test: add SEV-SNP verifier fixture

Author: kvinwang

verifier/fixtures/sev-snp-attestation.json

@@ -0,0 +1,3 @@
+{
+  "attestation": "00038112030000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000100000004000000000018d5250000000000000000000000000000006174746573742d746573742d666978747572652d32303236000000000000000000000000000000000000000000000000000000000000000000000000000000007f51e17f72a04d5422cb2c00998166536019a217376f3aa45a630e59c805a599847ff250dbffcd07e1ba639771d6f05d783f0057820acb99249af56cc3b07b4e8d80f65183167cba9cf437bb680f742f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ab942f03af5e6389b3c0fb8401af5d2fa4010f87e86d424989a57303ceabab12ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff04000000000017d519010100000000000000000000000000000000000000000038d174589d2dff97a6d40cb9f9d90b9507c027491219083cef3ce73ed18f7289142d941ad61eabecd27d25f268c1095d665f6001358e98a4769c82734a6bb87704000000000018d51d3701001d37010004000000000018d5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000506d88f9db02fc2005feded4a20d281b33337b70a2968eb346742cc73fe1f8fbfed9cc4b819357b980c0c8502a6166ad000000000000000000000000000000000000000000000000ef68f81d09b43b55cc3b929268c02865d5b4b0331d47f59642ac9e9f4f431b5afb6165856fce3b4d64eb74928d8905ea00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000855242d2d2d2d2d424547494e2043455254494649434154452d2d2d2d2d0a4d49494769544343424469674177494241674944415141424d455947435371475349623344514542436a41356f4138774451594a59495a4941575544424149430a425143684844416142676b71686b694739773042415167774451594a59495a49415755444241494342514369417749424d4b4d44416745424d487378464441530a42674e564241734d433056755a326c755a5756796157356e4d517377435159445651514745774a56557a45554d424947413155454277774c55324675644745670a51327868636d4578437a414a42674e564241674d416b4e424d523877485159445651514b44425a425a485a68626d4e6c5a43424e61574e79627942455a585a700a5932567a4d524977454159445651514444416c42556b737454576c73595734774868634e4d6a41784d4449794d5467794e4449775768634e4e4455784d4449790a4d5467794e444977576a42374d525177456759445651514c44417446626d6470626d566c636d6c755a7a454c4d416b474131554542684d4356564d78464441530a42674e564241634d43314e68626e526849454e7359584a684d517377435159445651514944414a44515445664d4230474131554543677757515752325957356a0a5a57516754576c6a636d38675247563261574e6c637a45534d424147413155454177774a553056574c553170624746754d494943496a414e42676b71686b69470a397730424151454641414f43416738414d49494343674b43416745416e55326472724e546662684e51496c6c662b5732792b524f4362537a496431614b5a66740a3254397a6a5a514f7a6a4763636c313769316d494b576c374e5463423056595874334a785a537a4f5a6a736a4c4e5641454e324d476a39546965644c2b5165770a4b5a58304a6d514575596a6d2b574b6b734c747867644c70394537455a4e774e447156317230715250357442384f576b79516249644c65753461437a376a2f530a6c31466b427974657639736246477a743763776e6a7a69396d376e6f71736b2b7552564270332b496e3335515064636a3859666c456d6e48424e767555444a680a4c434a4d57384b4f6a50362b2b5068627333694369744a63414e4574573471544e466f4b573343486c626353436a544d384b734e625578334138656b3545564c0a6a5a57483170743945335466705236587966514b6e59366b6c356145495077645733654659617143465072496f39705154365775445350344a43594a625a6e650a4b4b49625a6a7a586b4a74334e5147333245756b59496d42623953436b6d392b6653354c5a4667396f6a7a75624d58332b4e6b426f535849374f50766e484d780a6a7570396d773573653651555637477170434132544e79706f6c6d75512b6341617856374a71484538646c397057662b59336172622b3969694643774674346c0a416c4a77354430435452544331593559574644424372412f76476e6d546e714738432b6a6a55415337636a6a523871344f506879446d4a52506e61432f5a47350a7550304b307a36476f4f2f3375656e397771736843754865674c54704f6548454a524b725146723450564977564f42302b65624f3546676f794f7734336e79460a4435554b424478454234424b6f2f307541694b484c527676674c624f526255384b4152497331456f71456a6d46385574726d5157563268556a777a71777648460a6569387250784d434177454141614f426f7a43426f44416442674e5648513445466751554f385a75474372442