Update to the latest way of preforming attestation

iroykaufman · iroykaufman · commit 4e3ca3c779b1 · 2025-11-27T15:57:40.000+02:00
using AK registration

Signed-off-by: Roy Kaufman &lt;rkaufman@redhat.com&gt;
diff --git a/configs/trustee.bu b/configs/trustee.bu
@@ -35,6 +35,10 @@ storage:
       mode: 0755
       contents:
         local: populate_kbs.sh
+    - path: /usr/local/bin/kbs-client
+      mode: 0755
+      contents:
+        local: kbs-client
     - path: /etc/containers/systemd/key-generation.container
       mode: 0644
       contents:
@@ -55,5 +59,9 @@ storage:
       mode: 0644
       contents:
         local: containers/nginx.container
+    - path: /etc/containers/systemd/register-ak.container
+      mode: 0644
+      contents:
+        local: containers/register-ak.container
 
 
diff --git a/configs/trustee/containers/kbc.container b/configs/trustee/containers/kbc.container
@@ -4,7 +4,7 @@ After=key-generation.container
 
 [Container]
 ContainerName=kbs-client
-Image=quay.io/rkaufman/kbs-tpm-snp:v1
+Image=quay.io/trusted-execution-clusters/trustee-attester:TPM-additional-dev
 Network=host
 Volume=user-keys:/opt/confidential-containers/kbs/user-keys
 Exec=tail -f /dev/null
diff --git a/configs/trustee/containers/kbs.container b/configs/trustee/containers/kbs.container
@@ -4,7 +4,7 @@ After=key-generation.container
 
 [Container]
 ContainerName=kbs
-Image=quay.io/rkaufman/kbs-tpm-snp:v1
+Image=quay.io/trusted-execution-clusters/key-broker-service:fix-TPM-report-data-size
 Network=host
 Entrypoint=/usr/local/bin/kbs
 PublishPort=8080:8080
@@ -13,6 +13,7 @@ Volume=/var/kbs/config/kbs-config.toml:/opt/confidential-containers/kbs/config/k
 Volume=kbs-storage:/opt/confidential-containers/kbs/repository
 Volume=nebula-ca:/opt/confidential-containers/kbs/nebula-ca
 Volume=user-keys:/opt/confidential-containers/kbs/user-keys
+Volume=trusted-ak-keys:/etc/tpm/trusted_ak_keys
 Exec=--config-file \
     /opt/confidential-containers/kbs/config/kbs-config.toml
 
diff --git a/configs/trustee/containers/key-generation.container b/configs/trustee/containers/key-generation.container
diff --git a/configs/trustee/containers/nginx.container b/configs/trustee/containers/nginx.container
diff --git a/configs/trustee/containers/register-ak.container b/configs/trustee/containers/register-ak.container
@@ -0,0 +1,13 @@
+[Unit]
+Description=server that allow to register AK
+Wants=network-online.target
+After=network-online.target
+
+[Container]
+ContainerName=register-ak
+Image=quay.io/trusted-execution-clusters/test-server-ak:latest
+PublishPort=5001:5001
+Volume=trusted-ak-keys:/data
+
+[Install]
+WantedBy=default.target
diff --git a/configs/trustee/kbs-client b/configs/trustee/kbs-client
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+set -euo pipefail
+# set -x
+
+KEY="${KEY:=/opt/confidential-containers/kbs/user-keys/private.key}"
+
+sudo podman exec -ti \
+  kbs-client \
+    kbs-client \
+      config \
+      --auth-private-key "${KEY}" \
+      "${@}"
diff --git a/configs/trustee/kbs-config.toml b/configs/trustee/kbs-config.toml
@@ -25,6 +25,9 @@ type = "BuiltIn"
 [attestation_service.rvps_config.storage]
 type = "LocalFs"
 
