diff --git a/.agents/index.md b/.agents/index.md new file mode 100644 index 000000000..cdf81a02b --- /dev/null +++ b/.agents/index.md @@ -0,0 +1,13 @@ +--- +okf_version: "0.1" +--- + +# .agents — MigTD institutional knowledge + +* [Agent guide](../AGENTS.md) - **Read first.** Core rules, session ritual, and links into everything below. +* [Knowledge index](knowledge/index.md) - All topical reference/playbook files (workflow, domain facts, build/release/test). + +# Skills + +* [migtd-review](skills/migtd-review/SKILL.md) - Security and correctness review playbook, triage scripts, and CI gauntlet. +* [migtd-port](skills/migtd-port/SKILL.md) - Playbook for forward-porting Microsoft-fork changes onto an intel/main-based branch. diff --git a/.agents/knowledge/anti-patterns.md b/.agents/knowledge/anti-patterns.md new file mode 100644 index 000000000..b7a2087e7 --- /dev/null +++ b/.agents/knowledge/anti-patterns.md @@ -0,0 +1,30 @@ +--- +type: Reference +title: Anti-patterns — Things To NOT Do +description: Collected pushback items from past sessions — a checklist of mistakes to avoid repeating. +tags: [anti-patterns, checklist] +timestamp: 2026-07-10T19:26:55+00:00 +--- + +# Anti-patterns — Things To NOT Do + +> Condensed in the root [agent guide](../../AGENTS.md). See +> [Domain Facts](domain-facts.md) and [Code Style](code-style.md). + +- ❌ Forget the DCO `Signed-off-by` trailer. +- ❌ Bundle unrelated changes into one commit. +- ❌ Use `expect()` / `unwrap()` in production paths. +- ❌ Rename parameters/fields gratuitously during a refactor. +- ❌ Add a feature gate when "always-on" is the obvious right answer. +- ❌ Dump full quotes or large buffers at log level INFO/DEBUG. +- ❌ Re-flag VMM DoS as a finding. +- ❌ Re-open the singleton-vector hypothesis for the cert_rot timeout. +- ❌ Increase a buffer size to *work around* a bug instead of fixing the bug. +- ❌ Run multiple `migtdemu.sh` invocations concurrently. +- ❌ Force-push without `--force-with-lease=:`. +- ❌ Force-push to `intel/*` or `ms/*` / `upstream/*` remotes. +- ❌ Run `cargo fmt` repo-wide; only touch files you modified. +- ❌ Add `.clawpatch/` or `.copilot-review-issues/` to source control + (gitignored). +- ❌ Touch code in a sibling clone (e.g. `../MigTD2`) from the wrong checkout + — another agent may be working there. diff --git a/.agents/knowledge/architecture-overview.md b/.agents/knowledge/architecture-overview.md new file mode 100644 index 000000000..165ea07ee --- /dev/null +++ b/.agents/knowledge/architecture-overview.md @@ -0,0 +1,58 @@ +--- +type: Reference +title: MigTD Architecture Overview (Azure Build) +description: Agent-oriented map of MigTD's main functional areas for the Azure IGVM build — flow, transport, attestation, policy v2, and error codes — with pointers into source. +tags: [architecture, azure, spdm, policy-v2, migration] +timestamp: 2026-07-13T22:37:00+00:00 +--- + +# MigTD Architecture Overview (Azure Build) + +Canonical source: [doc/MigTD_Functionality_Summary.md](../../doc/MigTD_Functionality_Summary.md) +(335 lines, kept up to date independently — read it in full before making +architectural changes). This file is a **navigation aid**: what exists where, +so you know which doc/source to open next. + +## What MigTD is + +A `no_std` Rust TDX **Service TD** (`SERVTD_TYPE = 0`) that mutually +remote-attests a migration source (MigTD-S) and destination (MigTD-D) over +**SPDM**, evaluates both against **policy v2**, and exchanges the **Migration +Session Key (MSK)** so the VMM can live-migrate a user TD. Entry point: +`src/migtd/src/lib.rs` (`_start`) → `main()` in +`src/migtd/src/bin/migtd/main.rs`. + +## Where things live (map, not detail) + +| Area | Source | Doc | +|---|---|---| +| End-to-end flow, MSK read/write, version negotiation | `src/migtd/src/bin/migtd/main.rs`, `migration/session.rs` | §2 | +| VMM interface (`vmcall-raw` GHCI, request dispatch) | `src/migtd/src/migration/{data,session,event}.rs` | §3 | +| Quote generation/verification (`igvm-attest`) | `src/attestation/src/{igvmattest,quote,attest}.rs` | §4 | +| Measurement / event log | `src/migtd/src/event_log.rs` | §4 | +| SPDM mutual attestation + secure session | `src/migtd/src/spdm/`, `migration/spdm_session.rs` | §5 | +| Policy v2 evaluation | `src/policy/`, `src/migtd/src/mig_policy.rs` | §6, [policy-v2-workflow.md](policy-v2-workflow.md) | +| TD binding / rebinding | `migration/servtd_ext.rs`, `migration/rebinding.rs` | §7, [init-tdinfo-servtd-ext.md](init-tdinfo-servtd-ext.md) | +| Crypto (ECDSA P-384, X.509, COSE_Sign1) | `src/crypto/` | §9 | +| Async runtime (no_std executor / tokio under emu) | `src/async/` | §10 | +| Build/hashing tools | `tools/migtd-hash`, `tools/migtd-policy-generator`, etc. | §11, §12 | +| AzCVMEmu emulation mode | `src/migtd/src/bin/migtd/cvmemu.rs` | §13, [azcvmemu-build-and-run.md](azcvmemu-build-and-run.md) | + +## Migration error codes (host-visible) — quick lookup + +| Code | Cause | +|:----:|-------| +| 1 | VMM-provided data not as expected | +| 3 | Out of memory | +| 4 | TDX module error (often mismatched `SERVTD_INFO_HASH`) | +| 5 | Failed to establish host communication channel | +| 6 | SPDM/secure-session error (remote quote verification or handshake aborted) | +| 7 | Unable to obtain the quote | +| 8 | Remote quote does not satisfy the migration policy | + +## Explicitly out of scope of the Azure-focused doc + +The implemented optional one-hash TCB-mapping / CoRIM endorsement path +(`servtd_corim`) and +non-Azure options (RA-TLS, virtio/vsock transports, `bin` image format) — see +[doc/MigTD_Functionality_Summary.md](../../doc/MigTD_Functionality_Summary.md) scope note. diff --git a/.agents/knowledge/azcvmemu-build-and-run.md b/.agents/knowledge/azcvmemu-build-and-run.md new file mode 100644 index 000000000..e4bcf86fa --- /dev/null +++ b/.agents/knowledge/azcvmemu-build-and-run.md @@ -0,0 +1,62 @@ +--- +type: Reference +title: AzCVMEmu Build & Run — Agent Cheat Sheet +description: Feature-flag combinations, prerequisites, and migtdemu.sh invocations for building/running MigTD as a standard Rust app under Azure CVM Emulation. +tags: [azcvmemu, build, emu, tpm] +timestamp: 2026-07-13T22:37:00+00:00 +--- + +# AzCVMEmu Build & Run — Agent Cheat Sheet + +Canonical source: [doc/AzCVMEmu.md](../../doc/AzCVMEmu.md). Read that in full for +architecture rationale; this is the command/decision cheat sheet. + +## Feature flag → mode + +| Cargo features (with `--no-default-features`) | Attestation | Requires | +|---|---|---| +| `AzCVMEmu` | Real Azure IMDS attestation | Azure TDX CVM + TPM2-TSS | +| `AzCVMEmu,test_mock_report` | Mock TD reports/quotes, full attestation flow | Any Linux | +| `AzCVMEmu,igvm-attest` | `servtd_get_quote` path | Azure TDX CVM + TPM2-TSS | +| `AzCVMEmu,igvm-attest,test_mock_report` | IGVM attest + mock | Any Linux | +| `AzCVMEmu,test_disable_ra_and_accept_all` | Attestation bypassed entirely | Any Linux | + +`AzCVMEmu` implies `main` + `vmcall-raw` (don't add them explicitly) and +**only** works with the `vmcall-raw` transport. + +## Preferred invocation: `migtdemu.sh` + +```bash +./migtdemu.sh --skip-ra --both --no-sudo --log-level info # no attestation, any Linux +./migtdemu.sh --mock-report --both # full attestation, mock data +./migtdemu.sh --igvm-attest --mock-report --both # servtd_get_quote path +./migtdemu.sh --policy-v2 --policy-file --policy-issuer-chain-file --both +./migtdemu.sh --features spdm_attestation --both +``` + +`--both` runs destination in the background then source in the foreground; +destination logs go to `dest.out.log`. See +[verification-and-checklist.md](verification-and-checklist.md) for the +**do-not-run-concurrently** rule (hardcoded port 8001, `taskset -c 0`, shared +`target/release/migtd`). + +## TPM2-TSS gotcha + +Runtime TPM2-TSS (`libtss2-esys`, `libtss2-tcti-device0`) is needed **unless** +you use `--skip-ra` (`test_disable_ra_and_accept_all`), which uses mock TD +reports/quotes and needs no TPM at all. The script auto-sets +`TSS2_TCTI=device:/dev/tpmrm0` and enables sudo automatically when +`/dev/tpmrm0` exists and permissions are insufficient (not needed for +`--mock-report` or `--skip-ra`). + +## Manual run requires two env vars + +```bash +export MIGTD_POLICY_FILE="/path/to/policy.json" +export MIGTD_ROOT_CA_FILE="/path/to/root_ca.cer" +``` + +Missing/nonexistent files → hard exit. See +`deps/td-shim-AzCVMEmu/README.md` for the emulation-layer implementation +details (RTMR extension as no-op, REPORTDATA bypass rationale — cross-check +against [Security Bypasses](security-bypasses.md)). diff --git a/.agents/knowledge/boot-measurements.md b/.agents/knowledge/boot-measurements.md new file mode 100644 index 000000000..0d0c022c9 --- /dev/null +++ b/.agents/knowledge/boot-measurements.md @@ -0,0 +1,433 @@ +--- +type: Reference +title: MigTD Boot Measurements — Who Measures What, When, and How +description: Mechanics of how each TDX measurement register (MRTD, RTMR0-3) is populated during a MigTD launch, with file-line citations. +tags: [attestation, tdx, measurements, mrtd, rtmr] +timestamp: 2026-07-22T22:32:31+00:00 +--- + +# MigTD Boot Measurements — Who Measures What, When, and How + +*Companion summary to `docs/One_Hash_Endorsement.md`. Focuses on the +**mechanics** of how each TDX measurement register gets populated for a +MigTD launch, with file-line citations. The "what the values mean for +attestation" question is covered in the One-Hash doc.* + +> **Scope.** All addresses and section attributes shown here are for the +> production **IGVM** build (Azure OS). TDVF builds differ only in how +> MRTD is populated at TD launch (BIOS-style metadata vs IGVM directives) +> — the RTMR0–3 portion is identical. + +--- + +## TL;DR table + +| Register | Contents (in order) | Who extends it | When | How (TDX op) | +|---|---|---|---|---| +| **MRTD** | td-shim BFV pages **+** MigTD payload pages **+** GPA layout of every region | IGVM loader (host) / TDX module | TD launch, **before any TD code runs** | `TDH.MEM.PAGE.ADD` (all pages) + `TDH.MR.EXTEND` (pages without `unmeasured` flag); sealed by `TDH.MR.FINALIZE` | +| **RTMR0** | `EV_SEPARATOR` = `SHA384(0x00000000)` extended once from zero | td-shim | Inside `boot_builtin_payload`, just before jumping to MigTD entry | `tdcall_extend_rtmr(rtmr_index=0)` | +| **RTMR1** | `EV_SEPARATOR`, then the digest of signer anchor `A` (root fingerprint + enrolled signer-purpose EKU) | td-shim (separator) → MigTD (anchor) | td-shim runtime, then MigTD `do_measurements()` | `tdcall_extend_rtmr(rtmr_index=1)` | +| **RTMR2** | **One extend**: canonical `policyData` with the JSON TCB mapping, its issuer chain, and optional TD Identity + issuer chain redacted; a CoRIM-only policy has no `servtdCollateral` to redact | MigTD | MigTD `do_measurements()`, before any migration handling | `tdcall_extend_rtmr(rtmr_index=2)` | +| **RTMR3** | Unused (always zero) in production builds | — | — | — | + +Test/debug variant: when `test_disable_ra_and_accept_all` is on, +`do_measurements()` short-circuits and extends **only** +`TEST_DISABLE_RA_AND_ACCEPT_ALL_EVENT` into RTMR2; no policy / issuer +chain measurements are made. (`src/migtd/src/bin/migtd/main.rs:155-158, +183-186`) + +--- + +## 1. MRTD — populated at TD launch by the IGVM loader + +### What's in it + +For the MigTD IGVM image, the IGVM loader processes one +`IgvmDirectiveHeader::PageData` per 4 KB page. Each page hits MRTD as: + +1. **`TDH.MEM.PAGE.ADD`** — for every non-shared page (records the GPA + regardless of whether content is measured). +2. **`TDH.MR.EXTEND`** — only for pages where `IgvmPageDataFlags.unmeasured` + is **clear**. Extends MRTD with the page content in 256-byte chunks. + +So MRTD reflects both the **GPA layout** of every region AND the **byte +content** of every "measured" region. + +### Section breakdown (per `MigTD/config/metadata.json`) + +| Section | GPA (in MigTD layout) | `attributes` | `unmeasured` in IGVM? | What's in it | +|---|---|---|---|---| +| **CFV** | `0xFF000000`, `0xA0000` | `0x0` | **yes** (GPA-only) | Policy JSON, policy issuer cert chain (PEM), root CA — measured later into RTMR1/RTMR2 | +| **TempMem** (stack, heap, mailbox, etc.) | various | `0x0` | yes (GPA-only) | Zero-fill at launch | +| **PermMem** | `0x0`, `0x2000000` | `0x2` | yes (GPA-only) | Reserved memory for runtime use | +| **Payload** | `0xFF0C1000`, `0xEE6000` (~15 MB) | `0x1` (EXTENDMR) | **no** — measured | The **MigTD binary** (PE/COFF, wrapped as a DXE_CORE FV file) | +| **BFV** | `0xFFFA7000`, `0x59000` (~356 KB) | `0x1` (EXTENDMR) | **no** — measured | td-shim metadata + IPL + reset vector | + +### The code path that emits these directives + +1. **`MigTD/config/metadata.json`** declares the sections and their + `Attributes`. This is the *source of truth* for the MigTD IGVM build. + +2. **`td-shim-ld -i igvm`** (invoked by + `MigTD/xtask/src/build.rs:204-206,260-261`) calls + `TdShimLinker::build_igvm()`. + +3. **`MigTD/deps/td-shim/td-shim-tools/src/linker.rs::build_igvm`** + (lines `424-627`) emits one `IgvmDirectiveHeader::PageData` per page, + per region. The crucial calls: + + ```rust + // CFV — unmeasured iff metadata attributes==0 (true for MigTD) + insert_igvm_pages(..., TD_SHIM_CONFIG_BASE, ..., &vec![], cfv_unmeasured); // L445-451 + // Mailbox / TempStack / TempHeap — always unmeasured + insert_igvm_pages(..., MAILBOX, &vec![], true); // L453-459 + insert_igvm_pages(..., TEMP_STACK, &vec![], true); // L461-467 + insert_igvm_pages(..., TEMP_HEAP, &vec![], true); // L469-475 + // MigTD payload binary — MEASURED into MRTD + insert_igvm_pages(..., TD_SHIM_PAYLOAD_BASE, &payload_data, false); // L495-501 + // td-shim BFV (metadata + IPL + reset vector) — MEASURED into MRTD + insert_igvm_pages(..., TD_SHIM_METADATA_BASE, &bfv_data, false); // L577-583 + ``` + +4. **`insert_igvm_pages`** (`linker.rs:344-374`) translates the + `unmeasured` arg into the on-wire IGVM page flag: + + ```rust + let mut flags = IgvmPageDataFlags::new(); + if unmeasured { flags.set_unmeasured(true); } // L362-365 + directive_headers.push(IgvmDirectiveHeader::PageData { + gpa: base + i * PAGE_SIZE_4K, flags, data, ... // L366-372 + }); + ``` + +5. The `EXTENDMR` attribute (`0x1`) → "not unmeasured" → `TDH.MR.EXTEND` + on every page in the section. Defined at + `MigTD/deps/td-shim/td-shim-interface/src/metadata.rs:68`. + +### Common misconception: "td-shim loads the payload, so the payload isn't in MRTD" + +**Wrong.** TD-shim *does* find/relocate/jump-to the payload at runtime, +but that's a separate concern from measurement. The payload **bytes** +are placed into TD memory by the **IGVM loader** at TD launch and +extended into MRTD at that moment — well before td-shim's first +instruction executes. TD-shim's runtime work: + +- Reads the payload from `SliceType::ShimPayload` (the read-only FV + region the IGVM loader populated). `td-layout/src/memslice.rs:72-75` + for the slice; `td-shim/src/bin/td-shim/main.rs:217-223` for the read. +- Optionally PE-relocates into a **separate** writable region + `SliceType::Payload` + (`td-shim/src/bin/td-shim/main.rs:238-240`). +- Jumps to the relocated entry point + (`td-shim/src/bin/td-shim/main.rs:266-`). + +The execution-region writes happen AFTER `TDH.MR.FINALIZE`, so they do +not affect MRTD. Only the as-shipped, pre-execution image in the FV is +measured. + +### The "MRTD vs RTMR1" toggle for payload (`payload_extend_rtmr`) + +`td-shim/src/bin/td-shim/shim_info.rs:84-92,116-118` makes a runtime +decision: + +```rust +if section.r#type == TDX_METADATA_SECTION_TYPE_PAYLOAD && section.attributes == 0 { + payload_extend_rtmr = true; // payload was NOT measured into MRTD +} // → fall back to logging it into RTMR1 at runtime +``` + +If `payload_extend_rtmr()` is true, `boot_builtin_payload` calls +`log_payload_binary(payload_bin, event_log)` which extends RTMR1 +(`td-shim/src/bin/td-shim/event_log.rs:76-92`, mr_index=2 → +rtmr_index=1). + +**For MigTD's IGVM build the Payload section has `attributes=0x1`, so +`payload_extend_rtmr` is `false` → the payload is in MRTD only, NOT +also in RTMR1.** This is what makes RTMR1 deterministic (separator + +issuer chain only). + +--- + +## 2. RTMR0 — `EV_SEPARATOR` only + +Extended exactly once, by td-shim, in +`MigTD/deps/td-shim/cc-measurement/src/log.rs:58-67`: + +```rust +pub fn create_seperator(&mut self) -> Result<()> { + let separator = u32::to_le_bytes(0); + // Measure 0x0000_0000 into RTMR[0] and RTMR[1] + let _ = self.calculate_digest_and_extend(&separator, 1)?; // mr_index 1 → RTMR0 + let sha384 = self.calculate_digest_and_extend(&separator, 2)?; // mr_index 2 → RTMR1 + self.log_cc_event(1, EV_SEPARATOR, &[&separator], &sha384)?; + self.log_cc_event(2, EV_SEPARATOR, &[&separator], &sha384) +} +``` + +Call site for the MigTD path: +`td-shim/src/bin/td-shim/main.rs:236` (inside `boot_builtin_payload`, +after the optional `log_payload_binary` and before jumping to the +payload entry point). + +**Why RTMR0 is a deterministic constant in MigTD IGVM builds:** + +- `log_hob_list` (which would extend RTMR0) is **skipped** because + MigTD's `metadata.json` declares no `TD_HOB` section, so + `BootTimeDynamic::td_hob()` returns `None` and the `if let Some(td_hob)` + branch in `td-shim/src/bin/td-shim/main.rs:131-134` is not taken. +- `log_payload_binary` (which would extend RTMR1) is **skipped** because + `payload_extend_rtmr` is `false` (see §1). +- The only thing left is the separator → RTMR0 ends up as a fixed + function of `SHA384(0x0000_0000)` extended from zeros. + +The mr_index→RTMR translation is in +`MigTD/src/migtd/src/event_log.rs:164-175`: +```rust +let rtmr_index = match mr_index { 1..=4 => mr_index - 1, _ => err }; +tdcall_extend_rtmr(&digest, rtmr_index)?; +``` + +--- + +## 3. RTMR1 — `EV_SEPARATOR` + stable signer anchor + +Two extensions, in order: + +| # | What | Where | +|---|---|---| +| 1 | Separator `SHA384(0x0000_0000)` | td-shim `create_seperator()` — see §2 | +| 2 | Digest of signer anchor `A` | MigTD `get_policy_issuer_chain_and_measure()` | + +The anchor is: + +```text +R = SHA384(DER(root certificate)) +A = SHA384("MIGTD-RTMR1-ANCHOR-V1" || 0x00 || R || 0x00 || leaf_EKU_OID_DER) +RTMR1 extends SHA384(A) +``` + +The CFV may carry either the full PEM issuer chain or a precomputed 48-byte +anchor. `config::get_signer_anchor_source()` prefers the direct anchor slot; +`resolve_signer_anchor()` derives `A` from PEM or accepts the direct value. +Both enrollment forms produce the same RTMR1. + +```rust +fn get_policy_issuer_chain_and_measure(event_log: &mut [u8]) { + let anchor_source = config::get_signer_anchor_source()...; + let signer_anchor = policy::resolve_signer_anchor(anchor_source)...; + event_log::write_tagged_event_log( + event_log, + MR_INDEX_POLICY_ISSUER_CHAIN, // = 0x2 → rtmr_index 1 → RTMR1 + &signer_anchor, // hashed again by the event-log helper + TAGGED_EVENT_ID_POLICY_ISSUER_CHAIN, + anchor_source, // PEM or 48-byte anchor for replay + ); +} +``` + +Leaf-key and intermediate-CA rotation under the same root + signer-anchor EKU is +measurement-stable. Root or EKU changes are trust-anchor changes and alter +RTMR1. Peer validation enforces the same root+EKU fingerprint; it no longer +uses leaf Subject Name as signer identity. + +--- + +## 4. RTMR2 — policy binding (and root CA on legacy v1) + +### policy_v2 build (current default) + +**One extension** over canonical `policyData`. For the JSON-collateral path, +the extractor removes: + +- `servtdCollateral.servtdTcbMapping` (strictly required when + `servtdCollateral` is present), +- `servtdTcbMappingIssuerChain`, +- optional `servtdIdentity`, and +- optional `servtdIdentityIssuerChain`. + +The mapping and optional identity can therefore be re-issued without changing +`tdinfo_hash`; their signer chains are separately bound to the RTMR1 anchor. +Every other `policyData` field remains measured, including migration rules, +platform collaterals, `policySvn`, servTD collateral version fields, and +`servtdCrl`. A CoRIM-only policy omits `servtdCollateral`, so its entire +`policyData` object is measured as-is. + +| # | Bytes hashed | Tag ID constant | EventName | +|---|--------------|-----------------|-----------| +| 1 | canonical `policyData` after the implemented servTD redaction set above (object bytes including outer `{ }`) | `TAGGED_EVENT_ID_POLICY_DATA = 0x9` | `MigTdPolicyData` | + +Canonicalization sorts object keys lexicographically at every level, preserves +array order, and removes whitespace. The extractor accepts either bare +`policyData` or the legacy `{policyData, signature}` envelope. The legacy +outer signature is ignored; policyData integrity comes from RTMR2. + +`get_policy_and_measure()` in `MigTD/src/migtd/src/bin/migtd/main.rs` calls +`event_log::write_tagged_event_log` exactly once for this extend, with +`MR_INDEX_POLICY = 0x3 → rtmr_index 2 → RTMR2`. The `tagged_event_data` +payload that lands in the event log is the small `version.as_bytes()` +string — the full canonical-bytes payload is only fed into the digest, +keeping CCEL size bounded. + +Sketch: + +```rust +// canonical policyData after JSON servTD endorsement redaction → SHA-384 +let policy_bytes = migtd::policy::extract_canonical_policy_data_bytes(policy)?; +event_log::write_tagged_event_log( + event_log, + MR_INDEX_POLICY, // = 0x3 → RTMR2 + &policy_bytes, // bytes that get SHA-384'd + TAGGED_EVENT_ID_POLICY_DATA, // = 0x9 + event_data, // version.as_bytes() — small event payload +); +``` + +Why one redacted-policyData extend instead of either (a) a single +signed-blob hash or (b) per-field whitelist: + +- A signed-blob hash would re-introduce the original circularity (the + signed file must exist before the image is built). +- A per-field whitelist (the previous "six extends" scheme) required + reviewer discipline to remember to add every new `policyData` field to + the measurement code path. The single-extend redacted scheme + automatically binds every newly added field unless it is deliberately + added to the explicit redaction set. The mapping and identity issuer chains + are intentionally redacted from RTMR2 and must instead resolve to the same + RTMR1 anchor; a swapped root/EKU fails closed during policy verification. +- The dummy policy embedded in the base IGVM's CFV pre-computes the same + RTMR2 as the final enrolled policy as long as the canonical + measured `policyData` agrees byte-for-byte after the same redaction helper. + +The **hashed bytes** are the canonical redacted-`policyData` bytes (sorted-key, whitespace-free); the **event-log payload field** is the small version string. Peers replay the event log and compare digests, not raw payloads — `check_policy_integrity` recomputes the canonical bytes via the same `extract_canonical_policy_data_bytes` helper to verify the single digest. + +Mirror in `MigTD/tools/migtd-hash/src/lib.rs` (`rtmr2()`): offline simulator +performs the same single `rtmr2.extend_with_raw_data(...)` call so the build +pipeline's `tdinfo_hash` matches the runtime RTMR2 exactly. + +### Legacy `not(policy_v2)` build + +Two extensions in order: `policy` then `root_ca` +(`MigTD/src/migtd/src/bin/migtd/main.rs:329-348`, +`MR_INDEX_ROOT_CA = 0x3` → RTMR2). Not used in current production. + +### Test mode + +`measure_test_feature()` (`MigTD/src/migtd/src/bin/migtd/main.rs:194-210`) +extends RTMR2 (`MR_INDEX_TEST_FEATURE = 0x3`) with the literal bytes +`b"test_disable_ra_and_accept_all"` and returns early, replacing the +normal policy / signer-anchor measurements. **Only present when the +`test_disable_ra_and_accept_all` feature is built in — not in production +images.** + +--- + +## 5. Boot sequence — who runs when + +``` + Measurement +───────────────────────────────────────────────────────────────────────── +Host: IGVM loader processes migtd.igvm + ├─ For each PageData directive: + │ ├─ TDH.MEM.PAGE.ADD (GPA) → MRTD (GPA only) + │ └─ if !unmeasured: TDH.MR.EXTEND (content) → MRTD (content) + │ (BFV pages + Payload pages get this; CFV / TempMem do not) + └─ TDH.MR.FINALIZE → MRTD sealed +───────────────────────────────────────────────────────────────────────── +TD launch — first instruction is reset vector @ 0xFFFFFFF0 + └─ reset_vector → IPL → switch to long mode +───────────────────────────────────────────────────────────────────────── +td-shim main() runs (deps/td-shim/td-shim/src/bin/td-shim/main.rs) + ├─ Parse metadata, build BootTimeStatic / BootTimeDynamic + ├─ if td_hob.is_some(): log_hob_list → RTMR0 (NOT for MigTD IGVM) + ├─ Build payload memory, set up paging, etc. + └─ boot_builtin_payload(): + ├─ Read payload from SliceType::ShimPayload FV (no measurement) + ├─ if payload_extend_rtmr: log_payload_binary → RTMR1 (NOT for MigTD IGVM) + ├─ event_log.create_seperator() → RTMR0 + RTMR1 (separator) + ├─ PE-relocate payload into SliceType::Payload (writable, runtime, NOT measured) + └─ switch stack / jump to MigTD entry point +───────────────────────────────────────────────────────────────────────── +MigTD runtime_main() runs (src/migtd/src/bin/migtd/main.rs:83) + └─ do_measurements(): + ├─ get_policy_issuer_chain_and_measure → RTMR1 (signer anchor) + └─ get_policy_and_measure → RTMR2 (policy) + (test mode replaces both with a single RTMR2 test-feature event) + └─ register migration callback, handle_pre_mig() … +``` + +After this point, the TD report's `tdinfo` is frozen at: + +``` +mrtd = SHA384( all measured pages of td-shim + payload ) [deterministic per image] +rtmr0 = SHA384(0 || SHA384(separator)) [deterministic per td-shim version] +rtmr1 = extend(extend(0, separator), SHA384(signer_anchor_A)) [stable across leaf/intermediate rotation] +rtmr2 = extend(0, SHA384(canonical_redacted_policyData)) [varies by measured policy content] +rtmr3 = 0 [unused] +``` + +--- + +## 6. Why this matters for endorsement + +(See `docs/One_Hash_Endorsement.md` for the full story; this is the +one-paragraph summary.) + +- The JSON TCB mapping and signed CoRIM both map the complete 48-byte + `tdinfo_hash` / `SERVTD_INFO_HASH` to SVN. That hash is + `SHA384(TDINFO)` for production `servtd_attr=0`, so it covers MRTD and all + RTMRs, including the measured policy content in RTMR2. +- The mapping/CoRIM bytes themselves are not measured, breaking the circular + dependency. Their signatures are trusted only when the signer chain resolves + to the RTMR1 anchor. + +--- + +## 7. Quick code reference index + +| Concern | File | Key lines | +|---|---|---| +| What goes into MRTD | `MigTD/config/metadata.json` | whole file | +| Build-time IGVM directive generation | `MigTD/deps/td-shim/td-shim-tools/src/linker.rs` | `424-627` (build_igvm), `344-374` (insert_igvm_pages) | +| `EXTENDMR` constant | `MigTD/deps/td-shim/td-shim-interface/src/metadata.rs` | `68` | +| Default metadata sections (fallback when no `-m`) | `MigTD/deps/td-shim/td-shim-tools/src/metadata.rs` | `111-192`, `194-253` | +| `payload_extend_rtmr` toggle | `MigTD/deps/td-shim/td-shim/src/bin/td-shim/shim_info.rs` | `84-92`, `116-118` | +| TD-shim payload load + jump | `MigTD/deps/td-shim/td-shim/src/bin/td-shim/main.rs` | `210-272` (boot_builtin_payload) | +| Separator extension | `MigTD/deps/td-shim/cc-measurement/src/log.rs` | `58-67` (create_seperator) | +| td-shim event-log helpers (RTMR1) | `MigTD/deps/td-shim/td-shim/src/event_log.rs` | `71-102` | +| MigTD MR_INDEX constants | `MigTD/src/migtd/src/event_log.rs` | `34-37` | +| MigTD `tdcall_extend_rtmr` wrapper | `MigTD/src/migtd/src/event_log.rs` | `116-175` | +| MigTD `do_measurements` (policy_v2) | `MigTD/src/migtd/src/bin/migtd/main.rs` | `167-192` | +| MigTD policy / signer-anchor extension | `MigTD/src/migtd/src/bin/migtd/main.rs` | `get_policy_and_measure`, `get_policy_issuer_chain_and_measure` | +| Event log replay / RTMR comparison | `MigTD/src/migtd/src/event_log.rs` | `228-288` | + +--- + +## 8. Common gotchas + +1. **"td-shim loads the payload"** is true at the *runtime relocation* + level but **misleading for measurement**. Payload bytes are in MRTD + before td-shim runs; see §1. +2. **`Attributes: 0x1` (EXTENDMR) ↔ IGVM `unmeasured=false` ↔ MRTD**; + `Attributes: 0x0` ↔ `unmeasured=true` ↔ GPA-only. There is no + middle ground — the bit either extends or doesn't. +3. **CFV content is NOT in MRTD.** Changing measured policy content changes + RTMR2. Rotating a leaf/intermediate under the same root+EKU does not change + RTMR1; changing the root or signer-anchor EKU does. +4. **`mr_index` in event-log code is PCR-style** (1-based), the + `tdcall_extend_rtmr` `rtmr_index` is 0-based. Off-by-one bugs are + easy here — see `event_log.rs:164-175`. +5. **`MR_INDEX_POLICY` and `MR_INDEX_ROOT_CA` and `MR_INDEX_TEST_FEATURE` + are all `0x3`** — they all extend the same register (RTMR2). The + tagged-event-ID is what distinguishes them at replay time. +6. **`payload_extend_rtmr` is mutually exclusive with `EXTENDMR`** on + the Payload section. A misconfigured `metadata.json` that sets + `Attributes: 0x0` on Payload would silently shift the measurement + from MRTD to RTMR1, breaking endorsement matching. +7. **`test_disable_ra_and_accept_all` replaces, not adds.** Test builds + omit the policy / issuer-chain measurements entirely, so their RTMR1 + and RTMR2 are completely different from production. Never reuse a + test-build event-log replay against a production endorsement. +8. **`payload_v1` vs `policy_v2`**: legacy v1 builds also extend + `root_ca` into RTMR2 *after* policy. policy_v2 builds do not — the + root is committed through the RTMR1 signer anchor. This means a v1→v2 transition + changes both RTMR1 *and* RTMR2. diff --git a/.agents/knowledge/code-coverage-plan.md b/.agents/knowledge/code-coverage-plan.md new file mode 100644 index 000000000..80a520699 --- /dev/null +++ b/.agents/knowledge/code-coverage-plan.md @@ -0,0 +1,51 @@ +--- +type: Reference +title: Code Coverage Plan (Draft Status) +description: The proposed (not-yet-implemented) per-PR code coverage flow — decided aggregation backend, tooling, and phased plan — to avoid contradicting already-made decisions. +tags: [code-coverage, ci, codecov, grcov, draft] +timestamp: 2026-07-13T22:37:00+00:00 +--- + +# Code Coverage Plan (Draft Status) + +Canonical source: [doc/code_coverage.md](../../doc/code_coverage.md). **Status: +DRAFT for review — nothing here is implemented in CI yet.** If asked to "add +code coverage", read the full doc first; don't re-derive the plan from +scratch or contradict the decisions already made below. + +## Decisions already made (don't re-litigate without new info) + +- **Aggregation backend: Codecov** (flag-merge + carryforward), chosen over + self-hosted merge, Coveralls, or ADO Cobertura. +- **Tooling: `grcov` → LCOV**, kept for uniformity across unit tests, AzCVMEmu + integration, and (future) firmware coverage — all converge on `.profraw` → + `grcov -t lcov`. +- **Firmware (real-hardware TDX) coverage approach: `minicov`** no_std + runtime, phase 2 — capture counters and stream over an existing channel + (serial/vsock) since the firmware is `no_std`, has no filesystem, and is a + **measured** image (instrumentation changes MRTD, requiring policy/cert + regeneration to match). + +## Why AzCVMEmu integration coverage is "easy" + +The AzCVMEmu binary is a **std host build**; `migtdemu.sh` launches it via +`env "${kv[@]}" … "$binary"` which inherits the parent environment, so +exporting `LLVM_PROFILE_FILE=…/%p-%m.profraw` instruments both source and +destination processes with **no script change**. + +## Phased plan + +1. **Phase 1 (now):** unit tests + a minimal AzCVMEmu subset (~4-6 of the 13 + legs) → Codecov flags `unittests` + `integration`, per-PR. +2. **Phase 2 (later):** firmware coverage via `minicov` on self-hosted TDX, + uploaded under a **carryforward** `hardware` flag (so PRs without a + hardware run still show the last-known production-path coverage). +3. **Phase 3:** lock in the covering subset, decide gating policy + (informational vs. blocking threshold). + +## Open questions still unresolved + +Per-PR CI time budget for the instrumented subset; whether to invest in +firmware/minicov now vs. defer; gating policy; Codecov org onboarding +(`CODECOV_TOKEN` for fork PRs). Surface these to the user rather than +assuming an answer if picking this work up. diff --git a/.agents/knowledge/code-style.md b/.agents/knowledge/code-style.md new file mode 100644 index 000000000..fc12da1cd --- /dev/null +++ b/.agents/knowledge/code-style.md @@ -0,0 +1,38 @@ +--- +type: Reference +title: Code Style Preferences +description: MigTD-specific Rust code style conventions — diff minimization, error handling, logging discipline, and refactoring guidance. +tags: [code-style, rust, logging, refactoring] +timestamp: 2026-07-10T19:26:55+00:00 +--- + +# Code Style Preferences + +> Condensed in the root [agent guide](../../AGENTS.md). + +- **Minimize diff.** When refactoring or merging conflicts, **keep existing + parameter and field names** instead of inventing new ones. Cosmetic + renames during functional work get pushed back. +- **Don't churn unrelated formatting.** `cargo fmt` only on files you've + modified. +- **No `expect()` / `unwrap()` in non-test code paths.