Support portable measurement policies on bare metal

[ameba23]

Following Easy-TEE/attest#22 we want to allow portable measurement policies on bare metal.

Previously the attestation crate had a guard to disallow them as it was not fully implemented.

This PR updates the attest crates and removes that guard. It also makes a change to the measurement policy record structure, as it must now explicitly specify an attestation type to remove ambiguity, as we can no longer assume portable measurements = GcpTdx.

It pins known trusted OVMF firmware, and on bare metal this must be used in order for attestations to be verified.

[alexhulbert]

You should be good to add the RTMR0/MRTD and update the pinned attest commit to 12f1e29f6ea63ecc2f80f39c2c1f1172720bcf24. That will make RTMR0 and MRTD work.

I'll send a link to the latest tdx OVMF firmware that's on Ubuntu's repo. That seems like a good first firmware to pin. Going forward, we probably want to have a list of allowed MRTDs.

[ameba23]

You should be good to add the RTMR0/MRTD and update the pinned attest commit to 12f1e29f6ea63ecc2f80f39c2c1f1172720bcf24. That will make RTMR0 and MRTD work.

I'll send a link to the latest tdx OVMF firmware that's on Ubuntu's repo. That seems like a good first firmware to pin. Going forward, we probably want to have a list of allowed MRTDs.

@alexhulbert thats wonderful. ⭐

Do you think we want to pin specific versions of trusted firmware, or have some remote resource that lets us look them up like google does?

Pinning ones is nice because it doesn't need any extra infra or network calls. But it does mean we cant support newer versions without re-releasing.

I've gone for pinning for now, using https://archive.ubuntu.com/ubuntu/pool/main/e/edk2/ovmf-inteltdx_2025.02-8ubuntu3.2_all.deb and extracting the .fd file from the debian package. I don't know if this matches the version that @bakhtin is using - but its a start and we can add more.

Edit: I added an extra firmware blob from Fedora, which looking at the devops repo, i think is the one used by Buildernet on Openmetal.

To avoid embedding the full firmware blob in the binary, DcapFirmware is extracted at build time. See 46073f9

One thing to note:

The newer Ubuntu 26.04 package contains only OVMF.inteltdx.ms.fd

That image has Secure Boot enabled and Microsoft PK/KEK/db/dbx certificates pre-enrolled. If i understand right, this wont play nice with attest as currently implemented. Probably i should write this up in an issue in attest rather than discuss it here.

[Copilot]

Pull request overview

This PR enables “portable” DCAP image-hash measurement policies to work on self-hosted/bare-metal TDX by pinning and bundling trusted OVMF firmware metadata (used to reconstruct MRTD/RTMR0) and by tightening measurement-policy records to explicitly declare an attestation type to avoid ambiguity.

Changes:

• Add a build-time pipeline to parse pinned OVMF .fd blobs into a compact, embedded trusted-firmware index keyed by MRTD.
• Extend portable DCAP image-hash verification to support SelfHostedTdx using bundled trusted firmware, and update policy parsing/tests accordingly.
• Update documentation and dependency pins to reflect the new policy format and added measurement fields (e.g., optional pe_sections).

Reviewed changes

Copilot reviewed 11 out of 14 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
crates/attestation/src/trusted_firmware.rs	Adds a lazy, embedded trusted-firmware lookup keyed by MRTD for self-hosted TDX verification.
crates/attestation/src/measurements.rs	Updates measurement-policy matching logic and adds SelfHostedTdx support for portable DCAP image-hash verification plus new tests.
crates/attestation/src/lib.rs	Wires in the new trusted_firmware module and updates test metadata construction fields.
crates/attestation/src/gcp/provenance.rs	Adjusts test imports in the provenance module.
crates/attestation/src/gcp/firmware.rs	Updates tests to use generic dcap-tdx policy records for GCP DCAP evidence and new image-hash fields.
crates/attestation/src/dcap.rs	Updates tests to pass platform metadata into measurement checks.
crates/attestation/README.md	Documents portable measurement policy behavior across DCAP/GCP and bare metal, including trusted firmware provenance.
crates/attestation/Cargo.toml	Bumps attest dependencies and adds build-dependencies for generating the trusted firmware JSON.
crates/attestation/build.rs	New build script to discover .fd firmware assets, extract DcapFirmware, and emit trusted-firmware.json.
crates/attestation/assets/ovmf/README.md	Documents provenance and checksums for pinned trusted OVMF firmware assets.
crates/attestation/assets/ovmf/COPYRIGHT	Adds firmware/package license and copyright information.
Cargo.lock	Updates locked git revisions for attest dependencies.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ameba23]

I think the cost of cloning this is not unreasonably high