feat(policy): bind signer anchors to dedicated EKU

[haitaohuang]

Summary

This is a stacked continuation of #1037, #1035, and #1032. The new commit adds a dedicated leaf Extended Key Usage to the RTMR1 signer fingerprint while retaining certificate identity continuity checks.

• derive the RTMR1 signer anchor from the root certificate fingerprint plus a dedicated leaf EKU OID;
• permit leaf key rotation only when the root, Subject Distinguished Name, Subject Alternative Name, and signer EKU remain stable;
• require peer JSON signer chains to preserve Subject DN and SAN and present the same single dedicated EKU, rejecting identity drift and missing, ambiguous, different, or anyExtendedKeyUsage values;
• match signed CoRIM x5chain leaves anchor-first across their dedicated EKUs without hard-coding the signer OID;
• retain fail-closed BasicConstraints enforcement for every certificate acting as an issuer;
• update certificate generation and focused identity, EKU, and key-rotation fixtures.

Validation

• targeted formatting for crypto and policy;
• cargo test -p crypto -p policy (68 tests);
• certificate fixture inspection for stable and mismatched Subject DN, SAN, and EKU cases.

[haitaohuang]

The CI failure is due to env issue. Please re-trigger the run for the failed job

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate findings remain, including policy-chain signing and collateral-generation issues.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This pull request binds RTMR1 signer anchors to a dedicated leaf EKU while preserving certificate identity continuity across policy, migration, crypto, and tooling.

Changes:

• Adds EKU-bound signer anchors and controlled certificate rotation.
• Adds CoRIM, collateral, CRL, and peer-chain validation.
• Updates policy/hash generators, build scripts, templates, and certificate fixtures.

File summaries

File	Change
xtask/src/build.rs	Adds signer-anchor and CoRIM enrollment options.
tools/servtd-collateral-generator/src/main.rs	Adds optional collateral input options.
tools/servtd-collateral-generator/src/build.rs	Serializes optional collateral components.
tools/servtd-collateral-generator/readme.md	Updates generator usage documentation.
tools/migtd-policy-generator/src/policy_v2.rs	Generates policy data with optional collateral and CRLs.
tools/migtd-policy-generator/src/main.rs	Adds policy generator CLI options.
tools/migtd-hash/src/main.rs	Adds report-based hashing and mapping workflows.
tools/migtd-hash/src/lib.rs	Implements TDINFO hashing and cumulative mappings.
tools/migtd-hash/Cargo.toml	Updates hash-tool dependencies.
src/policy/test/policy_v2/tcb_mapping.json	Updates policy mapping fixture.
src/policy/test/policy_v2/servtd_collateral.json	Updates collateral fixture.
src/policy/test/policy_v2/cert_chain/policy_issuer_chain.pem	Updates policy issuer-chain fixture.
src/policy/src/v2/servtd_corim.rs	Verifies signed CoRIM mappings and signer chains.
src/policy/src/v2/mod.rs	Wires v2 CoRIM support.
src/policy/src/lib.rs	Updates policy anchor and revocation interfaces.
src/policy/Cargo.toml	Enables policy validation dependencies and features.
src/migtd/src/spdm/spdm_rsp.rs	Updates SPDM response integration.
src/migtd/src/ratls/server_client.rs	Updates RA-TLS integration.
src/migtd/src/migration/session.rs	Updates migration session handling.
src/migtd/src/migration/rebinding.rs	Updates migration rebinding handling.
src/migtd/src/migration/pre_session_data.rs	Transports peer chains and CoRIM data.
src/migtd/src/migration/mod.rs	Wires migration module changes.
src/migtd/src/lib.rs	Updates runtime module integration.
src/migtd/src/event_log.rs	Updates event-log integration.
src/migtd/src/config.rs	Adds signer-anchor and CoRIM enrollment accessors.
src/migtd/src/bin/migtd/main.rs	Measures the EKU-bound signer anchor.
src/migtd/Cargo.toml	Enables runtime policy dependencies.
src/crypto/test/eku/signer_subject_mismatch.pem	Adds subject-mismatch fixture.
src/crypto/test/eku/signer_san_mismatch.pem	Adds SAN-mismatch fixture.
src/crypto/test/eku/signer_other_eku.pem	Adds alternate-EKU fixture.
src/crypto/test/eku/signer_no_eku.pem	Adds missing-EKU fixture.
src/crypto/test/eku/signer_multiple_eku.pem	Adds multiple-EKU fixture.
src/crypto/test/eku/signer_identity_rotated.pem	Adds rotated-identity fixture.
src/crypto/test/eku/signer_identity_other_eku.pem	Adds rotated alternate-EKU fixture.
src/crypto/test/eku/signer_identity_no_eku.pem	Adds rotated missing-EKU fixture.
src/crypto/test/eku/signer_identity_multi_eku.pem	Adds rotated multiple-EKU fixture.
src/crypto/test/eku/signer_identity_any_eku.pem	Adds any-EKU fixture.
src/crypto/test/eku/signer_identity_a.pem	Adds identity signer fixture.
src/crypto/test/eku/signer_designated_only.pem	Adds designated-EKU fixture.
src/crypto/test/eku/signer_designated_multi.pem	Adds designated multiple-EKU fixture.
src/crypto/test/eku/signer_b.pem	Adds alternate signer fixture.
src/crypto/test/eku/signer_any_eku.pem	Adds any-EKU signer fixture.
src/crypto/test/eku/signer_a.pem	Adds primary signer fixture.
src/crypto/test/eku/generate_designated.sh	Generates designated-EKU certificates.
src/crypto/src/crl.rs	Adds certificate revocation-list handling.
sh_script/key_gen.sh	Generates certificates with signer EKUs.
sh_script/build_policy_v2.sh	Updates v2 policy build flow.
sh_script/build_AzCVMEmu_policy_and_test.sh	Builds signer-rotation policy variants.
sh_script/Azure/build_azure_mock_test.sh	Updates Azure mock certificate generation.
deps/td-shim-AzCVMEmu/tdx-tdcall/src/tdx_emu.rs	Updates emulator integration.
config/templates/td_identity.json	Updates identity template.
config/templates/td_identity_signed.json	Updates signed identity template.
config/templates/tcb_mapping.json	Updates TCB mapping template.
config/templates/tcb_mapping_signed.json	Updates signed TCB mapping template.
config/templates/servtd_collateral.json	Updates collateral template.
config/templates/policy_issuer_chain.pem	Updates policy issuer-chain template.
config/AzCVMEmu/tcb_mapping.json	Updates emulator TCB mapping.
Cargo.lock	Updates locked dependencies.