** Return an error + instead. +- **Prefer the `LogErr` / `LogError` helper trait** for `Result` → log + error + patterns instead of hand-rolled `if let Err … { log!… }` blocks. +- **Refactor for reuse, not for novelty.** When asked for "polymorphism" / + "template" / "common closure", deliver *real* deduplication. Don't add a + trait/macro with only one implementation. +- **Don't add feature gates just to be safe.** If a feature is always + desired, remove the gate. +- **Logging discipline:** + - INFO level should be sparse. + - **Never dump full quotes / certs / large blobs at INFO/DEBUG.** Log + first 8 bytes + last 8 bytes + length. Excessive quote dump has caused + multi-second stalls on TiP. + - When adding diagnostic logs, gate behind explicit verbosity OR commit + them as a clearly-named debug/diag commit that can be dropped later. +- **Don't fix code that "looks redundant" without proving it.** Canonical + cautionary tale: `event_log::get_event_log()` returns `&raw[..size + 1]`; + removing the `+1` (commit `bc99fa4`) passed unit tests but broke EMU + integration. The `+1` is a load-bearing workaround for an upstream + `cc_measurement` bug. See [migtd-review SKILL.md](/skills/migtd-review/SKILL.md) §1. diff --git a/.agents/knowledge/commit-and-workflow.md b/.agents/knowledge/commit-and-workflow.md new file mode 100644 index 000000000..077a5efb6 --- /dev/null +++ b/.agents/knowledge/commit-and-workflow.md @@ -0,0 +1,84 @@ +--- +type: Playbook +title: Commit Hygiene, Remotes & Workflow Patterns +description: DCO sign-off rules, commit/force-push discipline, remote layout, common rebase/cherry-pick workflow patterns, and issue/PR filing conventions. +tags: [git, commit-hygiene, remotes, workflow, issues] +timestamp: 2026-07-10T19:26:55+00:00 +--- + +# Commit Hygiene, Remotes & Workflow Patterns + +> Condensed in the root [agent guide](../../AGENTS.md). + +## Commit hygiene + +- **Always commit with `git commit -s`** (or manually add the + `Signed-off-by:` trailer using the current `git config user.name` and + `user.email`). The project requires DCO sign-off on every committable + change **except** debug-only or `REVERTME` test commits. +- Use the existing repo identity — do not invent a different author. If the + Copilot `Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>` + trailer is appropriate for your environment, include it **in addition to** + the human Signed-off-by, not instead of it. +- **Commit message style: brief.** One short subject line stating the + problem, then a short body describing the high-level solution. Skip filler + like "no behavioural changes" boilerplate unless it materially helps a + future reader. +- **Don't bundle unrelated changes** into one commit. Separate: + - behaviour change vs refactor → two commits (or `fixup`/`squash` later); + - pre-existing fmt/lint fix vs your fix → standalone commit with a + "pre-existing; not caused by this series" note. +- **Fold/squash freely with `git rebase -i`** (`fixup` for "absorb and drop my + message", `squash` for "absorb and keep my message"). This is requested + often during cleanup. +- **Force-push** only to a personal fork remote (e.g. `origin`), and only + with `--force-with-lease=:`. Never force-push to + `intel/*` or `ms/*` / `upstream/*` remotes. + +## Remotes & branches + +Typical remote layout in active checkouts: + +``` +intel https://github.com/intel/MigTD.git # Intel upstream +ms https://github.com/microsoft/MigTD.git # Microsoft fork +upstream https://github.com/microsoft/MigTD.git # alias for ms +origin https://github.com//MigTD.git # personal fork (push target) +``` + +- "Upstream" in conversation usually means **`intel/main`** when discussing + Intel-bound patches, and **`microsoft/main`** (a.k.a. `ms/main` / + `upstream/main`) when discussing the Microsoft fork. Confirm by context. +- **Microsoft-specific features kept out of Intel-bound patches** include + `use-mock-quote`, AzCVMEmu emulation, and allow-all policy. Consult the + [migtd-port skill](/skills/migtd-port/SKILL.md) when rebasing toward Intel. + +## Common workflow patterns + +- **Rebase onto upstream**: "rebase changes from `` onto + `origin/`. Discard changes already on that branch." Use + `git rebase --onto`. +- **Cherry-pick from `intel/main` to simplify**: when bringing in fixes from + Intel, prefer cherry-pick over re-implementation if the change is small. +- **Squash/fold during cleanup**: commits are often named by target SHA + ("fold into ``", "fixup for ``"). Use `git rebase -i` with + `fixup` / `squash`. +- **Reference-by-commit**: when a specific SHA is cited as a template, read + that commit's diff before re-implementing. +- **Resume from a previous session checkpoint**: the session_store DB has + `checkpoints` keyed by session title — search there. +- **TiP logs come from Windows**: paths like `C:\Users\\Downloads\…` + translate to `/mnt/c/Users//Downloads/…` under WSL. + +## Issue / PR filing + +- GH issue title prefix: **`[Copilot Review]`** (not `[Security]` — not all + findings are security). +- **Microsoft EMU (Enterprise Managed User) GH accounts cannot create + issues on external repos.** Use a personal GH account via + `gh auth login --hostname github.com --web`. Verify with `gh auth status` + before running any issue-creation script. +- `gh issue close --reason "not planned"` (literal space, *not* + `not_planned`). +- See [`create_review_issues.sh`](/skills/migtd-review/scripts/create_review_issues.sh) + for the template. diff --git a/.agents/knowledge/decisions-log.md b/.agents/knowledge/decisions-log.md new file mode 100644 index 000000000..64bc47e4f --- /dev/null +++ b/.agents/knowledge/decisions-log.md @@ -0,0 +1,61 @@ +--- +type: Reference +title: Engineering Decisions Log +description: Concrete, non-obvious engineering decisions (feature/commit kept vs. dropped, and why) with commit SHAs and verification steps. Append-only; grows over time. +tags: [decisions-log, living-document] +timestamp: 2026-07-26T00:14:16+00:00 +--- + +# Engineering Decisions Log + +> This is a **decision log**, not a design doc. [Domain +> Facts](domain-facts.md) and [Anti-patterns](anti-patterns.md) hold standing +> rules. Keep entries short. Cite the implementing commit. Append new entries. +> Follow the root [agent guide](../../AGENTS.md) update ritual. + +- **Dropped the peer-leaf-certificate-expiration check** + (`crypto::validate_peer_leaf_expiration`, previously enforced in + `mig_policy.rs` for both the Policy and ServTDTCBMapping issuer chains on + `integration2`). Reason: it rejects a destination whose signing cert + expires before the source's, which blocks legitimate cert/key-rotation + operations where a newly-issued destination cert intentionally has a + shorter overlap/validity window than the cert it is rotating away from. + Simplifies rotation operations. Dropped via + `git rebase --onto integration2` (no later commit + touched `src/crypto/src/lib.rs`, `src/crypto/src/x509.rs`, or + `src/migtd/src/mig_policy.rs`, so the drop was conflict-free); verified + by a tree-diff-equivalence check plus `cargo fmt --check` and + `cargo xtask lib-test --crates migtd` (60 passed) before and after. + +- **Dropped all `init_td_info` trace-logging and its dedup accessor** + (`migration::trace_td_info()`/`trace_init_td_info_from_host()` full-buffer + dumps, and the `MigtdMigrationInformation::init_td_info_or_local()` + accessor that centralized the "VMM-provided vs. local fallback" pattern + + its own minimal trace lines). Reason: the upcoming design removes + `init_td_info` from the wire protocol entirely, so both the diagnostic + logging and the accessor that exists purely to serve it become dead + weight — no point carrying debugging aids and helper functions for data + that won't exist. Dropped via two `git rebase --onto`/`--skip` steps + (the accessor's own commit had to be skipped too, once identified as + serving the same soon-to-be-removed field); 3 real conflicts arose where + later commits built directly on the accessor/trace calls — resolved by + keeping the surrounding functional code and stripping only the + init_td_info-tracing lines. Verified: no `trace_td_info` / + `init_td_info_or_local` references remain anywhere in `src/`; `cargo fmt + --check` clean; `cargo xtask lib-test --crates migtd` (60 passed, + unchanged); `fast-emu-check.sh` (skip-RA + SPDM skip-RA) both PASS. + +- **Removed the Init_TDINFO allowlist check against the destination's local + TCB mapping.** Do not restore a local + `servtd_lookup_by_tdinfo_hash(init_tdinfo)` gate in migration or rebind. + An older destination cannot be expected to list future MigTD releases or + signer-key rotations; requiring that entry breaks bidirectional migration + between independently issued images. + +- **Clarified the required one-hash init/current SVN check.** Removing the + destination-local allowlist does not remove the init-hash lookup. The + verifier must use the authenticated source's verified JSON mapping or CoRIM + to resolve both `ServtdExt.init_servtd_info_hash` and the source's current + report `tdinfo_hash`, then reject `init SVN > current SVN`. This is now + enforced in both migration and rebinding; the legacy wire Init_TDINFO is + retained only for protocol compatibility and ignored. diff --git a/.agents/knowledge/domain-facts.md b/.agents/knowledge/domain-facts.md new file mode 100644 index 000000000..079bc05f7 --- /dev/null +++ b/.agents/knowledge/domain-facts.md @@ -0,0 +1,109 @@ +--- +type: Reference +title: MigTD Domain Facts (Trust Model, Attestation, Transport, Heap) +description: Non-obvious architectural facts to internalize before flagging anything as a bug — trust model, rebind vs. migration verifiers, TDINFO semantics, vmcall invariants, heap sizing, and rejected hypotheses. +tags: [trust-model, attestation, tdinfo, vmcall, heap, rejected-hypotheses] +timestamp: 2026-07-26T00:14:16+00:00 +--- + +# MigTD Domain Facts + +> Condensed in the root [agent guide](../../AGENTS.md). Read before flagging +> anything as a bug. + +## Trust model + +- Single-core, single-threaded `no_std` Rust firmware. No `Sync`/`Send` + races except via interrupts. +- **VMM is untrusted but can DoS.** DoS-via-VMM is *not* a finding. +- **Root of trust = `MRTD` + `RTMR0..3`** (attested). Certificate chains + carry signatures, but policy-v2 signer identity is bound by the RTMR1 + signer anchor: root-certificate SHA-384 fingerprint + one enrolled + signer-purpose EKU. CoRIM verification tries every EKU asserted by the leaf + and accepts only the one reproducing the measured anchor; legacy PEM paths + still require a single unambiguous EKU. +- After `mig_policy::init_policy()` succeeds, `VERIFIED_POLICY` is trusted. +- The one-hash TCB mapping (JSON or CoRIM) maps the complete 48-byte + `tdinfo_hash` / `SERVTD_INFO_HASH` directly to MigTD SVN. When a signed + CoRIM is enrolled it is the sole lookup authority; a miss does not fall + back to JSON collateral. +- Init/current SVN continuity in the completed one-hash design uses the + authenticated source's verified mapping twice: map + `ServtdExt.init_servtd_info_hash` to init SVN, map the source's authenticated + current-report `tdinfo_hash` to current SVN, and require + `init SVN <= current SVN`. Do not query the destination's local mapping. +- Migration and rebinding both enforce this mapped-SVN ordering. A missing + init or current mapping fails closed; the legacy wire Init_TDINFO is ignored. + +## Rebind vs Migration attestation — DIFFERENT verifiers + +- **Regular migration** → uses **quotes**. REPORTDATA at byte offset **520**. + Helper: `verify_report_data_binding`. +- **Rebind** → uses **TDREPORT** (no quote). REPORTDATA at byte offset + **128**. Helper: `verify_tdreport_data_binding`. +- **Mixing them = bug.** See commit `94975ec` (TH1 binding fix). + +See [Init_TDINFO and ServtdExt Usage Summary](init-tdinfo-servtd-ext.md) for +full detail on how each path verifies TDINFO, and +[Security Bypasses](security-bypasses.md) for which of these checks are +bypassed under which build feature. + +## TDINFO / MROwner / MROwnerConfig semantics + +- **MROwner** is provisioned by GHCI as the hash of the policy signer's + public key, but it is no longer the cross-peer signer trust anchor. +- **MROwnerConfig** = MigTD policy SVN (a.k.a. "migtd svn"). +- `verify_own_tdinfo()` checks only that the local `MROwnerConfig` matches + policy SVN. The old local `MROwner == signer-key hash` check is deprecated + because anchor-only CoRIM enrollment carries no leaf public key. +- Migration/rebind currently cross-check full **init** TDINFO + `MROwner`/`MROwnerConfig` with that same peer's authenticated current + report. This is transitional compatibility logic, not the final one-hash + mechanism. The final mechanism compares the two SVNs resolved from the + source peer's verified hash mapping. +- Cross-peer signer compatibility is the RTMR1 anchor equality + (root fingerprint + leaf EKU). Leaf and intermediate keys may rotate + independently under the same anchor. +- The legacy wire field **`init_td_info`** is accepted for framing + compatibility but cleared by `MigtdMigrationInformation::read_from_bytes`; + callers see it as absent. The completed one-hash flow must use + `ServtdExt.init_servtd_info_hash` directly and must not depend on a + VMM-supplied 512-byte Init_TDINFO. +- Under the **`AzCVMEmu`** feature, **skip the `verify_own_tdinfo()` + MROwnerConfig check** rather than emulating it via env vars. The + env-var emulation approach was tried (commit `8ce39a3`) and abandoned as + "too much to maintain". Current pattern: feature-gate-skip on `AzCVMEmu`. +- Existing `REVERTME` commits typically bypass MROwner/MROwnerConfig checks + because the host isn't ready to plumb them through; these are test-only + and must be reverted before upstreaming. + +## vmcall / transport invariants + +- `vmcall-raw` **never returns `Ok(0)` / EOF**. It blocks until data or + error. "What if VMM returns 0 bytes?" is already defended at the transport + layer. +- Each migration session has its own shared buffer with **`data_status` as + ground truth**. Broadcast interrupt wakes are filtered by the per-buffer + status check — correct by design. + +## Heap allocator + +- `ATTEST_HEAP_SIZE` is currently **2 MiB**. It was bumped from 512 KiB after + commit `3c44ea9` removed the `LOCAL_TCB_INFO` cache, raising per-migration + `verify_quote_integrity_ex` calls from 2 → 4 in TiP loopback; the 3rd call + exhausted the old heap (#UD inside the C verifier). +- The C verifier (`verify_quote_integrity_ex` from Intel DCAP `servtd_attest`) + uses **SgxSSL libcrypto** internally — host-glibc-libcrypto repro tools + **under-report** heap pressure. Host repros must link the same allocator + (tlibc dlmalloc/sbrk) and the same libcrypto (SgxSSL) as the in-image build. +- Single-thread heap **does** reuse freelists across calls; "leak across + calls" was rejected as a hypothesis. The 2 MiB bump is the accepted answer. +- See [Memory Budget](memory-budget.md) for the stack/heap/shared-memory + sizing methodology and current equations. + +## Rejected hypotheses — do not reopen without strong new evidence + +- **Singleton GetQuote vector hijacking MigTD vector**: host VMM team + definitively rejected this. `GhciRequestContext` omits + `NotificationInterrupt` by spec; Send/Receive vectors are re-supplied each + call. Don't propose fixes founded on this hypothesis. diff --git a/.agents/knowledge/index.md b/.agents/knowledge/index.md new file mode 100644 index 000000000..41d0477a6 --- /dev/null +++ b/.agents/knowledge/index.md @@ -0,0 +1,28 @@ +# .agents/knowledge — topical reference index + +## Workflow & conventions + +* [Commit Hygiene, Remotes & Workflow Patterns](commit-and-workflow.md) - DCO sign-off, force-push rules, remote layout, rebase/cherry-pick patterns, issue filing. +* [Setup, Verification Gauntlet & Pre-done Checklist](verification-and-checklist.md) - Mandatory post-checkout setup, the four-CI-workflow gauntlet, EMU invocations, and the "am I done" checklist. +* [Code Style Preferences](code-style.md) - Diff minimization, error handling, logging discipline. +* [Anti-patterns — Things To NOT Do](anti-patterns.md) - Collected pushback items from past sessions. +* [Engineering Decisions Log](decisions-log.md) - Concrete decisions (feature/commit kept vs. dropped) with SHAs — append-only. + +## Domain knowledge + +* [MigTD Domain Facts](domain-facts.md) - Trust model, one-hash/CoRIM lookup, signer-anchor and MROWNER semantics, verifiers, vmcall invariants, and heap sizing. +* [MigTD Architecture Overview (Azure Build)](architecture-overview.md) - Navigation map of functional areas to source/doc. +* [Security Bypasses](security-bypasses.md) - Which verification checks are bypassed under dev/test build features, and why. +* [Boot Measurements](boot-measurements.md) - How MRTD/RTMR0-3 are populated, including the RTMR1 root+EKU anchor and redacted RTMR2 policyData. +* [Init_TDINFO and ServtdExt Usage Summary](init-tdinfo-servtd-ext.md) - Continuity/integrity checks, current-image one-hash lookup, and migration vs. rebinding behavior. +* [Memory Budget](memory-budget.md) - Stack/heap/shared-memory sizing equations for multi-session SPDM attestation. +* [Reproducible Build — Status & Limitations](reproducible-build.md) - What's implemented, verified, and still limited for MRTD-stable rebuilds. + +## Build, release & test workflows + +* [AzCVMEmu Build & Run — Agent Cheat Sheet](azcvmemu-build-and-run.md) - Feature-flag combinations, prerequisites, `migtdemu.sh` invocations. +* [Policy v2 Generation Workflow](policy-v2-workflow.md) - JSON/CoRIM packaging, signer-anchor enrollment, and measurement-stable mapping/key rotation. +* [Integration Testing — QEMU/vsock and Azure TiP](integration-testing.md) - The two non-EMU integration test layers, build/run commands, current status. +* [MigTD TiP Lab-Blade Troubleshooting Skill](../skills/migtd-tip-troubleshoot/SKILL.md) - PowerTest/HCSTest setup, host validation, serial/hash diagnosis, and Hyper-V ETW capture. +* [Release Process](release-process.md) - Version semantics, release content checklist, release steps. +* [Code Coverage Plan (Draft Status)](code-coverage-plan.md) - Proposed per-PR coverage flow — decided backend/tooling, phased plan, open questions. diff --git a/.agents/knowledge/init-tdinfo-servtd-ext.md b/.agents/knowledge/init-tdinfo-servtd-ext.md new file mode 100644 index 000000000..da101c949 --- /dev/null +++ b/.agents/knowledge/init-tdinfo-servtd-ext.md @@ -0,0 +1,142 @@ +--- +type: Reference +title: Init_TDINFO and ServtdExt Usage Summary +description: Definitions of TDINFO_STRUCT/ServtdExt and how they are used and cross-checked across the migration and rebinding paths. +tags: [attestation, tdinfo, servtd, migration, rebinding] +timestamp: 2026-07-26T00:14:16+00:00 +--- + +# Init_TDINFO and ServtdExt Usage Summary + +> Reflects the `one_hash` code. MigTD compares init and current SVNs by +> resolving both hashes through the authenticated source's verified mapping. +> The legacy Init_TDINFO wire field is accepted for framing but ignored. + +## Definitions + +### TDINFO_STRUCT (512 bytes) — `TdInfo` + +The hardware-defined identity of a TD. Fields: + +| Field | Size | Description | +|---|---|---| +| `attributes` | 8 B | TD attributes (debug, sept-ve-disable, etc.) | +| `xfam` | 8 B | Extended feature attribute mask | +| `mrtd` | 48 B | Measurement of the TD's initial memory contents | +| `mrconfig_id` | 48 B | Software-defined non-owner config ID | +| `mrowner` | 48 B | GHCI owner ID (provisioned as policy signing-key hash); retained for init/current continuity, but no longer the cross-peer signer trust anchor | +| `mrownerconfig` | 48 B | Owner-defined config (in MigTD: first 4 bytes = policy SVN as LE u32, rest zero) | +| `rtmr0..rtmr3` | 4×48 B | Runtime-extendable measurement registers | +| `servtd_hash` | 48 B | Hash of bound service TDs' TDINFO_STRUCTs | +| `reserved` | 64 B | Must be zero | + +**Init_TDINFO** is the TDINFO_STRUCT of the *original MigTD* that was first +bound to the target TD at launch time. The legacy host field is accepted for +wire framing but cleared by `MigtdMigrationInformation::read_from_bytes`. +The completed one-hash design does not require the VMM to provide this +512-byte structure. + +### SERVTD_EXT_STRUCT (272 bytes) — `ServtdExt` + +Metadata stored in the target TD's TDCS, read by the *current* MigTD via `TDG.SERVTD.RD` (`read_servtd_ext()`, which always returns a populated `ServtdExt`). Fields: + +| Field | Size | Description | +|---|---|---| +| `init_servtd_info_hash` | 48 B | SHA-384 identifying the *initial* bound MigTD: `SHA384(masked_init_TDINFO)`, set at first binding | +| `init_attr` | 8 B | SERVTD_ATTR at initial binding. Bits 15:0 = SERVTD_TYPE (0=MigTD). Higher bits = IGNORE flags controlling which TDINFO fields are zeroed before hashing | +| `init_cpusvn` | 16 B | Platform CPU SVN at initial binding | +| `init_tee_tcb_svn` | 16 B | TEE TCB SVN at initial binding | +| `init_tee_model` | 12 B | TEE model info at initial binding | +| `cur_servtd_info_hash` | 48 B | Hash identifying the *currently* bound MigTD | +| `cur_servtd_attr` | 8 B | SERVTD_ATTR of the currently bound MigTD | +| reserved fields | 116 B | Padding | + +## One-hash init/current SVN ordering + +The enforced verification is: + +1. Verify the source quote/TDREPORT and measured policy. +2. Compute the authenticated source's current `tdinfo_hash` and resolve it + through that source policy's verified JSON mapping or CoRIM. +3. Read `ServtdExt.init_servtd_info_hash` and resolve it through the same + verified source mapping. +4. Require `init_lookup.isvsvn <= current_lookup.isvsvn`. + +Both mapping misses fail closed. The destination's local mapping is not used; +an older destination must not be required to predict future source releases. +Because the signed source mapping endorses both hashes, no VMM-provided full +Init_TDINFO or MROWNER continuity check is needed for SVN ordering. + +--- + +## Usage in each path (SPDM) + +### Migration (source → destination) + +**Source side** (`spdm_req`): reads `ServtdExt` via `read_servtd_ext()` and +sends it with the legacy Init_TDINFO VDM element. + +**Destination side** (`spdm_rsp` → `mig_policy::authenticate_migration_source_with_init_tdinfo`): +1. Receives ServtdExt and Init_TDINFO; stores ServtdExt in responder context. +2. `authenticate_remote_common`: verifies the source's quote, measured + policy/event log, and signer anchor; it resolves the **current source + TDINFO hash** through the source's verified JSON mapping or CoRIM to build + `evaluation_data_src`. +3. Resolves `ServtdExt.init_servtd_info_hash` through the same authenticated + source mapping and requires `init SVN <= current SVN`. Either mapping miss + fails closed. +4. **Policy evaluation** — `evaluate_policy_common` + `evaluate_policy_backward` against `relative_reference = get_local_tcb_evaluation_info()` (the **local** MigTD's TCB, not Init_TDINFO). +5. **SERVTD_ATTR check** (at MSK exchange, `session.rs::exchange_msk`): both sides call `verify_servtd_attr()` on their own bound target, checking `cur_servtd_attr == EXPECTED_SERVTD_ATTR` (hardcoded `0x0`). The historical `cur == init_attr` comparison was **removed** (it could falsely reject after a legitimate rebind). +6. **Approved hash write**: destination computes `SHA384(ServtdExt with cur_servtd_info_hash + cur_servtd_attr zeroed)` and writes it to `APPROVED_SERVTD_EXT_HASH` (`write_approved_servtd_ext_hash`). + +### Rebinding (old MigTD → new MigTD) + +**Old MigTD side** (SPDM requester): same as migration source. + +**New MigTD side** (SPDM responder, `spdm_rsp` → `mig_policy::authenticate_rebinding_old`): +1. `authenticate_rebinding_common`: verifies the old MigTD's **TDREPORT**, + measured policy/event log, and signer anchor; it resolves the old MigTD's + **current TDINFO hash** through that verified policy's JSON mapping or + CoRIM to build `evaluation_data_src`. +2. Resolves `ServtdExt.init_servtd_info_hash` through the old MigTD's + authenticated mapping and requires `init SVN <= current SVN`. Either + mapping miss fails closed. +3. **No local init-image allowlist.** Requiring the new MigTD's mapping to + contain the old init image would force an older release to predict future + rotations and would break bidirectional rebind. +4. **Policy evaluation** — `evaluate_policy_backward` against `relative_reference = get_local_tcb_evaluation_info()` (local TCB, not Init_TDINFO). +5. **Approved hash write** + **rebind attr write** (`write_servtd_rebind_attr`, rebinding-specific). + +--- + +## Migration vs rebinding + +| Aspect | Migration (destination) | Rebinding (new MigTD) | +|---|---|---| +| Peer attestation | Quote + supplemental data | TDREPORT | +| Init/current SVN ordering | Source mapping; enforced | Source mapping; enforced | +| Legacy Init_TDINFO | Ignored | Ignored | +| Init image lookup in destination's local mapping | ❌ deliberately absent | ❌ deliberately absent | +| Policy-eval relative reference | local TCB (`get_local_tcb_evaluation_info`) | local TCB (`get_local_tcb_evaluation_info`) | +| Policy rules evaluated | common + backward | backward | +| `write_approved_servtd_ext_hash` | ✅ | ✅ | +| `write_servtd_rebind_attr` | ❌ | ✅ | + +The one-hash flow does not use Init_TDINFO for continuity, integrity, or as +the policy-evaluation relative reference. Policy still evaluates the peer +against the local MigTD's TCB. + +--- + +## Init_TDINFO continuity vs current-image TCB lookup + +The two inputs serve different purposes: + +| Check | What it verifies | Input | +|---|---|---| +| init/current continuity | The initially bound release is no newer than the authenticated current source release | `init_servtd_info_hash` and current report `tdinfo_hash`, both resolved through the source's verified mapping | +| current-image TCB lookup | The authenticated current peer image resolves to SVN (and optional date/status) | Complete current `tdinfo_hash` via JSON mapping or CoRIM | +| cross-peer signer trust | Source and destination belong to the same signer authority while allowing leaf/intermediate rotation | RTMR1 signer anchor: root fingerprint + enrolled signer-purpose EKU | + +Do not add a destination-local lookup of Init_TDINFO or restore dependence on +its wire contents. diff --git a/.agents/knowledge/integration-testing.md b/.agents/knowledge/integration-testing.md new file mode 100644 index 000000000..166fb2b61 --- /dev/null +++ b/.agents/knowledge/integration-testing.md @@ -0,0 +1,84 @@ +--- +type: Reference +title: Integration Testing — QEMU/vsock and Azure TiP +description: The two non-EMU integration test layers — local QEMU+pytest (vsock/serial) and real-hardware Azure TDX loopback migration (TiP) — with build/run commands and current status. +tags: [integration-test, qemu, azure, tip, pytest] +timestamp: 2026-07-13T22:37:00+00:00 +--- + +# Integration Testing — QEMU/vsock and Azure TiP + +Two distinct real(er)-transport integration layers exist **in addition to** +the AzCVMEmu-based `migtdemu.sh` / EMU gauntlet layer covered in +[verification-and-checklist.md](verification-and-checklist.md) and the +`migtd-review` skill. Don't confuse the three. + +## 1. Local QEMU + pytest (vsock/serial transports) + +Canonical source: [doc/integration_test.md](../../doc/integration_test.md). + +```bash +./sh_script/preparation.sh +cd sh_script/test # configure conf/pyproject.toml first +# Vsock build +cargo image --policy config/policy_pre_production_fmspc.json \ + --root-ca config/Intel_SGX_Provisioning_Certification_RootCA_preproduction.cer +sudo pytest -k "cycle" # stress_test_cycles must be 1 in the config +sudo pytest -k "not cycle" # after: bash sh_script/build_final.sh -t test -c -a on +``` + +Serial transport variant swaps `--features stack-guard,virtio-serial` and +adds `--device_type serial` to the pytest invocations. This is the **only** +layer that exercises the real no_std firmware image end-to-end without Azure. + +## 2. Azure TiP (real TDX hardware, loopback live migration) + +Canonical source: [doc/integration_test_azure_tip.md](../../doc/integration_test_azure_tip.md). +**Status: Draft design**, not yet wired into CI (self-hosted TDX agent still +to be provisioned). + +- Build host (Linux): Rust 1.88.0 + `rust-src` + `x86_64-unknown-none`, + private `ms-crates-io` feed access, `./sh_script/preparation.sh`. +- Lab blade (Windows TDX host): test Secure Firmware DLL + registry key + (reboot once), TDX-LM velocity feature `53058573`, `Enable-VMMigration`, + `Enable-LoopbackMigration`. +- Build package: + ```bash + ./sh_script/Azure/tip/build_tip_package.sh \ + --out out/tip-package \ + --os-root /path/to/os.2020 \ + --hcstest-dir /path/to/prebuilt/HCSTest \ + --secfw-file /path/to/secfw_test_GenuineIntel.dll + ``` + Produces `test-migtd.igvm` for the default real policy, named + `test-migtd-{accept-all,reject-all,getquote-all}.igvm` policy variants, and + `_mock_quote` counterparts. The default and mock-quote policy builds each + also have a `_rebind` image whose otherwise identical policy has `policySvn` incremented + by one and is signed by the same key. HCSTest must be a prebuilt package + containing its v2 netfx DLL; source alone is insufficient. Regular images + use IGVMAgent GetQuote; mock-quote images use built-in quote data. + `test-migtd_key_rotation.igvm` and + `test-migtd_mock_quote_key_rotation.igvm` keep the baseline policy SVN and + signer anchor (same root + enrolled signer-purpose EKU) but rotate + the CFV signer leaf key, allowing bidirectional rebind. Peer compatibility + is based on the common RTMR1 anchor, not leaf Subject Name or leaf-key + equality. No image must pre-list future rotation measurements in its local + mapping. + `Run-TipTests.ps1` runs both mock-quote directions by + default and both regular-quote directions with `-IncludeAgentCases`. +- `migtd-hash --manifest config/Azure/servtd_info.json --image + --policy-v2` — the printed **last line** (96 hex chars) is the direct + `SERVTD_INFO_HASH` written to `.hash` (`MigTdHash` on the host side). + Do not use `--calc-servtd-hash`; that outer TDREPORT hash fails prebind. +- Test cases: accept-all, reject-all, real-policy (FMSPC/TCB match), + getquote-all, mock-quote/no-agent smoke test, ServTdExt prebind layout, + rebind (same or different image through `Test-TdxLmRebind.ps1`), cycle + (repeat N×). +- All TiP VM tests keep host migration policy `DisabledByDefault` and explicitly + opt each test TD in with `EnabledIfHostPermits` before assigning its MigTD + migration-policy hash. +- For lab-blade setup failures, generic `Move-VM` errors, MigTD serial capture, + ServTD hash verification, and VMMS/Worker ETW diagnosis, use the + [`migtd-tip-troubleshoot`](../skills/migtd-tip-troubleshoot/SKILL.md) skill. +- Out of scope here: production signing/release, and the QEMU/vsock/serial + flow above (Azure uses `vmcall-raw`, not virtio/vsock). diff --git a/.agents/knowledge/memory-budget.md b/.agents/knowledge/memory-budget.md new file mode 100644 index 000000000..41f8a6dd2 --- /dev/null +++ b/.agents/knowledge/memory-budget.md @@ -0,0 +1,47 @@ +--- +type: Reference +title: Memory Budget — Stack, Heap & Shared Memory +description: Current stack/heap/shared-memory sizing equations for multi-session SPDM attestation, and how the multi-session memory test methodology works. +tags: [memory, heap, stack, spdm, sizing] +timestamp: 2026-07-13T22:37:00+00:00 +--- + +# Memory Budget — Stack, Heap & Shared Memory + +Canonical source: [doc/memory_usage_test.md](../../doc/memory_usage_test.md) +(methodology: [PR #556](https://github.com/intel/MigTD/pull/556) pends both +sides mid-attestation to force multiple concurrent sessions since vsock +doesn't support multi-link transport). + +## Current sizing equations (destination MigTD, policy v2, SPDM attestation) + +```text +Stack Size = 0x20_0000 +Heap Size = 0x10_0000 + 0x8_0000 * session_num +Shared Memory Size = 0x4_0000 + 0x2_0000 * session_num # vmcall-raw only +``` + +Per-session heap breakdown: ~`0x2_8000` SPDM context data + ~`0x2_0000` remote +policy data. `0x2_0000` shared-memory-per-session is the max vmcall-raw buffer +for a v2 policy payload. + +> Cross-reference: [Domain Facts § Heap allocator](domain-facts.md) records +> the **`ATTEST_HEAP_SIZE = 2 MiB`** production constant and why it was +> bumped from 512 KiB — that is a different (smaller, single-session-focused) +> number from the equations above; don't conflate the two when reasoning +> about OOM reports. + +## How to reproduce the test + +Build with `test_stack_size,test_heap_size` features + `-l info`, then +manually pend both requester and responder after `key_exchange_rsp` (per the +reference PR) so N session pairs are simultaneously mid-handshake with no +in-flight messages, avoiding the vsock single-link constraint. Read +[doc/memory_usage_test.md](../../doc/memory_usage_test.md) for the full QEMU +socat/vsock wiring if you need to rerun this experiment. + +## Caveat + +Shared-memory consumption **cannot** be measured with vsock (allocated in the +device layer for vmcall data, and vsock has no multi-link support) — the +equation above is deductive, not measured, for that term. diff --git a/.agents/knowledge/policy-v2-workflow.md b/.agents/knowledge/policy-v2-workflow.md new file mode 100644 index 000000000..21c5b17ff --- /dev/null +++ b/.agents/knowledge/policy-v2-workflow.md @@ -0,0 +1,92 @@ +--- +type: Playbook +title: Policy v2 Generation Workflow +description: End-to-end tool chain for one-hash Policy v2 artifacts, JSON or CoRIM servTD endorsements, signer-anchor enrollment, and hash-stable updates. +tags: [policy-v2, tools, signing, tcb-mapping] +timestamp: 2026-07-26T00:14:16+00:00 +--- + +# Policy v2 Generation Workflow + +Design sources: +[tcb_mapping_design_proposal.md](../../doc/tcb_mapping_design_proposal.md) and +[rtmr1_signer_anchor_proposal.md](../../doc/rtmr1_signer_anchor_proposal.md). +The implementation source of truth is `src/policy/src/v2/measurement.rs` and +`src/policy/src/v2/policy.rs`. Use this playbook when regenerating a v2 policy, +rotating a mapping/signer leaf, or debugging a mismatched `SERVTD_INFO_HASH`. + +## Supported packaging paths + +```text +Shared: + migtd-collateral-generator -> platform TCB/QE collaterals + migtd-policy-generator v2 -> { "policyData": ... } + +JSON compatibility path: + sign tdTcbMapping (tdinfo_hash -> SVN) + optionally sign tdIdentity (SVN -> date/status) + servtd-collateral-generator -> JSON servtdCollateral + issuer chains + cargo image --policy-v2 --policy --policy-issuer-chain + +CoRIM-only path: + omit --servtd-collateral when generating policyData + produce signed TCB-mapping CoRIM (SERVTD_INFO_HASH -> SVN) + enroll the precomputed 48-byte signer anchor and CoRIM: + cargo image --policy-v2 --policy \ + --signer-anchor --servtd-corim +``` + +The legacy `{policyData, signature}` wrapper and `policy_v2_signed.json` +filenames remain accepted, but the **outer policy signature is ignored**. +PolicyData integrity comes from RTMR2. Authenticity of the re-issuable servTD +endorsement comes from either the inner JSON signatures or the CoRIM +`COSE_Sign1`, whose signer chain must resolve to the RTMR1 anchor. + +At boot, MigTD: + +1. Resolves the signer anchor + `A = SHA384(tag || H(rootDER) || leafEkuOidDER)` from a PEM chain or the + direct anchor slot and extends `SHA384(A)` into RTMR1. +2. Extends canonical `policyData` into RTMR2 after redacting the JSON TCB + mapping, its issuer chain, and optional TD Identity + issuer chain. A + CoRIM-only policy has no `servtdCollateral` and is measured as-is. +3. Verifies JSON/CoRIM signatures and binds their signer root+EKU to `A`. + +## Updating mappings and rotating signer leaves + +- `svnMappings[].tdMeasurements.tdinfo_hash` and CoRIM digest selectors use + the complete 48-byte `SERVTD_INFO_HASH`, not individual MRTD/RTMR fields. +- A deployable mapping must cover both current MigTD releases and any initial + MigTD hashes that can appear in target-TD `SERVTD_EXT` state. During + migration/rebinding, the verifier uses the authenticated source's mapping + to resolve both `init_servtd_info_hash` and the source's current report + hash, then requires `init SVN <= current SVN`. +- That comparison is against the **source peer's verified mapping**, not the + destination's local mapping. This preserves reverse migration because an + older destination does not need to predict future source releases. +- Re-issuing a JSON mapping, CoRIM, or optional TD Identity is measurement + neutral because those bytes are outside RTMR2. +- Rotating leaf or intermediate keys is measurement neutral only when the root + and signer-anchor EKU are unchanged; the new chain must still validate + and pass signer revocation checks. +- When a CoRIM is enrolled it is the sole TCB lookup authority. Do not expect + JSON fallback on a CoRIM miss. +- After enrollment, recompute the image hash with `migtd-hash` and require it + to equal the pre-enrollment value. A mismatch means measured policy content, + root, or signer EKU changed. + +## Implementation status + +The runtime enforces the completed design in both migration and rebinding: +it resolves `ServtdExt.init_servtd_info_hash` and the authenticated source's +current report hash through the source's verified mapping, fails closed on +either miss, and rejects `init SVN > current SVN`. The legacy wire +Init_TDINFO is ignored. + +## Gotcha + +Legacy scripts still use `config/templates/policy_v2_signed.json` and +`policy_issuer_chain.pem`. CoRIM-only builds instead need a policy without +`servtdCollateral`, the 48-byte anchor file, and the signed `.cose` mapping. +Do not mix the direct-anchor and PEM-chain inputs accidentally: the direct +anchor takes precedence when both CFV slots are populated. diff --git a/.agents/knowledge/release-process.md b/.agents/knowledge/release-process.md new file mode 100644 index 000000000..0c10e7b1b --- /dev/null +++ b/.agents/knowledge/release-process.md @@ -0,0 +1,41 @@ +--- +type: Playbook +title: Release Process +description: Version semantics, release content checklist, and release steps for cutting a MigTD release branch. +tags: [release, semver, branching] +timestamp: 2026-07-13T22:37:00+00:00 +--- + +# Release Process + +Canonical source: [doc/release.md](../../doc/release.md). + +## Versioning + +`v..` per [semver.org](https://semver.org/). + +## Release content checklist (per `v.` branch) + +- Release build image (no debug messages) + its `MigTD:TEE_INFO_HASH`. +- Debug build image (debug messages to virtual serial) + its + `MigTD:TEE_INFO_HASH`. +- Release notes: tested features, critical fixes/known issues, and the exact + configuration matrix (EMR SOC, IFWI/MCHECK, TDX-module, host + hypervisor/QEMU, guest OS/kernel/initrd, attestation library/DCAP version), + plus source/destination launch parameters. +- `Cargo.lock` (locks dependency versions — see + [reproducible-build.md](reproducible-build.md) for why this matters for MRTD + stability). + +## Steps + +1. Unit test on latest `main`. +2. Tag `v..-rc`. +3. Release test on the RC (validation engineer). +4. Fix issues found. +5. Create branch `v.`. +6. Upload release content to that branch. + +## Release test features + +Migration flow, attestation flow. diff --git a/.agents/knowledge/reproducible-build.md b/.agents/knowledge/reproducible-build.md new file mode 100644 index 000000000..1fe319235 --- /dev/null +++ b/.agents/knowledge/reproducible-build.md @@ -0,0 +1,46 @@ +--- +type: Reference +title: Reproducible Build — Status & Limitations +description: What's implemented for MigTD build reproducibility (container normalization, --remap-path-prefix), what's verified, and what's still limited — directly affects MRTD stability across rebuilds. +tags: [reproducible-build, mrtd, determinism] +timestamp: 2026-07-13T22:37:00+00:00 +--- + +# Reproducible Build — Status & Limitations + +Canonical source: [doc/reproducible_build.md](../../doc/reproducible_build.md). +Relevant whenever an MRTD mismatch across rebuilds is under investigation — +read [Domain Facts § Trust model](domain-facts.md) first for why MRTD +stability matters (root of trust). + +## Bottom line + +**With the pinned container, or with native `cargo image` (via `xtask`), the +build is already reproducible.** `xtask` applies `--remap-path-prefix` +(`xtask/src/build.rs`, `remap_rustflags`) for both `td-shim` and `migtd` +compiles, mapping project root → `/migtd`, `CARGO_HOME` → `/cargo`, +`RUSTUP_HOME` → `/rustup`. Verified: clean builds in two different paths +produced identical sha256 for both Linux TDVF and Azure IGVM outputs. + +## What's NOT covered by the fix + +- **Raw `cargo build` invocations outside `xtask`** (e.g. test scripts) still + embed real absolute paths. +- `td-shim-strip-info` is invoked **without `-s`** by `build_final.sh` → it's + a no-op for path stripping on the ELF binaries (its PE-specific + timestamp/PDB-GUID branches never apply — only `x86_64-unknown-uefi` + targets have those). Even with `-s`, ~19 embedded paths remain. +- Symbols are never stripped (`strip = "symbols"` intentionally disabled — + see `confidential-containers/td-shim#272`). +- No `SOURCE_DATE_EPOCH` (not currently needed — no observed timestamp + variance in these ELF builds). +- **No CI enforcement** — nothing in CI builds twice and diffs sha256. + +## If asked to "fix reproducibility" + +Check whether the reported non-determinism is from a **raw `cargo build`** +bypassing `xtask`, or from a genuinely new source of variance — the +path-embedding problem (the historically dominant cause, tracked in +[intel/MigTD#51](https://github.com/intel/MigTD/issues/51)) is already solved +for the documented `cargo image` build path. Don't re-propose the container +or `--remap-path-prefix` as if they were missing. diff --git a/.agents/knowledge/security-bypasses.md b/.agents/knowledge/security-bypasses.md new file mode 100644 index 000000000..42197e00f --- /dev/null +++ b/.agents/knowledge/security-bypasses.md @@ -0,0 +1,88 @@ +--- +type: Reference +title: MigTD Security Bypasses — Feature Comparison +description: Catalogue of verification checks bypassed under AzCVMEmu/test_mock_report/use-mock-quote build features, and why each is bypassed. +tags: [security, build-features, attestation, spdm, tls] +timestamp: 2026-07-26T00:14:16+00:00 +--- + +# MigTD Security Bypasses — Feature Comparison + +This document catalogues the verification checks bypassed under the +development/test build features, and explains **why** each is bypassed. + +> **None of these bypasses are acceptable in production.** They exist solely +> to enable development/testing on non-production environments. + +> Locations are given by function (line numbers drift). The init-TDINFO +> verification is bypassed in EMU/mock by a **`cfg` feature gate**, not by any +> SERVTD_EXT opt-out — integration2 always sends a populated `ServtdExt`. + +--- + +## Feature Semantics + +| Feature | Environment | TDX HW | `tdcall_report` | Quote (QGS/IMDS) | +|---------|-------------|:---:|:---:|:---:| +| `AzCVMEmu` | Desktop emulator (no TDX) | ✗ | Emulated (REPORTDATA not bound) | Emulated | +| `test_mock_report` | Emulated (implies AzCVMEmu) | ✗ | Emulated | Emulated | +| `use-mock-quote` | **Real TDX hardware** | ✓ | **Real** (REPORTDATA correctly bound) | Static mock data | + +- **`AzCVMEmu` / `test_mock_report`**: no hardware — `tdcall_report` is emulated + and does **not** embed caller-supplied REPORTDATA, so every REPORTDATA-derived + check must be bypassed. +- **`use-mock-quote`**: real TDX — `tdcall_report` binds REPORTDATA correctly, + so quote-derived migration checks are bypassed while TDREPORT-derived rebind + checks remain available. + +--- + +## SPDM Migration Path + +| # | Check | `AzCVMEmu` | `use-mock-quote` | Location | Reason | +|---|-------|:---:|:---:|------|--------| +| 1 | REPORTDATA TH1 binding — v1 | **Bypassed** | **Bypassed** | `spdm_rsp::rsp_verify_peer_attestation_v1`, `spdm_req` (requester) | Migration verifies REPORTDATA from quote supplemental data; mock quote is static | +| 2 | REPORTDATA TH1 binding — v2 | **Bypassed** | **Bypassed** | `spdm_rsp::rsp_verify_peer_attestation_v2`, `spdm_req` (requester) | Same — quote supplemental data is mocked | + +> Gate note: the v1 REPORTDATA check is additionally disabled under +> `test_disable_ra_and_accept_all`. + +--- + +## SPDM Rebinding Path (prepare-rebind) + +| # | Check | `AzCVMEmu` | `use-mock-quote` | Location | Reason | +|---|-------|:---:|:---:|------|--------| +| 5 | REPORTDATA TH1 binding (responder) | **Bypassed** | **Enforced** | `spdm_rsp` rebind handler (`#[cfg(not(any(AzCVMEmu, test_mock_report)))]`) | Rebind uses only `tdcall_report` (no quotes); real HW binds REPORTDATA correctly | +| 6 | REPORTDATA TH1 binding (requester) | **Bypassed** | **Enforced** | `spdm_req::...rebind...` (`#[cfg(not(any(AzCVMEmu, test_mock_report)))]`, `verify_tdreport_data_binding`) | Same | + +--- + +## TLS Path (non-SPDM) + +| # | Check | `AzCVMEmu` | `use-mock-quote` | Location | Reason | +|---|-------|:---:|:---:|------|--------| +| 8 | Public-key hash in REPORTDATA (cert verification) | **Bypassed** | **Bypassed** | `ratls/server_client.rs` cert-verify callbacks (`cfg!(AzCVMEmu)` / `cfg!(use-mock-quote)`) | EMU: REPORTDATA not bound. Mock-quote: cert path uses quote-derived data which is mocked | + +--- + +## What Remains Enforced + +### Under `AzCVMEmu` +- Full SPDM / TLS handshake (key exchange, cipher negotiation) +- RTMR2 policyData integrity and event-log replay +- Inner JSON mapping/identity signatures or signed-CoRIM verification, with + every signer bound to the RTMR1 root+EKU anchor +- Init/current SVN ordering through the authenticated source's verified + mapping; both mapping misses fail closed +- Policy evaluation (`evaluate_policy_common` / `evaluate_policy_backward`) +- **SERVTD_ATTR check** (`verify_servtd_attr`: `cur_servtd_attr == 0x0`) +- Rebind token creation/exchange and `tdcall_servtd_rebind_approve` (emulated) + +### Under `use-mock-quote` (real HW) +All of the above, **plus**: +- **Rebind REPORTDATA TH1 binding** (real `tdcall_report`) + +`use-mock-quote` bypasses quote-derived migration REPORTDATA checks. It does +not bypass mapped init/current SVN ordering. There is no destination-local +Init_TDINFO allowlist in the one-hash design. diff --git a/.agents/knowledge/verification-and-checklist.md b/.agents/knowledge/verification-and-checklist.md new file mode 100644 index 000000000..fc2099821 --- /dev/null +++ b/.agents/knowledge/verification-and-checklist.md @@ -0,0 +1,94 @@ +--- +type: Playbook +title: Setup, Verification Gauntlet & Pre-done Checklist +description: Mandatory post-checkout setup, the four-CI-workflow verification gauntlet, common EMU invocations, and the pre-done checklist. +tags: [ci, verification, emu, setup, checklist] +timestamp: 2026-07-10T19:26:55+00:00 +--- + +# Setup, Verification Gauntlet & Pre-done Checklist + +> Condensed in the root [agent guide](../../AGENTS.md). + +## Mandatory setup after fresh checkout / submodule update / `git clean` + +```bash +bash sh_script/preparation.sh +``` + +This applies the `spdm-rs` patches to the ring source selected by MigTD's +workspace override, `deps/td-shim/library/ring` +(`EphemeralPrivateKey::export_private_key_bytes`/`from_private_key_bytes` and +`digest::Context::to_bytes`/`from_bytes`). See +[`doc/dependency_preparation.md`](../../doc/dependency_preparation.md) for why +spdm-rs's own ring copy is not selected. **Skipping preparation produces build +errors that look like a real baseline regression but aren't.** CI runs it +automatically; **locally you must run it manually** after: + +- a fresh clone, +- `git clean -fdx`, +- any `git submodule update`, +- switching to a branch with different submodule SHAs. + +## Verification — all four CI workflows MUST pass, no exceptions + +The project standard is that **every test in every workflow passes** before a +change is considered done. Use the gauntlet script as the standard pre-push +verification: + +```bash +.agents/skills/migtd-review/scripts/run-ci-gauntlet.sh +.agents/skills/migtd-review/scripts/run-ci-gauntlet.sh --list +.agents/skills/migtd-review/scripts/run-ci-gauntlet.sh --from main # resume +.agents/skills/migtd-review/scripts/run-ci-gauntlet.sh --only emu # one stage +``` + +Stages mirror the four workflows: **format → deny → main → emu** (after +`prep`). The script stops at the first failure. **Fix the root cause; don't +skip ahead.** + +`cargo test` alone is **not sufficient** for changes to: + +- `event_log` / RTMR replay +- policy parsing / verification (`policy/src/v2/`, `mig_policy.rs`) +- migration session / handshake / rebind paths +- SPDM transport (`src/spdm/`) +- crypto / cert / PEM parsing (`src/crypto/`) +- any vmcall transport + +For those, **always** run the EMU integration tests (full or a relevant +subset via `./migtdemu.sh`). + +### Common single-scenario EMU invocations + +```bash +./migtdemu.sh --skip-ra --both --no-sudo --log-level info +./migtdemu.sh --features spdm_attestation --skip-ra --both --no-sudo --log-level info +./migtdemu.sh --operation rebind-prepare \ + --policy-file ./config/AzCVMEmu/policy_v2_signed.json \ + --policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem \ + --skip-ra --both --no-sudo --log-level info +./sh_script/build_AzCVMEmu_policy_and_test.sh --mock-report # full matrix +``` + +**Do not run multiple `migtdemu.sh` invocations concurrently** — it hardcodes +TCP port 8001, pins to `taskset -c 0`, and writes a shared `target/release/migtd` +artefact. + +See [AzCVMEmu build & run](azcvmemu-build-and-run.md) for feature-flag details +and [integration testing](integration-testing.md) for the QEMU/vsock and Azure +TiP test layers. + +## Quick checklist before "I'm done" + +1. `bash sh_script/preparation.sh` ran since last submodule change? +2. `cargo fmt --check` clean (only your touched files)? +3. `cargo clippy ... -- -D warnings` clean on in-scope features? +4. `cargo test` clean for crates you touched? +5. EMU tests run for boundary-code changes (event_log, policy, crypto, spdm, + vmcall)? +6. All four CI workflows pass via `run-ci-gauntlet.sh`? +7. Every committable change is `-s` signed-off (excluding debug / `REVERTME`)? +8. Commit messages brief and accurate (problem + high-level solution)? +9. No unrelated changes piled into one commit? +10. Pushed only to a personal fork remote (`--force-with-lease` if rewriting)? diff --git a/.agents/skills/migtd-port/SKILL.md b/.agents/skills/migtd-port/SKILL.md new file mode 100644 index 000000000..b6461f47a --- /dev/null +++ b/.agents/skills/migtd-port/SKILL.md @@ -0,0 +1,209 @@ +--- +name: migtd-port +description: Port the Microsoft `integration` branch onto an intel/main-based branch in the MigTD repo by cherry-picking (or rebasing) only the not-yet-upstreamed commits, then validating each pick with cargo fmt + the AzCVMEmu integration tests. Use when asked to "port integration to intel/main", "cherry-pick the integration branch", "rebase integration onto intel/main", "bring integration changes to integration2", or to forward-port Microsoft MigTD changes upstream. +--- + +# MigTD Port (integration → intel/main) + +Workflow + reusable scripts for moving the **remaining** Microsoft-fork changes from +the `integration` branch onto a branch based on `intel/main` (e.g. `integration2`, +or a fresh upstream PR branch). The hard part is **not** the mechanical cherry-pick — +it is figuring out which commits are *genuinely missing* versus already upstreamed in +reworded/squashed form, and never reverting the target branch's own improvements. + +Pairs with the **migtd-review** skill (trust model, build features, full CI gauntlet). +Read that skill's §1 before reasoning about any behavioural conflict you resolve here. + +--- + +## 1. The core problem (read FIRST) + +- The **majority of `integration`'s work has already been upstreamed** to `intel/main` + in *reworded and/or squashed* form. A naive `git cherry-pick base..integration` + re-applies dozens of already-present commits and conflicts on ~80% of them. +- `git cherry` (patch-id) **under-detects** duplicates: upstreaming refines the patch, + so the patch-id differs even though the change is present. `git cherry` only catches + byte-identical cherry-picks (`-`). +- **Commit-message similarity is the reliable "already there" signal.** Subjects survive + upstreaming mostly intact (often just gaining a `type(scope):` prefix). Matching each + `integration` subject against the target branch's subjects finds the reworded dupes. +- Therefore: **detect → human-review → pick only the residue → verify each pick.** + Never blind-pick. The end state must converge toward the `integration` *tip behaviour*, + but must **keep** the target branch's CI/dependency improvements and any fix the target + already carries in a better form. + +### Topology & remotes + +``` +intel https://github.com/intel/MigTD.git # upstream target base (intel/main) +origin https://github.com//MigTD.git # personal fork; carries origin/integration +upstream https://github.com/microsoft/MigTD.git # Microsoft fork (integration originates here) +``` + +- `integration` = Microsoft-fork dev branch (downstream of `intel/main` + lots of extra work). +- Target = an `intel/main`-based branch you are forward-porting onto. +- `merge-base integration ` is the common ancestor; everything after it on + `integration` is a *candidate*, everything after it on the target is the + *already-upstreamed corpus* you match against. + +--- + +## 2. Always-skip categories + +These are decided up front (the user's standing rules for this port). Mark them skip +without per-commit debate: + +| Category | Rule | +|---|---| +| **CI workflow SHA / action bumps** | The target (intel/main) owns its CI. Do **not** port `integration`'s CI bumps. Keep the target's. | +| **Dependency *downgrades*** | Never move a dep backwards. If `integration` pins an older version than the target, keep the target's newer pin. | +| **`sh_script/fuzzing.sh`** | Skip — target keeps its own. | +| **Anything the target lacks a commit for** | If `integration` has no commit introducing a change (it's just an older state), that's not a change to port — keep the target's version. | +| **Commits with a high subject-similarity match on target** | Already upstreamed. Verify the diff is equivalent, then skip. | + +Everything else is a **CANDIDATE** → review its actual diff → keep or skip with a reason. + +--- + +## 3. The workflow + +``` +0. preparation bash sh_script/preparation.sh # once per fresh checkout / submodule update +1. safety tag git tag -backup-before-port # so you can always get back +2. detect scripts/find-port-candidates.sh ... # table of keep/skip suggestions +3. triage record decisions in the `picks` session table (see §5) +4. pick loop per CANDIDATE: git cherry-pick -> resolve -> scripts/port-verify.sh +5. milestone scripts/emu-milestone.sh # after each batch / after a squash/drop +6. full CI parity migtd-review run-ci-gauntlet.sh # before pushing (all 4 workflows) +7. push --force-with-lease to a PERSONAL fork only; never a shared branch +``` + +### Step 2 — detect + +```bash +.agents/skills/migtd-port/scripts/find-port-candidates.sh \ + --source origin/integration --target --base +``` + +Prints a numbered table; each row is tagged: +- `SKIP-patchid` — identical patch already on target (`git cherry` `-`). Safe skip. +- `SKIP-similar` — subject ≥ threshold% similar to a target commit → reworded duplicate. + **Verify the diff, then skip.** +- `CANDIDATE` — no good match → likely genuinely missing. **Review the diff and decide.** + +Add `--sql` to emit `INSERT INTO picks(...)` seed rows for the session DB, and `--full` +to see untruncated subjects. The suggestion is a *starting point* — you still read diffs. + +### Step 4 — the per-pick gate (MANDATORY after every pick) + +After each `git cherry-pick` and conflict resolution: + +```bash +.agents/skills/migtd-port/scripts/port-verify.sh +``` + +It runs, fastest-first, stopping at the first failure: +1. `cargo fmt` (apply — picks frequently need reformatting; commit the reformat) +2. `cargo fmt --check` +3. `cargo xtask lib-test --crates migtd` (migtd unit tests + feature matrix) +4. `fast-emu-check.sh` (skip-RA + SPDM skip-RA emulation smoke) + +Use `--no-emu` only for doc-only / non-boundary picks. Fix failures **before** the next +pick — do not pile commits on top of a broken one (use `git rebase -i` to fold/drop). + +--- + +## 4. Verification ladder + +Three tiers, cheap → expensive. Do **not** skip straight to push. + +| Tier | Script | Scope | When | +|---|---|---|---| +| fast | `scripts/fast-emu-check.sh` | 2 emu scenarios (skip-RA, SPDM skip-RA) | after **every** pick (via `port-verify.sh`) | +| milestone | `scripts/emu-milestone.sh` | 8 curated emu scenarios | after a batch of picks / after a drop or squash | +| full CI | `.agents/skills/migtd-review/scripts/run-ci-gauntlet.sh` | all 14 emu + 32 `cargo image` + format + deny | before pushing | + +For just the full emu matrix or just the firmware builds: +```bash +.agents/skills/migtd-review/scripts/run-ci-gauntlet.sh --only emu +.agents/skills/migtd-review/scripts/run-ci-gauntlet.sh --only main +``` + +Why a fast gate per-pick and not the full 14 every time: the full emu matrix is ~20–40 +min; the 2-scenario gate is a couple of minutes and catches the overwhelming majority of +broken picks (build break, fmt, obvious logic regressions). The milestone (8) and full +(14) tiers catch policy-v2 / rebind / key-rotation specific regressions. + +> **migtdemu.sh is not parallel-safe** (hardcoded port 8001, `taskset -c 0`, fixed log +> names, shared `target/release/migtd`). Run emu scenarios **sequentially**. The scripts +> here already do. + +--- + +## 5. Tracking decisions — the `picks` session table + +Use the per-session SQLite DB (not a markdown file) to track every candidate. Schema used +in the worked example (`seq, hash, subject, status, note, pick_order`): + +```sql +-- statuses: 'pick' | 'done' | 'skip-similar' | 'skip-user' | 'skip-coupled' +UPDATE picks SET status='done', pick_order= WHERE seq=; -- after a successful pick +SELECT seq, hash, subject FROM picks WHERE status='pick' ORDER BY seq; -- remaining work +``` + +Seed it from `find-port-candidates.sh --sql`, then correct statuses as you review diffs. +This survives context summarisation and lets you resume mid-port. + +--- + +## 6. Conflict-resolution patterns & gotchas (learned) + +- **Prefer the target's structure.** When a pick conflicts because the target refactored a + function signature or moved code, re-express the *intent* of the `integration` commit on + top of the target's structure — do not drag the old structure back. +- **Gate on what the target gates on.** Example from the integration2 port: init-TDINFO / + servtd code is gated on `policy_v2` on the target, not `all(vmcall-raw, policy_v2)`. + Keep the target's gate. +- **Split partial picks.** A single `integration` commit often bundles a keeper + a part + that's already upstreamed or out-of-scope. Cherry-pick with `-n`, then `git reset`/`git + checkout -p` to stage only the keeper hunks. Note the split in the `picks.note`. +- **Combine related picks** when several `integration` commits implement one logical change + (e.g. all "truncate long logs" tweaks) — fold them into one commit. Ask the user before + combining if it's non-obvious. +- **Watch `git rerere`.** It can replay a *wrong* prior resolution (seen: a duplicate + `igvm-attest` key injected into `Cargo.toml`). If a resolution looks off, `git + checkout --conflict=merge ` and redo by hand; disable rerere before a big rebase if + it has a bad cached resolution. +- **Dropping an obsolete commit** mid-stack: `git rebase --onto ~1 `. + Re-run the milestone tier afterward — a "clean" drop can still change behaviour. +- **Feature-build footguns**: migtd default feature is `virtio-vsock` (no `vmcall-raw`); lib + tests with the `main` feature need `--lib` (bin `main` symbol clash, E0428); SPDM builds + need `export SPDM_CONFIG="$(pwd)/config/spdm_config.json"` (the scripts set this). For the + broader feature-gating map (which crates compile under which feature), see migtd-review + `references/build-features.md`. + +--- + +## 7. Commit message conventions + +- Brief, precise, conventional-commit style subject (`type(scope): summary`). +- Add a **`Signed-off-by:`** trailer (DCO — upstream PRs require it). `git commit -s`. +- For AI-assisted work, add **`Co-developed-by:`** for the AI contribution (user preference). +- Cherry-picks: keep `git cherry-pick -x` (adds `(cherry picked from commit …)`) when the + provenance is useful for an upstream PR; drop it when squashing/reworking. +- Keep PR branches single-purpose (one logical change per upstream PR), e.g. `hash_fix`, + `spdm-rebind-error-propagation` — cherry-pick the relevant commit(s) onto a fresh + `intel/main`-based branch rather than pushing the whole port. + +--- + +## 8. References + +- `references/port-playbook.md` — durable heuristics + the worked integration→integration2 + example (categories, counts, the specific keep/skip decisions and why). +- `scripts/find-port-candidates.sh` — keep/skip detection (patch-id + subject similarity). +- `scripts/port-verify.sh` — the after-every-pick gate (fmt + lib-test + fast emu). +- `scripts/fast-emu-check.sh` — 2-scenario emu smoke. +- `scripts/emu-milestone.sh` — 8-scenario emu checkpoint. +- migtd-review skill — trust model (§1), build features, and `run-ci-gauntlet.sh` for full + CI parity (format + deny + 32 image builds + 14 emu). diff --git a/.agents/skills/migtd-port/references/port-playbook.md b/.agents/skills/migtd-port/references/port-playbook.md new file mode 100644 index 000000000..33a6d7fc5 --- /dev/null +++ b/.agents/skills/migtd-port/references/port-playbook.md @@ -0,0 +1,114 @@ +--- +type: Playbook +title: MigTD Port Playbook — integration → intel/main +description: Durable heuristics and worked example for forward-porting Microsoft-fork MigTD changes onto an intel/main-based branch. +tags: [port, cherry-pick, integration, intel-main] +timestamp: 2026-07-10T19:26:55+00:00 +--- + +# Port playbook — durable heuristics + worked example + +Companion to `SKILL.md`. The first half is reusable for **any** `integration → intel/main` +port; the second half is the **worked integration → integration2 port (June 2026)** kept as +a concrete reference for the kinds of decisions that recur. + +--- + +## Part A — durable heuristics + +### Deciding keep vs skip for a CANDIDATE + +For each commit the detector tags `CANDIDATE` (no strong subject match on target), read the +**actual diff** and ask, in order: + +1. **Is the change already present in different form?** `git show ` then grep the target + tree for the introduced symbol/string. Subjects diverge more than code — the detector can + miss a dupe whose subject was heavily reworded. If present and equivalent → skip-similar. +2. **Is it an always-skip category?** (CI bump, dep downgrade, `fuzzing.sh`, target-only file.) → skip. +3. **Does it depend on a commit you're skipping?** If so it's `skip-coupled` unless you also + port the dependency. Re-express on the target's structure if the keeper part is wanted. +4. **Was it reverted later on `integration`?** Check `git log --oneline ..integration -- + ` for a revert/supersede. If the net effect at `integration` tip is gone → skip. + (Watch for `REVERT_ME:`-tagged temporary commits still live at the tip — keep only the + surviving parts.) +5. **Otherwise → keep.** Cherry-pick, resolve onto the target's structure, verify. + +### Detection method ranking (most → least reliable here) + +1. **Subject similarity** vs the target's post-base subjects (`find-port-candidates.sh`). Best + single signal because subjects survive upstreaming. +2. **`git cherry` patch-id** (`-`). Only catches byte-identical picks, but those are *certain*. +3. **Per-commit 3-way / `git merge-tree`** — unreliable when the branches diverged + structurally (lots of false "conflicts"). Use only to sanity-check a specific pick. + +### Convergence invariant + +After the port, the target's **behaviour** should match `integration`'s tip for the ported +areas, while **keeping** the target's CI/dependency posture and any fix it already carries in +a better form. When in doubt, diff the specific module against `integration` tip and reconcile +deliberately — do not assume "more commits = closer". + +--- + +## Part B — worked example: integration → integration2 (June 2026) + +- **Topology:** merge-base `7829a8f9`. `integration2` = base + 86 (intel/main upstreamed work + + CI/dep bumps). `integration` = base + 148. Baseline for the scan: `88f4ae7e`. +- **Candidate scan** (`88f4ae7e..integration`, 93 rows): triaged to + **28 picked · 26 skip-similar · 9 skip-user · 1 skip-coupled** (the historical 64-row count + was a tighter base window; the 93-row scan from `88f4ae7e` is what the current script prints). +- The tree was later **rebased/squashed** by the user, so the final commit count on + `integration2` differs from "28 picks". Treat the numbers as illustrative of the *triage*, + not the final history. + +### Notable keep decisions + +- **policy_v2 gating** (user-confirmed): gate init_td_info / servtd_ext code on `policy_v2`, + **not** `all(vmcall-raw, policy_v2)` (the latter came from a skipped commit). Keep the + target's `policy_v2` gate. +- **Truncating long logs**: several `integration` commits combined into one logical pick. +- **REVERT_ME #40/#42**: kept only the surviving parts (logging threshold doubling + 256/128/32; use-mock-quote allowlist gating); dropped the superseded soft-fails. +- **Partial pick of the REPORTDATA-bypass commit**: applied the bypass + script; dropped the + unrelated ratls/mrowner and ServtdExt-optional hunks (pre-scope / out-of-scope). + +### Notable skip decisions + +- **SERVTD_EXT opt-out feature** (`f408a0c25`, `90f97e2bf`, `f9d966e18`, `0f4c2fd86`): + **skipped by user constraint — assume SERVTD_EXT is always opt-in.** `read_servtd_ext()` + returns `ServtdExt` (not `Option`). The opt-out series was entangled with a pre-scope + refactor adding `init_policy_hash` to `client_rebinding` (5-arg vs target's 4-arg) and a + `setup_evaluation_data_with_tdinfo` that doesn't exist on the target. +- **`fix(clippy): silence derivable_impls`** (`9912691ba`): `skip-coupled` — only needed + because of the skipped init_td_info re-gating; the target doesn't have the offending impl. +- **User-requested skips**: UB-in-FFI-return-type fix, `unify init_td_info handling`, peak-heap + logging, post-rebase fmt/cleanup, `enable jq for rebind-skip-ra` CI tweak. +- **Obsolete after squash** (`51efdbb1`, "port PR #825 cfg structure"): its `main.rs` import + became net-zero and its `mig_policy` gating referenced `rebinding::InitData`, which the + function no longer uses (signature changed to `&[u8; TD_INFO_SIZE]`). Dropped via + `git rebase --onto 51efdbb1~1 51efdbb1`; re-verified clean (lib-test all configs, emu 8/8). + +### Migration / rebinding facts confirmed during the port (target = integration2) + +- `verify_servtd_info_hash` computes a **direct** `SHA384(masked_tdinfo)` (not the old + composite `init_servtd_info_hash`). `verify_init_tdinfo` wraps it. +- Migration-dest `authenticate_migration_source_with_init_tdinfo` verifies init-TDINFO + integrity + allowlist, gated `#[cfg(not(any(AzCVMEmu, test_mock_report, use-mock-quote)))]` + (real-HW only). Both migration and rebinding use `get_local_tcb_evaluation_info()` (local + TCB) as the policy reference — neither uses init as a relative reference. +- `verify_servtd_attr` only checks `cur == EXPECTED_SERVTD_ATTR` (0x0); the `cur == init_attr` + check was removed. +- `finalize_spdm_session` preserves `decode_spdm_session_err` error mapping. + +### Validation commands used + +```bash +cargo xtask lib-test --crates migtd # migtd unit tests + targeted feature matrix +.agents/skills/migtd-port/scripts/fast-emu-check.sh # per-pick smoke (skip-ra + spdm skip-ra) +.agents/skills/migtd-port/scripts/emu-milestone.sh # 8-scenario checkpoint +.agents/skills/migtd-review/scripts/run-ci-gauntlet.sh # full CI parity before push +export SPDM_CONFIG="$(pwd)/config/spdm_config.json" # required for any spdm build +``` + +Safety tags created (pattern to repeat): `integration2-backup-before-cherrypick`, +`integration2-before-drop-51efdbb1`. diff --git a/.agents/skills/migtd-port/scripts/emu-milestone.sh b/.agents/skills/migtd-port/scripts/emu-milestone.sh new file mode 100755 index 000000000..c734c6138 --- /dev/null +++ b/.agents/skills/migtd-port/scripts/emu-milestone.sh @@ -0,0 +1,62 @@ +#!/usr/bin/env bash +# +# emu-milestone.sh — a curated 8-scenario AzCVMEmu checkpoint. Broader than +# fast-emu-check.sh (which runs 2), cheaper than the full 14-scenario gauntlet +# emu stage. Run this at logical milestones (e.g. after a batch of picks, or +# after dropping/squashing a commit) before the final full-matrix run. +# +# Covers: skip-ra, policy-v2 (mock), policy-v2 + igvm, rebind (mock), and the +# SPDM variants + a key-rotation scenario — the cross-section that has +# historically caught regressions in this port work. +# +# For TRUE CI parity (all 14 emu scenarios + the 32 `cargo image` builds + +# format + deny) use the migtd-review gauntlet: +# .agents/skills/migtd-review/scripts/run-ci-gauntlet.sh --only emu +# .agents/skills/migtd-review/scripts/run-ci-gauntlet.sh --only main +# +# Exit 0 only if every scenario passes. +# +# Usage: ./emu-milestone.sh +set -u + +REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)" +cd "$REPO_ROOT" +export SPDM_CONFIG="$REPO_ROOT/config/spdm_config.json" + +LOG_DIR="$REPO_ROOT/target/port-milestone" +mkdir -p "$LOG_DIR" +PASS=0; FAIL=0; FAILED="" + +P="./config/AzCVMEmu/policy_v2_signed.json" +C="./config/AzCVMEmu/policy_issuer_chain.pem" +PA="./config/AzCVMEmu/policy_v2_signed_a.json"; CA="./config/AzCVMEmu/policy_issuer_chain_a.pem" +PB="./config/AzCVMEmu/policy_v2_signed_b.json"; CB="./config/AzCVMEmu/policy_issuer_chain_b.pem" + +run() { # name timeout cmd... + local name="$1"; shift + local to="$1"; shift + local log="$LOG_DIR/${name}.log" + echo ""; echo "########## $name ##########" + timeout "$to" "$@" > "$log" 2>&1 + local rc=$? + if [ $rc -eq 0 ] && grep -q "SUCCESS" "$log"; then + echo "PASS: $name"; PASS=$((PASS+1)) + else + echo "FAIL: $name (rc=$rc) -> $log"; FAIL=$((FAIL+1)); FAILED="$FAILED $name" + echo "--- last 15 lines ---"; tail -15 "$log" + fi +} + +run skip-ra 300 ./migtdemu.sh --skip-ra --both --no-sudo --log-level info +run policy-v2 900 ./migtdemu.sh --policy-v2 --policy-file "$P" --policy-issuer-chain-file "$C" --mock-report --both --no-sudo --log-level info +run policy-v2-igvm 900 ./migtdemu.sh --policy-v2 --policy-file "$P" --policy-issuer-chain-file "$C" --mock-report --features igvm-attest --both --no-sudo --log-level info +run rebind-mock 900 ./migtdemu.sh --operation rebind-prepare --policy-file "$P" --policy-issuer-chain-file "$C" --mock-report --both --no-sudo --log-level info +run spdm-skip-ra 300 ./migtdemu.sh --skip-ra --features spdm_attestation --both --no-sudo --log-level info +run spdm-policy-v2 900 ./migtdemu.sh --policy-v2 --policy-file "$P" --policy-issuer-chain-file "$C" --mock-report --features spdm_attestation --both --no-sudo --log-level info +run spdm-rebind-skip-ra 300 ./migtdemu.sh --operation rebind-prepare --policy-file "$P" --policy-issuer-chain-file "$C" --skip-ra --features spdm_attestation --both --no-sudo --log-level info +run policy-v2-key-rotation 900 ./migtdemu.sh --policy-v2 --src-policy-file "$PA" --src-policy-issuer-chain-file "$CA" --dst-policy-file "$PB" --dst-policy-issuer-chain-file "$CB" --mock-report --both --no-sudo --log-level info + +echo ""; echo "================ MILESTONE SUMMARY ================" +echo "PASS=$PASS FAIL=$FAIL" +[ -n "$FAILED" ] && { echo "FAILED:$FAILED"; exit 1; } +exit 0 diff --git a/.agents/skills/migtd-port/scripts/fast-emu-check.sh b/.agents/skills/migtd-port/scripts/fast-emu-check.sh new file mode 100755 index 000000000..739d354a6 --- /dev/null +++ b/.agents/skills/migtd-port/scripts/fast-emu-check.sh @@ -0,0 +1,59 @@ +#!/usr/bin/env bash +# +# fast-emu-check.sh — the quick per-commit emulation gate used during a +# cherry-pick / rebase loop. Builds and runs the two fastest AzCVMEmu scenarios +# (skip-RA and SPDM skip-RA). This is NOT full CI parity; it is the cheap +# smoke test you run after EACH pick before moving on. Run the milestone matrix +# (emu-milestone.sh) at checkpoints and the full gauntlet (see SKILL.md) before +# pushing. +# +# Built in the dev profile (not --release): intel/main fences the insecure test +# features test_disable_ra_and_accept_all / use-mock-quote out of release builds +# via compile_error! (src/migtd/src/lib.rs), so the emu smoke must use --debug. +# +# Exit 0 only if BOTH scenarios print SUCCESS and return rc 0; otherwise 1. +# +# Usage: ./fast-emu-check.sh +set -u +set -o pipefail + +REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)" +cd "$REPO_ROOT" +export SPDM_CONFIG="$REPO_ROOT/config/spdm_config.json" + +LOG_DIR="$REPO_ROOT/target/port-fast" +mkdir -p "$LOG_DIR" +RC=0 + +run() { # name timeout cmd... + local name="$1"; shift + local to="$1"; shift + local log="$LOG_DIR/${name}.log" + echo "=== $name ===" + set +e + timeout "$to" "$@" > "$log" 2>&1 + local rc=$? + set -e + if [ $rc -eq 0 ] && grep -q "SUCCESS" "$log"; then + echo " PASS ($name)" + else + echo " FAIL ($name) rc=$rc -> $log" + echo " --- last 20 lines ---" + tail -20 "$log" | sed 's/^/ /' + RC=1 + fi +} + +echo "[1/2] build skip-ra" +cargo build --no-default-features \ + --features "AzCVMEmu,test_disable_ra_and_accept_all" 2>&1 | tail -2 +run skip-ra 180 ./migtdemu.sh --skip-ra --both --no-sudo --log-level info --debug + +echo "[2/2] build spdm skip-ra" +cargo build --no-default-features \ + --features "AzCVMEmu,test_disable_ra_and_accept_all,spdm_attestation" 2>&1 | tail -2 +run spdm-skip-ra 180 ./migtdemu.sh --skip-ra --features spdm_attestation --both --no-sudo --log-level info --debug + +echo +if [ $RC -eq 0 ]; then echo "fast-emu-check: PASS"; else echo "fast-emu-check: FAIL"; fi +exit $RC diff --git a/.agents/skills/migtd-port/scripts/find-port-candidates.sh b/.agents/skills/migtd-port/scripts/find-port-candidates.sh new file mode 100755 index 000000000..3a7ca391c --- /dev/null +++ b/.agents/skills/migtd-port/scripts/find-port-candidates.sh @@ -0,0 +1,160 @@ +#!/usr/bin/env bash +# +# find-port-candidates.sh — list commits that live on the Microsoft `integration` +# branch but are NOT yet on an intel/main-based target branch, and flag the ones +# that look already-upstreamed so you can skip them. +# +# Why this exists: the majority of `integration` work has already been upstreamed +# to intel/main (in reworded / squashed form), so a naive `git cherry-pick +# base..integration` re-applies dozens of commits that are already present. Patch-id +# (`git cherry`) under-detects because upstreaming refines the patch; commit-message +# similarity is the reliable "already there" signal. This script combines both: +# - git cherry patch-id membership (- = identical patch already on target) +# - subject-similarity vs every target subject (high % = reworded duplicate) +# +# Output is a human-reviewable table. YOU still decide keep/skip per row — treat +# CANDIDATE as "look closer", not "blindly pick". +# +# Usage: +# ./find-port-candidates.sh [--source REF] [--target REF] [--base REF] +# [--threshold N] [--full] [--sql] +# +# --source REF branch carrying the changes (default: origin/integration) +# --target REF intel/main-based branch to port onto (default: current branch) +# --base REF only consider commits after this (default: merge-base src/tgt) +# --threshold N similarity %% at/above which a row is tagged LIKELY-UPSTREAMED +# (default: 55) +# --full do not truncate subjects +# --sql also emit `INSERT INTO picks ...` lines for the session DB +# +# Exit: 0 always (this is a reporting tool). +set -u +set -o pipefail + +SOURCE="origin/integration" +TARGET="$(git rev-parse --abbrev-ref HEAD 2>/dev/null)" +BASE="" +THRESHOLD=55 +FULL=0 +EMIT_SQL=0 + +while [ $# -gt 0 ]; do + case "$1" in + --source) SOURCE="$2"; shift 2 ;; + --target) TARGET="$2"; shift 2 ;; + --base) BASE="$2"; shift 2 ;; + --threshold) THRESHOLD="$2"; shift 2 ;; + --full) FULL=1; shift ;; + --sql) EMIT_SQL=1; shift ;; + -h|--help) sed -n '2,40p' "$0"; exit 0 ;; + *) echo "unknown arg: $1" >&2; exit 2 ;; + esac +done + +git rev-parse --verify "$SOURCE^{commit}" >/dev/null 2>&1 || { echo "bad --source: $SOURCE" >&2; exit 2; } +git rev-parse --verify "$TARGET^{commit}" >/dev/null 2>&1 || { echo "bad --target: $TARGET" >&2; exit 2; } +[ -z "$BASE" ] && BASE="$(git merge-base "$SOURCE" "$TARGET")" +git rev-parse --verify "$BASE^{commit}" >/dev/null 2>&1 || { echo "bad --base: $BASE" >&2; exit 2; } + +echo "source : $SOURCE ($(git rev-parse --short "$SOURCE"))" +echo "target : $TARGET ($(git rev-parse --short "$TARGET"))" +echo "base : $BASE ($(git rev-parse --short "$BASE"))" +echo "thresh : ${THRESHOLD}% subject similarity" +echo + +# Candidate commits = base..source, with patch-id membership vs target. +# git cherry => examines .., +# prefixing '-' if an equivalent patch is already in , else '+'. +SRC_TSV="$(mktemp)"; TGT_TSV="$(mktemp)" +trap 'rm -f "$SRC_TSV" "$TGT_TSV"' EXIT + +git cherry "$TARGET" "$SOURCE" "$BASE" | while read -r flag sha; do + printf '%s\t%s\t%s\n' "$flag" "$sha" "$(git show -s --format=%s "$sha")" +done > "$SRC_TSV" + +# Target subjects (the already-upstreamed corpus to match against). +git log --format='%H%x09%s' "$BASE..$TARGET" > "$TGT_TSV" + +THRESHOLD="$THRESHOLD" FULL="$FULL" EMIT_SQL="$EMIT_SQL" \ +python3 - "$SRC_TSV" "$TGT_TSV" <<'PY' +import os, re, sys + +thr = int(os.environ["THRESHOLD"]) +full = os.environ["FULL"] == "1" +emsql = os.environ["EMIT_SQL"] == "1" +src_f, tgt_f = sys.argv[1], sys.argv[2] + +PREFIX = re.compile(r'^[a-z]+(\([^)]*\))?!?:\s*') # strip conventional-commit type(scope): +STOP = set("""a an the to of for in on with and or not is are be add adds added +adding update updates updated use uses using fix fixes fixed feat feature refactor +chore docs test tests style ci build perf migtd support instead into via from this +that when then return returns make makes only also new""".split()) + +def toks(subj): + s = PREFIX.sub('', subj.strip().lower()) + s = re.sub(r'[^a-z0-9]+', ' ', s) + return {w for w in s.split() if w and w not in STOP and len(w) > 2} + +def load(path): + rows = [] + with open(path) as fh: + for line in fh: + line = line.rstrip('\n') + if not line: + continue + parts = line.split('\t') + rows.append(parts) + return rows + +tgt = [(h, s, toks(s)) for h, s in load(tgt_f)] + +def jaccard(a, b): + if not a or not b: + return 0.0 + return len(a & b) / len(a | b) + +def trunc(s, n): + return s if full or len(s) <= n else s[:n-1] + "\u2026" + +rows = load(src_f) +print(f"{'#':>3} {'SHA':<9} {'PID':<3} {'SIM':>4} {'SUGGEST':<17} SUBJECT") +print("-" * 100) +seq = 0 +sql_lines = [] +for r in rows: + flag, sha = r[0], r[1] + subj = r[2] if len(r) > 2 else "" + seq += 1 + short = sha[:9] + st = toks(subj) + best, bestsubj = 0.0, "" + for _, ts, tt in tgt: + j = jaccard(st, tt) + if j > best: + best, bestsubj = j, ts + simpct = round(best * 100) + if flag == '-': + suggest = "SKIP-patchid" # identical patch already on target + elif simpct >= thr: + suggest = "SKIP-similar" # reworded/squashed duplicate, verify then skip + else: + suggest = "CANDIDATE" # likely genuinely missing — review + print(f"{seq:>3} {short:<9} {flag:<3} {simpct:>3}% {suggest:<17} {trunc(subj,52)}") + if simpct >= thr and bestsubj: + print(f"{'':>3} {'':<9} {'':<3} {'':>4} {'':<17} ~ {trunc(bestsubj,70)}") + if emsql: + esc = lambda x: x.replace("'", "''") + status = {'SKIP-patchid':'skip-similar','SKIP-similar':'skip-similar','CANDIDATE':'pick'}[suggest] + sql_lines.append( + f"INSERT INTO picks(seq,hash,subject,status,note) VALUES" + f"({seq},'{sha}','{esc(subj)}','{status}','{esc(bestsubj)}');") + +cand = sum(1 for r in rows + if not (r[0] == '-' )) +print("-" * 100) +print(f"total={len(rows)} (PID '-' = identical patch already on target; " + f"SIM >= {thr}% = likely reworded duplicate)") +if emsql and sql_lines: + print("\n-- session-DB seed (review before trusting 'status'):") + print("\n".join(sql_lines)) +PY diff --git a/.agents/skills/migtd-port/scripts/port-verify.sh b/.agents/skills/migtd-port/scripts/port-verify.sh new file mode 100755 index 000000000..9863890b8 --- /dev/null +++ b/.agents/skills/migtd-port/scripts/port-verify.sh @@ -0,0 +1,55 @@ +#!/usr/bin/env bash +# +# port-verify.sh — the "after every pick" gate the porting workflow requires. +# Runs, in fastest-feedback-first order, stopping at the first failure: +# 1. cargo fmt (apply — picks frequently need reformatting) +# 2. cargo fmt --check (confirm clean) +# 3. cargo xtask lib-test --crates migtd (migtd unit tests + feature matrix) +# 4. fast-emu-check.sh (skip-ra + spdm skip-ra emulation smoke) +# +# Run this immediately after each `git cherry-pick` (and after resolving any +# conflict) before moving to the next commit. Run emu-milestone.sh at batch +# checkpoints and the full gauntlet before pushing. +# +# Usage: +# ./port-verify.sh # full gate +# ./port-verify.sh --no-emu # skip step 4 (use for doc-only / non-boundary picks) +# ./port-verify.sh --no-fmt-apply # only check fmt, do not auto-apply +set -u + +REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)" +cd "$REPO_ROOT" +HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" + +DO_EMU=1 +FMT_APPLY=1 +while [ $# -gt 0 ]; do + case "$1" in + --no-emu) DO_EMU=0; shift ;; + --no-fmt-apply) FMT_APPLY=0; shift ;; + -h|--help) sed -n '2,20p' "$0"; exit 0 ;; + *) echo "unknown arg: $1" >&2; exit 2 ;; + esac +done + +bail() { echo ""; echo "port-verify: FAILED at $1"; exit 1; } + +echo "=== [1/4] cargo fmt ===" +if [ $FMT_APPLY -eq 1 ]; then + cargo fmt || bail "cargo fmt (apply)" +fi +echo "=== [2/4] cargo fmt --check ===" +cargo fmt --check || bail "cargo fmt --check (commit the reformatting)" + +echo "=== [3/4] cargo xtask lib-test --crates migtd ===" +cargo xtask lib-test --crates migtd || bail "lib-test" + +if [ $DO_EMU -eq 1 ]; then + echo "=== [4/4] fast-emu-check ===" + "$HERE/fast-emu-check.sh" || bail "fast-emu-check" +else + echo "=== [4/4] emu skipped (--no-emu) ===" +fi + +echo "" +echo "port-verify: PASS" diff --git a/.agents/skills/migtd-review/SKILL.md b/.agents/skills/migtd-review/SKILL.md new file mode 100644 index 000000000..6c3ec2537 --- /dev/null +++ b/.agents/skills/migtd-review/SKILL.md @@ -0,0 +1,348 @@ +--- +name: migtd-review +description: Security and correctness review of the Intel MigTD codebase (TDX migration TD firmware, Rust no_std). Use when reviewing MigTD source code, triaging clawpatch findings, filing GitHub issues for review findings, or running local EMU integration tests. Triggers on phrases like "review MigTD", "audit MigTD", "triage MigTD finding", "MigTD code review", "review code in intel/MigTD". +--- + +# MigTD Code Review + +Domain-specific guidance for reviewing the Intel MigTD codebase. Codifies the trust model, build-feature scope, common false-positive patterns, lessons learned from previous reviews, and the verification workflow. + +--- + +## 1. High-Level View (read this FIRST) + +Most failed/regressed "fixes" in this codebase trace back to skipping this section. Internalize these properties before flagging anything. + +### Execution model + +- **Single-core, single-threaded `no_std` Rust firmware**. No `Sync`/`Send` races within one TD. There is no preemption between non-interrupt code paths. + - Do **not** flag missing locks, atomics, or `Send` bounds unless an interrupt handler mutates shared state. +- **Heap is ~7 MiB**, bump-allocator behaviour for some paths. Out-of-memory is recoverable but rare. +- **Async runtime is cooperative** (`async_runtime` crate, single-threaded executor). Futures run to suspension; "races" between awaits are not races in the classical sense. + +### Trust model + +- **VMM is untrusted but has inherent DoS capability** — it can starve the TD, stall vmcalls, drop packets, withhold cycles, or kill the TD. **DoS-via-VMM is NOT a finding.** Do not file issues that boil down to "the VMM could refuse to make progress". +- **Root of trust = hardware attestation registers**: `MRTD` and `RTMR0..RTMR3`. The QE/PCK chain is a transport, not the root. + - Policy-v2 signer identity is attested through the **RTMR1 signer anchor** + (root-certificate fingerprint + enrolled signer-purpose EKU), not raw + issuer-chain bytes or leaf Subject Name. +- **Trusted-after-init**: `mig_policy::init_policy()` verifies the RTMR2-bound + policyData plus its inner JSON/CoRIM endorsements and freezes + `VERIFIED_POLICY`. The legacy outer policy signature is ignored. +- **Two distinct attestation paths**: + - *Regular migration* → uses **quotes**. REPORTDATA at byte offset **520**. Helper: `verify_report_data_binding`. + - *Rebind* → uses **TDREPORT** (no quote). REPORTDATA at byte offset **128**. Helper: `verify_tdreport_data_binding`. + - **Mixing the two = bug.** Always trace which helper is called from each rebind/migration code path. See commit `94975ec` for the TH1 binding fix. + +### Boundary surfaces (where bugs actually live) + +- The **vmcall transports** (`vmcall-raw`, `virtio-vsock`, etc.): every byte coming from VMM must be size-checked. Wrap-around arithmetic on `u32` offsets is a real risk; integer overflow on `u64` is generally not exploitable on 64-bit. +- **TLS-over-vmcall** in `crypto/`: certificate parsing, ASN.1, PEM. Look for slice indexing, `find()` ordering, and PEM block delimiters. +- **Policy parsing/verification** in `policy/src/v2/`: JSON/CoRIM decoding, + RTMR1 anchor binding, PEM/x5chain handling, and one-hash lookups. +- **Event log / RTMR replay** in `migtd/src/event_log.rs` and upstream `cc-measurement`: bounds checks, off-by-ones, RTMR replay correctness. +- **FFI / over-the-wire structs**: anything sent between source and destination MigTDs or exchanged with td-shim must be `#[repr(C)]` (or explicitly serialised). + +### What looks like a bug but isn't + +- "VMM can supply OOB buffer offsets" → each migration ctx has its own shared buffer with `data_status` as ground truth. +- "`vmcall-raw` read returns 0 → infinite loop" → the transport blocks until data or error; it **never returns Ok(0)/EOF**. +- "Interrupt broadcast wakes all migrations" → per-buffer `data_status` check filters spurious wakes (correct by design). +- "TSC division by zero in calibration" → pre-conditioned by CPUID/feature detection on real hardware. +- "Unbounded heap allocation in peer-info parse" → bounded by mig session size limits and the 7 MiB heap. DoS only. +- "`ecdsa_sign` PKCS8 panic" → dead code; no callers in the production binary. +- "Missing `#[repr(C)]` on `ExchangeInformation`" → dead code behind `#[cfg(not(feature = "spdm_attestation"))]` in the in-scope build. +- "Misspelled identifier" → fix only if user-visible; do not churn internal names. + +### Patterns that look like style fixes but are actually load-bearing + +This is the most important class to internalise. **Do not "clean up" code that looks redundant without first proving it is redundant.** + +- **`event_log::get_event_log()` returns `&raw[..size + 1]`**, not `&raw[..size]`. The `+1` looks like an off-by-one but is a deliberate workaround for a bug in upstream `cc_measurement::log::CcEvents::next()` (uses `<` instead of `<=`), which silently drops the last event when the slice ends exactly at the last event boundary. The runtime CCEL area is zero-padded so the extra byte is safe. **Removing the `+1` breaks AzCVMEmu integration tests** (lost policy tag → `Failed to initialize migration policy`). Upstream issue: . Regression test: `event_log::tests::last_event_visible_only_with_trailing_padding`. +- **Comments documenting workarounds are mandatory**. If you find code that does something odd without a comment, add the comment before considering changing the code. +- **CI history is the source of truth for "what broke when"**. If a regression appears, find the breaking commit via `git bisect` or by reading CI run history; do not guess from local symptoms (which may be masked by other environment issues — see §6). + +### Why these matter + +A previous review pass produced a "fix" (`bc99fa4`) that removed the `+1`, passed cargo fmt/clippy and the host-runnable unit tests, but silently broke the EMU integration tests. The breakage was not caught until CI history was inspected. The lesson: **passing `cargo test` is not sufficient evidence of correctness for changes that touch boundary code; always run the EMU integration tests after every behavioural change.** + +--- + +## 2. Codebase essentials + +- **MANDATORY first step after fresh checkout / submodule update**: run `bash sh_script/preparation.sh`. This: + 1. Invokes `deps/td-shim/sh_script/preparation.sh` (td-shim's own prep). + 2. Applies the spdm-rs ring patches (`0003-introduce-EphemeralPrivateKey-serialization.patch` and `0004-Introduce-digest-de-serialization.patch` from `deps/spdm-rs/external/patches/ring/`) to `deps/td-shim/library/ring`. MigTD's workspace-level `[patch.crates-io]` selects this ring copy, not spdm-rs's copy. The patches add `EphemeralPrivateKey::export_private_key_bytes`/`from_private_key_bytes` and `digest::Context::to_bytes`/`from_bytes`, which spdmlib needs to preserve intermediate SPDM context. + 3. Runs `deps/spdm-rs/sh_script/pre-build.sh`. + CI does this automatically via `.github/actions/setup-build-environment` (default `run-preparation: true`). Locally you MUST run it manually after any `git clean -fdx`, `git submodule update`, or fresh clone. Failing to run it produces build errors that look like a real baseline regression but are not. See [`doc/dependency_preparation.md`](../../../doc/dependency_preparation.md) for the dependency-resolution rationale. +- **Build profiles vary**. Always confirm scope before flagging code as buggy. Default in-scope set used during the audit: + - `vmcall-raw, stack-guard, main, vmcall-interrupt, oneshot-apic, spdm_attestation, igvm-attest, policy_v2` + - `policy_v2` pulls in `policy/policy_v2` + `attestation/attest-lib-ext`. + - **Out of scope in that profile**: `virtio-serial`, `virtio-vsock`, `vmcall-vsock`, `fuzz`, `AzCVMEmu` runtime (the host-side emu harness is separate from the in-firmware build). +- **Always in tree** (regardless of features): `virtio`, `pci`, `crypto` (rustls enabled by default). +- **Build (production image)**: + ```bash + cargo image --features main,vmcall-raw,stack-guard,vmcall-interrupt,oneshot-apic,spdm_attestation,igvm-attest,policy_v2 + ``` + - The xtask sets release/debug profile internally — do **not** pass `--release`. +- **Build (AzCVMEmu host harness)**: see §6. +- Bigger build cmd (matrix): `.github/workflows/main.yml`. +- Architectural facts: + - `ring::pkcs8::Document` in **this fork** is stack-inlined `[u8; 185]` + `len`, NOT heap-allocated → `sensitive_data_cleanup` works as intended. + - `verify_quote_integrity_ex` is a C-library built from source as a submodule. + - Policy v2 supports a JSON servTD-collateral path (PEM chain derives the + RTMR1 anchor) and a CoRIM-only path (direct 48-byte anchor + signed + TCB-mapping CoRIM). The outer JSON policy signature is legacy/ignored; + mapping/identity or CoRIM signatures must bind to the same root+EKU anchor. + +--- + +## 3. Common false-positive patterns + +| Pattern | Why it's usually NOT a bug | +|---|---| +| "VMM can supply OOB buffer offsets" | Each migration ctx has its own shared buffer; `data_status` is ground truth. Wrap arithmetic on `u32` offsets is checked. | +| "Shared log circular buffer overflow" | Wrapping logic keeps offsets in bounds; VMM is reader, not writer. | +| "vmcall-raw read returns 0 → infinite loop" | The `vmcall-raw` transport blocks until data or error; **never returns 0/EOF**. | +| "Interrupt broadcast wakes all migrations" | Spurious wakes are caught by per-buffer status check (correct by design). | +| "Cert chain weakness in attestation/SPDM verifier" | The root+signer-EKU anchor is measured into RTMR1; chain compromise alone is insufficient unless it can produce a chain under that anchor and evade revocation. | +| "TSC div-by-zero in calibration" | Pre-conditioned by CPUID/feature detection on real HW. | +| "Unbounded heap alloc in peer-info parse" | Bounded by mig session size limits + 7 MiB heap → just DoS. | +| "Misspelled identifier" | Fix only if user-visible; don't churn the codebase for internal names. | +| `ecdsa_sign` PKCS8 panic | Dead code — no callers in the production binary. | +| `ExchangeInformation` missing `#[repr(C)]` | Dead code behind `#[cfg(not(feature = "spdm_attestation"))]` in this build. | + +--- + +## 4. Known real bug patterns + +Fixes already merged that double as templates for what *real* bugs look like: + +1. **Match-arm fallthrough** in `match … { _ => { … } }` blocks where caller expects early return → check every arm for explicit `return` (see `poll_vmcall_completion`, commit `ed80789`). +2. **Missing `#[repr(C)]`** on FFI / serialized-over-the-wire structs → see `HelloPacketPayload` (commit `a277723`). +3. **Wrong field used for crypto-algorithm lookup**: `cert.signature_algorithm` (the signer's algorithm) vs `cert.tbs_certificate.subject_public_key_info.algorithm` (the subject's algorithm used to verify the cert *under* the subject's pub key) → commit `70872c0`. +4. **PEM search order**: `find(END)` before `find(BEGIN)` allows END before BEGIN → search for END *after* BEGIN's end-index (commit `dfb449c`). +5. **Missing TH1 binding on SPDM rebind path**: rebind uses `TDREPORT` (REPORTDATA at offset **128**), regular migration uses quotes (REPORTDATA at offset **520**). They need distinct verification helpers (`verify_tdreport_data_binding` vs `verify_report_data_binding`). See commit `94975ec`. + +--- + +## 5. The verification cycle (DO THIS AFTER EVERY FIX) + +A fix is not done until **all of these pass — every test in every CI workflow, no exceptions**. The user explicitly requires this. The order matters — fastest feedback first. + +### Local quick gate (must all be green before pushing) + +```bash +# 0. Preparation (skip only if you've already run it since last submodule update) +bash sh_script/preparation.sh + +# 1. Format check (instant) +cargo fmt --check + +# 2. Clippy on the in-scope feature set +cargo clippy --workspace --all-targets \ + --features main,vmcall-raw,stack-guard,vmcall-interrupt,oneshot-apic,spdm_attestation,igvm-attest,policy_v2 \ + -- -D warnings + +# 3. Host-runnable unit tests for the crates you touched (seconds) +cargo test -p migtd --lib +# e.g.: cargo test -p migtd --lib event_log +# e.g.: cargo test -p crypto + +# 4. EMU integration tests (minutes) — REQUIRED for any change to: +# - event_log / RTMR replay code +# - policy parsing or verification +# - migration session / handshake / rebind paths +# - SPDM transport +# - crypto / cert / PEM parsing +# - any vmcall transport +./sh_script/build_AzCVMEmu_policy_and_test.sh --skip-test # build first +./sh_script/build_AzCVMEmu_policy_and_test.sh # then full test run +# OR run individual scenarios via ./migtdemu.sh (see §6). +``` + +### Full CI parity (all four workflows MUST pass — no exceptions) + +The user has stated **every test in every workflow must pass**. The reusable gauntlet script automates this — use it as the standard pre-push verification: + +```bash +.agents/skills/migtd-review/scripts/run-ci-gauntlet.sh +``` + +It runs the four CI workflows in the order `prep → format → deny → main → emu` and **stops at the first failure** with the failing command, the path of the captured log, and a resume hint (`--from `). Logs land under `target/ci-gauntlet/`. Total wall-clock is ~30 min cold, much less on warm caches. + +```bash +.agents/skills/migtd-review/scripts/run-ci-gauntlet.sh --list # list stages +.agents/skills/migtd-review/scripts/run-ci-gauntlet.sh --from main # resume from main +.agents/skills/migtd-review/scripts/run-ci-gauntlet.sh --only emu # single stage +``` + +When the gauntlet fails, **fix the root cause first, then re-run from the failing stage** — do not skip ahead. The script intentionally bails so a review agent (or you) has time to read the log, propose a minimal fix, and re-verify before continuing. + +What each stage covers (the commands the script runs are the source of truth): + +| Workflow | Stage | What it runs | +|---|---|---| +| `.github/workflows/format.yml` | `format` | `cargo fmt -- --check`, `cargo check`, `cargo clippy --features stack-guard,virtio-vsock,virtio-serial,vmcall-interrupt` (no `-D warnings`) | +| `.github/workflows/deny.yml` | `deny` | `cargo deny check advisories`, `cargo deny check sources` (continue-on-error), `cargo deny check bans` | +| `.github/workflows/main.yml` | `main` | 32 `cargo image` builds = 4 devices × 2 policy_versions × 2 protocols × 2 build_types | +| `.github/workflows/integration-emu.yml` | `emu` | 15 EMU scenarios mirroring the workflow matrix exactly, including the explicit pre-builds and the fail-closed revoked-signer policy test | + +**Note**: the format.yml clippy step uses a *different* feature set than the in-scope set above (`stack-guard,virtio-vsock,virtio-serial,vmcall-interrupt`). Both must compile cleanly; the former is what runs in CI and gates merges. + +**Why step 4 is mandatory**: passing `cargo test` is not sufficient evidence of correctness for boundary code. Unit tests in `migtd` exercise small, controlled inputs; many real bugs only surface when the full source ↔ destination migration handshake replays the event log, parses a real signed policy, or extends RTMRs. The bc99fa4/event_log regression is the canonical example — host unit tests passed; EMU integration tests failed loudly. + +If `cargo image` succeeds (full TDX firmware build) that's a strong signal the change at least compiles for the no_std target, but it does not exercise runtime behaviour. The EMU harness does. + +### EMU test failure debugging order + +If an EMU test fails after a fix: + +1. **First**: check the CI run history on GitHub to see whether the same test passes for an unrelated commit on `main`. If `main` is also failing the test in CI, the failure is pre-existing (environment, OpenSSL, runner image) — see §6. +2. **Then**: `git bisect` (or scan recent commits) to find the breaking commit. The narrative "my fix broke it" is often correct; the narrative "the failure is unrelated" is often wrong. +3. Only after you have a specific breaking commit, reason about *why* — typically by reading the diff in light of §1. + +--- + +## 6. Running EMU integration tests locally + +Prerequisites: Rust 1.88.0, nasm, clang, libtss2-dev, pkg-config, jq, and `bash sh_script/preparation.sh` has been run (see §2). On a fresh host, install the full toolchain in one shot with `./sh_script/setup_build_env.sh` (single `sudo apt-get install` + rustup/toolchain/`x86_64-unknown-none`; `--print-apt` shows just the apt one-liner). + +Working tests on Ubuntu 24.04 (skip-RA paths): + +```bash +./migtdemu.sh --skip-ra --both --no-sudo --log-level info +./migtdemu.sh --operation rebind-prepare \ + --policy-file ./config/AzCVMEmu/policy_v2_signed.json \ + --policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem \ + --skip-ra --both --no-sudo --log-level info +./migtdemu.sh --skip-ra --features spdm_attestation --both --no-sudo --log-level info +``` + +Full test matrix script (mirrors `.github/workflows/integration-emu.yml`): + +```bash +./sh_script/build_AzCVMEmu_policy_and_test.sh --mock-report +``` + +### Policy file gotcha — `EXPLICIT_POLICY_FILE` + +- `config/AzCVMEmu/policy_v2_signed.json`, `config/AzCVMEmu/policy_v2_raw.json`, and `config/AzCVMEmu/policy_issuer_chain.pem` are **tracked in git**. CI starts every job from a clean `actions/checkout`, so these are always present. +- `migtdemu.sh` only auto-generates policy files when `EXPLICIT_POLICY_FILE != true` *and* `SKIP_POLICY_GENERATION != true` (see `migtdemu.sh:452`). Passing `--policy-file` sets `EXPLICIT_POLICY_FILE=true`, which **disables** auto-generation. So if you `git clean -fdx` (or otherwise delete the tracked policy files), then run with `--policy-file`, you'll get `Error: Source Policy file not found: …`. Restore them with `git checkout config/AzCVMEmu/` and re-run. +- The key-rotation policy files (`policy_v2_signed_a/b/pm_b/pmi_b.json` + matching chains) are **not** tracked. The rotation scenarios in `integration-emu.yml` generate them on demand. + +### Local CI matrix invocations (mirrors `integration-emu.yml`) + +Single-instance scenarios (no `--mock-report` or `--policy-v2`): + +```bash +./migtdemu.sh --skip-ra --both --no-sudo +./migtdemu.sh --features spdm_attestation --skip-ra --both --no-sudo +``` + +`policy_v2` + mock-report scenarios (require the tracked policy files): + +```bash +./migtdemu.sh --policy-v2 --policy-file ./config/AzCVMEmu/policy_v2_signed.json \ + --policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem \ + --mock-report --both --no-sudo +``` + +Rebind scenarios use `--operation rebind-prepare`. SPDM scenarios add `--features spdm_attestation`. Key-rotation scenarios additionally pass `--policy-file`/`--policy-issuer-chain-file` pointing at the rotated artifacts (e.g., `policy_v2_signed_a.json`). + +### No safe parallelism for `migtdemu.sh` + +Do **not** run multiple `migtdemu.sh` invocations concurrently. The script: +- Hardcodes TCP port `8001` (no override flag). +- Uses `taskset -c 0` (all invocations contend on the same core). +- Writes log files at fixed names (`dest_*_out.log`, `migtd__.log`). +- Builds into `target/release/migtd`, rebuilt per-scenario with different feature sets — concurrent runs will clobber each other's binary. + +If you must speed up local CI parity, run scenarios sequentially in a single shell. CI parallelism is achieved per-job in GitHub Actions, where each runner has its own isolated filesystem. + +### When CI passes but local fails (or vice versa) + +CI failures can mask local regressions and vice versa. If `cargo image` or an EMU test fails locally but the same commit passes in CI on `main`, suspect: missing `preparation.sh`, missing system package, stale submodule, OpenSSL version skew, or deleted tracked policy files. Conversely, if a local change passes but CI fails, do **not** assume the CI is flaky — re-read the §1 trust-model rules first. + +--- + +## 7. Workflow A — Triaging clawpatch findings + +```bash +ls .clawpatch/findings/*.json | xargs -I{} jq -r '.findingId + " " + .status + " - " + .title' {} +# Open ones first: +ls .clawpatch/findings/*.json | xargs -I{} jq -r 'select(.status=="open") | .findingId + " - " + .title' {} +``` + +For each open finding: + +1. Open the JSON; read `evidence`, `reasoning`, `reproduction` against the source. +2. Confirm the file/line is **actually compiled** in the in-scope build (check `Cargo.toml` features). Many findings are in vsock/virtio-serial dead code for vmcall-raw. +3. Decide and triage: + ```bash + clawpatch triage --finding --status --note "" + ``` +4. For *fixed* findings: make a minimal, surgical commit; reference the finding ID in the commit body. **Then run the §5 verification cycle, including EMU integration tests for any boundary-code change.