+[attestation_service.verifier_config.tpm_verifier]
+trusted_ak_keys_dir = "/etc/tpm/trusted_ak_keys"
+max_trusted_ak_keys = 100
 
 [[plugins]]
 name = "resource"
diff --git a/configs/trustee/populate_kbs.sh b/configs/trustee/populate_kbs.sh
@@ -9,17 +9,11 @@ KEY=${KEY:=/opt/confidential-containers/kbs/user-keys/private.key}
 ## set reference values for TPM 
 for i in {7,14}; do
     value=$(sudo tpm2_pcrread sha256:${i} | awk -F: '/0x/ {sub(/.*0x/, "", $2); gsub(/[^0-9A-Fa-f]/, "", $2); print tolower($2)}')
-	podman exec -ti kbs-client \
-		 kbs-client  config \
-			--auth-private-key ${KEY} \
-			set-sample-reference-value tpm_pcr${i} "${value}"
+	kbs-client set-sample-reference-value tpm_pcr${i} "${value}"
 done
 
 # Check reference values
-podman exec -ti kbs-client \
-	kbs-client  config \
-		--auth-private-key ${KEY} \
-		get-reference-values
+kbs-client get-reference-values
 
 
 # Create attestation policy
@@ -53,25 +47,15 @@ result := {
 }
 EOF
 
-podman cp A_policy.rego kbs-client:/A_policy.rego
-podman exec -ti kbs-client \
-	kbs-client  config \
-		--auth-private-key ${KEY} \
-		set-attestation-policy \
-		--policy-file /A_policy.rego \
-		--type rego --id default_cpu
+sudo podman cp A_policy.rego kbs-client:/A_policy.rego
+kbs-client set-attestation-policy --policy-file A_policy.rego --type rego --id default_cpu
 
 # Upload resource
 cat > secret << EOF
 { "key_type": "oct", "key": "2b442dd5db4478367729ef8bbf2e7480" }
 EOF
-podman cp secret kbs-client:/secret
-podman exec -ti kbs-client \
-	kbs-client  config \
-		--auth-private-key ${KEY} \
-		set-resource --resource-file /secret \
-		--path ${SECRET_PATH}
-
+sudo podman cp secret kbs-client:/secret
+kbs-client set-resource --resource-file /secret --path ${SECRET_PATH}
 
 # Create resource policy
 ## This policy allows access only if both CPUs report an "affirming" status 
@@ -90,9 +74,5 @@ allow if {
 }
 EOF
 
-podman cp R_policy.rego kbs-client:/R_policy.rego
-podman exec -ti kbs-client \
-	kbs-client  config \
-		--auth-private-key ${KEY} \
-		set-resource-policy \
-		--policy-file /R_policy.rego \
+sudo podman cp R_policy.rego kbs-client:/R_policy.rego
+kbs-client set-resource-policy --policy-file R_policy.rego
diff --git a/containerfiles/trustee-attester.container b/containerfiles/trustee-attester.container
@@ -13,7 +13,7 @@ RUN . /etc/os-release && \
 RUN dnf install -y git tss2-devel tpm2-tss-devel cargo openssl-devel perl
 
 RUN cd /usr/src/ && \
-    git clone https://github.com/confidential-containers/guest-components.git && \
+    git clone https://github.com/trusted-execution-clusters/guest-components.git && \
     cd guest-components && git checkout ${COMMIT}
 