f5431695a456962343764484c4c5438762f67770a487759445652306a42426777466f41556861776130555033794b7856314d5564515569723158684b31464d7745675944565230544151482f42416777426745420a2f7749424144414f42674e56485138424166384542414d43415151774f6759445652306642444d774d5441766f4332674b3459706148523063484d364c7939720a5a484e70626e526d4c6d46745a43356a62323076646d4e6c617939324d53394e615778686269396a636d77775267594a4b6f5a496876634e4151454b4d446d670a447a414e42676c67686b67425a514d4541674946414b45634d426f474353714753496233445145424344414e42676c67686b67425a514d4541674946414b49440a416745776f774d43415145446767494241496765555153634166336c4459716757553156746c44626d494e3853326443356b6d517a735a2f4874416a516e4c450a5049316a6833674a624c784c366766334b386a7863747a4f576e6b59636264664d4f4f7232384b54333549614152323072656b4b52467074544868652b4446720a3341467a5a4c44443763574b32392f4770506974504a444b43764937413455673036726b374a307a426531667a2f71653469322f4631327276667743475968630a5278507937514633713866523647434a644231555135536c77436a4678443475657a55527a74496c49416a4d6b74374446764b52682b327a4b2b35706c5647470a46736a444a744d7a32756439793070764f45346a336448354957396a47786153475374714e7261626e6e7046323336455472312f613433623846464b4c35514e0a6d7438567239786e5852707a6e71435276716a722b6b56726236646c6675546c6c69586551544d6c426f5257464a4f524c384163424a78475a344b326d5866740a6c316a5535544c6568354b584c394e5737612f71414f4955733246694f687172747a41684a526739496a38516b5139506b2b634b477a7736456c3354336b46720a4567367a6b786d764d7561625a4f73644b66526b57666848325a4b63546c44666d483148307a7130513262473375766156646943744659314c6c57794233384a0a5332664e73522f50793674356272454a43464e767a61446b79364b654334696f6e2f635667556169377a7a5333624751577a4b444b55333553714e5532576b500a493878435a3030577449694b4b466e5857555178766c4b6d6d675a424959506530317a44304e38617446786d5769536e664a6c3639304239724a704e522f66490a616a7843573353656977733672315a6d2b74437556624d694e7470533954686a4e58347576653574687966453244676f78524676593143736f46354d0a2d2d2d2d2d454e442043455254494649434154452d2d2d2d2d0a7d1d2d2d2d2d2d424547494e2043455254494649434154452d2d2d2d2d0a4d494946517a43434176656741774942416749424144424242676b71686b69473977304241516f774e4b41504d413047435743475341466c41775143416755410a6f5277774767594a4b6f5a496876634e415145494d413047435743475341466c41775143416755416f674d4341544177657a45554d424947413155454377774c0a5257356e6157356c5a584a70626d6378437a414a42674e5642415954416c56544d5251774567594456515148444174545957353059534244624746795954454c0a4d416b47413155454341774351304578487a416442674e5642416f4d466b466b646d46755932566b4945317059334a764945526c646d6c6a5a584d78456a41510a42674e5642414d4d43564e465669314e61577868626a4165467730794e6a41324d5463774d5441314d4452614677307a4d7a41324d5463774d5441314d4452610a4d486f784644415342674e564241734d433056755a326c755a5756796157356e4d517377435159445651514745774a56557a45554d424947413155454277774c0a553246756447456751327868636d4578437a414a42674e564241674d416b4e424d523877485159445651514b44425a425a485a68626d4e6c5a43424e61574e790a627942455a585a705932567a4d52457744775944565151444441685452565974566b4e46537a42324d42414742797147534d34394167454742537542424141690a4132494142456a4a38647772704166506d697461586552553646335235392f304955342b376b766a6b536d5a3937307665325543566f6457536357744c34724d0a54344e76482f472f3632436f684841534e75357947436a7247564b656e70556b30647643677349646275456c3675356f6e426d2b74444942637261526b5267440a69545538384b4f4341526377676745544d42414743537347415151426e48674241515144416745414d42634743537347415151426e4867424167514b4667684e0a61577868626931434d44415242676f7242674545415a783441514d4242414d43415151774551594b4b775942424147636541454441675144416745414d4245470a43697347415151426e48674241775145417749424144415242676f7242674545415a783441514d4642414d43415141774551594b4b77594242414763654145440a42675144416745414d42454743697347415151426e48674241776345417749424144415242676f7242674545415a783441514d4442414d43415263774567594b0a4b775942424147636