kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

rust/pvattest: Improve check and verifiy documentation

Browse Source 
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Steffen Eiden
2024-12-05 08:39:30 +01:00
committed by Jan Höppner
parent 195579cf0b
commit 4df0781989
5 changed files with 36 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rust/pvattest/src/cli.rs
+11 -9
View File
@@ -50,7 +50,10 @@ pub enum Command {
/// workstation. Input must contain the response as produced by ’pvattest perform’. The
/// protection key must be the one that was used to create the request by ’pvattest create’.
/// Shred the protection key after the verification. The header must be the IBM Secure
/// Execution header of the image that was attested during ’pvattest perform’
/// Execution header of the image that was attested during ’pvattest perform’. The verify
/// command solely verifies that the Attestation measurement is correct. It does not check for
/// the content of additional data or user data. See `pvattest check` for policy checks after
/// you verified the Attestation measurement.
Verify(VerifyOpt),
/// Check if the attestation result matches defined policies.
@@ -265,11 +268,10 @@ pub struct CheckOpt {
/// Use FILE to include as successful Add-secret request.
///
/// Checks if the Attestation response contains the hash of all specified add secret
/// requests-tags.
/// The hash is sensible to the order in which the secrets where added. This means that if the
/// order of adding here different from the order the add-secret requests where sent to the UV
/// this check will fail even though the same secrets are included in the UV secret store.
/// Can be specified multiple times.
/// requests-tags. The hash is sensible to the order in which the secrets where added. This
/// means that if the order of adding here different from the order the add-secret requests
/// where sent to the UV this check will fail even though the same secrets are included in the
/// UV secret store. Can be specified multiple times.
#[arg(
long,
value_name = "FILE",
@@ -283,14 +285,14 @@ pub struct CheckOpt {
/// Check whether the guests secret store is locked or not.
///
/// Compares the hash of the secret store state to the one calculated by this option and
/// optionally specified add-secret-requests. If the attestation response does not contain a
/// secret store hash, this check fails.
/// optionally specified add-secret-requests in the correct order. If the attestation response
/// does not contain a secret store hash, this check fails.
///
/// Required if add-secret-requests are specified.
#[arg(long, value_name = "BOOL")]
pub secret_store_locked: Option<bool>,
/// Check whether the firmware is on an IBM supported version.
/// Check whether the firmware is supported by IBM.
///
/// Requires internet access.
#[arg(long)]