Support portable measurement policies on bare metal

crates/attestation/Cargo.toml

@@ -13,8 +13,8 @@ pccs = { workspace = true }
 mock-tdx = { workspace = true, optional = true }
 tokio = { workspace = true, features = ["fs", "rt", "rt-multi-thread"] }
 tokio-rustls = { workspace = true, default-features = false }
-attest-types = { git = "https://github.com/easy-tee/attest.git", rev = "8206cd19d9dcb1978d85a3d8dece06a3ee7a1206" }
-attest-measure = {git = "https://github.com/easy-tee/attest.git", rev = "8206cd19d9dcb1978d85a3d8dece06a3ee7a1206" }
+attest-types = { git = "https://github.com/easy-tee/attest.git", rev = "12f1e29f6ea63ecc2f80f39c2c1f1172720bcf24" }
+attest-measure = { git = "https://github.com/easy-tee/attest.git", rev = "12f1e29f6ea63ecc2f80f39c2c1f1172720bcf24" }
 
 anyhow = "1.0.100"
 pem-rfc7468 = { version = "0.7.0", features = ["std"] }
@@ -51,6 +51,10 @@ rustls = { workspace = true, default-features = false, features = ["aws_lc_rs"]
 
 serde-saphyr = "0.0.22"
 
+[build-dependencies]
+attest-measure = { git = "https://github.com/easy-tee/attest.git", rev = "12f1e29f6ea63ecc2f80f39c2c1f1172720bcf24" }
+serde_json = "1.0.145"
+
 [features]
 default = []
 

crates/attestation/README.md

@@ -262,29 +262,32 @@ The `measurements` format above specifies register values, so any change
 to platform-injected values (firmware, RAM size, disk count, ACPI tables)
 changes the expected register values even when the OS image is unchanged.
 
-The `dcap_image_hashes` alternative allows you to specify the OS image's 
+The `dcap_image_hashes` alternative allows you to specify the OS image's
 boot-component hashes instead, and the verifier reconstructs the expected
-register values from those hashes plus platform metadata fetched attest
-verification time. The same policy record then matches the same OS images
-across platform variants.
+register values from those hashes plus platform metadata available at
+attestation verification time. The same policy record then matches the same OS
+images across platform variants.
 
 This can be done with the `attest measure` CLI from
 [Easy-TEE/attest](https://github.com/Easy-TEE/attest) which outputs five
-hex-encoded SHA-384 values:
+hex-encoded SHA-384 values and, for images using a recent systemd EFI stub, one
+additional optional value:
 
 - `uki_authenticode` - authenticode hash of the UKI (unified kernel image)
 - `kernel_authenticode` - authenticode hash of the kernel binary
 - `cmdline_hash` - hash of the kernel command line
 - `initrd_hash` - hash of the initramfs
 - `gpt_disk_guid_hash` - hash derived from GPT partition GUIDs
+- `pe_sections` - optional accumulated hash of the UKI PE sections measured by
+  recent systemd EFI stubs
 
 Example:
 
 ```JSON
 [
   {
     "measurement_id": "flashbox-l1-v1.0.0",
-    "attestation_type": "gcp-tdx",
+    "attestation_type": "dcap-tdx",
     "dcap_image_hashes": {
       "uki_authenticode": "fcaceb6d87694746ba2d93a87ef4209f2a7629b7f400097b93241e80b9ec3e1e80f9a4cd8028e6a83f297ea5de8d9abc",
       "kernel_authenticode": "b6c5133268aa8b440509f3d53ee855a5cd3aeb6441eb109a9f27f14c43bce3e2383856df4af876501ceeb4c9a3b15f0c",
@@ -298,17 +301,21 @@ Example:
 
 #### Supported attestation types for portable measurements
 
-Portable policies currently only work with the `"gcp-tdx"` attestation type.
-For GCP, the verifier fetches the platform firmware blob from Google's metadata
-service (keyed by MRTD) and combines it with the image hashes to reconstruct the
-expected registers. A `dcap_image_hashes` record with any other attestation type
-is rejected when parsing from JSON.
+Portable policies work with the `"dcap-tdx"` and `"gcp-tdx"` attestation types.
+`"dcap-tdx"` accepts DCAP evidence from any platform, including GCP and
+bare-metal TDX, while `"gcp-tdx"` restricts the record to GCP. For bare-metal
+DCAP TDX, MRTD selects a bundled trusted OVMF firmware blob. The verifier uses
+that blob and the platform metadata to reconstruct and check MRTD and RTMR0, in
+addition to the image-dependent RTMR1 and RTMR2. An unknown bare-metal MRTD is
+rejected. The accepted firmware assets and their provenance are documented in
+[`assets/ovmf`](assets/ovmf/README.md). For GCP, the verifier instead fetches a
+Google-endorsed platform firmware blob keyed by MRTD.
 
 The JSON object emitted directly by `attest measure portable` is also accepted
 as a measurement policy. Its optional `azure` PCR values and its `dcap` image
-hashes are converted into Azure TDX and GCP TDX policy records respectively.
-It can be supplied on its own or as an element of a policy array, including an
-array mixed with records in the policy format described above:
+hashes are converted into an Azure TDX record and a generic DCAP record
+respectively. It can be supplied on its own or as an element of a policy array,
+including an array mixed with records in the policy format described above:
 
 ```JSON
 {