Skip to content

feat(policy): validate CoRIM release enrollment - #217

Open
Haitao Huang (haitaohuang) wants to merge 41 commits into
microsoft:integrationfrom
haitaohuang:user/hhuang/pr215-tank-revision
Open

feat(policy): validate CoRIM release enrollment#217
Haitao Huang (haitaohuang) wants to merge 41 commits into
microsoft:integrationfrom
haitaohuang:user/hhuang/pr215-tank-revision

Conversation

@haitaohuang

@haitaohuang Haitao Huang (haitaohuang) commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

-generate signed ServTD TCB-mapping CoRIM artifacts locally with monotonic generation and no unsupported wall-clock claims

  • publish a policy-only IGVM enrollment artifact and canonical private enrollment wrapper-
  • prove the anchor-stage to final-CoRIM transition preserves MRTD and RTMR0-3
  • enforce the pre-final/final tdinfo_hash equality gate, including a measured-mapping negative regression
    add CI coverage and tool documentation

Copilot AI reviewed Jul 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR reworks the Azure/EMU policy build flow to avoid checked-in CoRIM fixtures by generating CoRIM test artifacts locally, while also formalizing a “public, policy-only, non-bootable enrollment artifact” contract (policy sidecar + strict verification/extraction).

Changes:

  • Add a local servtd-corim-generator tool to sign a TCB-mapping CoRIM and emit the corresponding signer anchor for --corim-only AzCVMEmu flows.
  • Introduce a --non-bootable-enrollment-artifact build mode for xtask image and add schema validation to ensure the policy-only enrollment sidecar is unsigned and contains the required production identity rule.
  • Add strict policy-only enrollment artifact verification/extraction to migtd-hash, plus updates to Azure scripts/Makefile/docker wrapper, docs, CI, and the gauntlet EMU stage to enforce the sidecar/embedded-policy contract.