 RUN cd /usr/src/guest-components && \
diff --git a/coreos/Containerfile b/coreos/Containerfile
@@ -1,14 +1,10 @@
 ARG BASE
-FROM quay.io/trusted-execution-clusters/trustee-attester:2025-11-12 as kbc
-FROM quay.io/trusted-execution-clusters/clevis-pin-trustee as clevis
-FROM quay.io/trusted-execution-clusters/ignition:attestation as ignition
-
-ARG KBS_CLIENT_IMAGE=quay.io/confidential-clusters/trustee-attester:2025-10-21
-ARG CLEVIS_PIN_TRUSTEE_IMAGE=quay.io/confidential-clusters/clevis-pin-trustee
-
-FROM $KBS_CLIENT_IMAGE as kbc
-FROM $CLEVIS_PIN_TRUSTEE_IMAGE as clevis
-FROM quay.io/confidential-clusters/ignition:attestation as ignition
+ARG TRUSTEE_ATTESTER=quay.io/trusted-execution-clusters/trustee-attester:TPM-additional-dev
+ARG CLEVIS_PIN_TRUSTEE=quay.io/trusted-execution-clusters/clevis-pin-trustee
+ARG IGNITION=quay.io/trusted-execution-clusters/ignition:attestation
+FROM $TRUSTEE_ATTESTER as kbc
+FROM $CLEVIS_PIN_TRUSTEE as clevis
+FROM $IGNITION as ignition
 
 FROM $BASE
 
diff --git a/coreos/justfile b/coreos/justfile
@@ -18,14 +18,13 @@ os_name := if os == "scos" { scos_os } else { fcos_os }
 label := if os == "scos" { scos_label } else { fcos_label }
 archive := os + ".ociarchive"
 platform := "qemu"
-kbc_image := "quay.io/afrosi_rh/kbs-client-image:latest"
-clevis_pin_trustee_image := "quay.io/confidential-clusters/clevis-pin-trustee"
+
 
 build:
-    sudo podman build --no-cache --build-arg BASE={{base}} --build-arg COM_COREOS_OSNAME={{label}} --build-arg KBS_CLIENT_IMAGE={{kbc_image}} --build-arg CLEVIS_PIN_TRUSTEE_IMAGE={{clevis_pin_trustee_image}} -t {{image}} -f Containerfile .
+    sudo podman build --no-cache --build-arg BASE={{base}} --build-arg COM_COREOS_OSNAME={{label}} -t {{image}} -f Containerfile .
 
 oci-archive:
-    sudo skopeo copy containers-storage:{{image}} oci-archive:{{archive}}
+    sudo skopeo copy containers-storage:{{image}}:latest oci-archive:{{archive}}
 
 osbuild:
     #!/bin/bash
diff --git a/coreos/usr/lib/dracut/modules.d/66tmp_tools/module-setup.sh b/coreos/usr/lib/dracut/modules.d/66tmp_tools/module-setup.sh
@@ -18,7 +18,8 @@ install () {
         tpm2_nvread \
         tpm2_nvwrite \
         tpm2_pcrread \
-        tpm2_unseal
+        tpm2_unseal \
+        tpm2_readpublic
 
     # Library dependencies
     inst_libdir_file "libtss2*" 
diff --git a/scripts/GCP/README.md b/scripts/GCP/README.md
@@ -14,7 +14,7 @@ This guide provides step-by-step instructions for setting up remote attestation
 
