fix: add unpadded init_data hashes to RVPS for bare metal SNP (#23)

Commit f928983 ("feat: add baremetal TDX/SNP and NVIDIA GPU
attestation support") added zero-padded raw hashes to the RVPS
init_data reference values, described as "SHA256(toml) zero-padded
to 48 bytes for baremetal TDX/SNP". However, SNP and TDX store the
init_data hash in different fields with different sizes:

- TDX uses mr_config_id (48 bytes), so the 32-byte SHA-256 hash is
  zero-padded to 48 bytes (96 hex chars). The padded format is correct
  for TDX.

- SNP uses host_data (32 bytes), so the SHA-256 hash is stored as-is
  with no padding (64 hex chars). This is confirmed in the KBS SNP
  verifier (deps/verifier/src/snp/mod.rs), which calls
  regularize_data(hash, 32, "HOST_DATA", "SNP") and emits
  hex::encode(report.host_data) as the init_data claim.

Because the RVPS only contained the padded (96-char) format, the OPA
policy check failed on bare metal SNP: the 64-char init_data from the
attestation report did not match any value in the reference list.

Add $rawHash and $debugRawHash (unpadded) to the RVPS alongside the
existing padded values. This supports both TDX (padded) and SNP
(unpadded) from a single configuration.

Fixes: f928983 ("feat: add baremetal TDX/SNP and NVIDIA GPU attestation support")

Signed-off-by: Jens Freimann <jfreiman@redhat.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: jensfr

templates/rvps-values-policies.yaml

@@ -25,7 +25,7 @@ spec:
           {{`{{- $debugRawHash := fromConfigMap "imperative" "debug-initdata" "RAW_HASH" -}}`}}
           {{`{{- $rawHashPadded := printf "%s00000000000000000000000000000000" $rawHash -}}`}}
           {{`{{- $debugRawHashPadded := printf "%s00000000000000000000000000000000" $debugRawHash -}}`}}
-          {{`{{- $referenceValues := list (dict "name" "init_data" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr8Hash $debugPcr8Hash $rawHashPadded $debugRawHashPadded)) -}}`}}
+          {{`{{- $referenceValues := list (dict "name" "init_data" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr8Hash $debugPcr8Hash $rawHash $debugRawHash $rawHashPadded $debugRawHashPadded)) -}}`}}
           {{`{{- $pcrStash := (lookup "v1" "Secret" "trustee-operator-system" "pcr-stash") -}}`}}
           {{`{{- if $pcrStash -}}`}}
           {{`{{- $secretData := $pcrStash.data.json | base64dec | fromJson -}}`}}