Reviewed changes

Copilot reviewed 18 out of 22 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
xtask/src/main.rs Adds a clap help regression test asserting the new non-bootable enrollment flag is discoverable/documented.
xtask/src/build.rs Adds --non-bootable-enrollment-artifact, argument gating, and JSON validation for policy-only enrollment sidecars; adjusts build flow accordingly; adds unit tests.
tools/servtd-corim-generator/src/main.rs New CLI tool to build/sign a TCB-mapping CoRIM, compute signer anchor, and self-verify the result.
tools/servtd-corim-generator/Cargo.toml Declares dependencies for the new generator tool.
tools/migtd-hash/src/migtd_consts.rs Adds the ServTD CoRIM CFV GUID constant (mirrors MigTD).
tools/migtd-hash/src/main.rs Adds --verify-policy-only-enrollment-artifact and optional --extract-policy, with safe output handling and tests.
tools/migtd-hash/src/lib.rs Implements strict policy-only artifact verification (FFS inventory + schema checks) and IGVM CFV page assembly to extract exact policy bytes.
tools/migtd-hash/Cargo.toml Adds igvm / igvm_defs dependencies for IGVM parsing.
sh_script/build_AzCVMEmu_policy_and_test.sh Switches --corim-only to build/generate CoRIM artifacts locally (certs + new tool) instead of copying fixtures; plumbs signer EKU OID.
sh_script/Azure/test_policy_only_enrollment_contract.sh New contract test ensuring the Azure public build emits a policy-only sidecar and does not invoke private enrollment inputs.
sh_script/Azure/test_docker_build_igvm_wrapper.sh New test validating docker_build_igvm.sh enforces the policy sidecar copy + byte-equality contract.
sh_script/Azure/Makefile Reorients the default Azure build to generate the policy-only sidecar and build a non-bootable enrollment IGVM; verifies extracted embedded policy matches the sidecar.
sh_script/Azure/docker_build_igvm.sh Publishes the policy sidecar alongside migtd.igvm and enforces that it matches extracted embedded policy; strengthens artifact extraction failure handling.
doc/reproducible_build.md Documents the public policy-only enrollment artifact contract and the private enrollment transition steps.
Cargo.toml Adds tools/servtd-corim-generator to the workspace members.
Cargo.lock Locks new dependencies for servtd-corim-generator and migtd-hash IGVM parsing.
.gitignore Removes the exception that previously allowed a checked-in signer anchor fixture.
.github/workflows/reproducible-igvm.yml Adds CI coverage for the new contract tests (policy-only enrollment + docker wrapper).
.agents/skills/migtd-review/SKILL.md Updates EMU stage description to include CoRIM-only coverage.
.agents/skills/migtd-review/scripts/run-ci-gauntlet.sh Adds CoRIM-only build/test steps and CoRIM migration/rebind scenarios plus runtime verification.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread tools/migtd-hash/src/lib.rs Outdated
@haitaohuang Haitao Huang (haitaohuang) changed the title generate CoRIM test artifacts locally feat(policy): validate CoRIM release enrollment Jul 29, 2026
@haitaohuang
Haitao Huang (haitaohuang) force-pushed the user/hhuang/pr215-tank-revision branch 2 times, most recently from 700fd46 to c0bdd4a Compare July 31, 2026 02:58
Haitao Huang (haitaohuang) and others added 24 commits August 4, 2026 20:08
@haitaohuang
feat(migration): harden SPDM sessions and logging
c8f6440 
Centralize SPDM transport finalization, preserve replay protection, tear down failed sessions, and safely truncate oversized structured log messages.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
build: make firmware builds reproducible and portable
4e45975 
Normalize embedded build paths, support current GCC toolchains, and exclude generated collateral and image outputs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
refactor(policy): use one-hash TCB mappings
a2e052e 
Adopt tdinfo_hash as the canonical mapping key, collapse RTMR2 to one redacted policyData extend, and keep runtime and offline measurements byte-identical.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
docs(policy): describe one-hash TCB mapping design
9bc47f4 
Document the canonical policy measurement, tdinfo_hash lookup model, and policy-v2 measurement contract.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@mingweishih @haitaohuang
feat(policy): bind CoRIM endorsements and revocation
fa61be4 
Verify signed one-hash endorsements against the RTMR1 trust anchor, remove the legacy outer policy signature dependency, and enforce local signer revocation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
feat(policy): bind signer identity to RTMR1 anchors
efe45dd 
Measure and verify a stable root-certificate plus leaf-EKU signer anchor while preserving precise policy initialization failures.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@mingweishih @haitaohuang
feat(policy): support CoRIM-only signer enrollment
caeb2f2 
Enroll signer anchors directly, accept CoRIM-only policies, and match the measured anchor against any asserted non-generic leaf EKU.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
fix(policy): decouple init TDINFO from local mappings
48972fc 
Do not require destination policy mappings to predict future source MigTD images during signer rotations. Also fix the policy redesign document references.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
feat(vmcall-raw): support Azure transport limits
4049a1f 
Raise the raw VMCALL transfer size for Azure and add regression coverage for chunking and offset validation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
test(Azure): consolidate emulation and release tooling
4d822a2 
Add the AzCVMEmu policy matrix, mock-quote controls, reproducible IGVM workflow, and Azure image build configuration as one cohesive integration layer.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
test(Azure): add TiP deployment and validation package
8b44b6b 
Package the Azure TiP dependencies, loopback migration tests, startup checks, ServTD prebinding checks, and publication helpers.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
docs(Azure): add migration troubleshooting skills
c820f4e 
Capture reusable TiP lab-blade and cross-node SPDM transport diagnostics without embedding user-specific aliases.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
docs: document build, coverage, and functionality
f811906 
Add the reusable environment bootstrap and operator-facing functionality, coverage, and reproducible-build guidance.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
docs(agents): add reusable MigTD engineering guidance
14bbe27 
Collect architecture knowledge, porting workflows, security-review guidance, and the CI parity runner using generic user references.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
docs(agents): clarify one-hash init SVN verification
276085b 
Record that init and current SVNs must be resolved through the authenticated source mapping, distinguish that from the removed destination-local allowlist, and document the current implementation gap.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
Enforce mapped init SVN ordering
158c9a4 
Resolve the initial and current MigTD hashes through the authenticated source policy for migration and rebinding, and fail closed on missing or reversed mappings. Keep legacy Init_TDINFO only for wire compatibility and populate SERVTD_EXT in migration emulation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@haitaohuang
docs: remove obsolete TCB mapping redesign
4a83ec2 
Remove the superseded combined proposal and point implementation references at the focused TCB-mapping and signer-anchor design documents.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@haitaohuang
test: restore temporary migration diagnostics
a190fd8 
Re-enable the test-mode policy bypasses, BC trace points, and expanded log truncation window on the dedicated one_hash_test branch.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
test(migration): cover ignored rebinding init TDINFO
71683ab 
Verify full-form host requests are accepted for both StartMigration and StartRebinding while the supplied init TDINFO is cleared before dispatch.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
docs(migtd): consolidate agent guidance
e977a04 
Move durable repository rules into the root AGENTS.md, preserve the one-hash SVN-ordering guidance, and centralize the WSL authentication note. Retarget knowledge references and remove the obsolete AGENT_NOTES entry point.

