Skip to content

Add makefile command to get image hashes for portable measurement policies #185

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ameba23 wants to merge 1 commit into from
Open

Add makefile command to get image hashes for portable measurement policies #185

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ ifndef IMAGE
$(error IMAGE is not set. Please specify IMAGE=<image> when running make build or make build-dev)
endif

.PHONY: all build build-dev setup measure clean check-module
.PHONY: all build build-dev setup measure measure-portable clean check-module

# Default target
all: build
Expand All @@ -52,6 +52,10 @@ measure: ## Export TDX measurements for the built EFI file
@$(WRAPPER) measured-boot $(FILE) build/measurements.json --direct-uki
echo "Measurements exported to build/measurements.json"

measure-portable: ## Export portable measurements for the built EFI file
@$(WRAPPER) bash -c 'attest measure portable "$$1" > build/portable_measurements.json' _ "$(FILE)"
echo "Portable measurements exported to build/portable_measurements.json"

measure-gcp: ## Export TDX measurements for GCP
@$(WRAPPER) dstack-mr -uki $(FILE) > build/gcp_measurements.json
echo "GCP Measurements exported to build/gcp_measurements.json"
Expand Down
8 changes: 8 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,14 @@ make measure

This generates measurement files in the `build/` directory for attestation and verification.

Alternatively, to get image hashes for 'portable measurement policies':

```bash
make measure-portable
```

This will create a file `build/portable_measurements.json` which can be used for [portable measurement policies](https://github.com/flashbots/attested-tls/tree/main/crates/attestation#portable-measurement-policies).

### Running Images

**Add yourself to the kvm group** (to run QEMU without sudo):
Expand Down
21 changes: 21 additions & 0 deletions flake.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,26 @@
};
vendorHash = "sha256-glOyRTrIF/zP78XGV+v58a1Bec6C3Fvc5c8G3PglzPM=";
};
attest-src = pkgs.fetchFromGitHub {
owner = "Easy-TEE";
repo = "attest";
rev = "e7f59c78f9eabd5d1ac7c9e96da46027878d038c";
hash = "sha256-4PKNsN8j2P6YJfzghz0U28+Bm3BhS/CveR/mSx3oUg8=";
};
attest = pkgs.rustPlatform.buildRustPackage {
pname = "attest";
version = "0.0.1";
src = attest-src;
cargoLock = {
lockFile = "${attest-src}/Cargo.lock";
outputHashes = {
"dcap-qvl-0.3.12" = "sha256-rLTp5wIhXRAcBtJb7lfd1TAg7yPRnwa0cBa1YT4LwKU=";
"cc-eventlog-0.5.8" = "sha256-KEauakj53LrhKTc0yYp5SM8ec0cFNm4YVuHCJYiPQjw=";
};
};
cargoBuildFlags = ["-p" "attest-cli" "--no-default-features"];

@ameba23 ameba23 Jul 30, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No default features because we don't need the default verify feature which add extra dependencies.

cargoTestFlags = ["-p" "attest-cli" "--no-default-features"];
};
mkosi = system: let
pkgsForSystem = import nixpkgs {inherit system;};
mkosiTools = with pkgsForSystem; [
Expand Down Expand Up @@ -130,6 +150,7 @@
(mkosi system)
measured-boot
measured-boot-gcp
attest
bash
curl
git
Expand Down