** + +Required JSON fields when manually creating a finding (clawpatch finding schema): +`schemaVersion, findingId, featureId, title, category, severity, confidence, triage, evidence, reasoning, reproduction (string not null), recommendation, whyTestsDoNotAlreadyCoverThis (string not null), suggestedRegressionTest (string not null), minimumFixScope, status, history, signature (string), linkedPatchAttemptIds (array), createdByRunId (string), createdAt, updatedAt`. + +--- + +## 8. Workflow B — Manual deep review + +Use parallel `explore` agents (Haiku) for breadth, then `view`/`grep` for verification. Suggested chunking: + +- Agent 1: `src/devices/**`, `src/std-support/**` +- Agent 2: `src/spdm/**`, SPDM transport, attestation glue +- Agent 3: `src/migtd/src/main/*`, migration session, policy +- Agent 4: `src/crypto/**`, `src/attestation/**`, `src/policy/**` + +Prompt each agent to read **only files compiled in the target build**, return findings as a structured list (file:line, severity, description, suggested fix). Then *you* verify each finding against the source before filing — agents will hallucinate; the trust model in §1 catches most hallucinations. + +--- + +## 9. Workflow C — Filing GitHub issues for the audit + +See `scripts/create_review_issues.sh` template. Important details: + +- Use `[Copilot Review]` prefix in the title (not `[Security]`) — not every finding is a security concern. +- Microsoft org requires SSO; **EMU (Enterprise Managed User) accounts cannot create issues** — use a personal GitHub account with `gh auth login --hostname github.com --web` (device-flow login). Verify the active account with `gh auth status` before running create scripts. +- `gh issue close` uses `--reason "not planned"` (with a literal space), NOT `not_planned`. +- For each issue body file: include Title, Severity, File:line, Description, Triage Status (Fixed / False-positive / Wont-fix), and Triage Notes from the clawpatch finding. +- Before running the create script, scan all body files for duplicated triage-note sentences and empty triage-notes sections; cross-check empty ones against the original clawpatch JSON (the `triage.notes` array — multiple entries should be concatenated, deduplicated, and de-fluffed). + +--- + +## 10. Workflow D — Filing upstream issues for cross-repo bugs + +Some bugs surface in MigTD but live in submodules (`deps/td-shim`, `deps/spdm-rs`, etc.). When you confirm one: + +1. Identify the upstream repo via `.gitmodules`. +2. Search existing issues + PRs (open and closed) for the symptom and the symbol names. Try at least 3–4 wordings. +3. Verify the bug still exists on upstream `origin/main` (the submodule SHA may be stale). +4. File an issue containing: a self-contained reproducer, the affected file:line, downstream impact, and a proposed fix. Offer to send a PR. +5. In the MigTD-side workaround, **add a code comment referencing the upstream issue URL** so the workaround is not removed later. +6. Add a **regression test** in MigTD that mirrors the upstream reproducer; phrase the assertion so it fails loudly when upstream fixes the bug, signaling that the workaround and test can be removed. Example: `event_log::tests::last_event_visible_only_with_trailing_padding`. + +--- + +## 11. Things to avoid + +- **Don't fix unrelated pre-existing issues** uncovered during review unless they are *directly coupled* to the change. If a pre-existing fmt/style issue blocks `cargo fmt --check` for your commit, fix it as a **separate** standalone commit with a clear "pre-existing; not caused by this series" note in the body — do not bundle it into a behavioural commit. +- **Don't churn formatting/lint across the codebase**. `cargo fmt` only touches files you've already modified; do not run it repo-wide. +- **Don't add `.clawpatch/` or `.copilot-review-issues/` to source control** — they are gitignored. +- **Don't "fix" code that looks redundant without proving it is redundant.** See §1's discussion of `event_log::get_event_log()`. The standard test is: revert your fix, run the EMU integration tests; if they break, the code was load-bearing. +- **Don't trust local symptoms when CI tells a different story.** A `SignatureVerificationFailed` locally on Ubuntu 24.04 can mask an entirely unrelated regression (or vice versa). +- **Don't pile new commits on top of an incorrect commit.** If a commit is wrong, use `git rebase -i` to drop or fold it (`fixup`/`squash`) before pushing. Force-push with `--force-with-lease=:` to a personal fork only; never to a shared branch. + +--- + +## 12. References + +- `references/build-features.md` — full feature gating + which crates compile when. +- `references/triage-justifications.md` — boilerplate justifications for the most common false-positives. +- `references/security-test-areas.md` — static analysis, fuzz targets by area, and the secure-review checklist for external-input boundaries. +- `scripts/list_open_findings.sh` — list open clawpatch findings. +- `scripts/create_review_issues.sh` — template to create GH issues from body files. diff --git a/.agents/skills/migtd-review/references/build-features.md b/.agents/skills/migtd-review/references/build-features.md new file mode 100644 index 000000000..dc7346c9c --- /dev/null +++ b/.agents/skills/migtd-review/references/build-features.md @@ -0,0 +1,58 @@ +--- +type: Reference +title: MigTD Build Features +description: Feature-gating map of which crates and code paths compile under which Cargo feature combinations. +tags: [build, cargo-features, feature-gating] +timestamp: 2026-07-10T19:26:55+00:00 +--- + +# Build features — what compiles when + +Source: `src/migtd/Cargo.toml`, `src/devices/Cargo.toml`, `Cargo.toml` workspace. + +## Default in-scope feature set used in the audit + +``` +main, vmcall-raw, stack-guard, vmcall-interrupt, oneshot-apic, +spdm_attestation, igvm-attest, policy_v2 +``` + +## Feature → enabled crates / modules + +| Feature | Pulls in / enables | +|---|---| +| `main` | `bin/migtd` binary | +| `vmcall-raw` | `src/devices/vmcall_raw/` transport | +| `vmcall-interrupt` | Interrupt-driven completion in `vmcall_raw/transport/vmcall.rs` | +| `oneshot-apic` | One-shot APIC mode in `td_payload`/`devices/apic` | +| `spdm_attestation` | `src/migtd/src/spdm/` paths (requester + responder) | +| `igvm-attest` | `attestation/igvm-attest` integration in `attestation/` | +| `policy_v2` | `src/policy/src/v2/`, `attestation/attest-lib-ext` | +| `stack-guard` | Stack canary in `migtd` startup | + +## Not in scope under that set + +| Feature | Module | +|---|---| +| `virtio-vsock`, `vmcall-vsock` | `src/devices/vsock/` (entire crate path) | +| `virtio-serial` | `src/devices/virtio_serial/` | +| `AzCVMEmu` | `deps/td-shim-AzCVMEmu/`, `cvmemu` module | +| `fuzz` | `src/devices/*/fuzz/`, top-level `fuzz/` | +| `test_disable_ra_and_accept_all` | RA-bypass paths (skip-ra EMU tests only) | + +## Always compiled + +- `src/devices/virtio/` (not optional) +- `src/devices/pci/` (not optional, but in vmcall-raw builds it's effectively dead — still compiled) +- `src/crypto/` (rustls is default) +- `src/attestation/` (attest-lib backbone) + +## How to decide if code is dead in your build + +```bash +# Find feature gates on the offending function/module: +grep -rn '#\[cfg(' path/to/file.rs | head -20 +# Then check Cargo.toml deps in the consuming crate. +``` + +If the function has `#[cfg(feature = "virtio-vsock")]` and your build doesn't enable that, the finding is wont-fix. diff --git a/.agents/skills/migtd-review/references/security-test-areas.md b/.agents/skills/migtd-review/references/security-test-areas.md new file mode 100644 index 000000000..129965fc9 --- /dev/null +++ b/.agents/skills/migtd-review/references/security-test-areas.md @@ -0,0 +1,52 @@ +--- +type: Reference +title: Security Test Areas — Static Analysis, Fuzzing, Secure Review +description: The MigTD security test surface — static analyzers, vulnerable-crate scanning, fuzz targets by area, and the secure-code-review checklist for external-input boundaries. +tags: [security, fuzzing, clippy, cargo-deny, review] +timestamp: 2026-07-13T22:37:00+00:00 +--- + +# Security Test Areas + +Canonical source: [doc/security_test.md](../../../../doc/security_test.md). Use this as +a checklist when reviewing changes that touch external-input boundaries (see +also the [migtd-review SKILL.md](../SKILL.md) trust model and +[triage-justifications.md](triage-justifications.md)). + +## Static analysis + +`cargo-clippy`, Prusti, MIRAI (see `td-shim`'s +[`static_analyzer.md`](https://github.com/confidential-containers/td-shim/blob/main/doc/static_analyzer.md)). + +## Vulnerable crate scan + +`cargo-deny` (see `td-shim`'s +[`cargo-deny.md`](https://github.com/confidential-containers/td-shim/blob/main/doc/cargo-deny.md)) +— this is the `deny` stage of `run-ci-gauntlet.sh`. + +## Fuzz targets by area + +| Area | Fuzzer | Location | +|---|---|---| +| Virtio devices (VirtioPci, VirtioVsock) | AFL | `src/devices/virtio/fuzz/` | +| Migration policy | AFL & LibFuzzer | `src/policy/fuzz/` | +| X.509 certificate parsing | AFL & LibFuzzer | `src/crypto/fuzz/` | +| GHCI `VmcallServiceResponse` | AFL & LibFuzzer | `src/migtd/fuzz/` | + +## Secure-code-review checklist (external-input boundaries) + +These four areas take **untrusted external input** and must copy-to-private + +sanity-check before use — flag any code that reads from these sources +directly without validation as a candidate finding: + +- **Virtio devices** — external input; copy to private memory before use. +- **GHCI `VmcallServiceResponse`** — VMM result is untrusted; copy to private + memory + sanity-check before use. +- **Migration policy** — external input; must be measured (RTMR) and + sanity-checked before use. +- **X.509 certificate** (peer MigTD's) — external input; must be measured and + sanity-checked before use. + +Cross-reference: [Domain Facts § Trust model](../../../knowledge/domain-facts.md) +— "VMM is untrusted but can DoS" already covers the DoS-vs-integrity +distinction for these same boundaries. diff --git a/.agents/skills/migtd-review/references/triage-justifications.md b/.agents/skills/migtd-review/references/triage-justifications.md new file mode 100644 index 000000000..1f924bac6 --- /dev/null +++ b/.agents/skills/migtd-review/references/triage-justifications.md @@ -0,0 +1,94 @@ +--- +type: Reference +title: MigTD Review Triage Justifications +description: Rationale patterns for accepting or rejecting review findings, including common false-positive categories. +tags: [review, triage, false-positives, security] +timestamp: 2026-07-10T19:26:55+00:00 +--- + +# Boilerplate triage justifications + +Reusable text for the `--note` arg of `clawpatch triage`. Adapt the file:line and specifics. + +## Out-of-scope feature + +``` +Dead code in target build: function is gated by `#[cfg(feature = "")]` at +:. The target build set (vmcall-raw, policy_v2, ...) does NOT enable +``, so the offending code is not compiled. No action needed for this build. +``` + +## VMM-controlled offsets in shared circular buffer + +``` +False-positive. The shared log area is a circular buffer where the migtd is the +writer and the VMM is the reader. Wrapping arithmetic in : keeps +write offsets in bounds. VMM-supplied offsets cannot drive OOB reads because the +migtd never reads from the buffer; the VMM only reads. See for the +wrap logic. +``` + +## DoS by untrusted VMM + +``` +Wont-fix. VMM is untrusted and has inherent DoS capability (can starve resources +or kill the TD outright). Unbounded allocation / blocking call here is bounded by +the per-session buffer (max bytes) and the 7 MiB heap — worst case is the TD +exits, which is already part of the VMM's threat surface. +``` + +## Cert-chain weakness in attested path + +``` +False-positive. The root CA chain is measured into RTMR and attested via the +TDX quote — see . A compromised cert alone is insufficient +because the peer's verification of our quote would catch a divergent measurement. +Trust root is hardware attestation, not the software chain. +``` + +## vmcall-raw 0-byte read + +``` +False-positive. The vmcall-raw transport in : blocks until data +arrives or returns an error; it never returns Ok(0). The "infinite loop on EOF" +pattern flagged by the static rule does not apply to this transport. +``` + +## Spurious interrupt wake + +``` +False-positive. The vmcall-interrupt model broadcasts to all migrations on every +event, but each context re-checks its own buffer status (data_status field) before +acting. Spurious wakes are absorbed correctly — see . +``` + +## Single-threaded firmware, no race + +``` +False-positive. MigTD is a single-core, single-threaded no_std firmware. The +flagged access cannot race with another thread; there is no other thread. The +only re-entrancy source is interrupt handlers, which do not mutate the field at +:. +``` + +## Dead public API + +``` +Wont-fix. Function is public but has no in-tree callers in the target build. +Verified with `grep -rn "" src/ --include=*.rs` — only the definition is +returned. Will be removed in a future cleanup pass; not exploitable today. +``` + +## Misspelling without user impact + +``` +Wont-fix (cosmetic). Misspelled internal identifier at : is +not user-visible (no print, no API, no wire format). Renaming would touch +call sites without behavior change. Deferred. +``` + +## Duplicate finding + +``` +Duplicate of finding . Same root cause / same fix surface. +``` diff --git a/.agents/skills/migtd-review/scripts/create_review_issues.sh b/.agents/skills/migtd-review/scripts/create_review_issues.sh new file mode 100755 index 000000000..b0a95aa40 --- /dev/null +++ b/.agents/skills/migtd-review/scripts/create_review_issues.sh @@ -0,0 +1,48 @@ +#!/usr/bin/env bash +# Template: create+close GH issues from a directory of body files. +# Body files: body_000.md ... body_NNN.md (each starts with "# " on line 1) +# Each body file may end with a marker line "STATUS: closed/<reason>" or "STATUS: open" +# +# Expected env: +# REPO - e.g. "Microsoft/MigTD" +# PREFIX - title prefix, defaults to "[Copilot Review]" +# +# Notes: +# - Auth: `gh auth login --hostname github.com --web` first (device flow). +# - SSO: SAML may require `gh auth refresh -s repo,write:org`. +# - EMU accounts cannot create issues — use a personal account. +# - `gh issue close --reason "not planned"` (with space). + +set -euo pipefail + +: "${REPO:?Set REPO=<owner>/<repo>}" +PREFIX="${PREFIX:-[Copilot Review]}" +BODY_DIR="${BODY_DIR:-.copilot-review-issues}" + +if [[ ! -d "$BODY_DIR" ]]; then + echo "Body dir not found: $BODY_DIR" >&2 + exit 1 +fi + +for body in "$BODY_DIR"/body_*.md; do + [[ -f "$body" ]] || continue + title_line=$(head -n1 "$body") + title="${title_line#"# "}" + full_title="$PREFIX $title" + + echo "→ Creating: $full_title" + issue_url=$(gh issue create --repo "$REPO" --title "$full_title" --body-file "$body") + echo " $issue_url" + + # Look at last line for STATUS marker + status_line=$(tail -n1 "$body") + case "$status_line" in + "STATUS: closed/fixed") + gh issue close "$issue_url" --reason "completed" --comment "Fixed in linked commit." ;; + "STATUS: closed/wont-fix") + gh issue close "$issue_url" --reason "not planned" --comment "Wont-fix: see triage notes." ;; + "STATUS: closed/false-positive") + gh issue close "$issue_url" --reason "not planned" --comment "False-positive: see triage notes." ;; + *) ;; + esac +done diff --git a/.agents/skills/migtd-review/scripts/list_open_findings.sh b/.agents/skills/migtd-review/scripts/list_open_findings.sh new file mode 100755 index 000000000..7911fb9a7 --- /dev/null +++ b/.agents/skills/migtd-review/scripts/list_open_findings.sh @@ -0,0 +1,17 @@ +#!/usr/bin/env bash +# List open (unresolved) clawpatch findings, oldest first. +# Usage: ./list_open_findings.sh [findings-dir] + +set -euo pipefail + +DIR="${1:-.clawpatch/findings}" + +if [[ ! -d "$DIR" ]]; then + echo "Directory not found: $DIR" >&2 + exit 1 +fi + +# Print: id severity title (status) +for f in "$DIR"/*.json; do + jq -r 'select(.status=="open") | [.findingId, .severity, .title] | @tsv' "$f" +done | sort -k1 diff --git a/.agents/skills/migtd-review/scripts/run-ci-gauntlet.sh b/.agents/skills/migtd-review/scripts/run-ci-gauntlet.sh new file mode 100755 index 000000000..3c21838be --- /dev/null +++ b/.agents/skills/migtd-review/scripts/run-ci-gauntlet.sh @@ -0,0 +1,341 @@ +#!/usr/bin/env bash +# +# run-ci-gauntlet.sh — exercise the full MigTD CI test surface locally and +# stop at the first failure so an agent can fix it before continuing. +# +# Mirrors: +# .github/workflows/format.yml +# .github/workflows/deny.yml +# .github/workflows/main.yml +# .github/workflows/integration-emu.yml +# +# Logs are written to target/ci-gauntlet/. On failure the script prints +# the path of the failing log and exits non-zero so the caller (or a +# review agent) can read it and propose a fix. +# +# Usage: +# ./run-ci-gauntlet.sh # full run +# ./run-ci-gauntlet.sh --list # list stages without running +# ./run-ci-gauntlet.sh --from STAGE # resume from STAGE (skip earlier) +# ./run-ci-gauntlet.sh --only STAGE # run a single stage only +# ./run-ci-gauntlet.sh -h | --help +# +# STAGE ∈ { prep | format | deny | main | emu } +# +set -u +set -o pipefail + +# ------------------------------------------------------------ paths / setup +REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)" +cd "$REPO_ROOT" + +LOG_DIR="$REPO_ROOT/target/ci-gauntlet" +mkdir -p "$LOG_DIR" +SUMMARY="$LOG_DIR/summary.txt" +: > "$SUMMARY" + +STAGES=(prep format deny main emu) +FROM_STAGE="prep" +ONLY_STAGE="" + +while [ $# -gt 0 ]; do + case "$1" in + -h|--help) + sed -n '2,25p' "$0" + exit 0 + ;; + --list) + printf '%s\n' "${STAGES[@]}" + exit 0 + ;; + --from) + FROM_STAGE="$2"; shift 2 ;; + --only) + ONLY_STAGE="$2"; shift 2 ;; + *) + echo "unknown arg: $1" >&2 + exit 2 + ;; + esac +done + +# stage-runner state +CURRENT_STAGE="" +STARTED=0 + +stage_should_run() { + local name="$1" + if [ -n "$ONLY_STAGE" ]; then + [ "$name" = "$ONLY_STAGE" ] && return 0 || return 1 + fi + if [ "$STARTED" -eq 1 ]; then return 0; fi + if [ "$name" = "$FROM_STAGE" ]; then STARTED=1; return 0; fi + return 1 +} + +# log + run a sub-step; on failure print path and bail. +# usage: step "<label>" <cmd...> +step() { + local label="$1"; shift + local log="$LOG_DIR/${CURRENT_STAGE}__${label}.log" + printf ' [%s] %-50s ' "$CURRENT_STAGE" "$label" | tee -a "$SUMMARY" + local start=$(date +%s) + if "$@" >"$log" 2>&1; then + local dur=$(( $(date +%s) - start )) + printf '✓ PASS (%ds)\n' "$dur" | tee -a "$SUMMARY" + return 0 + else + local rc=$? + local dur=$(( $(date +%s) - start )) + printf '✗ FAIL (%ds rc=%d)\n' "$dur" "$rc" | tee -a "$SUMMARY" + echo "" | tee -a "$SUMMARY" + echo "==== gauntlet FAILED ====" | tee -a "$SUMMARY" + echo "stage: $CURRENT_STAGE" | tee -a "$SUMMARY" + echo "label: $label" | tee -a "$SUMMARY" + echo "command: $*" | tee -a "$SUMMARY" + echo "log: $log" | tee -a "$SUMMARY" + echo "resume: $(realpath "$0") --from $CURRENT_STAGE" | tee -a "$SUMMARY" + echo "" | tee -a "$SUMMARY" + echo "----- last 80 lines of $log -----" | tee -a "$SUMMARY" + tail -n 80 "$log" | tee -a "$SUMMARY" + exit "$rc" + fi +} + +# Run a negative test that must fail and emit a specific diagnostic. +# usage: step_expect_failure_pattern "<label>" "<pattern>" <cmd...> +step_expect_failure_pattern() { + local label="$1"; shift + local pattern="$1"; shift + local log="$LOG_DIR/${CURRENT_STAGE}__${label}.log" + printf ' [%s] %-50s ' "$CURRENT_STAGE" "$label" | tee -a "$SUMMARY" + local start=$(date +%s) + "$@" >"$log" 2>&1 + local rc=$? + local dur=$(( $(date +%s) - start )) + if [ "$rc" -ne 0 ] && grep -aq "$pattern" "$log"; then + printf '✓ PASS (%ds expected rc=%d)\n' "$dur" "$rc" | tee -a "$SUMMARY" + return 0 + fi + + printf '✗ FAIL (%ds rc=%d)\n' "$dur" "$rc" | tee -a "$SUMMARY" + echo "" | tee -a "$SUMMARY" + echo "==== gauntlet FAILED ====" | tee -a "$SUMMARY" + echo "stage: $CURRENT_STAGE" | tee -a "$SUMMARY" + echo "label: $label" | tee -a "$SUMMARY" + echo "expected: non-zero exit and log pattern '$pattern'" | tee -a "$SUMMARY" + echo "command: $*" | tee -a "$SUMMARY" + echo "log: $log" | tee -a "$SUMMARY" + echo "resume: $(realpath "$0") --from $CURRENT_STAGE" | tee -a "$SUMMARY" + echo "" | tee -a "$SUMMARY" + echo "----- last 80 lines of $log -----" | tee -a "$SUMMARY" + tail -n 80 "$log" | tee -a "$SUMMARY" + exit 1 +} + +banner() { + CURRENT_STAGE="$1" + echo "" | tee -a "$SUMMARY" + echo "============== stage: $CURRENT_STAGE ==============" | tee -a "$SUMMARY" +} + +# ============================================================ STAGE: prep +if stage_should_run prep; then + banner prep + step preparation bash sh_script/preparation.sh +fi + +# ============================================================ STAGE: format +# Mirrors .github/workflows/format.yml. The CI clippy step does NOT +# escalate warnings to errors; we match that. +if stage_should_run format; then + banner format + step fmt-check cargo fmt -- --check + step cargo-check cargo check + step clippy cargo clippy \ + --features stack-guard,virtio-vsock,virtio-serial,vmcall-interrupt +fi + +# ============================================================ STAGE: deny +# Mirrors .github/workflows/deny.yml. CI marks `sources` as +# continue-on-error; we do the same. +if stage_should_run deny; then + banner deny + if ! command -v cargo-deny >/dev/null 2>&1; then + echo " [deny] cargo-deny not installed — install with: cargo install cargo-deny" | tee -a "$SUMMARY" + exit 2 + fi + step advisories cargo deny check advisories + # sources is continue-on-error in CI + CURRENT_STAGE_LOG="$LOG_DIR/deny__sources.log" + printf ' [deny] %-50s ' "sources (continue-on-error)" | tee -a "$SUMMARY" + if cargo deny check sources >"$CURRENT_STAGE_LOG" 2>&1; then + echo "✓ PASS" | tee -a "$SUMMARY" + else + echo "⚠ fail (ignored per CI policy, log: $CURRENT_STAGE_LOG)" | tee -a "$SUMMARY" + fi + step bans cargo deny check bans +fi + +# ============================================================ STAGE: main +# Mirrors .github/workflows/main.yml: 32 cargo image builds. +# device × policy_version × protocol × build_type +if stage_should_run main; then + banner main + for device in virtio-vsock virtio-serial vmcall-vsock vmcall-raw; do + for policy_version in v1 v2; do + for protocol in tls spdm; do + for build_type in release debug; do + label="${device}-${policy_version}-${protocol}-${build_type}" + cmd=(cargo image) + if [ "$device" != "virtio-vsock" ]; then + features="stack-guard,${device}" + if [ "$protocol" = "spdm" ]; then + features="${features},spdm_attestation" + fi + cmd+=(--no-default-features --features "$features") + elif [ "$protocol" = "spdm" ]; then + cmd+=(--features spdm_attestation) + fi + if [ "$policy_version" = "v2" ]; then + cmd+=(--policy-v2 + --policy config/templates/policy_v2_signed.json + --policy-issuer-chain config/templates/policy_issuer_chain.pem) + fi + if [ "$build_type" = "debug" ]; then + cmd+=(--debug) + fi + step "$label" "${cmd[@]}" + done + done + done + done +fi + +# ============================================================ STAGE: emu +# Mirrors .github/workflows/integration-emu.yml. Some scenarios run an +# explicit `cargo build` *before* migtdemu.sh; others let migtdemu.sh +# build internally. We match the workflow exactly. +if stage_should_run emu; then + banner emu + + # CI generates all default, rotation, and revocation policy variants before + # each policy-v2 scenario. A single generation covers this local serial run. + step policy-generation ./sh_script/build_AzCVMEmu_policy_and_test.sh \ + --mock-report --skip-test + + # 1. skip-ra + step skip-ra__build cargo build \ + --features AzCVMEmu,test_disable_ra_and_accept_all --no-default-features + step skip-ra ./migtdemu.sh --skip-ra --debug --both --no-sudo --log-level info + + # 2. policy-v2 + step policy-v2 ./migtdemu.sh --policy-v2 \ + --policy-file ./config/AzCVMEmu/policy_v2_signed.json \ + --policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem \ + --mock-report --both --no-sudo --log-level info + + # 3. policy-v2-igvm + step policy-v2-igvm ./migtdemu.sh --policy-v2 \ + --policy-file ./config/AzCVMEmu/policy_v2_signed.json \ + --policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem \ + --mock-report --features igvm-attest --both --no-sudo --log-level info + + # 4. rebind-skip-ra + step rebind-skip-ra__build cargo build \ + --features AzCVMEmu,policy_v2,test_disable_ra_and_accept_all --no-default-features + step rebind-skip-ra ./migtdemu.sh --operation rebind-prepare \ + --policy-file ./config/AzCVMEmu/policy_v2_signed.json \ + --policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem \ + --skip-ra --debug --both --no-sudo --log-level info + + # 5. rebind-mock + step rebind-mock ./migtdemu.sh --operation rebind-prepare \ + --policy-file ./config/AzCVMEmu/policy_v2_signed.json \ + --policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem \ + --mock-report --both --no-sudo --log-level info + + # 6. spdm-skip-ra + export SPDM_CONFIG="$REPO_ROOT/config/spdm_config.json" + step spdm-skip-ra__build cargo build \ + --features AzCVMEmu,test_disable_ra_and_accept_all,spdm_attestation --no-default-features + step spdm-skip-ra ./migtdemu.sh --skip-ra --debug --features spdm_attestation \ + --both --no-sudo --log-level info + + # 7. spdm-policy-v2 + step spdm-policy-v2 ./migtdemu.sh --policy-v2 \ + --policy-file ./config/AzCVMEmu/policy_v2_signed.json \ + --policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem \ + --mock-report --features spdm_attestation --both --no-sudo --log-level info + + # 8. spdm-rebind-skip-ra + step spdm-rebind-skip-ra__build cargo build \ + --features AzCVMEmu,policy_v2,test_disable_ra_and_accept_all,spdm_attestation --no-default-features + step spdm-rebind-skip-ra ./migtdemu.sh --operation rebind-prepare \ + --policy-file ./config/AzCVMEmu/policy_v2_signed.json \ + --policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem \ + --skip-ra --debug --features spdm_attestation --both --no-sudo --log-level info + + # 9. mock-quote-retry + step mock-quote-retry ./migtdemu.sh --mock-report --mock-quote-retry \ + --features igvm-attest --both --no-sudo --log-level info + + # 10. policy-v2-key-rotation + step policy-v2-key-rotation ./migtdemu.sh --policy-v2 \ + --src-policy-file ./config/AzCVMEmu/policy_v2_signed_a.json \ + --src-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_a.pem \ + --dst-policy-file ./config/AzCVMEmu/policy_v2_signed_b.json \ + --dst-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_b.pem \ + --mock-report --both --no-sudo --log-level info + + # 11. policy-v2-key-rotation-igvm + step policy-v2-key-rotation-igvm ./migtdemu.sh --policy-v2 \ + --src-policy-file ./config/AzCVMEmu/policy_v2_signed_a.json \ + --src-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_a.pem \ + --dst-policy-file ./config/AzCVMEmu/policy_v2_signed_b.json \ + --dst-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_b.pem \ + --mock-report --features igvm-attest --both --no-sudo --log-level info + + # 12. spdm-policy-v2-key-rotation + step spdm-policy-v2-key-rotation ./migtdemu.sh --policy-v2 \ + --src-policy-file ./config/AzCVMEmu/policy_v2_signed_a.json \ + --src-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_a.pem \ + --dst-policy-file ./config/AzCVMEmu/policy_v2_signed_b.json \ + --dst-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_b.pem \ + --mock-report --features spdm_attestation --both --no-sudo --log-level info + + # 13. policy-v2-policy-mapping-rotation + step policy-v2-policy-mapping-rotation ./migtdemu.sh --policy-v2 \ + --src-policy-file ./config/AzCVMEmu/policy_v2_signed_a.json \ + --src-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_a.pem \ + --dst-policy-file ./config/AzCVMEmu/policy_v2_signed_pm_b.json \ + --dst-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_b.pem \ + --mock-report --both --no-sudo --log-level info + + # 14. policy-v2-all-chains-rotation + step policy-v2-all-chains-rotation ./migtdemu.sh --policy-v2 \ + --src-policy-file ./config/AzCVMEmu/policy_v2_signed_a.json \ + --src-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_a.pem \ + --dst-policy-file ./config/AzCVMEmu/policy_v2_signed_pmi_b.json \ + --dst-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_b.pem \ + --mock-report --both --no-sudo --log-level info + + # 15. policy-v2-revoked + step policy-v2-revoked__build cargo build --release \ + --features AzCVMEmu,policy_v2,test_mock_report --no-default-features + step_expect_failure_pattern policy-v2-revoked SignerRevoked \ + ./migtdemu.sh --policy-v2 \ + --src-policy-file ./config/AzCVMEmu/policy_v2_signed_revoked.json \ + --src-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem \ + --dst-policy-file ./config/AzCVMEmu/policy_v2_signed_revoked.json \ + --dst-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem \ + --mock-report --both --no-sudo --log-level info +fi + +# ============================================================ SUMMARY +{ + echo "" + echo "============== gauntlet PASSED ==============" + echo "logs: $LOG_DIR" + echo "" +} | tee -a "$SUMMARY" diff --git a/.agents/skills/migtd-spdm-transport-debug/SKILL.md b/.agents/skills/migtd-spdm-transport-debug/SKILL.md new file mode 100644 index 000000000..3635fbce6 --- /dev/null +++ b/.agents/skills/migtd-spdm-transport-debug/SKILL.md @@ -0,0 +1,445 @@ +--- +name: migtd-spdm-transport-debug +description: Debug MigTD SPDM transport and key-exchange failures during TDX migration or rebinding, especially `TRANSPORT(RECEIVE_FAIL)`, `spdm_requester_transfer_msk`, status code 6, pending receives with zero bytes, and cross-node source/destination trace mismatches. Use when MigTD reports an SPDM requester/responder transport error, when source MigTD times out waiting for a peer, or when Hyper-V migration fails before the destination MigTD receives a request. +--- + +# MigTD SPDM Transport Debugging + +Use this skill to find the first causal failure behind MigTD SPDM transport +errors. A requester-side `TRANSPORT(RECEIVE_FAIL)` is often a secondary symptom: +the source waited for a response that the destination host never produced. + +Do not diagnose this class of failure from one MigTD error line. Correlate the +source and destination host traces, both MigTD logs, deployed image hashes, and +the exact source revisions matching the test. + +## Required access and evidence + +Before analyzing code or assigning a root cause, collect or ask the user for: + +| Requirement | Why it is required | +|---|---| +| Source-node ETL | Shows request creation, bytes sent/received, cancellation, and source `MigTdLog` events. | +| Destination-node ETL | Usually contains the first host-side failure that prevented a response. | +| Source and destination MigTD serial logs | Shows whether either MigTD booted, received the request, and logged a terminal error. | +| Exact host build on each node | Determines the matching Windows OS source branch and event schema. | +| Access to the matching Windows OS source branch | File/line references in VMMS and Worker traces are meaningful only against the matching build. | +| Exact deployed MigTD repository, branch, commit/tag, and feature set | Local `main`, `integration`, or `integration2` may not match the deployed image. | +| Source and destination IGVM files and `.igvm.hash` files | Verifies that both nodes use the intended image and expected prebind hash. | +| MigTD HCS IDs, target VM IDs, migration request ID, and repro time/time zone | Required to filter concurrent health checks and unrelated migrations. | +| MigTD package/build manifest, if available | Prevents comparing traces against a locally rebuilt but different image. | + +If any branch, build, or repository is unknown, stop and ask for it. Never +silently use the currently checked-out branch as a substitute for deployed +source. + +For cross-node traces, confirm whether clocks are synchronized and normalize +timestamps to one time zone before ordering events. + +## Source repositories + +These are the source repositories used for this investigation. Agents may need +the user to grant access, provide a checkout, or identify the correct branch. + +| Repository | Access and revision requirement | Relevant source | +|---|---|---| +| Microsoft MigTD: `https://github.com/microsoft/MigTD.git` or the user's deployment fork | Use the exact deployed branch/commit/tag. Record submodule SHAs. | `src/migtd/src/bin/migtd/main.rs`, `src/migtd/src/migration/session.rs`, `src/migtd/src/migration/spdm_session.rs`, `src/migtd/src/migration/transport.rs`, `src/migtd/src/migration/mod.rs`, `src/migtd/src/spdm/`, `src/devices/vmcall_raw/src/` | +| spdm-rs: `https://github.com/ccc-spdm-tools/spdm-rs` | Use the SHA pinned by the deployed MigTD commit, not the submodule's upstream head. | `spdmlib/src/requester/context.rs`, `spdmlib/src/error.rs`, requester/responder handshake code | +| td-shim: `https://github.com/confidential-containers/td-shim` | Use the SHA pinned by the deployed MigTD commit. | `tdx-tdcall/src/tdx.rs`, `tdx-tdcall/src/lib.rs`; MigTD TDVMCALL WaitForRequest, ReportStatus, Send, and Receive leaves | +| Windows OS source (`os.2020`): `https://microsoft.visualstudio.com/DefaultCollection/OS/_git/os.2020` | Restricted Azure DevOps/GVFS repository. Ask for access and the branch matching the source and destination host build. Do not use an arbitrary OS branch because line numbers and behavior drift. | Paths listed below | +| ACC-CVM-IgvmAgent: `https://dev.azure.com/msazure/One/_git/ACC-CVM-IgvmAgent` | Optional but needed when health-check/GetTDReport or agent forwarding behavior is part of the timeline. Ask for the branch deployed on the host. | Search for `MigTdReport`, host API forwarding, and MigTD health-check code | + +Important Windows OS source paths: + +```text +src/onecore/vm/vmms/migration/vmmsvmmigrationbase.cpp +src/onecore/vm/common/migration/vmmigrationtcptransport.cpp +src/onecore/vm/common/migration/vmmigrationconnection.cpp +src/onecore/vm/worker/migration/TdxProtocol.cpp +src/onecore/vm/dv/chipset/ghci/GhciDevice.cpp +src/onecore/vm/dv/chipset/ghci/GhciRequestManager.cpp +src/onecore/vm/dv/chipset/ghci/GhciLogHandler.cpp +src/onecore/vm/dv/chipset/ghci/GhciTypes.h +src/onecore/vm/dv/chipset/ghci/*RequestContext.cpp +src/onecore/vm/test/common/powershell/PowerTest/LiveMigrationUtilities.psm1 +src/onecore/vm/test/common/powershell/PowerTest/TdxLiveMigrationUtilities.psm1 +``` + +Record provenance before reading source: + +```bash +git -C <MIGTD_ROOT> remote -v +git -C <MIGTD_ROOT> branch --show-current +git -C <MIGTD_ROOT> rev-parse HEAD +git -C <MIGTD_ROOT> submodule status deps/spdm-rs deps/td-shim +``` + +For the Windows GVFS checkout, use its supported Windows-side `git.cmd` or +GVFS tooling and record at least the remote, branch, and commit. If the agent +cannot access the checkout or hydrate a required file, ask the user rather than +guessing from another branch. + +## Tools used + +### Trace capture and decoding + +| Tool | Use | +|---|---| +| PowerShell 7 (`pwsh`) | Runs the diagnostic scripts and preserves structured event properties. | +| `wpr.exe` | Captures focused ETW traces on source and destination nodes. | +| `logman.exe query providers` | Confirms provider registration and GUIDs. | +| `tracerpt.exe` | Converts ETL to raw XML/CSV when `Get-WinEvent` cannot decode all providers. | +| `Get-WinEvent` | Reads event channels and decodes ETL events when manifests are available. | +| `wevtutil.exe` | Temporarily enables VMMS/Worker analytic channels. | +| Windows Performance Analyzer (WPA) | Manual fallback for provider/event inspection when scripted decoding is incomplete. | +| `wslpath` | Converts WSL paths before invoking Windows trace tools from WSL. | + +### Timeline and source analysis + +| Tool | Use | +|---|---| +| `rg` | Filters event timelines by request ID, VM ID, timestamps, HRESULT, file, and message. | +| `awk` | Converts `tracerpt` XML into compact chronological provider/task/data timelines. | +| `sed`, `cut`, `sort` | Normalizes fields and counts event/task names. | +| `git` and Windows/GVFS `git.cmd` | Confirms exact branches, commits, remotes, and submodule revisions. | +| `strings` | Last-resort ETL sanity check only; never use strings output as the sole diagnostic evidence. | + +### Existing MigTD diagnostic scripts + +Reuse these instead of inventing a different capture path: + +```text +.agents/skills/migtd-tip-troubleshoot/scripts/Invoke-TdxLmDiagnosticCapture.ps1 +.agents/skills/migtd-tip-troubleshoot/scripts/Invoke-GhciVDevDiagnosticCapture.ps1 +.agents/skills/migtd-tip-troubleshoot/scripts/Export-GhciVDevEvents.ps1 +.agents/skills/migtd-tip-troubleshoot/scripts/TdxLmTraceProfile.wprp +.agents/skills/migtd-tip-troubleshoot/scripts/Test-MigTdHashBinding.ps1 +.agents/skills/migtd-spdm-transport-debug/scripts/Export-MigTdMigrationTimeline.ps1 +.agents/skills/migtd-spdm-transport-debug/scripts/Compare-MigTdNodeTraces.ps1 +.agents/skills/migtd-spdm-transport-debug/scripts/Get-MigTdDeploymentProvenance.ps1 +.agents/skills/migtd-spdm-transport-debug/scripts/Test-CrossNodeMigTdBinding.ps1 +``` + +The GHCI VDev provider is: + +```text +Name: Microsoft.Windows.HyperV.GhciVDev +GUID: AEFC8638-19A2-553A-06CB-C3984FFC7EE8 +``` + +## Reusable scripted workflow + +Capture provenance on both nodes before changing mappings or packages: + +```powershell +.\Get-MigTdDeploymentProvenance.ps1 ` + -MigTdRepoPath <MIGTD_ROOT> ` + -OsRepoPath <OS_ROOT> ` + -IgvmFilePath <MIGTD.igvm> ` + -HashFilePath <MIGTD.igvm.hash> ` + -SerialLogPath <MIGTD_SERIAL.log> ` + -MigTdHcsId <MIGTD_HCS_ID> ` + -PowerTestPath <POWERTEST_PATH> ` + -OutputDir <PROVENANCE_OUTPUT> +``` + +On the destination, verify the source-required hash, runtime hash, host +mapping, and running MigTD instance before `Move-VM`: + +```powershell +.\Test-CrossNodeMigTdBinding.ps1 ` + -SourceHashFilePath <SOURCE_MIGTD.igvm.hash> ` + -DestinationSerialLogPath <DESTINATION_MIGTD_SERIAL.log> ` + -DestinationMigTdHcsId <DESTINATION_MIGTD_HCS_ID> ` + -PowerTestPath <POWERTEST_PATH> ` + -RequireRuntimeHash +``` + +After collecting source and destination ETLs, normalize both traces: + +```powershell +.\Export-MigTdMigrationTimeline.ps1 ` + -EtlPath <SOURCE.etl> ` + -Node Source ` + -OutputDir <SOURCE_TIMELINE_DIR> + +.\Export-MigTdMigrationTimeline.ps1 ` + -EtlPath <DESTINATION.etl> ` + -Node Destination ` + -OutputDir <DESTINATION_TIMELINE_DIR> +``` + +Then align the request window: + +```powershell +.\Compare-MigTdNodeTraces.ps1 ` + -SourceTimelinePath <SOURCE_TIMELINE_DIR>\migtd-migration-timeline.csv ` + -DestinationTimelinePath <DESTINATION_TIMELINE_DIR>\migtd-migration-timeline.csv ` + -RequestId <MIGRATION_REQUEST_ID> ` + -OutputDir <COMPARISON_DIR> +``` + +Use `-DestinationClockOffsetMilliseconds` only when clock comparison proves a +known offset. The comparison script marks a first destination failure +*candidate*; verify that event against the exact matching Windows OS source. + +## Investigation workflow + +### 1. Establish exact provenance + +Create a short evidence header before interpreting any event: + +```text +Source host build: +Destination host build: +Windows OS source branch/commit: +MigTD repository/branch/commit: +spdm-rs submodule SHA: +td-shim submodule SHA: +Source IGVM/hash: +Destination IGVM/hash: +Source MigTD HCS ID: +Destination MigTD HCS ID: +Target VM ID: +Migration request ID: +Trace time zone: +``` + +If source and destination host builds differ, obtain both matching OS branches +or explicitly document which side cannot be source-correlated. + +### 2. Capture both sides around one clean repro + +Start the destination capture first, then the source capture, reproduce once, +and stop both captures immediately afterward. Include: + +- VMMS, Worker, VID, VmsIf, HCL, and GHCI VDev ETW providers. +- VMMS/Worker Admin, Operational, and temporarily enabled Analytic channels. +- Both MigTD serial logs. +- Test console output. +- IGVMAgent process health when the image depends on the agent. + +Use `Invoke-TdxLmDiagnosticCapture.ps1 -CaptureEtw -EnableAnalytic` where +possible. A GHCI-only trace is useful for request sequencing but is not enough +to identify a VMMS or transport-connection failure. + +### 3. Export ETL data without discarding raw evidence + +Create the normalized cross-provider timeline: + +```powershell +.\Export-MigTdMigrationTimeline.ps1 ` + -EtlPath <TRACE.etl> ` + -Node <Source|Destination> ` + -OutputDir <OUTPUT_DIR> +``` + +For a GHCI-only provider export, use: + +```powershell +.\Export-GhciVDevEvents.ps1 ` + -EtlPath <TRACE.etl> ` + -OutputDir <OUTPUT_DIR> +``` + +For a complete raw trace: + +```powershell +tracerpt.exe <TRACE.etl> -of XML -o <TRACE.xml> -y +tracerpt.exe <TRACE.etl> -of CSV -o <TRACE.csv> -y +``` + +Keep the original ETL. Compact timelines may be retained for analysis, but do +not replace the original trace with a filtered file. + +### 4. Analyze the destination first + +The requester error says only that no acceptable response arrived. Find the +destination's first fatal event before analyzing the source timeout. + +Order destination events and answer: + +1. Did migration reach the destination host? +2. Did compatibility validation complete? +3. Which MigTD hash was supplied to target-TD prebind? +4. Was the target VM realized? +5. Was a destination `CreateTdxPrepareMigrationRequest` emitted with + `IsSource=0`? +6. Did destination MigTD send or receive any bytes for the request? +7. What is the first error before later timeout/message-order errors? + +If no destination prepare-migration request exists, the failure occurred before +destination MigTD or SPDM processing. Do not blame destination SPDM policy, +attestation, or transport code without evidence that MigTD received a request. + +Search the matching Windows OS source for the first trace file and line. Read +the surrounding function, not just the line. Line numbers from a different +branch are not reliable. + +### 5. Build the source request timeline + +Filter by the migration request ID and retain these GHCI events: + +```text +GetCachedTdInfo_Success +GetMaxReceiveBufferCapacity +CreateTdxPrepareMigrationRequest +PrepareMigrationRequest_FillBuffer +SubmitRequest_Sent +PrepareMigration_ProcessSendRequest +PrepareMigration_GetSendData +PrepareMigration_ProcessReceiveRequest_Queued +PrepareMigrationRequest_Cancel +CancelRequest +PrepareMigrationRequest_ReportStatus_AlreadyCancelled +HandleReportStatus +MigTdLog +``` + +Always report: + +- `IsSource` +- request ID in decimal and hexadecimal +- bytes sent and received +- whether send/receive entries were pending at cancellation +- cancellation HRESULT +- `PreMigrationStatus` +- all `MigTdLog` entries attached to the request + +A sequence of `Sent > 0`, `Received = 0`, queued receive, host cancellation, +and then `TRANSPORT(RECEIVE_FAIL)` means the source error was produced after +the host aborted an unanswered receive. It does not identify why the +destination failed to respond. + +### 6. Correlate source, destination, and health checks + +Produce one time-ordered table: + +| Time | Node | Provider | Request/VM | Event | Interpretation | +|---|---|---|---|---|---| + +Place the destination's first failure and the source's later cancellation in +the same table. Calculate the delay; a stable 30- or 60-second gap usually +identifies a host or session timeout boundary. + +Separate periodic `GetTDReport` health checks from migration requests by +request ID. Successful health checks before, during, or after the failure prove +that MigTD is alive and its basic GHCI request path works. They do not prove +that migration reached destination MigTD. + +### 7. Trace the software error mapping + +In the exact deployed MigTD source, follow: + +```text +handle_pre_mig + -> exchange_msk + -> migration_src_exchange_msk / migration_dst_exchange_msk + -> spdm_requester_transfer_msk / spdm_responder_transfer_msk + -> spdmlib RequesterContext::receive + -> vmcall_raw receive + -> TDVMCALL<MigTD> Receive +``` + +Current source maps: + +```text +spdmlib transport RECEIVE_FAIL + -> SpdmStatus TRANSPORT(RECEIVE_FAIL) + -> MigrationResult::SecureSessionError + -> status code 6 +``` + +Verify this mapping on the deployed branch. Do not assume status values are +unchanged. + +For a requester receive failure, inspect: + +```text +deps/spdm-rs/spdmlib/src/requester/context.rs +deps/spdm-rs/spdmlib/src/error.rs +src/migtd/src/spdm/spdm_req.rs +src/migtd/src/migration/spdm_session.rs +src/migtd/src/migration/session.rs +src/devices/vmcall_raw/src/transport/vmcall.rs +deps/td-shim/tdx-tdcall/src/tdx.rs +``` + +### 8. Verify destination MigTD mapping and runtime hash + +On the destination host: + +```powershell +Get-VmHostMigrationTdMapping +``` + +Parse the mapping and verify: + +```text +source VM's required MigTdHash -> destination MigTD HCS ID +``` + +Do not confuse: + +```text +expected host/prebind hash from .igvm.hash +actual runtime TD Info Hash printed by MigTD +outer TDREPORT SERVTD_HASH +``` + +The ETL can show the hash requested for prebind, but it may not prove the +runtime TD Info Hash of the destination MigTD. Obtain the actual value from: + +- destination MigTD serial `TD Info Hash:` output; +- the exact destination `.igvm.hash` plus matching build provenance; or +- a parsed TDREPORT obtained from an explicit `MigTdReport` request. + +### 9. Classify primary and secondary failures + +Use these rules: + +| Evidence | Classification | +|---|---| +| Destination VMMS fails before destination `CreateTdxPrepareMigrationRequest` | Host setup, mapping, prebind, realization, or connection failure; not a destination SPDM failure. | +| Destination request exists but no MigTD send/receive progress | GHCI/transport dispatch boundary. | +| Both sides exchange bytes and destination MigTD logs policy/attestation failure | MigTD/SPDM/policy failure; inspect destination log first. | +| Source receive is canceled with zero bytes after a destination error | Source `RECEIVE_FAIL` is secondary. | +| Later packet-header timeout or unexpected message ID follows an earlier error | Consequence of the first failure; do not report it as root cause. | +| Periodic GetTDReport continues succeeding | MigTD remains alive; migration-specific path failed. | + +## Current logging caveat + +On the current `integration2` implementation, production handlers for +`StartMigration`, `StartRebinding`, `GetTDReport`, `EnableLogArea`, and +`GetMigtdData` use `TRACE` for request entry and success in +`src/migtd/src/bin/migtd/main.rs`. Error paths use `ERROR`. + +Therefore, absence of an `INFO`-level `MigTdLog` entry is not proof that a +request was never handled. Prefer GHCI request events and byte counters, and +verify logging levels again on the deployed branch. + +## Required report format + +Deliver the result in this order: + +1. **Provenance**: source/destination builds, branches, commits, image hashes, + request ID, and time zone. +2. **Destination timeline**: first causal error highlighted. +3. **Source timeline**: send, pending receive, cancellation, report status, + and `MigTdLog`. +4. **Cross-node correlation**: time difference between the first destination + failure and source cancellation. +5. **Root cause**: one evidence-backed sentence. +6. **Secondary symptoms**: requester `RECEIVE_FAIL`, timeouts, and + message-order errors. +7. **Evidence gaps**: missing source access, branch, actual runtime hash, or + undecoded provider data. +8. **Corrective action**: exact mapping, deployment, source, or code change + needed to remove the first failure. + +Never report `TRANSPORT(RECEIVE_FAIL)` alone as the root cause. + +## Detailed worked example + +Read `references/spdm-receive-fail-case-study.md` for the event sequence and +reasoning from the cross-node failure that motivated this skill. diff --git a/.agents/skills/migtd-spdm-transport-debug/references/spdm-receive-fail-case-study.md b/.agents/skills/migtd-spdm-transport-debug/references/spdm-receive-fail-case-study.md new file mode 100644 index 000000000..ecb57e31e --- /dev/null +++ b/.agents/skills/migtd-spdm-transport-debug/references/spdm-receive-fail-case-study.md @@ -0,0 +1,186 @@ +# SPDM RECEIVE_FAIL Cross-Node Case Study + +This case demonstrates why source MigTD's requester error was not the original +failure. + +## Symptom + +Source MigTD logged: + +```text +exchange_msk: spdm_requester_transfer_msk error: +SpdmStatus { + severity: ERROR, + status_code: TRANSPORT(RECEIVE_FAIL), + error_data: None +} + +Failure during key exchange status code: 6 +``` + +In the matching MigTD source, status `6` was +`MigrationResult::SecureSessionError`. + +## Source sequence + +Migration request `19` (`0x13`) ran against MigTD HCS instance +`9DC12BB6-66F9-5D1A-BB9C-B7A887C4DE34`: + +```text +17:18:47.283112 GetCachedTdInfo_Success +17:18:47.402795 CreateTdxPrepareMigrationRequest + RequestId=19, IsSource=1 +17:18:47.403544 SubmitRequest_Sent +17:18:47.403983 PrepareMigration_ProcessSendRequest + Bytes=16 +17:18:47.404110 PrepareMigration_GetSendData + TotalBytesSent=16 + TotalBytesReceived=0 +17:18:47.404276 PrepareMigration_ProcessReceiveRequest_Queued + MaxPayloadSize=65524 + TotalBytesSent=16 + TotalBytesReceived=0 + +17:18:53.394723 GetTdReportRequest_Success + RequestId=20 + +17:19:17.412656 PrepareMigrationRequest_Cancel + ReceiveEntryPending=true + SendEntryPending=false + TotalBytesSent=16 + TotalBytesReceived=0 +17:19:17.412711 CancelRequest +17:19:17.419277 PrepareMigrationRequest_ReportStatus_AlreadyCancelled + ExistingStatus=0x800704C7 +17:19:17.419301 HandleReportStatus + PreMigrationStatus=0x0601 +17:19:17.419315 MigTdLog + TRANSPORT(RECEIVE_FAIL) +17:19:17.419317 MigTdLog + RequestId=0x13 + status code=6 + +17:19:23.412011 GetTdReportRequest_Success + RequestId=21 +``` + +Interpretation: + +- Source MigTD sent its initial 16 bytes. +- It received no response bytes. +- The host canceled the pending receive approximately 30 seconds later. +- The cancellation surfaced through spdm-rs as `RECEIVE_FAIL`. +- Successful health checks during and after the failure showed that source + MigTD remained alive. + +## Destination sequence + +The destination trace showed: + +```text +17:18:34.207 GetTDReport health check succeeds +17:18:47.274 Migration starts +17:18:47.294 Compatibility validation succeeds +17:18:47.370 Target TD prebind uses MigTdHash + 2F4214E871FD6037A95F71FE9F03A16A + E8E0E0C34245ACF026538A6DB57F0D41 + 45FFB780F25914C44B1484B70D0901A7 +17:18:47.396 VM realization succeeds +17:18:47.407805 VMMS fails with 0x8007000D + vmmsvmmigrationbase.cpp:7285 +17:19:04.225 Destination MigTD health check succeeds +17:19:17.411 TCP packet-header read times out, 0x800705B4 +17:19:29.422 Unexpected message ID 6, expected 38, 0x80048055 +``` + +There was no destination: + +```text +CreateTdxPrepareMigrationRequest IsSource=0 +``` + +and no destination migration `MigTdLog`. Migration never reached destination +MigTD. + +## Source-code correlation + +The exact host source matching the trace showed that +`vmmsvmmigrationbase.cpp:7285` reported: + +```text +Failed to find Migration TD instance for the given hash +``` + +The later TCP timeout and unexpected message ID occurred only after that +mapping lookup failure. + +Relevant host files were: + +```text +src/onecore/vm/vmms/migration/vmmsvmmigrationbase.cpp +src/onecore/vm/common/migration/vmmigrationtcptransport.cpp +src/onecore/vm/common/migration/vmmigrationconnection.cpp +src/onecore/vm/test/common/powershell/PowerTest/LiveMigrationUtilities.psm1 +``` + +## Root cause + +The destination host could not resolve the source VM's required MigTD hash to +a running destination MigTD instance. Because the destination never submitted +a migration request to MigTD, it never produced an SPDM response. The source +host eventually canceled its pending receive, which source MigTD reported as +`TRANSPORT(RECEIVE_FAIL)`. + +Required mapping: + +```text +2f4214e871fd6037a95f71fe9f03a16ae8e0e0c34245acf026538a6db57f0d4145ffb780f25914c44b1484b70d0901a7 + -> +9DC12BB6-66F9-5D1A-BB9C-B7A887C4DE34 +``` + +## Validation commands + +The reusable preflight command for this case is: + +```powershell +.\Test-CrossNodeMigTdBinding.ps1 ` + -SourceMigTdHash ` + 2f4214e871fd6037a95f71fe9f03a16ae8e0e0c34245acf026538a6db57f0d4145ffb780f25914c44b1484b70d0901a7 ` + -DestinationSerialLogPath .\destination-migtd.serial.log ` + -DestinationMigTdHcsId 9DC12BB6-66F9-5D1A-BB9C-B7A887C4DE34 ` + -PowerTestPath <POWERTEST_PATH> ` + -RequireRuntimeHash +``` + +The underlying destination mapping can also be inspected directly: + +```powershell +Get-VmHostMigrationTdMapping + +$expected = + '2f4214e871fd6037a95f71fe9f03a16ae8e0e0c34245acf026538a6db57f0d4145ffb780f25914c44b1484b70d0901a7' + +$mapping = (Get-VmHostMigrationTdMapping | + ConvertFrom-Json -AsHashtable).mappings + +$mapping.GetEnumerator() | Format-Table Key, Value +$mapping[$expected] +``` + +Also verify: + +1. Source and destination deployment packages contain the intended IGVM. +2. Their `.igvm.hash` values match the required mapping key. +3. Destination MigTD serial `TD Info Hash:` equals the intended runtime hash. +4. The mapping value is the HCS ID of the running destination MigTD instance. + +## Evidence limitations + +The ETL exposed the hash requested for prebind but did not prove the actual +runtime TD Info Hash of destination MigTD. That value required serial output, +the exact build artifact, or a parsed TDREPORT. + +Likewise, successful destination GetTDReport health checks proved the +destination MigTD was alive; they did not prove that the migration request +reached it. diff --git a/.agents/skills/migtd-spdm-transport-debug/scripts/Compare-MigTdNodeTraces.ps1 b/.agents/skills/migtd-spdm-transport-debug/scripts/Compare-MigTdNodeTraces.ps1 new file mode 100644 index 000000000..10103ea08 --- /dev/null +++ b/.agents/skills/migtd-spdm-transport-debug/scripts/Compare-MigTdNodeTraces.ps1 @@ -0,0 +1,297 @@ +<# +.SYNOPSIS + Align normalized source and destination MigTD migration timelines. + +.DESCRIPTION + Consumes CSV files created by Export-MigTdMigrationTimeline.ps1. It selects + a request-centered time window, applies an optional destination clock + correction, marks the first destination failure candidate and source + cancellation, and calculates their time difference. + +.EXAMPLE + .\Compare-MigTdNodeTraces.ps1 ` + -SourceTimelinePath .\source\migtd-migration-timeline.csv ` + -DestinationTimelinePath .\destination\migtd-migration-timeline.csv ` + -RequestId 19 ` + -OutputDir .\comparison +#> +[CmdletBinding()] +param( + [Parameter(Mandatory)] [string]$SourceTimelinePath, + [Parameter(Mandatory)] [string]$DestinationTimelinePath, + [string]$RequestId, + [string]$OutputDir, + [ValidateRange(0, 600)] [int]$SecondsBefore = 5, + [ValidateRange(1, 3600)] [int]$SecondsAfter = 90, + [ValidateRange(-3600000, 3600000)] + [int]$DestinationClockOffsetMilliseconds = 0 +) + +$ErrorActionPreference = 'Stop' + +function Convert-ToTimelineEvent { + param( + [Parameter(Mandatory)] [object]$Row, + [Parameter(Mandatory)] [string]$Role, + [int]$ClockOffsetMilliseconds = 0 + ) + + $rawTimestamp = if ($Row.TimestampUtc) { + [string]$Row.TimestampUtc + } else { + [string]$Row.TimeCreated + } + $timestamp = [datetimeoffset]::MinValue + if (-not [datetimeoffset]::TryParse( + $rawTimestamp, + [System.Globalization.CultureInfo]::InvariantCulture, + [System.Globalization.DateTimeStyles]::AllowWhiteSpaces, + [ref]$timestamp)) { + throw "Unable to parse timeline timestamp '$rawTimestamp'." + } + $timestamp = $timestamp.AddMilliseconds($ClockOffsetMilliseconds) + + return [pscustomobject]@{ + Timestamp = $timestamp + TimeCreated = $timestamp.ToString('o') + OriginalTimeCreated = [string]$Row.TimeCreated + Role = $Role + Node = [string]$Row.Node + Provider = [string]$Row.Provider + EventId = [string]$Row.EventId + Level = [string]$Row.Level + LevelName = [string]$Row.LevelName + Task = [string]$Row.Task + Opcode = [string]$Row.Opcode + Data = [string]$Row.Data + Marker = '' + } +} + +function Test-RequestMatch { + param( + [Parameter(Mandatory)] [object]$Event, + [Parameter(Mandatory)] [string]$Id + ) + + $escaped = [regex]::Escape($Id) + $text = "$($Event.Task) $($Event.Data)" + if ($text -match "(?i)(RequestId|MigRequestID)\s*=\s*$escaped(?:\D|$)") { + return $true + } + + $numericId = 0L + if ([long]::TryParse($Id, [ref]$numericId)) { + $hex = '0x{0:X}' -f $numericId + if ($text -match "(?i)(RequestId|MigRequestID)\s*=\s*$([regex]::Escape($hex))(?:\D|$)") { + return $true + } + } + return $false +} + +function Test-FailureEvent { + param([Parameter(Mandatory)] [object]$Event) + + if ($Event.Level -in @('1', '2')) { + return $true + } + $text = "$($Event.Task) $($Event.Data)" + if ($text -match '(?i)\b(fail(?:ed|ure)?|error|timed?\s*out|timeout|unexpected|cancel(?:ed|led|lation)?)\b') { + return $true + } + if ($text -match '(?i)0x(?:8|c)[0-9a-f]{7,15}') { + return $true + } + if ($text -match '(?i)(hresult|resulthr|status)\s*=\s*-\d+') { + return $true + } + return $false +} + +foreach ($path in @($SourceTimelinePath, $DestinationTimelinePath)) { + if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { + throw "Timeline CSV not found: $path" + } +} +$SourceTimelinePath = (Resolve-Path -LiteralPath $SourceTimelinePath).Path +$DestinationTimelinePath = + (Resolve-Path -LiteralPath $DestinationTimelinePath).Path + +if (-not $OutputDir) { + $OutputDir = Join-Path (Get-Location) 'migtd-trace-comparison' +} +New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null +$OutputDir = (Resolve-Path -LiteralPath $OutputDir).Path + +$source = @(Import-Csv -LiteralPath $SourceTimelinePath | ForEach-Object { + Convert-ToTimelineEvent -Row $_ -Role Source +}) +$destination = @(Import-Csv -LiteralPath $DestinationTimelinePath | + ForEach-Object { + Convert-ToTimelineEvent ` + -Row $_ ` + -Role Destination ` + -ClockOffsetMilliseconds $DestinationClockOffsetMilliseconds + }) + +if (-not $source.Count) { + throw "Source timeline has no events: $SourceTimelinePath" +} +if (-not $destination.Count) { + throw "Destination timeline has no events: $DestinationTimelinePath" +} + +$sourceCreateEvents = @($source | Where-Object { + $_.Task -match '(?i)CreateTdxPrepare(Migration|Rebinding)Request' +}) +$anchor = $null +if ($RequestId) { + $anchor = @($sourceCreateEvents | + Where-Object { Test-RequestMatch -Event $_ -Id $RequestId } | + Sort-Object Timestamp | + Select-Object -First 1) + if (-not $anchor.Count) { + $anchor = @($source | + Where-Object { Test-RequestMatch -Event $_ -Id $RequestId } | + Sort-Object Timestamp | + Select-Object -First 1) + } +} else { + $anchor = @($sourceCreateEvents | Sort-Object Timestamp | + Select-Object -First 1) +} + +if (-not $anchor.Count) { + throw 'No source migration/rebinding request anchor was found.' +} +$anchor = $anchor[0] + +if (-not $RequestId) { + $requestMatch = [regex]::Match( + "$($anchor.Task) $($anchor.Data)", + '(?i)RequestId\s*=\s*(\d+)' + ) + if ($requestMatch.Success) { + $RequestId = $requestMatch.Groups[1].Value + } +} + +$windowStart = $anchor.Timestamp.AddSeconds(-$SecondsBefore) +$windowEnd = $anchor.Timestamp.AddSeconds($SecondsAfter) +$selectedSource = @($source | Where-Object { + $_.Timestamp -ge $windowStart -and $_.Timestamp -le $windowEnd +}) +$selectedDestination = @($destination | Where-Object { + $_.Timestamp -ge $windowStart -and $_.Timestamp -le $windowEnd +}) + +$destinationFailure = @($selectedDestination | + Where-Object { $_.Timestamp -ge $anchor.Timestamp } | + Where-Object { Test-FailureEvent $_ } | + Sort-Object Timestamp | + Select-Object -First 1) +if ($destinationFailure.Count) { + $destinationFailure = $destinationFailure[0] + $destinationFailure.Marker = 'FIRST_DESTINATION_FAILURE_CANDIDATE' +} else { + $destinationFailure = $null +} + +$sourceCancelCandidates = @($selectedSource | Where-Object { + $_.Task -match '(?i)(PrepareMigrationRequest_Cancel|CancelRequest)' +} | Sort-Object Timestamp) +$sourceCancel = @() +if ($RequestId) { + $sourceCancel = @($sourceCancelCandidates | + Where-Object { Test-RequestMatch -Event $_ -Id $RequestId } | + Select-Object -First 1) +} +if (-not $sourceCancel.Count) { + $sourceCancel = @($sourceCancelCandidates | Select-Object -First 1) +} +if ($sourceCancel.Count) { + $sourceCancel = $sourceCancel[0] + $sourceCancel.Marker = 'SOURCE_CANCELLATION' +} else { + $sourceCancel = $null +} + +foreach ($event in @($selectedSource | Where-Object { + $_.Task -eq 'MigTdLog' -and + (-not $RequestId -or (Test-RequestMatch -Event $_ -Id $RequestId) -or + $_.Data -match 'MigRequestID=0xFFFFFFFFFFFFFFFF') + })) { + if (-not $event.Marker) { + $event.Marker = 'MIGTD_LOG' + } +} + +$combined = @($selectedSource + $selectedDestination | + Sort-Object Timestamp, Role) +$csvPath = Join-Path $OutputDir 'combined-timeline.csv' +$textPath = Join-Path $OutputDir 'combined-timeline.txt' +$summaryPath = Join-Path $OutputDir 'summary.json' + +$combined | Select-Object TimeCreated, OriginalTimeCreated, Role, Node, + Provider, EventId, Level, LevelName, Task, Data, Marker | + Export-Csv -LiteralPath $csvPath -NoTypeInformation +$combined | ForEach-Object { + '{0} | {1} | {2} | L{3} {4} | {5} | {6} | {7}' -f + $_.TimeCreated, $_.Role, $_.Marker, $_.Level, $_.LevelName, + $_.Provider, $_.Task, $_.Data +} | Set-Content -LiteralPath $textPath + +$delayMilliseconds = $null +if ($destinationFailure -and $sourceCancel) { + $delayMilliseconds = + ($sourceCancel.Timestamp - $destinationFailure.Timestamp).TotalMilliseconds +} + +$summary = [ordered]@{ + RequestId = $RequestId + AnchorTime = $anchor.TimeCreated + WindowStart = $windowStart.ToString('o') + WindowEnd = $windowEnd.ToString('o') + DestinationClockOffsetMilliseconds = $DestinationClockOffsetMilliseconds + SourceEventCount = $selectedSource.Count + DestinationEventCount = $selectedDestination.Count + FirstDestinationFailureCandidate = if ($destinationFailure) { + [ordered]@{ + Time = $destinationFailure.TimeCreated + Provider = $destinationFailure.Provider + Task = $destinationFailure.Task + Data = $destinationFailure.Data + } + } else { + $null + } + SourceCancellation = if ($sourceCancel) { + [ordered]@{ + Time = $sourceCancel.TimeCreated + Task = $sourceCancel.Task + Data = $sourceCancel.Data + } + } else { + $null + } + FailureToCancellationDelayMilliseconds = $delayMilliseconds + Warning = 'The first destination failure is a candidate. Confirm it against the exact matching Windows OS source branch before assigning root cause.' + CombinedTimelineCsv = $csvPath + CombinedTimelineText = $textPath +} +$summary | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $summaryPath + +Write-Host "Request anchor: $($anchor.TimeCreated) RequestId=$RequestId" +if ($destinationFailure) { + Write-Host "First destination failure candidate: $($destinationFailure.TimeCreated) $($destinationFailure.Task)" +} else { + Write-Warning 'No destination failure candidate was found in the selected window.' +} +if ($sourceCancel) { + Write-Host "Source cancellation: $($sourceCancel.TimeCreated)" +} +if ($null -ne $delayMilliseconds) { + Write-Host ('Failure-to-cancellation delay: {0:N3} ms' -f $delayMilliseconds) +} +Write-Host "Cross-node comparison: $OutputDir" diff --git a/.agents/skills/migtd-spdm-transport-debug/scripts/Export-MigTdMigrationTimeline.ps1 b/.agents/skills/migtd-spdm-transport-debug/scripts/Export-MigTdMigrationTimeline.ps1 new file mode 100644 index 000000000..fdf4caec4 --- /dev/null +++ b/.agents/skills/migtd-spdm-transport-debug/scripts/Export-MigTdMigrationTimeline.ps1 @@ -0,0 +1,336 @@ +<# +.SYNOPSIS + Export a normalized MigTD/Hyper-V migration timeline from an ETL trace. + +.DESCRIPTION + Uses tracerpt.exe to decode an ETL, then streams the XML and writes selected + Hyper-V events as CSV, CLIXML, JSON summary, and compact text. By default, + only migration-relevant events from Hyper-V and GHCI providers are retained. + +.EXAMPLE + .