Skip to content

Allow callers to configure acceptable TCB status levels#96

Open
zeyu-zh wants to merge 1 commit into
google:mainfrom
zeyu-zh:main
Open

Allow callers to configure acceptable TCB status levels#96
zeyu-zh wants to merge 1 commit into
google:mainfrom
zeyu-zh:main

Conversation

@zeyu-zh

@zeyu-zh zeyu-zh commented Mar 31, 2026

Copy link
Copy Markdown

Proposal

Add an AcceptedTCBStatuses option to verify.Options (and the corresponding accepted_tcb_statuses field in the RootOfTrust protobuf message) that lets callers specify which TCB statuses they consider acceptable beyond the default UpToDate.

Behavior:

  • When AcceptedTCBStatuses is nil or empty, the current default behavior is preserved — only UpToDate is accepted.
  • When set, both the TDX TCB Info status check and the QE Identity TCB status check will accept any status in the provided list.

Supported values:

  • UpToDate
  • SWHardeningNeeded
  • ConfigurationNeeded
  • ConfigurationAndSWHardeningNeeded
  • OutOfDate
  • OutOfDateConfigurationNeeded

Comment thread proto/checkconfig.proto
// accepted. Possible values: "UpToDate", "SWHardeningNeeded",
// "ConfigurationNeeded", "ConfigurationAndSWHardeningNeeded", "OutOfDate",
// "OutOfDateConfigurationNeeded".
repeated string accepted_tcb_statuses = 5;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you think it's worth making this field an enum than string? It would help to avoid configuring by mistake

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants