attest

type Attestation struct {

	// Attestation Key (AK) Public Area, encoded as a TPMT_PUBLIC
	AkPub []byte `protobuf:"bytes,1,opt,name=ak_pub,json=akPub,proto3" json:"ak_pub,omitempty"`
	// Quotes over all supported PCR banks
	Quotes []*tpm.Quote `protobuf:"bytes,2,rep,name=quotes,proto3" json:"quotes,omitempty"`
	// TCG Event Log, encoded in the raw binary format.
	// Can be SHA-1 or crypto-agile.
	EventLog []byte `protobuf:"bytes,3,opt,name=event_log,json=eventLog,proto3" json:"event_log,omitempty"`
	// Optional information about a GCE instance, unused outside of GCE
	InstanceInfo *GCEInstanceInfo `protobuf:"bytes,4,opt,name=instance_info,json=instanceInfo,proto3" json:"instance_info,omitempty"`
	// A TCG Canonical Event Log.
	CanonicalEventLog []byte `protobuf:"bytes,5,opt,name=canonical_event_log,json=canonicalEventLog,proto3" json:"canonical_event_log,omitempty"`
	// Attestation Key (AK) Certificate, encoded as ASN.1 DER.
	// Optional.
	AkCert []byte `protobuf:"bytes,6,opt,name=ak_cert,json=akCert,proto3" json:"ak_cert,omitempty"`
	// Intermediate Certificates for verifying the AK Certificate, encoded as
	// ASN.1 DER. Optional.
	IntermediateCerts [][]byte `protobuf:"bytes,7,rep,name=intermediate_certs,json=intermediateCerts,proto3" json:"intermediate_certs,omitempty"`
	// Trusted execution environment attestation is a secondary platform
	// attestation that the machine is running within a particular confidential
	// environment.
	//
	// Types that are assignable to TeeAttestation:
	//
	//	*Attestation_SevSnpAttestation
	//	*Attestation_TdxAttestation
	TeeAttestation isAttestation_TeeAttestation `protobuf_oneof:"tee_attestation"`
	// contains filtered or unexported fields
}

type Attestation_SevSnpAttestation struct {
	SevSnpAttestation *sevsnp.Attestation `protobuf:"bytes,8,opt,name=sev_snp_attestation,json=sevSnpAttestation,proto3,oneof"`
}

type Attestation_TdxAttestation struct {
	TdxAttestation *tdx.QuoteV4 `protobuf:"bytes,9,opt,name=tdx_attestation,json=tdxAttestation,proto3,oneof"`
}

type AttestedCosState struct {
	Container        *ContainerState        `protobuf:"bytes,1,opt,name=container,proto3" json:"container,omitempty"`
	CosVersion       *SemanticVersion       `protobuf:"bytes,2,opt,name=cos_version,json=cosVersion,proto3" json:"cos_version,omitempty"`
	LauncherVersion  *SemanticVersion       `protobuf:"bytes,3,opt,name=launcher_version,json=launcherVersion,proto3" json:"launcher_version,omitempty"`
	HealthMonitoring *HealthMonitoringState `protobuf:"bytes,4,opt,name=health_monitoring,json=healthMonitoring,proto3" json:"health_monitoring,omitempty"`
	// contains filtered or unexported fields
}

type Certificate struct {

	// The representation of the certificate. If the certificate matches a
	// well-known certificate above, representation should contain the value in
	// the enum. Otherwise, it will contain the raw DER.
	//
	// Types that are assignable to Representation:
	//
	//	*Certificate_Der
	//	*Certificate_WellKnown
	Representation isCertificate_Representation `protobuf_oneof:"representation"`
	// contains filtered or unexported fields
}

type Certificate_Der struct {
	// DER representation of the certificate.
	Der []byte `protobuf:"bytes,1,opt,name=der,proto3,oneof"`
}

type Certificate_WellKnown struct {
	WellKnown WellKnownCertificate `protobuf:"varint,2,opt,name=well_known,json=wellKnown,proto3,enum=attest.WellKnownCertificate,oneof"`
}

type ContainerState struct {
	ImageReference string `protobuf:"bytes,1,opt,name=image_reference,json=imageReference,proto3" json:"image_reference,omitempty"`
	// Digest of the registry's image manifest, which contains a list of the
	// layers comprising the image.
	ImageDigest   string        `protobuf:"bytes,2,opt,name=image_digest,json=imageDigest,proto3" json:"image_digest,omitempty"`
	RestartPolicy RestartPolicy `` /* 127-byte string literal not displayed */
	// Digest of the local image configuration object, containing config items
	// such as local layer digests.
	ImageId string            `protobuf:"bytes,4,opt,name=image_id,json=imageId,proto3" json:"image_id,omitempty"`
	Args    []string          `protobuf:"bytes,5,rep,name=args,proto3" json:"args,omitempty"`
	EnvVars map[string]string `` /* 170-byte string literal not displayed */
	// Record operator input Env Vars and Args, should be subsets of the above
	// Env Vars and Args.
	OverriddenArgs    []string          `protobuf:"bytes,7,rep,name=overridden_args,json=overriddenArgs,proto3" json:"overridden_args,omitempty"`
	OverriddenEnvVars map[string]string `` /* 202-byte string literal not displayed */
	// contains filtered or unexported fields
}

