Fix C-WCOW dm-verity hash mismatch vs cplat runtime - #37
Merged
Conversation
dmverity-vhd produced per-layer and merged block-CIM dm-verity hashes that did not match the values the cplat runtime (containerd blockcim snapshotter) computes at pull time, which blocks hash-locked confidential Windows containers. Two inputs to the hash differed: 1. CIM name: the CIM name is part of the dm-verity-hashed content. confcom named each layer CIM "<layerDigest>.cim" while the runtime names every layer CIM "layer.cim". Use the constant "layer.cim" to match. 2. Parent-layer order: hcsshim's processNonBaseLayer merges each layer's registry delta against parentLayerPaths[0], and MergeBlockCIMLayersWithOpts expects source CIMs topmost-first (base last). The runtime supplies parents immediate-parent-first (containerd parent-chain order), producing a cumulative/chained registry merge; confcom accumulated them base-first (a flat merge against the original base), diverging from the 3rd layer on. Add orderedParentsForMerge() and apply it in tarToCim and generateMergedCim.
KenGordon
approved these changes
Jun 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
dmverity-vhdproduced per-layer and merged block-CIM dm-verity hashes that did not match the values the cplat runtime (containerd blockcim snapshotter) computes at pull time, which blocks hash-locked confidential Windows (C-WCOW) containers.Two inputs to the dm-verity hash differed between confcom and the runtime:
CIM name — the CIM name is part of the dm-verity-hashed content. confcom named each layer CIM
<layerDigest>.cimwhile the runtime names every layer CIMlayer.cim. Fixed by using the constantlayer.cim.Parent-layer order — hcsshim's
processNonBaseLayermerges each layer's registry delta againstparentLayerPaths[0], andMergeBlockCIMLayersWithOptsexpects source CIMs topmost-first (base last). The runtime supplies parents immediate-parent-first (containerd parent-chain order), producing a cumulative/chained registry merge; confcom accumulated them base-first (a flat merge against the original base), diverging from the 3rd layer onward. Fixed by addingorderedParentsForMerge()and applying it intarToCimandgenerateMergedCim.Change
Single file:
cmd/dmverity-vhd/cim.go(+31/-3). No behavioral change beyond aligning the two hash inputs with the runtime.