Combines Microsoft one_hash commits 16aa7ed and 59a4edd.

Assisted-by: GitHub Copilot CLI:gpt-5.6-sol [migtd-port] [migtd-review]
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
build(migtd): harden reproducible Azure builds
8092ae0 
Make Azure builders tolerate transient package failures, bootstrap CA trust, prepare attestation sources without Git metadata, and prune linux-sgx only when the selected feature set permits it. Add regression coverage for every supported pruning mode.

Combines Microsoft one_hash commits 979f04f, 8e44f69, 49a8a6f, 5ad7576, and fb0c743.

Assisted-by: GitHub Copilot CLI:gpt-5.6-sol [migtd-port] [migtd-review]
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
fix(migtd-hash): preserve cumulative SVN mappings
a4eb7a5 
Retain authority-maintained historical tdinfo_hash entries when adding a release, canonicalize mapping order for signing, reject conflicting duplicates, and require explicit hash revocation.

Route Azure, AzCVMEmu, TiP, and manual release workflows through the Rust updater so authenticated source policies map both initial and current MigTD hashes. Fixes microsoft#199.

Ported from Microsoft one_hash commit 9d8b4af.

Assisted-by: GitHub Copilot CLI:gpt-5.6-sol [migtd-port] [migtd-review]
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
fix(policy): enforce servTD CRL for CoRIM signers
ff13b7f 
Retain verified CoRIM x5chain material and apply the measured local servTD CRL during initialization and peer authentication. Accept the legacy nested CRL location while keeping peer-delivered CRLs out of revocation and anti-rollback decisions.

Fixes microsoft#200. Ported from Microsoft one_hash commit 3f57c86.

Assisted-by: GitHub Copilot CLI:gpt-5.6-sol [migtd-port] [migtd-review]
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
fix(policy): support CoRIM-only Azure releases
319576c 
Use the TCB-mapping CoRIM SVN for Azure policy evaluation when TD identity evidence is absent. Add release-policy coverage, CoRIM-only migration and rebind EMU flows, firmware-volume fixtures, and an inline CI gate for the production feature set.

Combines Microsoft one_hash commits 9715ba8, 5b368dd, 505542e, and 9f824f4.

Assisted-by: GitHub Copilot CLI:gpt-5.6-sol [migtd-port] [migtd-review]
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
fix(migtd): remove obsolete init-TDINFO helper
cb4f331 
Delete the unused verify_init_migtd_data_policy_binding API now that one-hash ServtdExt validation owns init/current SVN ordering.

Partial port of microsoft#218; intentionally retain its unrelated fail-closed and log-truncation changes for separate consideration.