type Database struct {
	Certs  []*Certificate `protobuf:"bytes,1,rep,name=certs,proto3" json:"certs,omitempty"`
	Hashes [][]byte       `protobuf:"bytes,2,rep,name=hashes,proto3" json:"hashes,omitempty"`
	// contains filtered or unexported fields
}

type EfiApp struct {

	// The PE/COFF digest of the EFI application (pulled from the raw event digest).
	Digest []byte `protobuf:"bytes,1,opt,name=digest,proto3" json:"digest,omitempty"`
	// contains filtered or unexported fields
}

type EfiState struct {

	// UEFI's OS Loader code is required to measure attempts to load and execute
	// UEFI applications.
	// UEFI applications are typically bootloaders such as shim and GRUB.
	// These run and are measured using the UEFI LoadImage() service.
	Apps []*EfiApp `protobuf:"bytes,1,rep,name=apps,proto3" json:"apps,omitempty"`
	// contains filtered or unexported fields
}

type Event struct {

	// The Platform Control Register (PCR) this event was extended into.
	PcrIndex uint32 `protobuf:"varint,1,opt,name=pcr_index,json=pcrIndex,proto3" json:"pcr_index,omitempty"`
	// The type of this event. Note that this value is not verified, so it should
	// only be used as a hint during event parsing.
	UntrustedType uint32 `protobuf:"varint,2,opt,name=untrusted_type,json=untrustedType,proto3" json:"untrusted_type,omitempty"`
	// The raw data associated to this event. The meaning of this data is
	// specific to the type of the event.
	Data []byte `protobuf:"bytes,3,opt,name=data,proto3" json:"data,omitempty"`
	// The event digest actually extended into the TPM. This is often the hash of
	// the data field, but in some cases it may have a type-specific calculation.
	Digest []byte `protobuf:"bytes,4,opt,name=digest,proto3" json:"digest,omitempty"`
	// This is true if hash(data) == digest.
	DigestVerified bool `protobuf:"varint,5,opt,name=digest_verified,json=digestVerified,proto3" json:"digest_verified,omitempty"`
	// contains filtered or unexported fields
}

type GCEConfidentialTechnology int32

type GCEInstanceInfo struct {
	Zone          string `protobuf:"bytes,1,opt,name=zone,proto3" json:"zone,omitempty"`
	ProjectId     string `protobuf:"bytes,2,opt,name=project_id,json=projectId,proto3" json:"project_id,omitempty"`
	ProjectNumber uint64 `protobuf:"varint,3,opt,name=project_number,json=projectNumber,proto3" json:"project_number,omitempty"`
	InstanceName  string `protobuf:"bytes,4,opt,name=instance_name,json=instanceName,proto3" json:"instance_name,omitempty"`
	InstanceId    uint64 `protobuf:"varint,5,opt,name=instance_id,json=instanceId,proto3" json:"instance_id,omitempty"`
	// contains filtered or unexported fields
}

type GrubFile struct {

	// The digest of the file (pulled from the raw event digest).
	Digest []byte `protobuf:"bytes,1,opt,name=digest,proto3" json:"digest,omitempty"`
	// The event data. This is not measured, so it is untrusted.
	UntrustedFilename []byte `protobuf:"bytes,2,opt,name=untrusted_filename,json=untrustedFilename,proto3" json:"untrusted_filename,omitempty"`
	// contains filtered or unexported fields
}

type GrubState struct {

	// All GRUB-read and measured files, including grub.cfg.
	Files []*GrubFile `protobuf:"bytes,1,rep,name=files,proto3" json:"files,omitempty"`
	// A list of executed GRUB commands and command lines passed to the kernel
	// and kernel modules.
	Commands []string `protobuf:"bytes,2,rep,name=commands,proto3" json:"commands,omitempty"`
	// contains filtered or unexported fields
}

type HealthMonitoringState struct {

	// Whether memory monitoring is enabled.
	MemoryEnabled *bool `protobuf:"varint,1,opt,name=memory_enabled,json=memoryEnabled,proto3,oneof" json:"memory_enabled,omitempty"`
	// contains filtered or unexported fields
}

type LinuxKernelState struct {

	// The kernel command line.
	CommandLine string `protobuf:"bytes,1,opt,name=command_line,json=commandLine,proto3" json:"command_line,omitempty"`
	// contains filtered or unexported fields
}

