Bug in src/report.c

[rhomber]

Line 245:

print_tcb_version("Reported TCB", &report->platform_version);

Should be:

print_tcb_version("Reported TCB", &report->reported_tcb);

I noticed this when implementing it in rust, the "SNP firmware SVN" was different in my version and I couldn't work out why!

So at least on my report "platform_version" isn't the same as "reported_tcb", in one snp is 5 and the other it's 6.

[rhomber]

Also in attestation/nginx/disk-key.sh line 100:

${SEV_TOOL} --ofolder . --export_cert_chain_vcek ${tcb_version} > /dev/null

sevtool --export_cert_chain_vcek doesn't take any arguments and just reads from /dev/sev. Well not from what I can gather by looking at the code (trying to understand how it works).

[rhomber]

The original report is probably wrong, because in the end I needed "platform_version" to download the certs. But the second part to this is true, sevtool no longer (or never did?) take an argument, it just downloads based on readings from /dev/sev.