Check if the SE-guests machine firmware is in an IBM approved state.
The machine firmware version can be obtained via setting a flag in the
attestation request.
The opaque 320 byte value from firmware is forwarded to an IBM server
that verifies the firmware value and confirms if the machine is in an
IBM approved firmware state.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a check to verify the hash over the Secret Store in the guest UV
storage. During 'create' the user can request that hash via a flag. During
'check' the user specifies the Add Secret requests and check whether the store is
locked. If the calculated hash over this state matches the one reported
by attestation, this check is successful.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Define and set the minimal supported Rust version (MSRV) to 1.75.0. This
is the (current) minimal supported version over all supported distros
that use rust in s390-tools.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a CLI compatible Rust implementation of pvattest-C.
- All (non-experimental) options are supported and work exactly as in
the C implementation. For some options/parameters new variants are
available.
- `perform` now also accepts positional arguments, while keep accepting
-i and -o that was mandatory in the C implementation.
- `version` may also be a command instead of an option now.
- -V is deprecated
- -v increases verbosity instead of showing the version
- all experimental options are dropped
Acked-by: Qi Feng Huo <huoqif@cn.ibm.com>
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Jan Höppner