protection
 key must be the one that was used to create the request by ’pvattest create’.
 Shred the protection key after the verification. The header must be the IBM
 Secure Execution header of the image that was attested during ’pvattest
-perform’
+perform’. The verify command solely verifies that the Attestation measurement
+is correct. It does not check for the content of additional data or user data.
+See `pvattest check` for policy checks after you verified the Attestation
+measurement.
 ### Options
 
 `-i`, `--input <FILE>`
@@ -325,8 +328,8 @@ the UV secret store. Can be specified multiple times.
 <ul>
 Check whether the guests secret store is locked or not. Compares the hash of the
 secret store state to the one calculated by this option and optionally specified
-add-secret-requests. If the attestation response does not contain a secret store
-hash, this check fails.
+add-secret-requests in the correct order. If the attestation response does not
+contain a secret store hash, this check fails.
 
 Required if add-secret-requests are specified.
 </ul>
@@ -334,8 +337,7 @@ Required if add-secret-requests are specified.
 
 `--firmware`
 <ul>
-Check whether the firmware is on an IBM supported version. Requires internet
-access.
+Check whether the firmware is supported by IBM. Requires internet access.
 </ul>
 
 

rust/pvattest/man/pvattest-check.1

@@ -3,7 +3,7 @@
 .\" it under the terms of the MIT license. See LICENSE for details.
 .\"
 
-.TH pvattest-check 1 "2024-11-18" "s390-tools" "Attestation Manual"
+.TH pvattest-check 1 "2024-12-05" "s390-tools" "Attestation Manual"
 .nh
 .ad l
 .SH NAME
@@ -91,8 +91,8 @@ the UV secret store. Can be specified multiple times.
 .RS 4
 Check whether the guests secret store is locked or not. Compares the hash of the
 secret store state to the one calculated by this option and optionally specified
-add-secret-requests. If the attestation response does not contain a secret store
-hash, this check fails.
+add-secret-requests in the correct order. If the attestation response does not
+contain a secret store hash, this check fails.
 
 Required if add-secret-requests are specified.
 .RE
@@ -100,8 +100,7 @@ Required if add-secret-requests are specified.
 .PP
 \-\-firmware
 .RS 4
-Check whether the firmware is on an IBM supported version. Requires internet
-access.
+Check whether the firmware is supported by IBM. Requires internet access.
 .RE
 .RE
 .PP

rust/pvattest/man/pvattest-create.1

@@ -3,7 +3,7 @@
 .\" it under the terms of the MIT license. See LICENSE for details.
 .\"
 
-.TH pvattest-create 1 "2024-11-18" "s390-tools" "Attestation Manual"
+.TH pvattest-create 1 "2024-12-05" "s390-tools" "Attestation Manual"
 .nh
 .ad l
 .SH NAME
@@ -26,7 +26,7 @@ attestation request protection key and shred it after verification. Every
 \-k, \-\-host-key-document <FILE>
 .RS 4
 Use FILE as a host-key document. Can be specified multiple times and must be
-used at least once.
+specified at least once.
 .RE
 .RE
 .PP
@@ -49,9 +49,9 @@ intermediate CA certificate (signed by the root CA).
 .PP
 \-\-crl <FILE>
 .RS 4
-Use FILE as a certificate revocation list. The list is used to check whether a
-certificate of the chain of trust is revoked. Specify this option multiple times
-to use multiple CRLs.
+Use FILE as a certificate revocation list (CRL). The list is used to check
+whether a certificate of the chain of trust is revoked. Specify this option
+multiple times to use multiple CRLs.
 .RE
 .RE
 .PP

rust/pvattest/man/pvattest-verify.1

@@ -3,7 +3,7 @@
 .\" it under the terms of the MIT license. See LICENSE for details.
 .\"
 
-.TH pvattest-verify 1 "2024-11-18" "s390-tools" "Attestation Manual"
+.TH pvattest-verify 1 "2024-12-05" "s390-tools" "Attestation Manual"
 .nh
 .ad l
 .SH NAME
@@ -22,7 +22,10 @@ environment, such as your workstation. Input must contain the response as
 produced by ’pvattest perform’. The protection key must be the one that was
 used to create the request by ’pvattest create’. Shred the protection key
 after the verification. The header must be the IBM Secure Execution header of
-the image that was attested during ’pvattest perform’
+the image that was attested during ’pvattest perform’. The verify command
+solely verifies that the Attestation measurement is correct. It does not check
+for the content of additional data or user data. See `pvattest check` for policy
+checks after you verified the Attestation measurement.
 .SH OPTIONS
 .PP
 \-i, \-\-input <FILE>

rust/pvattest/src/cli.rs

@@ -50,7 +50,10 @@ pub enum Command {
     /// workstation. Input must contain the response as produced by ’pvattest perform’. The
     /// protection key must be the one that was used to create the request by ’pvattest create’.
     /// Shred the protection key after the verification. The header must be the IBM Secure
-    /// Execution header of the image that was attested during ’pvattest perform’
+    /// Execution header of the image that was attested during ’pvattest perform’. The verify
+    /// command solely verifies that the Attestation measurement is correct. It does not check for
+    /// the content of additional data or user data. See `pvattest check` for policy checks after
+    /// you verified the Attestation measurement.
     Verify(VerifyOpt),
 
     /// Check if the attestation result matches defined policies.
@@ -265,11 +268,10 @@ pub struct CheckOpt {
     /// Use FILE to include as successful Add-secret request.
     ///
     /// Checks if the Attestation response contains the hash of all specified add secret
-    /// requests-tags.
-    /// The hash is sensible to the order in which the secrets where added. This means that if the
-    /// order of adding here different from the order the add-secret requests where sent to the UV
-    /// this check will fail even though the same secrets are included in the UV secret store.
-    /// Can be specified multiple times.
+    /// requests-tags. The hash is sensible to the order in which the secrets where added. This
+    /// means that if the order of adding here different from the order the add-secret requests
+    /// where sent to the UV this check will fail even though the same secrets are included in the
+    /// UV secret store. Can be specified multiple times.
     #[arg(
         long,
         value_name = "FILE",
@@ -283,14 +285,14 @@ pub struct CheckOpt {
     /// Check whether the guests secret store is locked or not.
     ///
     /// Compares the hash of the secret store state to the one calculated by this option and
-    /// optionally specified add-secret-requests. If the attestation response does not contain a
-    /// secret store hash, this check fails.
+    /// optionally specified add-secret-requests in the correct order. If the attestation response
+    /// does not contain a secret store hash, this check fails.
     ///
     /// Required if add-secret-requests are specified.
     #[arg(long, value_name = "BOOL")]
     pub secret_store_locked: Option<bool>,
 
-    /// Check whether the firmware is on an IBM supported version.
+    /// Check whether the firmware is supported by IBM.
     ///
     /// Requires internet access.
     #[arg(long)]