Assisted-by: GitHub Copilot CLI:gpt-5.6-sol [migtd-port] [migtd-review]
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
Update dependencies for Component Governance alerts
d2a0808 
Upgrade vulnerable OpenSSL, quinn-proto, and bytes lockfile entries detected by the AP signing Windows scan.

Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
(cherry picked from commit 497aed5)
@haitaohuang
docs: explain ring dependency preparation
79d54af 
Document why MigTD applies spdm-rs serialization patches to td-shim's ring source and update agent guidance to use the current API names.

Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol [migtd-review]

Copilot-Session: a6817bca-828a-435d-aba7-85d72ec9ec63
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
fix(policy): bind JSON servTD identity to RTMR2
1daa6e6 
Keep the signed servtdIdentity envelope and its issuer chain in the canonical policyData measurement. This prevents replay of an older valid JSON identity while leaving the CoRIM-only SVN policy unchanged.

Fixes microsoft#198

Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol [migtd-review]
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
build(attestation): prune unused jwt-cpp sources
be65a79 
Remove jwt-cpp before SERVTD_ATTEST compilation so CI verifies that the attestation library does not depend on its headers or implementation. Extend the pruning safety test with the same path.

Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
docs(policy): clarify CoRIM producer terminology
e440c48 
Describe TCB-mapping CoRIMs as production release artifacts and remove implementation-specific tool references.

Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 047c0ad8-f29d-44c1-8b1d-f95f92c51a64
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
fix(policy): reject CoRIM time claims
461ac3c 
Reject CWT nbf and exp claims because MigTD has no trusted wall clock.

Fixes microsoft#201

Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 047c0ad8-f29d-44c1-8b1d-f95f92c51a64
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
Revert "fix(migtd/migration): restrict GetTDReport to emulation builds"
9e479bc 
This reverts commit 7b98d80.
@haitaohuang Haitao Huang (haitaohuang) mentioned this pull request Aug 15, 2026
Merged
Haitao Huang (haitaohuang) added a commit to haitaohuang/MigTD that referenced this pull request Aug 15, 2026
@haitaohuang
feat(tools): add official CoRIM CLI helpers
2f4b740 
Import the pinned Azure/corim installation, signing, and signer-anchor helpers from PR microsoft#217 for reuse by CoRIM test generation.

Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
fix(policy): use authenticated peer CoRIM for SVN lookup
448f790 
Transport and verify the peer signed CoRIM against its signer anchor, retain the local CRL as authoritative, and resolve both current and initial source hashes through the peer mapping.

Refs: microsoft#229

Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
feat(tools): add official CoRIM CLI helpers
db61a4e 
Add pinned Azure/corim installation, signing, and signer-anchor helpers for repository test generation.

Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
test(ci): cover asymmetric peer CoRIM lookup
49920ae 
Generate distinct source and destination CoRIMs with the official CLI. Only the source maps the shared mock TDINFO hash, so the EMU scenario requires lookup through the authenticated peer mapping.

Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
Haitao Huang (haitaohuang) force-pushed the user/hhuang/pr215-tank-revision branch from 65f40a5 to 3942b96 Compare August 17, 2026 18:21
@haitaohuang
feat(xtask): add policy-only enrollment artifact mode
88a74e0 
Add an explicit non-bootable image mode that embeds only validated raw Azure production policy and rejects every trust input that could contaminate the public base. Normal policy-v2 builds continue to require exactly one issuer chain or signer anchor.

Publish and strictly verify the byte-exact policy sidecar, inventory the decoded Azure IGVM CFV fail-closed, make extraction non-destructive, and mirror both CoRIM-only integration scenarios in the local CI gauntlet.

Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol [migtd-review code-review]
@haitaohuang
ci(migtd): enforce tdinfo_hash equality gate (microsoft#203)
5823ccc 
Add an authoritative staged release gate that re-derives the 48-byte
SHA-384 tdinfo_hash from the same source inputs used during policy
generation and compares it to the recorded pre-final hash. A mismatch
causes nonzero exit so CI or release pipelines catch any divergence
between the measured binary and the deployed one.