\Export-MigTdMigrationTimeline.ps1 ` + -EtlPath .\td_source.etl ` + -Node Source ` + -OutputDir .\source-timeline + +.EXAMPLE + .\Export-MigTdMigrationTimeline.ps1 ` + -EtlPath .\td_dest.etl ` + -Node Destination ` + -OutputDir .\destination-timeline ` + -IncludeAllEvents ` + -KeepXml +#> +[CmdletBinding()] +param( + [Parameter(Mandatory)] [string]$EtlPath, + [string]$OutputDir, + [string]$Node = $env:COMPUTERNAME, + [string]$ProviderPattern = '(?i)(Hyper|Ghci)', + [string]$EventPattern = '(?i)(mig|tdx|servtd|ghci|bind|compat|request|send|receive|cancel|timeout|error|fail|connect|message|report|status|prebind|rebind)', + [switch]$IncludeAllEvents, + [switch]$KeepXml, + [ValidateRange(64, 65536)] [int]$MaxDataValueLength = 1024 +) + +$ErrorActionPreference = 'Stop' + +function Get-XmlChildText { + param( + [AllowNull()] [System.Xml.XmlNode]$Parent, + [Parameter(Mandatory)] [string]$Name + ) + + if (-not $Parent) { + return '' + } + $child = @($Parent.ChildNodes | Where-Object LocalName -eq $Name | + Select-Object -First 1) + if ($child.Count -eq 0) { + return '' + } + return [string]$child[0].InnerText +} + +function Get-XmlAttribute { + param( + [AllowNull()] [System.Xml.XmlNode]$Node, + [Parameter(Mandatory)] [string]$Name + ) + + if (-not $Node -or -not $Node.Attributes) { + return '' + } + $attribute = $Node.Attributes[$Name] + if (-not $attribute) { + return '' + } + return [string]$attribute.Value +} + +function Convert-DataValue { + param([AllowNull()] [string]$Value) + + if ($null -eq $Value) { + return '' + } + $normalized = $Value -replace '[\r\n\t]+', ' ' + if ($normalized.Length -gt $MaxDataValueLength) { + return $normalized.Substring(0, $MaxDataValueLength) + '...' + } + return $normalized +} + +if (-not (Test-Path -LiteralPath $EtlPath -PathType Leaf)) { + throw "ETL file not found: $EtlPath" +} +$EtlPath = (Resolve-Path -LiteralPath $EtlPath).Path + +if (-not $OutputDir) { + $OutputDir = Join-Path ` + (Split-Path -Parent $EtlPath) ` + ((Split-Path -LeafBase $EtlPath) + '-migration-timeline') +} +New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null +$OutputDir = (Resolve-Path -LiteralPath $OutputDir).Path + +$tracerpt = Get-Command tracerpt.exe -ErrorAction Stop +$xmlPath = Join-Path $OutputDir 'tracerpt.xml' +$tracerptLogPath = Join-Path $OutputDir 'tracerpt.log' +$csvPath = Join-Path $OutputDir 'migtd-migration-timeline.csv' +$clixmlPath = Join-Path $OutputDir 'migtd-migration-timeline.clixml' +$textPath = Join-Path $OutputDir 'migtd-migration-timeline.txt' +$summaryPath = Join-Path $OutputDir 'summary.json' + +& $tracerpt.Source $EtlPath -of XML -o $xmlPath -y *> $tracerptLogPath +if ($LASTEXITCODE -ne 0) { + throw "tracerpt failed to decode $EtlPath. See $tracerptLogPath." +} + +$events = [System.Collections.Generic.List[object]]::new() +$decodedEventCount = 0 +$readerSettings = [System.Xml.XmlReaderSettings]::new() +$readerSettings.DtdProcessing = [System.Xml.DtdProcessing]::Prohibit +$readerSettings.XmlResolver = $null +$reader = [System.Xml.XmlReader]::Create($xmlPath, $readerSettings) + +try { + while ($reader.Read()) { + if ($reader.NodeType -ne [System.Xml.XmlNodeType]::Element -or + $reader.LocalName -ne 'Event') { + continue + } + + $eventXml = $reader.ReadOuterXml() + if (-not $eventXml) { + continue + } + $decodedEventCount++ + + try { + [xml]$document = $eventXml + } + catch { + Write-Warning "Skipping malformed event XML at decoded event $decodedEventCount." + continue + } + + $event = $document.DocumentElement + $system = @($event.ChildNodes | Where-Object LocalName -eq 'System' | + Select-Object -First 1) + if ($system.Count -eq 0) { + continue + } + $system = $system[0] + + $providerNode = @($system.ChildNodes | Where-Object LocalName -eq 'Provider' | + Select-Object -First 1) + $timeNode = @($system.ChildNodes | Where-Object LocalName -eq 'TimeCreated' | + Select-Object -First 1) + $executionNode = @($system.ChildNodes | Where-Object LocalName -eq 'Execution' | + Select-Object -First 1) + + $provider = if ($providerNode.Count) { + Get-XmlAttribute $providerNode[0] 'Name' + } else { + '' + } + $providerGuid = if ($providerNode.Count) { + Get-XmlAttribute $providerNode[0] 'Guid' + } else { + '' + } + if ($provider -notmatch $ProviderPattern -and + $providerGuid -notmatch $ProviderPattern) { + continue + } + + $dataPairs = [System.Collections.Generic.List[string]]::new() + $eventData = @($event.ChildNodes | Where-Object LocalName -eq 'EventData' | + Select-Object -First 1) + if ($eventData.Count) { + $unnamedIndex = 0 + foreach ($dataNode in @($eventData[0].GetElementsByTagName('Data'))) { + $name = Get-XmlAttribute $dataNode 'Name' + if (-not $name) { + $name = "Data$unnamedIndex" + $unnamedIndex++ + } + $value = Convert-DataValue ([string]$dataNode.InnerText) + $dataPairs.Add("$name=$value") + $signedValue = 0L + if ($name -match '(?i)(hresult|resulthr)$' -and + [int64]::TryParse($value.Trim(), [ref]$signedValue)) { + $numericValue = if ($signedValue -lt 0) { + [uint64]($signedValue + 0x100000000) + } else { + [uint64]$signedValue + } + $dataPairs.Add( + ('{0}Hex=0x{1:X8}' -f $name, $numericValue) + ) + } + } + } + + $userData = @($event.ChildNodes | Where-Object LocalName -eq 'UserData' | + Select-Object -First 1) + if ($userData.Count) { + foreach ($dataNode in @($userData[0].GetElementsByTagName('*') | + Where-Object { + $_.NodeType -eq [System.Xml.XmlNodeType]::Element -and + -not @($_.ChildNodes | Where-Object { + $_.NodeType -eq [System.Xml.XmlNodeType]::Element + }).Count + })) { + $name = [string]$dataNode.LocalName + $value = Convert-DataValue ([string]$dataNode.InnerText) + $dataPairs.Add("$name=$value") + } + } + + $renderingInfo = @($event.ChildNodes | + Where-Object LocalName -eq 'RenderingInfo' | + Select-Object -First 1) + $renderingInfo = if ($renderingInfo.Count) { + $renderingInfo[0] + } else { + $null + } + $renderedTask = Get-XmlChildText $renderingInfo 'Task' + $renderedOpcode = Get-XmlChildText $renderingInfo 'Opcode' + $renderedLevel = Get-XmlChildText $renderingInfo 'Level' + $message = Get-XmlChildText $renderingInfo 'Message' + if ($message) { + $dataPairs.Add('Message=' + (Convert-DataValue $message)) + } + + $task = if ($renderedTask) { + $renderedTask + } else { + Get-XmlChildText $system 'Task' + } + $opcode = if ($renderedOpcode) { + $renderedOpcode + } else { + Get-XmlChildText $system 'Opcode' + } + $level = Get-XmlChildText $system 'Level' + $eventId = Get-XmlChildText $system 'EventID' + $data = $dataPairs -join '; ' + $relevanceText = "$provider $task $opcode $data" + $isErrorLevel = $level -in @('1', '2') + if (-not $IncludeAllEvents -and + -not $isErrorLevel -and + $relevanceText -notmatch $EventPattern) { + continue + } + + $timeCreated = if ($timeNode.Count) { + Get-XmlAttribute $timeNode[0] 'SystemTime' + } else { + '' + } + $timestamp = [datetimeoffset]::MinValue + if ($timeCreated) { + [datetimeoffset]::TryParse( + $timeCreated, + [System.Globalization.CultureInfo]::InvariantCulture, + [System.Globalization.DateTimeStyles]::AllowWhiteSpaces, + [ref]$timestamp + ) | Out-Null + } + + $processId = if ($executionNode.Count) { + Get-XmlAttribute $executionNode[0] 'ProcessID' + } else { + '' + } + $threadId = if ($executionNode.Count) { + Get-XmlAttribute $executionNode[0] 'ThreadID' + } else { + '' + } + + $events.Add([pscustomobject]@{ + TimeCreated = $timeCreated + TimestampUtc = if ($timestamp -ne [datetimeoffset]::MinValue) { + $timestamp.UtcDateTime.ToString('o') + } else { + '' + } + Node = $Node + Provider = $provider + ProviderGuid = $providerGuid + EventId = $eventId + Level = $level + LevelName = $renderedLevel + Task = $task + Opcode = $opcode + ProcessId = $processId + ThreadId = $threadId + Data = $data + }) + } +} +finally { + $reader.Dispose() +} + +$orderedEvents = @($events | Sort-Object { + if ($_.TimestampUtc) { + [datetimeoffset]::Parse($_.TimestampUtc) + } else { + [datetimeoffset]::MaxValue + } +}) + +$orderedEvents | Export-Csv -LiteralPath $csvPath -NoTypeInformation +$orderedEvents | Export-Clixml -LiteralPath $clixmlPath +$orderedEvents | ForEach-Object { + '{0} | {1} | L{2} {3} | {4} | {5} | {6}' -f + $_.TimeCreated, $_.Node, $_.Level, $_.LevelName, $_.Provider, + $_.Task, $_.Data +} | Set-Content -LiteralPath $textPath + +$summary = [ordered]@{ + EtlPath = $EtlPath + Node = $Node + DecodedEventCount = $decodedEventCount + SelectedEventCount = $orderedEvents.Count + ProviderPattern = $ProviderPattern + EventPattern = if ($IncludeAllEvents) { $null } else { $EventPattern } + FirstEvent = if ($orderedEvents.Count) { $orderedEvents[0].TimeCreated } else { $null } + LastEvent = if ($orderedEvents.Count) { $orderedEvents[-1].TimeCreated } else { $null } + CsvPath = $csvPath + ClixmlPath = $clixmlPath + TextPath = $textPath +} +$summary | ConvertTo-Json -Depth 4 | Set-Content -LiteralPath $summaryPath + +if (-not $KeepXml) { + Remove-Item -LiteralPath $xmlPath -Force +} + +Write-Host "Selected $($orderedEvents.Count) of $decodedEventCount decoded events." +Write-Host "Migration timeline: $OutputDir" diff --git a/.agents/skills/migtd-spdm-transport-debug/scripts/Get-MigTdDeploymentProvenance.ps1 b/.agents/skills/migtd-spdm-transport-debug/scripts/Get-MigTdDeploymentProvenance.ps1 new file mode 100644 index 000000000..da64e89bc --- /dev/null +++ b/.agents/skills/migtd-spdm-transport-debug/scripts/Get-MigTdDeploymentProvenance.ps1 @@ -0,0 +1,445 @@ +<# +.SYNOPSIS + Capture MigTD deployment, host, repository, image, hash, and mapping provenance. + +.DESCRIPTION + Writes a reusable JSON/CLIXML/text bundle describing the host build, supplied + repositories, IGVM artifacts, `.igvm.hash` files, serial TD Info Hash values, + host MigTD mappings, and optional running HCS systems. + +.EXAMPLE + .\Get-MigTdDeploymentProvenance.ps1 ` + -MigTdRepoPath C:\src\MigTD ` + -OsRepoPath C:\src\os.2020 ` + -IgvmFilePath .\test-migtd-accept-all.igvm ` + -HashFilePath .\test-migtd-accept-all.igvm.hash ` + -SerialLogPath .\tipmigtd.serial.log ` + -MigTdHcsId 9DC12BB6-66F9-5D1A-BB9C-B7A887C4DE34 ` + -PowerTestPath 'C:\Program Files\WindowsPowerShell\Modules\PowerTest' +#> +[CmdletBinding()] +param( + [string[]]$IgvmFilePath, + [string[]]$HashFilePath, + [string[]]$SerialLogPath, + [string[]]$MigTdHcsId, + [string]$MigTdRepoPath, + [string]$OsRepoPath, + [string]$IgvmAgentRepoPath, + [string]$PowerTestPath, + [string]$HcsTestPath, + [string]$OutputDir, + [switch]$SkipHostMappings, + [switch]$SkipHcsSystems +) + +$ErrorActionPreference = 'Stop' + +function Get-ResolvedPathOrNull { + param([AllowNull()] [string]$Path) + + if (-not $Path -or -not (Test-Path -LiteralPath $Path)) { + return $null + } + $resolved = Resolve-Path -LiteralPath $Path + if ($resolved.ProviderPath) { + return $resolved.ProviderPath + } + return $resolved.Path +} + +function Invoke-GitText { + param( + [Parameter(Mandatory)] [string]$RepositoryPath, + [Parameter(Mandatory)] [string[]]$GitArguments + ) + + $wrapper = Join-Path $RepositoryPath 'git.cmd' + $stderrPath = [System.IO.Path]::GetTempFileName() + try { + if (Test-Path -LiteralPath $wrapper -PathType Leaf) { + Push-Location $RepositoryPath + try { + $output = @(& $wrapper @GitArguments 2> $stderrPath) + $exitCode = $LASTEXITCODE + } + finally { + Pop-Location + } + } else { + $git = Get-Command git -ErrorAction Stop + $output = @(& $git.Source -C $RepositoryPath @GitArguments 2> $stderrPath) + $exitCode = $LASTEXITCODE + } + $stderr = if (Test-Path -LiteralPath $stderrPath) { + @(Get-Content -LiteralPath $stderrPath) + } else { + @() + } + } + catch { + return [pscustomobject]@{ + Success = $false + Text = $null + Error = $_.Exception.Message + } + } + finally { + Remove-Item -LiteralPath $stderrPath -Force -ErrorAction SilentlyContinue + } + + $text = ($output | ForEach-Object { [string]$_ } | + Where-Object { $_.Trim() } | Select-Object -Last 1) + return [pscustomobject]@{ + Success = ($exitCode -eq 0) + Text = if ($exitCode -eq 0) { $text } else { $null } + Error = if ($exitCode -eq 0) { + $null + } else { + (@($stderr + $output) -join [Environment]::NewLine) + } + } +} + +function Get-GitProvenance { + param( + [Parameter(Mandatory)] [string]$Name, + [AllowNull()] [string]$Path + ) + + $resolvedPath = Get-ResolvedPathOrNull $Path + if (-not $resolvedPath) { + return [pscustomobject]@{ + Name = $Name + Path = $Path + Available = $false + Remote = $null + Branch = $null + Commit = $null + Dirty = $null + Error = if ($Path) { 'Repository path not found.' } else { 'Not supplied.' } + } + } + + $gitPath = $resolvedPath + if ((Test-Path -LiteralPath (Join-Path $resolvedPath 'git.cmd') -PathType Leaf) -and + (Test-Path -LiteralPath (Join-Path $resolvedPath 'src') -PathType Container)) { + $gitPath = Join-Path $resolvedPath 'src' + } + $remote = Invoke-GitText $gitPath @('remote', 'get-url', 'origin') + $branch = Invoke-GitText $gitPath @('branch', '--show-current') + $commit = Invoke-GitText $gitPath @('rev-parse', 'HEAD') + $status = Invoke-GitText $gitPath @('status', '--porcelain') + $errors = @(@($remote, $branch, $commit, $status) | + Where-Object { -not $_.Success -and $_.Error } | + ForEach-Object { $_.Error }) + + return [pscustomobject]@{ + Name = $Name + Path = $resolvedPath + Available = ($commit.Success) + Remote = $remote.Text + Branch = $branch.Text + Commit = $commit.Text + Dirty = if ($status.Success) { [bool]$status.Text } else { $null } + Error = if ($errors.Count) { $errors -join ' | ' } else { $null } + } +} + +function Get-FileProvenance { + param( + [Parameter(Mandatory)] [string]$Kind, + [Parameter(Mandatory)] [string]$Path + ) + + if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { + return [pscustomobject]@{ + Kind = $Kind + Path = $Path + Available = $false + Length = $null + LastWriteTimeUtc = $null + Sha256 = $null + MigTdHash = $null + Error = 'File not found.' + } + } + + $resolvedPath = Get-ResolvedPathOrNull $Path + $item = Get-Item -LiteralPath $resolvedPath + $sha256 = ((Get-FileHash ` + -LiteralPath $resolvedPath ` + -Algorithm SHA256).Hash).ToLowerInvariant() + $migTdHash = $null + $errorMessage = $null + if ($Kind -eq 'HashFile') { + $value = (Get-Content -LiteralPath $resolvedPath -Raw).Trim() + if ($value -match '^[0-9a-fA-F]{96}$') { + $migTdHash = $value.ToLowerInvariant() + } else { + $errorMessage = 'Hash file does not contain exactly 96 hexadecimal characters.' + } + } + + return [pscustomobject]@{ + Kind = $Kind + Path = $resolvedPath + Available = $true + Length = $item.Length + LastWriteTimeUtc = $item.LastWriteTimeUtc.ToString('o') + Sha256 = $sha256 + MigTdHash = $migTdHash + Error = $errorMessage + } +} + +function Get-SerialHashProvenance { + param([Parameter(Mandatory)] [string]$Path) + + if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { + return [pscustomobject]@{ + Path = $Path + Available = $false + TdInfoHashes = @() + LastTdInfoHash = $null + Error = 'Serial log not found.' + } + } + + $resolvedPath = Get-ResolvedPathOrNull $Path + $matches = @(Select-String ` + -LiteralPath $resolvedPath ` + -Pattern 'TD Info Hash:\s*([0-9a-fA-F]{96})') + $hashes = @($matches | ForEach-Object { + $_.Matches[0].Groups[1].Value.ToLowerInvariant() + }) + return [pscustomobject]@{ + Path = $resolvedPath + Available = $true + TdInfoHashes = $hashes + LastTdInfoHash = if ($hashes.Count) { $hashes[-1] } else { $null } + Error = if ($hashes.Count) { + $null + } else { + 'No TD Info Hash line was found.' + } + } +} + +function Import-PowerTestMappingModule { + if (Get-Command Get-VmHostMigrationTdMapping -ErrorAction SilentlyContinue) { + return + } + if (-not $PowerTestPath) { + throw 'Get-VmHostMigrationTdMapping is unavailable and -PowerTestPath was not supplied.' + } + $modulePath = Join-Path $PowerTestPath 'LiveMigrationUtilities.psm1' + if (-not (Test-Path -LiteralPath $modulePath -PathType Leaf)) { + throw "PowerTest module file not found: $modulePath" + } + Import-Module $modulePath -Global -Force -DisableNameChecking +} + +function Get-MappingProvenance { + try { + Import-PowerTestMappingModule + $raw = (@(Get-VmHostMigrationTdMapping) -join '').Trim() + if (-not $raw) { + return [pscustomobject]@{ + Available = $true + RawJson = $raw + Entries = @() + Error = $null + } + } + + $parsed = $raw | ConvertFrom-Json -AsHashtable -ErrorAction Stop + $entries = [System.Collections.Generic.List[object]]::new() + if ($parsed.ContainsKey('mappings') -and $parsed.mappings) { + foreach ($entry in $parsed.mappings.GetEnumerator()) { + $entries.Add([pscustomobject]@{ + MigTdHash = ([string]$entry.Key).ToLowerInvariant() + MigTdHcsId = [string]$entry.Value + }) + } + } + return [pscustomobject]@{ + Available = $true + RawJson = $raw + Entries = @($entries) + Error = $null + } + } + catch { + return [pscustomobject]@{ + Available = $false + RawJson = $null + Entries = @() + Error = $_.Exception.Message + } + } +} + +function Import-HcsTestModule { + if (Get-Command Get-HcsSystem -ErrorAction SilentlyContinue) { + return + } + if ($HcsTestPath) { + Import-Module $HcsTestPath ` + -ArgumentList @{ UseVersion2 = $true } ` + -Global ` + -Force + } else { + Import-Module HCSTest ` + -ArgumentList @{ UseVersion2 = $true } ` + -Global ` + -Force + } +} + +function Get-HcsSystemProvenance { + param([Parameter(Mandatory)] [string]$Id) + + $system = $null + try { + Import-HcsTestModule + $system = Get-HcsSystem -Id $Id -ErrorAction Stop + $rawProperties = Get-HcsSystemProperties -System $system -RawJson + $properties = $rawProperties | ConvertFrom-Json + return [pscustomobject]@{ + Id = $Id + Available = $true + State = [string]$properties.State + RuntimeId = [string]$properties.RuntimeId + IsClosed = [bool]$system.IsClosed + Error = $null + } + } + catch { + return [pscustomobject]@{ + Id = $Id + Available = $false + State = $null + RuntimeId = $null + IsClosed = $null + Error = $_.Exception.Message + } + } + finally { + if ($system -and -not $system.IsClosed) { + $system.Close() + } + } +} + +$timestamp = Get-Date -Format 'yyyyMMdd-HHmmss' +if (-not $OutputDir) { + $OutputDir = Join-Path ` + (Get-Location) ` + "migtd-provenance-$($env:COMPUTERNAME)-$timestamp" +} +New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null +$OutputDir = (Resolve-Path -LiteralPath $OutputDir).Path + +$osRegistry = Get-ItemProperty ` + 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' +$hostInfo = [pscustomobject]@{ + ComputerName = $env:COMPUTERNAME + CapturedAt = [datetimeoffset]::Now.ToString('o') + ProductName = [string]$osRegistry.ProductName + DisplayVersion = [string]$osRegistry.DisplayVersion + CurrentBuild = [string]$osRegistry.CurrentBuildNumber + Ubr = [string]$osRegistry.UBR + BuildLabEx = [string]$osRegistry.BuildLabEx + PowerShellVersion = $PSVersionTable.PSVersion.ToString() + PowerShellEdition = $PSVersionTable.PSEdition +} + +$repositories = @( + Get-GitProvenance -Name MigTD -Path $MigTdRepoPath + Get-GitProvenance -Name WindowsOS -Path $OsRepoPath + Get-GitProvenance -Name IgvmAgent -Path $IgvmAgentRepoPath +) + +$files = [System.Collections.Generic.List[object]]::new() +foreach ($path in @($IgvmFilePath | Where-Object { $_ })) { + $files.Add((Get-FileProvenance -Kind Igvm -Path $path)) +} +foreach ($path in @($HashFilePath | Where-Object { $_ })) { + $files.Add((Get-FileProvenance -Kind HashFile -Path $path)) +} + +$serialLogs = @($SerialLogPath | Where-Object { $_ } | + ForEach-Object { Get-SerialHashProvenance -Path $_ }) +$mappings = if ($SkipHostMappings) { + [pscustomobject]@{ + Available = $false + RawJson = $null + Entries = @() + Error = 'Skipped by caller.' + } +} else { + Get-MappingProvenance +} +$hcsSystems = if ($SkipHcsSystems) { + @() +} else { + @($MigTdHcsId | Where-Object { $_ } | + ForEach-Object { Get-HcsSystemProvenance -Id $_ }) +} + +$tools = @('wpr.exe', 'tracerpt.exe', 'logman.exe', 'wevtutil.exe', 'git') | + ForEach-Object { + $command = Get-Command $_ -ErrorAction SilentlyContinue + [pscustomobject]@{ + Name = $_ + Available = [bool]$command + Path = if ($command) { $command.Source } else { $null } + Version = if ($command -and $command.Version) { + $command.Version.ToString() + } else { + $null + } + } + } + +$provenance = [ordered]@{ + Host = $hostInfo + Repositories = $repositories + Files = @($files) + SerialLogs = $serialLogs + HostMappings = $mappings + HcsSystems = @($hcsSystems) + Tools = @($tools) +} + +$jsonPath = Join-Path $OutputDir 'migtd-deployment-provenance.json' +$clixmlPath = Join-Path $OutputDir 'migtd-deployment-provenance.clixml' +$textPath = Join-Path $OutputDir 'migtd-deployment-provenance.txt' +$provenance | ConvertTo-Json -Depth 10 | Set-Content -LiteralPath $jsonPath +$provenance | Export-Clixml -LiteralPath $clixmlPath +@( + '=== Host ===' + ($hostInfo | Format-List | Out-String).TrimEnd() + '' + '=== Repositories ===' + ($repositories | Format-Table -AutoSize | Out-String).TrimEnd() + '' + '=== Files ===' + (@($files) | Format-Table -AutoSize | Out-String).TrimEnd() + '' + '=== Serial hashes ===' + ($serialLogs | Format-List | Out-String).TrimEnd() + '' + '=== Host mappings ===' + ($mappings | Format-List | Out-String).TrimEnd() + ($mappings.Entries | Format-Table -AutoSize | Out-String).TrimEnd() + '' + '=== HCS systems ===' + ($hcsSystems | Format-Table -AutoSize | Out-String).TrimEnd() + '' + '=== Tools ===' + (@($tools) | Format-Table -AutoSize | Out-String).TrimEnd() +) | Set-Content -LiteralPath $textPath + +Write-Host "MigTD deployment provenance: $OutputDir" diff --git a/.agents/skills/migtd-spdm-transport-debug/scripts/Test-CrossNodeMigTdBinding.ps1 b/.agents/skills/migtd-spdm-transport-debug/scripts/Test-CrossNodeMigTdBinding.ps1 new file mode 100644 index 000000000..2ae72c168 --- /dev/null +++ b/.agents/skills/migtd-spdm-transport-debug/scripts/Test-CrossNodeMigTdBinding.ps1 @@ -0,0 +1,269 @@ +<# +.SYNOPSIS + Preflight a destination host's cross-node MigTD hash binding. + +.DESCRIPTION + Run this on the destination node before Move-VM. It verifies that the source + VM's required MigTdHash matches the destination MigTD hash evidence, that the + destination host mapping contains the hash, and that the mapping points to + the intended running MigTD HCS instance. + +.EXAMPLE + .\Test-CrossNodeMigTdBinding.ps1 ` + -SourceHashFilePath .\source-migtd.igvm.hash ` + -DestinationSerialLogPath .\destination-migtd.serial.log ` + -DestinationMigTdHcsId 9DC12BB6-66F9-5D1A-BB9C-B7A887C4DE34 ` + -PowerTestPath 'C:\Program Files\WindowsPowerShell\Modules\PowerTest' + +.EXAMPLE + .\Test-CrossNodeMigTdBinding.ps1 ` + -SourceMigTdHash 2f4214e871fd6037a95f71fe9f03a16ae8e0e0c34245acf026538a6db57f0d4145ffb780f25914c44b1484b70d0901a7 ` + -DestinationHashFilePath .\destination-migtd.igvm.hash ` + -DestinationMigTdHcsId 9DC12BB6-66F9-5D1A-BB9C-B7A887C4DE34 ` + -MappingJsonPath .\destination-mappings.json ` + -SkipRunningCheck +#> +[CmdletBinding()] +param( + [string]$SourceMigTdHash, + [string]$SourceHashFilePath, + [string]$DestinationTdInfoHash, + [string]$DestinationSerialLogPath, + [string]$DestinationHashFilePath, + [Parameter(Mandatory)] [string]$DestinationMigTdHcsId, + [string]$MappingJsonPath, + [string]$PowerTestPath, + [string]$HcsTestPath, + [string]$OutputPath, + [switch]$RequireRuntimeHash, + [switch]$SkipRunningCheck +) + +$ErrorActionPreference = 'Stop' + +function Normalize-MigTdHash { + param( + [Parameter(Mandatory)] [string]$Value, + [Parameter(Mandatory)] [string]$Description + ) + + $normalized = $Value.Trim().ToLowerInvariant() + if ($normalized -notmatch '^[0-9a-f]{96}$') { + throw "$Description must contain exactly 96 hexadecimal characters." + } + return $normalized +} + +function Read-MigTdHashFile { + param( + [Parameter(Mandatory)] [string]$Path, + [Parameter(Mandatory)] [string]$Description + ) + + if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { + throw "$Description not found: $Path" + } + return Normalize-MigTdHash ` + -Value (Get-Content -LiteralPath $Path -Raw) ` + -Description $Description +} + +function Read-SerialTdInfoHash { + param([Parameter(Mandatory)] [string]$Path) + + if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { + throw "Destination serial log not found: $Path" + } + $match = Select-String ` + -LiteralPath $Path ` + -Pattern 'TD Info Hash:\s*([0-9a-fA-F]{96})' | + Select-Object -Last 1 + if (-not $match) { + throw "No TD Info Hash was found in destination serial log: $Path" + } + return Normalize-MigTdHash ` + -Value $match.Matches[0].Groups[1].Value ` + -Description 'Destination TD Info Hash' +} + +function Import-PowerTestMappingModule { + if (Get-Command Get-VmHostMigrationTdMapping -ErrorAction SilentlyContinue) { + return + } + if (-not $PowerTestPath) { + throw 'Get-VmHostMigrationTdMapping is unavailable and -PowerTestPath was not supplied.' + } + $modulePath = Join-Path $PowerTestPath 'LiveMigrationUtilities.psm1' + if (-not (Test-Path -LiteralPath $modulePath -PathType Leaf)) { + throw "PowerTest module file not found: $modulePath" + } + Import-Module $modulePath -Global -Force -DisableNameChecking +} + +function Get-MappingJson { + if ($MappingJsonPath) { + if (-not (Test-Path -LiteralPath $MappingJsonPath -PathType Leaf)) { + throw "Mapping JSON file not found: $MappingJsonPath" + } + return (Get-Content -LiteralPath $MappingJsonPath -Raw) + } + + Import-PowerTestMappingModule + return (@(Get-VmHostMigrationTdMapping) -join '').Trim() +} + +function Import-HcsTestModule { + if (Get-Command Get-HcsSystem -ErrorAction SilentlyContinue) { + return + } + if ($HcsTestPath) { + Import-Module $HcsTestPath ` + -ArgumentList @{ UseVersion2 = $true } ` + -Global ` + -Force + } else { + Import-Module HCSTest ` + -ArgumentList @{ UseVersion2 = $true } ` + -Global ` + -Force + } +} + +if (-not $SourceMigTdHash) { + if (-not $SourceHashFilePath) { + throw 'Provide -SourceMigTdHash or -SourceHashFilePath.' + } + $SourceMigTdHash = Read-MigTdHashFile ` + -Path $SourceHashFilePath ` + -Description 'Source MigTD hash file' +} else { + $SourceMigTdHash = Normalize-MigTdHash ` + -Value $SourceMigTdHash ` + -Description 'Source MigTdHash' +} + +$destinationHashEvidence = $null +if ($DestinationTdInfoHash) { + $DestinationTdInfoHash = Normalize-MigTdHash ` + -Value $DestinationTdInfoHash ` + -Description 'Destination TD Info Hash' + $destinationHashEvidence = 'ExplicitRuntimeTdInfoHash' +} elseif ($DestinationSerialLogPath) { + $DestinationTdInfoHash = + Read-SerialTdInfoHash -Path $DestinationSerialLogPath + $destinationHashEvidence = 'SerialRuntimeTdInfoHash' +} elseif ($DestinationHashFilePath) { + $DestinationTdInfoHash = Read-MigTdHashFile ` + -Path $DestinationHashFilePath ` + -Description 'Destination MigTD hash file' + $destinationHashEvidence = 'BuildArtifactExpectedHash' +} else { + throw 'Provide destination hash evidence through -DestinationTdInfoHash, -DestinationSerialLogPath, or -DestinationHashFilePath.' +} + +$runtimeHashVerified = + $destinationHashEvidence -in @( + 'ExplicitRuntimeTdInfoHash', + 'SerialRuntimeTdInfoHash' + ) +$hashesMatch = $SourceMigTdHash -eq $DestinationTdInfoHash + +$mappingRaw = Get-MappingJson +if (-not $mappingRaw) { + throw 'Destination host returned empty MigTD mapping data.' +} +$mappingObject = + $mappingRaw | ConvertFrom-Json -AsHashtable -ErrorAction Stop +if (-not $mappingObject.ContainsKey('mappings') -or + -not $mappingObject.mappings) { + throw 'Destination mapping JSON does not contain a mappings object.' +} + +$mappingValue = $null +foreach ($entry in $mappingObject.mappings.GetEnumerator()) { + if ([string]$entry.Key -ieq $SourceMigTdHash) { + $mappingValue = [string]$entry.Value + break + } +} +$mappingExists = $null -ne $mappingValue +$mappingTargetMatches = + $mappingExists -and + $mappingValue -ieq $DestinationMigTdHcsId + +$runningState = 'Skipped' +$runtimeId = $null +$runningCheckPassed = $true +if (-not $SkipRunningCheck) { + $system = $null + try { + Import-HcsTestModule + $system = Get-HcsSystem -Id $DestinationMigTdHcsId -ErrorAction Stop + $properties = (Get-HcsSystemProperties -System $system -RawJson) | + ConvertFrom-Json + $runningState = [string]$properties.State + $runtimeId = [string]$properties.RuntimeId + $runningCheckPassed = + $runningState -eq 'Running' -and [bool]$runtimeId + } + catch { + $runningState = "Unavailable: $($_.Exception.Message)" + $runningCheckPassed = $false + } + finally { + if ($system -and -not $system.IsClosed) { + $system.Close() + } + } +} + +$checks = [ordered]@{ + SourceAndDestinationHashesMatch = $hashesMatch + MappingKeyExists = $mappingExists + MappingTargetsExpectedMigTd = $mappingTargetMatches + DestinationMigTdRunning = if ($SkipRunningCheck) { + $null + } else { + $runningCheckPassed + } + RunningCheckSkipped = [bool]$SkipRunningCheck + RuntimeHashVerified = $runtimeHashVerified +} +$requiredChecksPassed = + $hashesMatch -and + $mappingExists -and + $mappingTargetMatches -and + $runningCheckPassed -and + (-not $RequireRuntimeHash -or $runtimeHashVerified) + +$result = [pscustomobject]@{ + Passed = $requiredChecksPassed + SourceRequiredMigTdHash = $SourceMigTdHash + DestinationMigTdHash = $DestinationTdInfoHash + DestinationHashEvidence = $destinationHashEvidence + DestinationMigTdHcsId = $DestinationMigTdHcsId + MappingValue = $mappingValue + DestinationHcsState = $runningState + DestinationRuntimeId = $runtimeId + Checks = [pscustomobject]$checks +} + +$result | Format-List +$result.Checks | Format-List +if ($OutputPath) { + $parent = Split-Path -Parent $OutputPath + if ($parent) { + New-Item -ItemType Directory -Path $parent -Force | Out-Null + } + $result | ConvertTo-Json -Depth 5 | Set-Content -LiteralPath $OutputPath + Write-Host "Binding preflight result: $OutputPath" +} + +if (-not $runtimeHashVerified) { + Write-Warning 'Destination hash came from a build artifact, not runtime TD Info Hash evidence. Add -RequireRuntimeHash to make that a required check.' +} +if (-not $requiredChecksPassed) { + throw 'Cross-node MigTD binding preflight failed.' +} + +Write-Host 'PASS: cross-node MigTD hash, mapping, and destination instance checks succeeded.' diff --git a/.agents/skills/migtd-tip-troubleshoot/SKILL.md b/.agents/skills/migtd-tip-troubleshoot/SKILL.md new file mode 100644 index 000000000..390405e01 --- /dev/null +++ b/.agents/skills/migtd-tip-troubleshoot/SKILL.md @@ -0,0 +1,305 @@ +--- +name: migtd-tip-troubleshoot +description: Troubleshoot Azure TiP / TDX lab-blade MigTD loopback migration failures, PowerTest and HCSTest setup, ServTD hash binding, MigTD serial logs, and Hyper-V VMMS/Worker ETW traces. Use when a lab-blade migration test fails, Move-VM reports a generic source/destination failure, New-TestHcsMigTd dependencies are missing, or TDX migration logs need diagnosis. +--- + +# MigTD TiP Lab-Blade Troubleshooting + +Use this skill for real-hardware Azure TiP / TDX loopback migration failures. +The canonical test package is `sh_script/Azure/tip/`. + +## Building the package (Linux) + +To (re)build the TiP package from source on a fresh Debian/Ubuntu host, first +bootstrap the build environment once with the reusable setup script: + +```bash +# System toolchain (single sudo apt install) + Rust + x86_64-unknown-none target +<REPO_ROOT>/sh_script/setup_build_env.sh +# print only the apt one-liner: sh_script/setup_build_env.sh --print-apt +# apt step only / rust step only: --apt-only / --rust-only + +source "$HOME/.cargo/env" +git submodule update --init --recursive deps/td-shim deps/spdm-rs deps/linux-sgx +./sh_script/preparation.sh +``` + +Then build: + +```bash +export CC=clang AR=llvm-ar +./sh_script/Azure/tip/build_tip_package.sh \ + --os-root <OS_ROOT> --fetch-collaterals +``` + +On GCC >= 14 the vendored linux-sgx DCAP C code would fail to compile; +`src/attestation/build.rs` auto-demotes those errors to warnings, so no manual +`CFLAGS` override is needed. + +`--os-root` bundles PowerTest, HCSTest PowerShell v2 source, and TDX +live-migration source scripts. The Linux build no longer requires winbuild +access. Use `Publish-TipPackage.ps1` on Windows to add HCSTest's `coreclr` v2 +binary, VmgsTool, and Secure Firmware from the matching winbuild. + +## Parameters + +Never hardcode a developer's mount points or OS enlistment: + +| Parameter | Meaning | Example | +|---|---|---| +| `REPO_ROOT` | MigTD repository root | `C:\src\MigTD` or `/home/user/MigTD` | +| `PACKAGE_DIR` | Published TiP package | `D:\migtd_igvm\tip-package` | +| `SOURCE_PACKAGE_DIR` | Linux-built source package copied to Windows | `C:\staging\tip-package` | +| `WINBUILD_ROOT` | Matching winbuild build directory | `\\winbuilds\release\<branch>\<build>` | +| `POWERTEST_PATH` | Installed PowerTest module directory | `C:\Program Files\PowerShell\Modules\PowerTest` | +| `OS_ROOT` | Optional Windows OS source enlistment | `Q:\src\os\os.2020` | +| `HCSTEST_SOURCE` | Optional prebuilt HCSTest folder from winbuilds | `\\winbuilds\...