Review details

Suppressed comments (8)

sh_script/build_policy_v2.sh:25

• This new guard makes the cumulative mapping argument mandatory, but doc/policy_v2.md:126 still documents bash sh_script/build_policy_v2.sh [preprod/prod] with no mapping path. Following the documented flow now exits at this check and never generates policy; update the documentation or preserve a compatible default.

if [[ -z "$tcb_mapping_file" ]]; then
  echo "Usage: $0 <pre-production|production> <cumulative-tcb-mapping.json>" >&2
  exit 1

src/migtd/src/mig_policy.rs:454

• This migration comment still calls the signer anchor root CA + leaf subject, which is no longer the binding: the anchor uses the root DER hash plus the dedicated leaf EKU OID. Update the security description to match the verifier and the policy measurement formula.
  src/migtd/src/migration/pre_session_data.rs:385
• The encoding comment says a zero-length CoRIM lets the decoder distinguish a new-format peer from legacy two-field framing, but decode_peer_data returns None for both cases (lines 437–460). Either preserve an explicit format marker in the returned data or correct this documentation; no caller can currently observe the claimed distinction.
  tools/migtd-policy-generator/src/policy_v2.rs:35
• When output is the same file as policy_data (as build_policy_v2.sh does), omitting --servtd-collateral leaves any value from a previous run in base. This contradicts the comment that omission produces a policy with no servtdCollateral, and can make a supposed CoRIM-only build retain stale JSON identity/mapping data and fall back to it if the CoRIM is absent. Remove the field in the else branch.
  tools/migtd-policy-generator/src/policy_v2.rs:40
• The optional CRL is only inserted when --servtd-crl is present; when the generator rewrites the same base file without that option, an older top-level servtdCrl remains in the output. That silently keeps enforcing a stale revocation list and changes the policy semantics. Remove servtdCrl in the else branch when the option is omitted.
  tools/servtd-collateral-generator/src/build.rs:39
• When --mapping-chain is omitted, this leaves servtdTcbMappingIssuerChain absent instead of applying the documented identity-chain fallback. The runtime then falls back to the outer policy issuer chain, so a mapping signed by a distinct leaf (the supported independent identity/mapping-signer case) is verified with the wrong key and the generated collateral is unusable. Select mapping_chain_path.or(identity_chain_path) before reading the chain.
  tools/servtd-collateral-generator/src/main.rs:34
• When --mapping-chain is omitted, this generator leaves the field absent; policy verification then falls back to the CFV policy issuer chain, not the identity chain. The help text is therefore misleading and can cause callers to assume a mapping signed by the identity key will work without supplying its chain. Document the actual CFV-chain fallback, or pass an explicit mapping chain when the mapping signer differs.
  xtask/src/build.rs:392
• With --signer-anchor, get_signer_anchor_source() supplies the raw 48-byte value to policy verification. A policy containing JSON servtdCollateral without servtdTcbMappingIssuerChain (the collateral generator's compatibility default) then tries to verify the mapping signature with those 48 bytes as PEM and fails, even though this CLI combination is accepted. Restrict direct-anchor enrollment to CoRIM-only policies or require an explicit mapping chain when JSON collateral is present.

• Files reviewed: 62/67 changed files
• Comments generated: 9
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jyao1]

The CI failure is due to env issue. Please re-trigger the run for the failed job

I tried twice but keeps failure. I will try again later.

[haitaohuang]

will add leaf subject. was fixed in another branch and missed it for PR

[haitaohuang]

The cargo deny failure is some new vul in dep. need separate fix

[jyao1]

The cargo deny failure is some new vul in dep. need separate fix

agree. It will be fixed separately.

BTW: I still do not see anyone from MSFT review and approve.