Add IsHardened in launch spec #244
Conversation
|
I'm not sure why git didn't recognize the move |
jkl73
force-pushed
the
checkhardenedminorfix
branch
3 times, most recently
from
b47020d to
96e6808
Compare
|
We will need to see what we do here after #246 is merged. My preference would probably be to just have PCR 13 used unconditionally, but have the server side be capable of understanding multiple container launches.
For future reference, you can get Git to pay attention to this stuff by having one commit that just moves the file (with |
jkl73
force-pushed
the
checkhardenedminorfix
branch
from
96e6808 to
0613ad6
Compare
Updated, removed resettable PCR change. I split the commit so now I think git can recognize the file rename. |
|
Maybe I'm missing something, but what is the future purpose of the IsHardened value in the launch spec? Is this so we can entirely control the machine restart behavior inside the container launcher? or something else? |
They are not entirely defined yet, controlling the restart behavior is one potential use case. Another is controlling the default logging behavior. |
Add kernel cmd through image building to indicate if this is hardened image. LaunchSpec will have a new field to indicate the current env is hardened or not. * Rename LauncherSpec to LaunchSpec * HostTokenPath -> hostTokenPath * Silence openssl deprecation warnings for ms-tpm-20-ref Signed-off-by: Jiankun Lu <jiankun@google.com>
Signed-off-by: Jiankun Lu <jiankun@google.com>
jkl73
force-pushed
the
checkhardenedminorfix
branch
from
0613ad6 to
aa2f168
Compare
Breaking Changes: New Features: Add IsHardened in launch spec: google#244 Add container logging redirect policy: google#249 Add SEV-SNP attestation support: google#240 Integrity-protect stateful partition on CS image: google#251 Retry launcher OIDC token refresh with backoff: google#261 Change restart policy behavior to reboot: google#260 Add ability to GetGCEInstanceInfo from a certificate: google#267 Bug Fixes: COS event log: require CEL events to use PCR13, add a launch separator, and don't skip unknown events: google#246 Measure LaunchSeparator event: google#247 Skip unallocated PCR selections when reading all PCRs: google#258 Remove gRPC client and use of insecure credentials: google#262 Fix server.VerifyAttestation proto merging(google#263) and defer of os.Exit(google#264): google#265 Other Changes: Add fake verifier client: google#234 Update CI Go Version to 1.19: google#241 Add launcher integration testing support: google#255 Test multi-writer PD creation disabled: google#256 Update go-sev-guest dependency to v0.2.6: google#259 Change OIDC retry policy to hourly and add jitter to refresh time: google#266 Add wrapper cloudbuild workflow to trigger image build and testing: google#269
Breaking Changes: New Features: Add IsHardened in launch spec: #244 Add container logging redirect policy: #249 Add SEV-SNP attestation support: #240 Integrity-protect stateful partition on CS image: #251 Retry launcher OIDC token refresh with backoff: #261 Change restart policy behavior to reboot: #260 Add ability to GetGCEInstanceInfo from a certificate: #267 Bug Fixes: COS event log: require CEL events to use PCR13, add a launch separator, and don't skip unknown events: #246 Measure LaunchSeparator event: #247 Skip unallocated PCR selections when reading all PCRs: #258 Remove gRPC client and use of insecure credentials: #262 Fix server.VerifyAttestation proto merging(#263) and defer of os.Exit(#264): #265 Other Changes: Add fake verifier client: #234 Update CI Go Version to 1.19: #241 Add launcher integration testing support: #255 Test multi-writer PD creation disabled: #256 Update go-sev-guest dependency to v0.2.6: #259 Change OIDC retry policy to hourly and add jitter to refresh time: #266 Add wrapper cloudbuild workflow to trigger image build and testing: #269
* COS eventlog now can measure to a resettable PCR (in the debug image)* Debug PCR will reset every time before launcher run in the debug imageSigned-off-by: Jiankun Lu jiankun@google.com