541454443415145416749413154424e42676b7242674545415a78344151514551446a52644669644c662b587074514d75666e5a433555480a7743644a45686b49504f3838357a37526a334b4a4643325547745965712b7a5366535879614d454a58575a66594145316a70696b6470794363307072754863770a5151594a4b6f5a496876634e4151454b4d445367447a414e42676c67686b67425a514d4541674946414b45634d426f474353714753496233445145424344414e0a42676c67686b67425a514d4541674946414b49444167457741344943415142766153364952394a795378575076426a43697841526561437a70533334526637710a6e563148495545584b373248365850794554387a6a5a6759686b477a72393942356a4f662b625a6a3258716554367438764147382b5677725a456e78527a31340a7765704930563152494d75396d62316846516c4b714b72725679396a5241394e6432736a746176387a793478762b6e6541562b36486a57483357325269536e650a534c624f77556b594b764c5a305a6d6c787646557a345a3045356f306f66514458662f5852596e544d4a5449336e6b4e47433035495259303273654b46524b700a66363439636d70793873586a2b47533446714f6a65796d5739574267787378657956392b44684a3075364e3754782b5148484a7563344147536e5671324b4a790a6e64726b6e7036626b2f7949535931334475556b65463731512f46476b337351653550734b376b534c63736f47614455527541337772727374704f2f6f6f49610a4f6e7971425736414b4c36766c75777a506343754d74784a3869562f4e6458497353556f6c506e6938685a51374d5968343734626c36384e6e6c442b763843500a7943366367486576516d4b467457417457586c7861707a55556c42496c4d495a414b55652b48656c364d68554638764c5955667245526f436e61636c5a6f6b700a42595676676a34514c7175677a595679484273526c6e7965704d755554364b785a6630314c573252717655774d4630307852376d715156445a6f6964417746320a30525a342b476f4c38794b5352366e6c4342544366494f6c446f4251505244475933524d4757426a68636331566e7a787847542b2b2f7561754b4b5269554b450a36347161565170306559544431435a477134493659592f5362386232553553533279766f4639474a4e3837337771476e785869704e785a415754492b704237370a7341732f3344645172413d3d0a2d2d2d2d2d454e442043455254494649434154452d2d2d2d2d0ab1067b226170705f6964223a2238366535393632356265393332303762633233353163346431626261323030333763656338653136222c22636f6d706f73655f68617368223a2238366535393632356265393332303762633233353163346431626261323030333763656338653136386461366231386635353961663561663635376237613233222c22696e7374616e63655f6964223a2264333738633030653635313132633432333562666562343663366130663938666430323134356133222c226b65795f70726f7669646572223a226b6d73222c226b65795f70726f76696465725f6964223a223330353933303133303630373261383634386365336430323031303630383261383634386365336430333031303730333432303030343139623234353764643962386161363434366439383066313336666666373831326563643663373737343065656230653238623130643536633063303030323861356236653539646365613330376435383362643166373037363965396331313664663262636662313735386139356438363133653764653163383438326330222c2276657273696f6e223a337d244073797374656d2d707265706172696e6700186170702d69645086e59625be93207bc2351c4d1bba20037cec8e1630636f6d706f73652d686173688086e59625be93207bc2351c4d1bba20037cec8e168da6b18f559af5af657b7a232c696e7374616e63652d696450d378c00e65112c4235bfeb46c6a0f98fd02145a330626f6f742d6d722d646f6e6500346f732d696d6167652d686173688032b4767373ad7fa0f9c418925006194d5c3f5619529f309fe81156789fecd8bc306b65792d70726f766964657231037b226e616d65223a226b6d73222c226964223a223330353933303133303630373261383634386365336430323031303630383261383634386365336430333031303730333432303030343139623234353764643962386161363434366439383066313336666666373831326563643663373737343065656230653238623130643536633063303030323861356236653539646365613330376435383362643166373037363965396331313664663262636662313735386139356438363133653764653163383438326330227d2873746f726167652d66730c7a66733073797374656d2d7265616479006174746573742d746573742d666978747572652d3230323600000000000000000000000000000000000000000000000000000000000000000000000000000000911e7b226f735f696d6167655f68617368223a2266363963386535303331656332623236396262633038383339636530326362393865653235356436393536323666393431663462333762393539343664333532222c226370755f636f756e74223