Changes:
- sh_script/check_tdinfo_hash_equality.sh (new): gate script
  Takes --pre-final-hash FILE and --from-report / --image+--manifest.
  Calls migtd-hash --policy-v2 --output-tdinfo-hash to re-derive the
  final hash, compares the two 96-char hex strings, writes a JSON audit
  record capturing both hashes plus derivation inputs, exits 0 on match
  and 1 on mismatch.

- tools/migtd-hash/src/lib.rs: add three unit tests
  tdinfo_hash_gate_positive_same_struct_yields_same_hash: same
  TDINFO_STRUCT → identical hash (gate passes).
  tdinfo_hash_gate_negative_mrtd_change_causes_mismatch: changed MRTD
  → different hash (deliberate measured-mapping negative; gate rejects).
  tdinfo_hash_gate_negative_rtmr_change_causes_mismatch: changed RTMR1
  → different hash (signer-anchor change; gate rejects).

- .github/workflows/main.yml: new tdinfo-hash-gate job
  Builds migtd-hash, generates a synthetic all-zero deterministic
  report, derives the pre-final hash, then exercises both paths:
  positive (exit 0) and a deliberate mismatch-negative (exit 1).
  Uploads audit records as an artifact for offline review.
  Also runs cargo test -p migtd-hash to cover the unit tests above.

Acceptance checklist (issue microsoft#203):
- Authoritative staged command: check_tdinfo_hash_equality.sh
- Nonzero mismatch failure: exits 1 on divergence
- CI coverage with deliberate mismatch-negative: Gate negative test step
- Exact final hash in generated mapping: migtd-hash unchanged; the
  mapping continues to record the hash via --output-tdinfo-hash
- Recorded pre/final hashes plus derivation inputs: JSON audit record

Implementation is independent of microsoft#205 (no init_servtd_info_hash
changes). Does not duplicate TDINFO packing/hash logic in shell;
all derivation is delegated to the existing migtd-hash binary.

Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
Assisted-by: Parker:claude-sonnet-4.6 [migtd-review]
@haitaohuang
ci(migtd): validate staged CoRIM enrollment
1c8a739 
Exercise the public-to-anchor-to-final release transition with a real signed CoRIM, enforce measurement equality, and retain evidence for CI diagnostics.

Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol [migtd-review]
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
fix(tools): bound IGVM input reads
23827e2 
Reject IGVM inputs larger than the expected 16 MiB image size before parsing so arbitrary files cannot drive unbounded allocation.

Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol [migtd-review]
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
fix(ci): enroll Azure IGVM at relocated CFV GPA
19f0dc9 
Rewrite the Azure configuration volume at GPA 0x02000000 instead of invoking td-shim-enroll, whose firmware GPA assumption made enrollment a silent no-op.

Preserve non-CFV directives, derive the CFV length from the validated image rather than the host build layout, require a version-1 policy-only artifact and byte-identical policy sidecar, bound enrollment inputs, cover the relocated GPA, and install the host assembly toolchain needed to build validation tools.

Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol [migtd-review code-review]

Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>

Copilot-Session: a6817bca-828a-435d-aba7-85d72ec9ec63
@haitaohuang
test(azure): consume integrated CoRIM fixtures
b5016b3 
Reuse the signed CoRIM and signer-anchor fixtures supplied on integration instead of rebuilding a local generator or CLI during enrollment validation.

Assisted-by: GitHub Copilot CLI:gpt-5.6-sol [rust-toolchain-switch]
Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
@haitaohuang
Haitao Huang (haitaohuang) force-pushed the user/hhuang/pr215-tank-revision branch from 3942b96 to b5016b3 Compare August 17, 2026 18:55
@haitaohuang
Haitao Huang (haitaohuang) changed the base branch from one_hash to integration August 17, 2026 18:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@haitaohuang @mingweishih