mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
c93b74b527
The pvattest man pages are generated mostly from the rust doc entries within the tool. Some escape sequences and whatis-entries are incorrect as found by different linter: $ man --warnings -E UTF-8 -l -Tutf8 -Z ./rust/pvattest/man/pvattest-create.1 troff:<standard input>:23: warning: macro 'create'' not defined $ lexgrog -w -m rust/pvattest/man/pvattest-verify.1 rust/pvattest/man/pvattest-verify.1: parse failed Fix this by regenerating the man pages with correct escape sequences and whatis-entries. Github-ID: https://github.com/ibm-s390-linux/s390-tools/issues/170 Reviewed-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
120 lines
2.3 KiB
Groff
120 lines
2.3 KiB
Groff
.\" Copyright 2024, 2025 IBM Corp.
|
||
.\" s390-tools is free software; you can redistribute it and/or modify
|
||
.\" it under the terms of the MIT license. See LICENSE for details.
|
||
.\"
|
||
|
||
.TH "PVATTEST" "1" "2025-03-12" "s390-tools" "Attestation Manual"
|
||
.nh
|
||
.ad l
|
||
.SH NAME
|
||
pvattest \- create, perform, and verify attestation measurements
|
||
.SH SYNOPSIS
|
||
.nf
|
||
.fam C
|
||
pvattest [OPTIONS] <COMMAND>
|
||
.fam C
|
||
.fi
|
||
.SH DESCRIPTION
|
||
Create, perform, and verify attestation measurements for IBM Secure Execution
|
||
guest systems.
|
||
.SH "PVATTEST COMMANDS"
|
||
.PP
|
||
|
||
\fBpvattest-create(1)\fR
|
||
.RS 4
|
||
Create an attestation measurement request
|
||
.RE
|
||
|
||
.PP
|
||
|
||
\fBpvattest-perform(1)\fR
|
||
.RS 4
|
||
Send the attestation request to the Ultravisor
|
||
.RE
|
||
|
||
.PP
|
||
|
||
\fBpvattest-verify(1)\fR
|
||
.RS 4
|
||
Verify an attestation response
|
||
.RE
|
||
|
||
.PP
|
||
|
||
\fBpvattest-check(1)\fR
|
||
.RS 4
|
||
Check if the attestation result matches defined policies
|
||
.RE
|
||
|
||
.SH OPTIONS
|
||
.PP
|
||
\-v, \-\-verbose
|
||
.RS 4
|
||
Provide more detailed output.
|
||
.RE
|
||
.RE
|
||
.PP
|
||
\-q, \-\-quiet
|
||
.RS 4
|
||
Provide less output.
|
||
.RE
|
||
.RE
|
||
.PP
|
||
\-\-version
|
||
.RS 4
|
||
Print version information and exit.
|
||
.RE
|
||
.RE
|
||
.PP
|
||
\-h, \-\-help
|
||
.RS 4
|
||
Print help (see a summary with \fB\-h\fR).
|
||
.RE
|
||
.RE
|
||
|
||
.SH EXAMPLES
|
||
For details refer to the man page of the command.
|
||
.PP
|
||
Create the request on a trusted system.
|
||
.PP
|
||
.nf
|
||
.fam C
|
||
trusted:~$ pvattest create \-k hkd.crt \-\-cert CA.crt \-\-cert ibmsk.crt \-\-arpk arp.key \-o attreq.bin
|
||
|
||
.fam T
|
||
.fi
|
||
On the SE-guest, \fIperform\fP the attestation.
|
||
.PP
|
||
.nf
|
||
.fam C
|
||
seguest:~$ pvattest perform attreq.bin attresp.bin
|
||
|
||
.fam T
|
||
.fi
|
||
On a trusted system, \fIverify\fP that the response is correct. Here, the protection key from the creation and the SE-guest’s header is used to \fIverify\fP the measurement.
|
||
.PP
|
||
.nf
|
||
.fam C
|
||
trusted:~$ pvattest verify \-i attresp.bin \-\-arpk arp.key \-\-hdr se_guest.hdr
|
||
trusted:~$ echo $?
|
||
0
|
||
|
||
.fam T
|
||
.fi
|
||
|
||
If the measurements do not match \fBpvattest\fP exits with code 2 and emits an error message. The SE-guest attestation failed.
|
||
.PP
|
||
.nf
|
||
.fam C
|
||
trusted:~$ pvattest verify \-i wrongresp.bin \-\-arpk arp.key \-\-hdr se_guest.hdr
|
||
ERROR: Attestation measurement verification failed:
|
||
Calculated and received attestation measurement are not the same.
|
||
trusted:~$ echo $?
|
||
2
|
||
|
||
.fam T
|
||
.fi
|
||
.SH "SEE ALSO"
|
||
.sp
|
||
\fBpvattest-create\fR(1) \fBpvattest-perform\fR(1) \fBpvattest-verify\fR(1) \fBpvattest-check\fR(1)
|