a322c226d656d6f72795f73697a65223a343239343936373239362c2271656d755f76657273696f6e223a2231302e302e32222c227063695f686f6c6536345f73697a65223a302c22687567657061676573223a66616c73652c226e756d5f67707573223a302c226e756d5f6e767377697463686573223a302c22686f74706c75675f6f6666223a66616c73652c22696d616765223a2264737461636b2d6e76696469612d302e362e302e6132222c22686f73745f73686172655f6d6f6465223a22766864222c226f766d665f76617269616e74223a22707265323032353035222c22737065635f76657273696f6e223a312c226d725f636f6e666967223a227b5c226170705f69645c223a5c22383665353936323562653933323037626332333531633464316262613230303337636563386531365c222c5c22636f6d706f73655f686173685c223a5c22383665353936323562653933323037626332333531633464316262613230303337636563386531363864613662313866353539616635616636353762376132335c222c5c22696e7374616e63655f69645c223a5c22643337386330306536353131326334323335626665623436633661306639386664303231343561335c222c5c226b65795f70726f76696465725c223a5c226b6d735c222c5c226b65795f70726f76696465725f69645c223a5c2233303539333031333036303732613836343863653364303230313036303832613836343863653364303330313037303334323030303431396232343537646439623861613634343664393830663133366666663738313265636436633737373430656562306532386231306435366330633030303238613562366535396463656133303764353833626431663730373639653963313136646632626366623137353861393564383631336537646531633834383263305c222c5c2276657273696f6e5c223a337d222c227365765f736e705f6d6561737572656d656e74223a227b5c22636865636b73756d5f66696c655c223a5c224d44646a4d6a6c6b4e6d55334e7a4e694e3252684d7a42695a44646c4e5756695a4463784e575a694d6d5a6a4d44426d5a6d45344d474932596a63785a4749794f5749795a4455344e6d597a4f4464684d5746684d79416762575668633356795a57316c626e5175633235774c6d4e696233494b5c222c5c226d6561737572656d656e745c223a5c22714764325a584a7a615739754132646a625752736157356c6551456659323975633239735a54313064486c544d434270626d6c3050533970626d6c3049484268626d6c6a50544567626d56304c6d6c6d626d46745a584d394d4342696157397a5a475632626d46745a5430774947316a5a5431765a6d596762323977637a3177595735705979427759326b39626d396c59584a736553427759326b39626d397462574e76626d5967636d46755a4739744c6e527964584e3058324e776454313549484a68626d527662533530636e567a6446396962323930624739685a4756795057346764484e6a50584a6c62476c68596d786c494735764c57743262574e7362324e724947527a6447466a61793579623239305a6e4e666147467a6144316a595456685a47466c5a6a4268597a4e684d7a59784d4467774d7a55354d6a55334e6a4e694e4468684e5467784f4759324d7a526c4e7a41775a6d4a68595749314e6a466b4e4445355a6d517a4d4751334d5449784947527a6447466a61793579623239305a6e4e6663326c365a5430304f5441334d544d774f44687062335a745a6c396f59584e6f5744442f745834354e476d6b6c38446a73487652795832474565565639475452524a4744646d574a4f735a43736d4f6e483555482f78414b684869582f67772f6a47397261325679626d56735832686863326859494e32656f6e544f6d67634a43794c6f4b45734d6842746c774348433056796c665138576378434a33534a7361326c75615852795a46396f59584e6f574342666845784b4c4b576a3048456250624f436b37496271536d376a6773385738476e6561562f615349634758426f59584e6f5a584e6664474669624756665a3342684767434244414270636d567a5a5852665a576c77476743417341527462335a745a6c397a5a574e30615739756334656a5932647759526f41674141415a484e70656d555a6b41426b64486c775a51476a5932647759526f41674b41415a484e70656d555a4d41426b64486c775a51476a5932647759526f41674e41415a484e70656d555a4541426b64486c775a514b6a5932647759526f41674f41415a484e70656d555a4541426b64486c775a514f6a5932647759526f41675041415a484e70656d555a4541426b64486c775a51536a5932647759526f41675241415a484e70656d555a3841426b64486c775a51476a5932647759526f41675141415a484e70656d555a4541426b64486c775a52413d5c222c5c2276637075735c223a322c5c22766370755f747970655c223a5c22455059432d76345c222c5c2267756573745f66656174757265735c223a317d227d"
+}

verifier/fixtures/sev-snp.README.md

@@ -0,0 +1,37 @@
+# SEV-SNP verifier fixture
+
+This fixture exercises the dstack-verifier AMD SEV-SNP path with the current
+split image-measurement material format.