 1. To deploy the Trustee server, run:
 ```bash
-./scripts/GCP/deploy-trustee.sh -k <SSH_KEY> -b ./configs/trustee-gcp.bu -i <IMAGE_NAME>
+./scripts/GCP/deploy-trustee.sh -k <SSH_KEY> -b ./configs/trustee.bu -i <IMAGE_NAME>
 ```
 2. After the server is up, populate the KBS with the reference value and add the remote ignition file:
 ```bash
@@ -28,8 +28,8 @@ This guide provides step-by-step instructions for setting up remote attestation
 1. Build a custom RHCOS image by running:
     ```bash
     cd coreos
-    just clevis_pin_trustee_image=quay.io/rkaufman/clevis-pin-trustee:latest os=scos base=quay.io/okd/scos-content:4.20.0-okd-scos.6-stream-coreos \
-    kbc_image=quay.io/rkaufman/kbs-tpm-snp:v1 platform=gcp build oci-archive osbuild
+    just os=scos base=quay.io/okd/scos-content:4.20.0-okd-scos.6-stream-coreos \
+    platform=gcp build oci-archive osbuild
     ```
 
 2. Upload the image to GCP by running:
@@ -46,11 +46,9 @@ This guide provides step-by-step instructions for setting up remote attestation
 
 ## Information About KBS, KBS-Client, and Clevis-Pin
 
-These are modified versions of [trustee](https://github.com/iroykaufman/trustee/tree/addtpm) and the [guest component](https://github.com/iroykaufman/guest-components/tree/TPM-as-additional-device) to support the TPM as an additional device.
+These are modified versions of [guest component](https://github.com/iroykaufman/guest-components/tree/TPM-as-additional-device) to support the TPM as an additional device.
 
-The changes in the guest component are also included in [PR#1093](https://github.com/confidential-containers/guest-components/pull/1093), and the changes in Trustee are related to [PR#851](https://github.com/confidential-containers/trustee/pull/851), where the most significant change is the removal of the trusted Attestation Key (AK) list.
-
-This uses a modified version of `clevis-pin-trustee` that adds AK before performing attestation. The source code is available here: [clevis-pin-trustee](https://github.com/iroykaufman/clevis-pin-trustee/tree/create-tpm-ak)
+The changes in the guest component are also included in [PR#1093](https://github.com/confidential-containers/guest-components/pull/1093).
 
 ## Attestation Policy
 
diff --git a/scripts/GCP/deploy-trustee.sh b/scripts/GCP/deploy-trustee.sh
@@ -41,7 +41,7 @@ sed "s|<KEY>|$KEY|g" "$butane" >"${bufile}"
 
 podman run --interactive --rm --security-opt label=disable \
 	--volume "$(pwd)/configs":/pwd -v "${bufile}":/config.bu:z --workdir /pwd quay.io/coreos/butane:release \
-	--pretty --strict /config.bu --output "/pwd/${IGNITION_FILE}" -d /pwd/trustee-gcp
+	--pretty --strict /config.bu --output "/pwd/${IGNITION_FILE}" -d /pwd/trustee
 
 chcon --verbose --type svirt_home_t ${IGNITION_CONFIG}
 
diff --git a/scripts/GCP/deploy-vm.sh b/scripts/GCP/deploy-vm.sh
@@ -44,8 +44,8 @@ KEY=$(cat "$key")
 
 sed "s|<KEY>|$KEY|g" $butane | sed "s/<IP>/$hostname/" > "${bufile}"
 
-podman run --interactive --rm --security-opt label=disable \
-	--volume "$(pwd)":/pwd -v "${bufile}":/config.bu:z --workdir /pwd quay.io/confidential-clusters/butane:clevis-pin-trustee \
+sudo podman run --interactive  --rm --security-opt label=disable \
+	--volume "$(pwd)":/pwd -v "${bufile}":/config.bu:z --workdir /pwd quay.io/trusted-execution-clusters/butane:attestation \
 	--pretty --strict /config.bu --output "/pwd/${IGNITION_FILE}" -d /pwd/rh-coreos
 
 chcon --verbose --type svirt_home_t ${IGNITION_CONFIG}
diff --git a/scripts/populate-trustee-kbs.sh b/scripts/populate-trustee-kbs.sh
@@ -2,7 +2,7 @@
 
 set -euo pipefail
 # set -x
-source common.sh
+source ./scripts/common.sh
 
 if [[ "${#}" > 3 ]]; then
 	echo "Usage: $0 <path-to-ssh-public-key>"
@@ -24,7 +24,7 @@ until ssh core@$IP \
 	-i "${KEY%.*}" \
 	-o StrictHostKeyChecking=no \
 	-o UserKnownHostsFile=/dev/null \
-	'sudo /usr/local/bin/populate_kbs.sh'; do
+	'populate_kbs.sh'; do
 	echo "Waiting for KBS to be populated..."
 	sleep 1
 done