type MachineState struct {
	Platform   *PlatformState   `protobuf:"bytes,1,opt,name=platform,proto3" json:"platform,omitempty"`
	SecureBoot *SecureBootState `protobuf:"bytes,2,opt,name=secure_boot,json=secureBoot,proto3" json:"secure_boot,omitempty"`
	// The complete parsed TCG Event Log, including those events used to
	// create the PlatformState.
	RawEvents []*Event `protobuf:"bytes,3,rep,name=raw_events,json=rawEvents,proto3" json:"raw_events,omitempty"`
	// The hash algorithm used when verifying the Attestation. This indicates:
	//   - which PCR bank was used for for quote validation and event log replay
	//   - the hash algorithm used to calculate event digests
	Hash        tpm.HashAlgo      `protobuf:"varint,4,opt,name=hash,proto3,enum=tpm.HashAlgo" json:"hash,omitempty"`
	Grub        *GrubState        `protobuf:"bytes,5,opt,name=grub,proto3" json:"grub,omitempty"`
	LinuxKernel *LinuxKernelState `protobuf:"bytes,6,opt,name=linux_kernel,json=linuxKernel,proto3" json:"linux_kernel,omitempty"`
	Cos         *AttestedCosState `protobuf:"bytes,7,opt,name=cos,proto3" json:"cos,omitempty"`
	Efi         *EfiState         `protobuf:"bytes,8,opt,name=efi,proto3" json:"efi,omitempty"`
	// contains filtered or unexported fields
}

type PlatformPolicy struct {

	// If PlatformState.firmware contains a scrtm_version_id, it must appear
	// in this list. For use with a GCE VM, minimum_gce_firmware_version is
	// often a better alternative.
	AllowedScrtmVersionIds [][]byte `` /* 131-byte string literal not displayed */
	// If PlatformState.firmware contains a minimum_gce_firmware_version, it must
	// be greater than or equal to this value. Currently, the max version is 1.
	MinimumGceFirmwareVersion uint32 `` /* 141-byte string literal not displayed */
	// The PlatformState's technology must be at least as secure as
	// the specified minimum_technology (i.e. AMD_SEV_ES > AMD_SEV > NONE).
	MinimumTechnology GCEConfidentialTechnology `` /* 151-byte string literal not displayed */
	// contains filtered or unexported fields
}

type PlatformState struct {

	// Types that are assignable to Firmware:
	//
	//	*PlatformState_ScrtmVersionId
	//	*PlatformState_GceVersion
	Firmware isPlatformState_Firmware `protobuf_oneof:"firmware"`
	// Set to NONE on non-GCE instances or non-Confidential Shielded GCE instances
	Technology GCEConfidentialTechnology `protobuf:"varint,3,opt,name=technology,proto3,enum=attest.GCEConfidentialTechnology" json:"technology,omitempty"`
	// Only set for GCE instances
	InstanceInfo *GCEInstanceInfo `protobuf:"bytes,4,opt,name=instance_info,json=instanceInfo,proto3" json:"instance_info,omitempty"`
	// contains filtered or unexported fields
}

type PlatformState_GceVersion struct {
	// Virtual GCE firmware version (parsed from S-CRTM version id)
	GceVersion uint32 `protobuf:"varint,2,opt,name=gce_version,json=gceVersion,proto3,oneof"`
}

type PlatformState_ScrtmVersionId struct {
	// Raw S-CRTM version identifier (EV_S_CRTM_VERSION)
	ScrtmVersionId []byte `protobuf:"bytes,1,opt,name=scrtm_version_id,json=scrtmVersionId,proto3,oneof"`
}

type Policy struct {
	Platform *PlatformPolicy `protobuf:"bytes,1,opt,name=platform,proto3" json:"platform,omitempty"`
	// contains filtered or unexported fields
}

type RestartPolicy int32

type SecureBootState struct {

	// Whether Secure Boot is enabled.
	Enabled bool `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// The Secure Boot signature (allowed) database.
	Db *Database `protobuf:"bytes,2,opt,name=db,proto3" json:"db,omitempty"`
	// The Secure Boot revoked signature (forbidden) database.
	Dbx *Database `protobuf:"bytes,3,opt,name=dbx,proto3" json:"dbx,omitempty"`
	// Authority events post-separator. Pre-separator authorities
	// are currently not supported.
	Authority *Database `protobuf:"bytes,4,opt,name=authority,proto3" json:"authority,omitempty"`
	// contains filtered or unexported fields
}

type SemanticVersion struct {
	Major uint32 `protobuf:"varint,1,opt,name=major,proto3" json:"major,omitempty"`
	Minor uint32 `protobuf:"varint,2,opt,name=minor,proto3" json:"minor,omitempty"`
	Patch uint32 `protobuf:"varint,3,opt,name=patch,proto3" json:"patch,omitempty"`
	// contains filtered or unexported fields
}

type WellKnownCertificate int32