+
+Files:
+
+- `sev-snp-attestation.json`: verifier input containing a self-contained
+  `attestation`. The embedded `vm_config` carries `sev_snp_measurement` with
+  `checksum_file` and `measurement` as JSON base64 byte strings.
+
+The fixture is derived from the real SEV-SNP attestation under
+`dstack-attest/tests/`:
+
+- the signed 1184-byte SNP report and MrConfigV3 document are unchanged;
+- the embedded config is normalized to the current
+  `sha256sum.txt + measurement.snp.cbor` schema;
+- the pinned ASK/VCEK PEMs are embedded in the attestation `cert_chain`, so the
+  verifier test is fully offline and does not call AMD KDS.
+
+To verify manually without image download:
+
+```toml
+address = "127.0.0.1"
+port = 0
+image_cache_dir = "/tmp/dstack-verifier-sev-snp-fixture-cache"
+image_download_url = "http://127.0.0.1:9/should-not-download/{OS_IMAGE_HASH}.tar.gz"
+image_download_timeout_secs = 1
+```
+
+```bash
+dstack-verifier --config verifier-no-download.toml \
+  --verify verifier/fixtures/sev-snp-attestation.json
+```
+
+Expected result: `Valid: true`, with quote, event log/app info, and OS image
+hash all verified. The cache directory should not be created.

verifier/src/verification.rs

@@ -1221,4 +1221,51 @@ mod tests {
         assert!(decode_key_provider_info(b"").is_none());
         assert!(decode_key_provider_info(b"not json").is_none());
     }
+
+    #[tokio::test]
+    async fn verifies_sev_snp_attestation_fixture_without_image_download() {
+        let request: VerificationRequest =
+            serde_json::from_str(include_str!("../fixtures/sev-snp-attestation.json"))
+                .expect("SNP verifier fixture parses");
+        let cache = tempfile::tempdir().expect("temp cache dir");
+        let image_cache_dir = cache.path().join("cache");
+        let verifier = CvmVerifier::new(
+            image_cache_dir.display().to_string(),
+            "http://127.0.0.1:9/should-not-download/{OS_IMAGE_HASH}.tar.gz".to_string(),
+            Duration::from_secs(1),
+            None,
+        );
+
+        let response = verifier.verify(request).await.expect("verifier runs");
+        assert!(response.is_valid, "{:?}", response.reason);
+        assert!(response.details.quote_verified);
+        assert!(response.details.event_log_verified);
+        assert!(response.details.os_image_hash_verified);
+        assert_eq!(response.details.tee_platform.as_deref(), Some("sev-snp"));
+        assert!(
+            !image_cache_dir.exists(),
+            "SNP verification must not download or cache OS images"
+        );
+    }
+
+    #[tokio::test]
+    async fn attestation_fixture_ignores_conflicting_top_level_inputs() {
+        let mut request: VerificationRequest =
+            serde_json::from_str(include_str!("../fixtures/sev-snp-attestation.json"))
+                .expect("SNP verifier fixture parses");
+        request.quote = Some(vec![0]);
+        request.event_log = Some("[]".to_string());
+        request.vm_config = Some("not-json".to_string());
+        let cache = tempfile::tempdir().expect("temp cache dir");
+        let verifier = CvmVerifier::new(
+            cache.path().join("cache").display().to_string(),
+            "http://127.0.0.1:9/should-not-download/{OS_IMAGE_HASH}.tar.gz".to_string(),
+            Duration::from_secs(1),
+            None,
+        );
+
+        let response = verifier.verify(request).await.expect("verifier runs");
+        assert!(response.is_valid, "{:?}", response.reason);
+        assert_eq!(response.details.tee_platform.as_deref(), Some("sev-snp"));
+    }
 }