\test_automation_bins\vm\test\compute\HCSTest` | +| `SECFW_FILE` | Optional matching test Secure Firmware DLL | `\\winbuilds\...\secfw_test_GenuineIntel.dll` | +| `OUTPUT_DIR` | Diagnostic bundle destination | `D:\logs\tdxlm-20260719` | + +If `OS_ROOT` is available, reference paths are: + +```text +<OS_ROOT>\src\onecore\vm\test\migration\tdx\Loopback\Tdx.LiveMigration.Partner.Tests.ps1 +<OS_ROOT>\src\onecore\vm\test\migration\tdx\Loopback\Tdx.LiveMigration.Loopback.Tests.ps1 +<OS_ROOT>\src\onecore\vm\test\common\powershell\PowerTest +<OS_ROOT>\src\onecore\vm\worker\migration\TdxProtocol.cpp +<OS_ROOT>\src\onecore\vm\compute\test\hcstest\powershellV2 +``` + +## Workflow + +1. **Enrich and publish from a matching winbuild** + + ```powershell + <SOURCE_PACKAGE_DIR>\Publish-TipPackage.ps1 ` + -PackageDir <SOURCE_PACKAGE_DIR> ` + -WinBuildRoot <WINBUILD_ROOT> ` + -ArchFlavor amd64fre ` + -SecFwFile <SECFW_FILE> ` + -Destination <PACKAGE_DIR> ` + -Force + ``` + + The publisher must add prebuilt HCSTest v2 + (`coreclr\Microsoft.HostCompute.Test.PowerShell.v2.dll`) and VmgsTool. + Pass `-SkipSecFw` only when the blade already has the matching Secure + Firmware configured. + +2. **Install bundled dependencies and configure the host** + + ```powershell + cd <PACKAGE_DIR> + .\Run-TipTests.ps1 -InstallDependencies -ConfigureHost + ``` + + Run setup from a fresh elevated PowerShell 7 process. Reboot if it reports a + Secure Firmware change, then run `.\Run-TipTests.ps1` for the default + mock-quote/no-secrets migration and ServTdExt checks. + +3. **Validate the host and modules** + + ```powershell + <REPO_ROOT>\.agents\skills\migtd-tip-troubleshoot\scripts\Test-TdxLmLabBlade.ps1 ` + -PowerTestPath <POWERTEST_PATH> + ``` + + Add `-Configure` only when host settings should be changed. Supply + `-HcsTestSource <HCSTEST_SOURCE>` if HCSTest v2 is not installed. + In a built TiP package, the same helpers are under `troubleshooting\`. + +4. **Run the package with serial capture** + + ```powershell + cd <PACKAGE_DIR> + .\Invoke-TdxLmLoopback.ps1 ` + -IgvmFilePath .\test-migtd-accept-all.igvm ` + -PowerTestPath <POWERTEST_PATH> ` + -CaptureSerial + ``` + + For a fully IGVMAgent-independent smoke test, use both the mock-quote image + and the target-VM no-secrets mode: + + ```powershell + .\Invoke-TdxLmLoopback.ps1 ` + -IgvmFilePath .\test-migtd-accept-all_mock_quote.igvm ` + -PowerTestPath <POWERTEST_PATH> ` + -NoPersistentSecrets ` + -CaptureSerial + ``` + + Validate startup request handling and a post-start external GetTDReport + independently of migration/rebind: + + ```powershell + .\Test-TdxMigTdStartupRequests.ps1 ` + -IgvmFilePath .\test-migtd-accept-all_mock_quote.igvm + ``` + + The Host OS `New-TestHcsMigTd` helper configures GHCI log level `Trace`, so + startup issues `EnableLogArea` first and an internal `GetTDReport` second to + cache TDINFO. The test treats that internal request as setup, then submits a + separate HCS `MigTdReport` query with a random REPORTDATA nonce, matching the + request path used by IGVMAgent health checks. It validates the nonce, + TDREPORT hashes, image TD Info Hash, and external GHCI VDev events. With a + working IGVMAgent, use + `test-migtd-getquote-all.igvm -ExpectedGetQuoteResult Success` to match the + Host OS GetQuote test (Worker Analytic event 18670). + + MigTD also accepts operation 5 (`GetMigtdData`), but the current Host OS + `GhciRequestOperation` exposes only operations 1–4 and has no HCS/PowerShell + trigger for operation 5. `Run-TipTests.ps1` reports it as `UNAVAILABLE` + rather than claiming real-host coverage. + +5. **Verify the host prebind hash** + + ```powershell + <REPO_ROOT>\.agents\skills\migtd-tip-troubleshoot\scripts\Test-MigTdHashBinding.ps1 ` + -SerialLogPath .\tipmigtd.serial.log ` + -HashFilePath .\test-migtd-accept-all.igvm.hash + ``` + + Hyper-V passes host `MigTdHash` directly to `TDH.SERVTD.PREBIND`, so it must + exactly equal the runtime `TD Info Hash` (`SERVTD_INFO_HASH`). + + ```text + MigTdHash == TD Info Hash + ``` + + Do not use `migtd-hash --calc-servtd-hash` for the package `.hash`. That + computes the outer TDREPORT `SERVTD_HASH`; using it for prebind causes + `TDX_SERVTD_INFO_HASH_MISMATCH`. + +6. **Validate the target ServTdExt after prebind** + + ```powershell + .\Test-TdxServTdExtPrebind.ps1 ` + -IgvmFilePath .\test-migtd-accept-all_mock_quote.igvm ` + -PowerTestPath <POWERTEST_PATH> ` + -NoPersistentSecrets + ``` + + The 272-byte value returned by `Get-VmServTdExt` must contain the expected + 48-byte hash at offsets 0 and 112. Init/current attributes and all reserved + ranges must be zero; CPU SVN, TEE TCB SVN, and TEE model metadata between + the hashes are platform-specific. + +7. **Test MigTD rebinding** + + ```powershell + .\Test-TdxLmRebind.ps1 ` + -OldIgvmFilePath .\test-migtd_mock_quote.igvm ` + -NewIgvmFilePath .\test-migtd_mock_quote_rebind.igvm + ``` + + The inputs may be different files or the same file. For equal hashes, the + script follows the host OS rebind test by assigning the second MigTD a + synthetic mapping key while verifying the partition reports the real hash. + It captures both MigTD serial logs by default. Rebind error `0x800721CE` + maps to GHCI `MIGPOLICY_UNSATISFIED_ERROR`; inspect the old/new logs to + identify which policy or identity check rejected the peer. For host-side + boundaries, wrap the command with `Invoke-TdxLmDiagnosticCapture.ps1`, + passing both serial paths and `-EnableAnalytic -CaptureEtw`; the WPR profile + includes VMMS, Worker, VID, and GHCI VDev rebind events. The script verifies + both HCS systems are `Running` with valid runtime IDs immediately before + rebind and waits up to 30 seconds for terminal rebind logs before cleanup. + Host policy is `DisabledByDefault`; the test VM is explicitly set to + `EnabledIfHostPermits` before its migration-policy hash is assigned. + + Policy leaf-key rotation uses the same policy SVN, root CA, and leaf Subject + Name with a different leaf key. Each peer authenticates the other peer's + signed TCB mapping; the destination does not require future peer measurements + in its local mapping. Test both directions: + + ```powershell + .\Test-TdxLmRebind.ps1 ` + -OldIgvmFilePath .\test-migtd_mock_quote.igvm ` + -NewIgvmFilePath .\test-migtd_mock_quote_key_rotation.igvm + .\Test-TdxLmRebind.ps1 ` + -OldIgvmFilePath .\test-migtd_mock_quote_key_rotation.igvm ` + -NewIgvmFilePath .\test-migtd_mock_quote.igvm + ``` + +8. **Capture Hyper-V diagnostics around one clean repro** + + ```powershell + <REPO_ROOT>\.agents\skills\migtd-tip-troubleshoot\scripts\Invoke-TdxLmDiagnosticCapture.ps1 ` + -OutputDir <OUTPUT_DIR> ` + -EnableAnalytic ` + -CaptureEtw ` + -SerialLogPath .\tipmigtd.serial.log ` + -ReproCommand { + .\Invoke-TdxLmLoopback.ps1 ` + -IgvmFilePath .\test-migtd-accept-all.igvm ` + -PowerTestPath <POWERTEST_PATH> ` + -CaptureSerial + } + ``` + + To isolate `Microsoft.Windows.HyperV.GhciVDev` events in a smaller ETL: + + ```powershell + <REPO_ROOT>\.agents\skills\migtd-tip-troubleshoot\scripts\Invoke-GhciVDevDiagnosticCapture.ps1 ` + -OutputDir <OUTPUT_DIR> ` + -ReproCommand { <REPRO_COMMAND> } + ``` + + This uses provider GUID `AEFC8638-19A2-553A-06CB-C3984FFC7EE8` and exports + raw `tracerpt` CSV/XML plus provider-filtered text/CLIXML when + `Get-WinEvent` can decode the ETL. Use `Export-GhciVDevEvents.ps1` to process + an existing trace. + +9. **Classify the failure boundary** + + | Evidence | Boundary | + |---|---| + | MigTD does not boot | IGVM/SecFw/HCS launch | + | Serial reaches `EnableLogArea`, then stops | Host failed before later MigTD protocol requests | + | VMMS event 20960 | MigTD approval was requested and rejected/failed | + | Worker `TdxProtocol.cpp:334` | `VidTdxBind` failed before approval | + | `0xC0350071` | `ERROR_HV_OPERATION_FAILED`; generic hypervisor failure | + | SEAM status `0xC0000D0300000000` | `TDX_SERVTD_INFO_HASH_MISMATCH` | + | `StartVtl0` + `0x800704C7` after 60 seconds | management VTL readiness timeout; inspect HCL/GHCI ETW | + | `StartVtl0` timeout after `OnAttestDelegate` | An unresponsive IGVMAgent can consume two 30-second RPC timeouts; verify agent health or use `-NoPersistentSecrets` | + | VMMS says `Failed to receive compatibility info` | Destination/connection failure; inspect Worker event first | + +## Load-bearing test behavior + +- Load **HCSTest v2**: + + ```powershell + Import-Module HCSTest -ArgumentList @{ UseVersion2 = $true } -Global + ``` + + V1 calls `vmcompute.dll!CreateEmptyGuestStateFile`; newer builds require the + v2 path through `computestorage.dll`. +- Import installed HCSTest directly before using PowerTest's + `Import-HcsTestModule`. Its default parameter calls + `Get-TestItem -Chunk TEST_AUTOMATION_BINS` even when the module is already + installed, which can fail through BNS (`System.Private.ServiceModel.dll`). +- Match `Tdx.LiveMigration.Partner.Tests.ps1`: + - call `Enable-LoopbackMigrationDirectoryWorkaround`; + - use `New-VM ... -GuestStateIsolation TDX -Generation 2 -NoVHD`; + - call `Move-VM` immediately after `Start-VM`. +- Regular package images are built with `igvm-attest`; MigTD GHCI GetQuote + therefore requires a compatible IGVMAgent even when the target VM uses + `-NoPersistentSecrets`. +- `-NoPersistentSecrets` suppresses only the target VM's OpenHCL attestation + call and changes TPM/VMGS persistence semantics. +- Pair `-NoPersistentSecrets` with an `_mock_quote` image for a fully + IGVMAgent-independent smoke test. +- `RequireIgvmAgent` under + `HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization` controls + whether VM startup requires an available agent endpoint; it is not needed + for the fully mock-quote/no-secrets path. +- Use `-StartupDelaySeconds` only as a controlled experiment. Zero and five + seconds producing the same bind failure rules out that timing difference; + `0xC0350071` does not identify a timing or save/restore-state cause. +- `secfw_test_GenuineIntel.dll` must exist, the `SecFwFile` registry value must + select it, and a reboot is required only when that registry value changes. + +## Detailed reference + +Read `references/labblade-playbook.md` for the investigation history, commands, +event channels, HRESULT interpretation, and parameterized OS-source lookup. diff --git a/.agents/skills/migtd-tip-troubleshoot/references/labblade-playbook.md b/.agents/skills/migtd-tip-troubleshoot/references/labblade-playbook.md new file mode 100644 index 000000000..6c3bb0b08 --- /dev/null +++ b/.agents/skills/migtd-tip-troubleshoot/references/labblade-playbook.md @@ -0,0 +1,429 @@ +# MigTD TiP Lab-Blade Troubleshooting Playbook + +This playbook records the troubleshooting sequence that took a TiP package from +module-load failures to a precise Hyper-V TDX bind failure. Paths outside MigTD +are examples only; pass them as parameters (`OS_ROOT`, `POWERTEST_PATH`, +`HCSTEST_SOURCE`) instead of committing machine-specific paths. + +## 1. Package build and baseline + +Build all variants on Linux: + +```bash +./sh_script/Azure/tip/build_tip_package.sh \ + --out out/tip-package \ + --fetch-collaterals \ + --os-root <OS_ROOT> +``` + +On a Windows machine with access to winbuilds and the TDX host, enrich and copy +the package: + +```powershell +.\Publish-TipPackage.ps1 ` + -PackageDir <SOURCE_PACKAGE_DIR> ` + -WinBuildRoot <WINBUILD_ROOT> ` + -ArchFlavor amd64fre ` + -SecFwFile <SECFW_FILE> ` + -Destination <PACKAGE_DIR> ` + -Force +``` + +The publisher adds prebuilt HCSTest containing +`coreclr\Microsoft.HostCompute.Test.PowerShell.v2.dll`, VmgsTool, and matching +Secure Firmware. The Linux-built source package remains unchanged. + +From a fresh elevated PowerShell 7 process, install dependencies and configure +the host: + +```powershell +.\Run-TipTests.ps1 -InstallDependencies -ConfigureHost +``` + +Reboot if setup reports a Secure Firmware change, then run +`.\Run-TipTests.ps1`. + +Before migration, validate MigTD's startup request handling: + +```powershell +.\Test-TdxMigTdStartupRequests.ps1 ` + -IgvmFilePath .\test-migtd-accept-all_mock_quote.igvm +``` + +The test captures `Microsoft.Windows.HyperV.GhciVDev` and requires +`EnableLogAreaRequest_Success` plus `InternalGetReport_TdInfoCached` during +startup. It then issues a separate post-start HCS `MigTdReport` query matching +the IGVMAgent health-check request and requires +`CreateMigTdGetReportRequest` plus `GetTdReportRequest_Success`. The returned +nonce, TDREPORT hashes, and image TD Info Hash are validated. The current Host +OS GHCI VDev can issue WaitForRequest operations 1–4 only; MigTD operation 5 +(`GetMigtdData`) has no real-host trigger and is reported as unavailable by the +package suite. + +## 2. PowerTest and HCSTest dependency chain + +`New-TestHcsMigTd` is in `TdxLiveMigrationUtilities.psm1`, but it calls commands +from other modules: + +- `New-HcsSystemDocument`, `New-HcsSystem`, `Start-HcsSystem`, + `Stop-HcsSystem` and `New-VmStateFile` come from **HCSTest**. +- `Grant-VmGroupAccess` and `Add-HcsSystemDocumentIsolated` come from + `HCSUtilities.psm1`. +- `Enable-LoopbackMigrationDirectoryWorkaround` and + `Enable-LoopbackMigration` come from `LiveMigrationUtilities.psm1`. + +Load HCSTest v2 explicitly: + +```powershell +Import-Module HCSTest -ArgumentList @{ UseVersion2 = $true } -Global -Force +(Get-Module HCSTest).NestedModules | Select-Object Name, Path +``` + +The nested binary name must end in `.v2`. + +### Why v2 matters + +In the OS source tree: + +```text +<OS_ROOT>\src\onecore\vm\compute\test\hcstest\powershell\New-VmStateFile.cs +<OS_ROOT>\src\onecore\vm\compute\test\hcstest\powershellV2\New-VmStateFile.cs +``` + +V1 reaches `vmcompute.dll!CreateEmptyGuestStateFile`; v2 uses the newer +`computestorage.dll` implementation. Loading v1 on a newer OS produces: + +```text +Unable to find an entry point named 'CreateEmptyGuestStateFile' in DLL 'vmcompute.dll' +``` + +### Installing HCSTest without BNS at runtime + +The package installer copies matching prebuilt HCSTest to: + +```text +%ProgramFiles%\PowerShell\Modules\HCSTest +``` + +The source convention is: + +```text +\\winbuilds\release\<branch>\<build>.<qfe>.<date-time>\<archflavor>\ +test_automation_bins\vm\test\compute\HCSTest +``` + +Use `<OS_ROOT>\bin\<archflavor>\test_automation_bins\buildname.txt` to identify +the matching build. Copy from a fresh elevated PowerShell process: loaded .NET +assemblies remain locked even after `Remove-Module`. + +PowerTest's `Import-HcsTestModule` has a default parameter that evaluates +`Get-TestItem -Chunk TEST_AUTOMATION_BINS` before it tries the installed module. +On a standalone blade that can fail while loading BNS dependencies: + +```text +TestItem:HCSTest ... PathNotFound +Cannot find ... System.Private.ServiceModel.dll +``` + +Avoid that path by importing installed HCSTest directly first. + +## 3. Host prerequisites + +`Initialize-TdxLmMachine` performs: + +```powershell +Enable-VMMigration +Set-VMHost ` + -VirtualMachineMigrationAuthenticationType Kerberos ` + -UseAnyNetworkForMigration $true ` + -VirtualMachineMigrationPerformanceOption Compression +Enable-LoopbackMigration +Update-SecFw +``` + +The test also follows the partner-reference workaround: + +```powershell +Enable-LoopbackMigrationDirectoryWorkaround +``` + +Check: + +- `%SystemRoot%\System32\secfw_test_GenuineIntel.dll` exists. +- `HKLM:\SYSTEM\CurrentControlSet\Control\Hypervisor\SecFwFile` selects it. +- Reboot only if the registry value changed. +- TDX-LM feature `53058573` is enabled. `Get-VelocityFeatureEnabled` requires + `StagingTool.exe`; provide that tool explicitly on a standalone blade rather + than triggering `Copy-TestItem`/BNS. + +Use `scripts/Test-TdxLmLabBlade.ps1` for a repeatable report. + +## 4. Serial logging and hash interpretation + +Run: + +```powershell +.\Invoke-TdxLmLoopback.ps1 ... -CaptureSerial +``` + +The observed serial sequence was: + +```text +MigTD Version - 0.7.1 +TDINFO policy binding verification failed: SvnMismatch + (ignored: TEST MODE, continuing startup) +TD Info Hash: <96 hex chars> +enable_logarea: Logging has been enabled +``` + +Interpretation: + +- The `SvnMismatch` was explicitly non-fatal in this test build. +- Reaching `EnableLogArea` proves MigTD booted and the host completed the first + GHCI request. +- Silence after that means the host failed before sending later migration + protocol requests. + +Hyper-V's host `MigTdHash` is the value passed to `TDH.SERVTD.PREBIND`. It must +be the direct `SERVTD_INFO_HASH` printed as `TD Info Hash`: + +```text +MigTdHash == TD Info Hash +``` + +The distinct composite value +`SHA384(SERVTD_INFO_HASH || SERVTD_TYPE || SERVTD_ATTR)` is the TDREPORT +`SERVTD_HASH`. It must not be written to the host `.hash` file. Use +`scripts/Test-MigTdHashBinding.ps1` to detect this specific mix-up. + +## 5. Event and ETW ladder + +Start with enabled channels: + +```powershell +Get-WinEvent Microsoft-Windows-Hyper-V-VMMS-Admin +Get-WinEvent Microsoft-Windows-Hyper-V-VMMS-Operational +Get-WinEvent Microsoft-Windows-Hyper-V-Worker-Admin +Get-WinEvent Microsoft-Windows-Hyper-V-Worker-Operational +``` + +Important VMMS Admin events: + +| Event | Meaning | +|---|---| +| 20413 | migration initiated | +| 20960 | TDX LM approval failed; includes reason/details | +| 20999 | TDX LM path reported not implemented | +| 21024 | generic migration failed summary | + +If 20413 and 21024 occur at the same instant and 20960 is absent, the failure +occurred before MigTD approval. + +Enable analytic channels only around one repro: + +```powershell +wevtutil sl Microsoft-Windows-Hyper-V-VMMS-Analytic /e:true +wevtutil sl Microsoft-Windows-Hyper-V-Worker-Analytic /e:true +# reproduce +wevtutil sl Microsoft-Windows-Hyper-V-VMMS-Analytic /e:false +wevtutil sl Microsoft-Windows-Hyper-V-Worker-Analytic /e:false +``` + +Prefer `scripts/Invoke-TdxLmDiagnosticCapture.ps1`, which restores the original +channel state and writes a timestamp-bounded bundle. Add `-CaptureEtw` to +capture focused VMMS, Worker, VID, WinHv, and hypervisor providers into +`tdxlm.etl`. + +For a focused trace of only `Microsoft.Windows.HyperV.GhciVDev`, use: + +```powershell +scripts\Invoke-GhciVDevDiagnosticCapture.ps1 ` + -OutputDir <OUTPUT_DIR> ` + -ReproCommand { <REPRO_COMMAND> } +``` + +The provider GUID is `AEFC8638-19A2-553A-06CB-C3984FFC7EE8`. The capture +includes `ghcivdev.etl` plus raw `tracerpt` CSV/XML and provider-filtered +text/CLIXML when the host can decode the ETL. Use +`scripts\Export-GhciVDevEvents.ps1 -EtlPath <ETL_PATH>` to export an existing +trace. + +## 6. Current failure boundary + +Worker Operational event 1840 reported: + +```text +onecore\vm\worker\migration\tdxprotocol.cpp(334) +0xC0350071 +``` + +At the matching OS source: + +```text +<OS_ROOT>\src\onecore\vm\worker\migration\TdxProtocol.cpp +``` + +line 334 throws the result returned by `VidTdxBind`. `0xC0350071` is +`ERROR_HV_OPERATION_FAILED`, a generic hypervisor status. It must not be +confused with `ERROR_HV_INVALID_SAVE_RESTORE_STATE`, which is `0xC0350017`. + +The VID kernel path is: + +```text +VID_IOCTL_TDX_BIND_OR_REBIND + -> VidTdxIoctlPartitionBindOrRebind + -> VidPartitionTableLookupAndReference(MigTdPartitionGuid) + -> WinHvBindOrRebindMigrationTd(target partition, MigTD partition, ...) +``` + +The focused ETW capture exposed the lower-level SEAM status: + +```text +EventName: TDX Bind failed +PartitionId: 0x18 +Status: 0x71 +SeamStatus: 0xC0000D0300000000 +MigrationPartitionId: 0x17 +``` + +Intel's TDX module defines `0xC0000D0300000000` as +`TDX_SERVTD_INFO_HASH_MISMATCH`. `TDH.SERVTD.BIND` computes the service TD's +current `SERVTD_INFO_HASH` and compares it directly with the value stored by +`TDH.SERVTD.PREBIND`. + +The package had incorrectly used: + +```text +migtd-hash ... --calc-servtd-hash +``` + +That produced the outer composite hash `c9f787...`, while MigTD's direct TD +Info Hash was `5c2950...`. The correction is to omit `--calc-servtd-hash` when +generating the host `.hash` file. + +The official partner test migrates immediately. The local test has reproduced +the same bind failure with both zero and five seconds of startup delay, so the +delay is not an established cause. Use this only for controlled comparison: + +```powershell +.\Invoke-TdxLmLoopback.ps1 ... -StartupDelaySeconds 0 +.\Invoke-TdxLmLoopback.ps1 ... -StartupDelaySeconds 15 +``` + +Do not replace the reference `-NoVHD` topology unless intentionally testing a +different scenario. + +## 7. Management-VTL startup timeout + +After correcting the prebind hash, a later repro reached a different boundary: + +```text +VidTdxIoctlPartitionPrebind ... success +StartVirtualProcessors ... success +StartVtl0 ... 0x800704C7 after 60 seconds +``` + +`WorkerTaskStarting` uses a 60-second default for `WaitVtl0Start`; the +`0x800704C7` record is the timeout cancellation, not proof that the operator +pressed Ctrl+C. No SEAM or hypercall failure accompanied this repro. + +This is a management-firmware/HCL startup issue, not a prebind failure. The +focused WPR profile includes Hyper-V HCL, HCL kernel, Guest Emulation Device, +and GHCI virtual-device providers so a subsequent capture can identify why +`vmfirmwarecvm.dll` did not signal VTL0 readiness. + +The expanded trace isolated this timeout to the host IGVM attestation RPC: + +```text +Reading VM ID from VMGS +Retrieving key-encryption key +GuestEmulationDevice::OnAttestDelegate +``` + +The host implementation calls `RpcIGVmAttest` through the local +`IGVM_AGENT_RPC_SERVER` endpoint. Its binding has a 30-second call timeout. +For an unencrypted newly-created VMGS, OpenHCL tolerates failure and performs +both a wrapped-key request and a key-release request. If `igvmagent.exe` has +registered the endpoint but is stale, suspended, or otherwise not replying, +the two calls consume 30 seconds each and exactly exhaust the worker's +60-second `StartVtl0` budget. + +Inspect the agent process before retrying: + +```powershell +Get-Process igvmagent -ErrorAction SilentlyContinue | + Select-Object Id, Path, StartTime, Responding +``` + +Process presence is not itself an error. Regular package images are built with +`igvm-attest`, and MigTD therefore needs a compatible IGVMAgent for GHCI +GetQuote during migration approval. A stale or incompatible agent must be +repaired or replaced, not simply removed when testing a regular image. + +`RequireIgvmAgent` controls whether VM startup requires the endpoint: + +```powershell +$path = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization' +Get-ItemProperty $path -Name RequireIgvmAgent -ErrorAction SilentlyContinue +``` + +To suppress the target VM's OpenHCL attestation request, use: + +```powershell +.\Invoke-TdxLmLoopback.ps1 ... -NoPersistentSecrets +``` + +This sets `GuestStateIsolationMode=NoPersistentSecrets`. Hyper-V advertises +`SuppressAttestation` to OpenHCL, which skips attestation before calling +`RpcIGVmAttest`. This is a valid smoke-test bypass, but it changes TPM/VMGS +persistence semantics and is not identical to the partner-reference test. + +This only bypasses attestation for the target VM's OpenHCL startup. The packaged +MigTD is built with `igvm-attest`; its GHCI GetQuote operation still calls the +same IGVMAgent RPC interface during migration approval. A GetQuote failure with +`0x80072F78` is `WININET_E_INVALID_SERVER_RESPONSE`: the agent responded, but +its response did not satisfy the host's V2 header/size validation. Use an +IGVMAgent binary matching the host build and supporting GetQuote V2. + +For a fully agent-independent smoke test, use a package image built with +`use-mock-quote` and suppress target-VM attestation: + +```powershell +.\Invoke-TdxLmLoopback.ps1 ` + -IgvmFilePath .\test-migtd-accept-all_mock_quote.igvm ` + -PowerTestPath <POWERTEST_PATH> ` + -NoPersistentSecrets ` + -CaptureSerial +``` + +## 8. Validate ServTdExt after prebind + +`Get-VmServTdExt` returns the runtime `HV_TD_SERVICE_TD_EXT` as 544 hexadecimal +characters (272 bytes). After first binding with `SERVTD_ATTR=0`, the relevant +layout is: + +| Byte offset | Size | Expected value | +|---:|---:|---| +| 0 | 48 | initial bound `SERVTD_INFO_HASH` | +| 48 | 16 | zero initial attribute and reserved bytes | +| 64 | 44 | platform CPU SVN, TEE TCB SVN, and TEE model metadata | +| 108 | 4 | zero reserved bytes | +| 112 | 48 | current bound `SERVTD_INFO_HASH` | +| 160 | 112 | zero current attribute and reserved bytes | + +Run the packaged validator: + +```powershell +.\Test-TdxServTdExtPrebind.ps1 ` + -IgvmFilePath .\test-migtd-accept-all_mock_quote.igvm ` + -PowerTestPath <POWERTEST_PATH> ` + -NoPersistentSecrets +``` + +It starts MigTD, registers the prebind hash, starts the target VM, polls +`Get-VmServTdExt -VmName tiptd`, validates the exact layout above, and cleans +up without issuing `Move-VM`. + +When serial capture observes `GetQuote returned Busy (attempt 5/6)`, cleanup +keeps MigTD alive for up to `-SerialDrainTimeoutSeconds` (default 30) so the +sixth-attempt terminal error is written before the named pipe closes. diff --git a/.agents/skills/migtd-tip-troubleshoot/scripts/Export-GhciVDevEvents.ps1 b/.agents/skills/migtd-tip-troubleshoot/scripts/Export-GhciVDevEvents.ps1 new file mode 100644 index 000000000..bda5cfca2 --- /dev/null +++ b/.agents/skills/migtd-tip-troubleshoot/scripts/Export-GhciVDevEvents.ps1 @@ -0,0 +1,95 @@ +<# +.SYNOPSIS + Export Microsoft.Windows.HyperV.GhciVDev events from an ETL trace. + +.DESCRIPTION + Creates raw tracerpt CSV/XML output and, when Get-WinEvent can decode the + ETL, provider-filtered CLIXML and text files. The GHCI VDev provider GUID is + AEFC8638-19A2-553A-06CB-C3984FFC7EE8. + +.EXAMPLE + .\Export-GhciVDevEvents.ps1 -EtlPath .\ghcivdev.etl +#> +[CmdletBinding()] +param( + [Parameter(Mandatory)] [string]$EtlPath, + [string]$OutputDir, + [string]$ProviderName = 'Microsoft.Windows.HyperV.GhciVDev', + [string]$ProviderGuid = 'AEFC8638-19A2-553A-06CB-C3984FFC7EE8' +) + +$ErrorActionPreference = 'Stop' + +if (-not (Test-Path -LiteralPath $EtlPath -PathType Leaf)) { + throw "ETL file not found: $EtlPath" +} +$EtlPath = (Resolve-Path -LiteralPath $EtlPath).Path + +if (-not $OutputDir) { + $OutputDir = Join-Path (Split-Path -Parent $EtlPath) 'ghcivdev-events' +} +New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null +$OutputDir = (Resolve-Path -LiteralPath $OutputDir).Path + +$providerQueryPath = Join-Path $OutputDir 'provider-query.txt' +$providerQuery = [System.Collections.Generic.List[string]]::new() +foreach ($provider in @($ProviderName, "{$ProviderGuid}")) { + $providerQuery.Add("=== logman query providers $provider ===") + $queryOutput = & logman.exe query providers $provider 2>&1 + $queryExitCode = $LASTEXITCODE + foreach ($line in $queryOutput) { + $providerQuery.Add([string]$line) + } + $providerQuery.Add("Exit code: $queryExitCode") + if ($queryExitCode -eq 0) { + break + } +} +$providerQuery | Set-Content -LiteralPath $providerQueryPath + +$tracerptLog = Join-Path $OutputDir 'tracerpt.txt' +$csvPath = Join-Path $OutputDir 'ghcivdev-tracerpt.csv' +$xmlPath = Join-Path $OutputDir 'ghcivdev-tracerpt.xml' + +& tracerpt.exe $EtlPath -of CSV -o $csvPath -y *> $tracerptLog +if ($LASTEXITCODE -ne 0) { + throw "tracerpt failed to export CSV from $EtlPath. See $tracerptLog." +} +& tracerpt.exe $EtlPath -of XML -o $xmlPath -y *>> $tracerptLog +if ($LASTEXITCODE -ne 0) { + throw "tracerpt failed to export XML from $EtlPath. See $tracerptLog." +} + +$providerGuidValue = [guid]$ProviderGuid +$decodeErrorPath = Join-Path $OutputDir 'get-winevent-error.txt' +try { + $events = @( + Get-WinEvent -Path $EtlPath -Oldest -ErrorAction Stop | + Where-Object { + $_.ProviderName -eq $ProviderName -or + $_.ProviderId -eq $providerGuidValue + } + ) + + $eventProjection = $events | + Select-Object TimeCreated, Id, LevelDisplayName, ProviderName, ProviderId, + TaskDisplayName, OpcodeDisplayName, KeywordsDisplayNames, Message, + Properties + $eventProjection | + Export-Clixml -LiteralPath (Join-Path $OutputDir 'ghcivdev-events.clixml') + $eventProjection | + Format-List * | + Out-File -LiteralPath (Join-Path $OutputDir 'ghcivdev-events.txt') + "Decoded GHCI VDev events: $($events.Count)" | + Set-Content -LiteralPath (Join-Path $OutputDir 'summary.txt') +} +catch { + $_ | Format-List * -Force | Out-File -LiteralPath $decodeErrorPath + @( + 'Get-WinEvent could not decode or filter the ETL on this host.' + 'Use ghcivdev-tracerpt.csv/xml or inspect the ETL in WPA.' + ) | Set-Content -LiteralPath (Join-Path $OutputDir 'summary.txt') + Write-Warning "Get-WinEvent decoding failed; raw tracerpt exports are available in $OutputDir." +} + +Write-Host "GHCI VDev event export: $OutputDir" diff --git a/.agents/skills/migtd-tip-troubleshoot/scripts/Invoke-GhciVDevDiagnosticCapture.ps1 b/.agents/skills/migtd-tip-troubleshoot/scripts/Invoke-GhciVDevDiagnosticCapture.ps1 new file mode 100644 index 000000000..05344f902 --- /dev/null +++ b/.agents/skills/migtd-tip-troubleshoot/scripts/Invoke-GhciVDevDiagnosticCapture.ps1 @@ -0,0 +1,85 @@ +<# +.SYNOPSIS + Capture Microsoft.Windows.HyperV.GhciVDev ETW events around one repro. + +.EXAMPLE + .\Invoke-GhciVDevDiagnosticCapture.ps1 -OutputDir .\diag-ghci ` + -ReproCommand { .\Test-TdxLmRebind.ps1 ... } +#> +[CmdletBinding()] +param( + [Parameter(Mandatory)] [scriptblock]$ReproCommand, + [Parameter(Mandatory)] [string]$OutputDir, + [string]$WprProfilePath = (Join-Path $PSScriptRoot 'TdxLmTraceProfile.wprp'), + [string]$ExporterPath = (Join-Path $PSScriptRoot 'Export-GhciVDevEvents.ps1') +) + +$ErrorActionPreference = 'Stop' + +if (-not (Test-Path -LiteralPath $WprProfilePath -PathType Leaf)) { + throw "WPR profile not found: $WprProfilePath" +} +if (-not (Test-Path -LiteralPath $ExporterPath -PathType Leaf)) { + throw "GHCI VDev exporter not found: $ExporterPath" +} +$WprProfilePath = (Resolve-Path -LiteralPath $WprProfilePath).Path +$ExporterPath = (Resolve-Path -LiteralPath $ExporterPath).Path + +New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null +$OutputDir = (Resolve-Path -LiteralPath $OutputDir).Path + +$etlPath = Join-Path $OutputDir 'ghcivdev.etl' +$reproError = $null +$wprStarted = $false +$traceStopped = $false +$start = Get-Date + +try { + & logman.exe query providers 'Microsoft.Windows.HyperV.GhciVDev' *>&1 | + Out-File -LiteralPath (Join-Path $OutputDir 'provider-before.txt') + + & wpr.exe -start "$WprProfilePath!GhciVDev" -filemode + if ($LASTEXITCODE -ne 0) { + throw "Failed to start GHCI VDev WPR capture. Stop any existing WPR session and run from elevated PowerShell." + } + $wprStarted = $true + + try { + & $ReproCommand *>&1 | + Tee-Object -FilePath (Join-Path $OutputDir 'repro-console.txt') + } + catch { + $reproError = $_ + $_ | Format-List * -Force | + Out-File -LiteralPath (Join-Path $OutputDir 'repro-error.txt') + } +} +finally { + $end = Get-Date + if ($wprStarted) { + & wpr.exe -stop $etlPath + if ($LASTEXITCODE -eq 0) { + $traceStopped = $true + } + else { + & wpr.exe -cancel | Out-Null + Write-Warning "Failed to stop WPR capture cleanly; $etlPath may be incomplete." + } + } + + @( + "Capture start: $start" + "Capture end: $end" + 'Provider: Microsoft.Windows.HyperV.GhciVDev' + 'Provider GUID: AEFC8638-19A2-553A-06CB-C3984FFC7EE8' + ) | Set-Content -LiteralPath (Join-Path $OutputDir 'capture.txt') +} + +if ($traceStopped) { + & $ExporterPath -EtlPath $etlPath -OutputDir (Join-Path $OutputDir 'events') +} + +Write-Host "GHCI VDev diagnostic bundle: $OutputDir" +if ($reproError) { + throw $reproError +} diff --git a/.agents/skills/migtd-tip-troubleshoot/scripts/Invoke-TdxLmDiagnosticCapture.ps1 b/.agents/skills/migtd-tip-troubleshoot/scripts/Invoke-TdxLmDiagnosticCapture.ps1 new file mode 100644 index 000000000..fd2d7c451 --- /dev/null +++ b/.agents/skills/migtd-tip-troubleshoot/scripts/Invoke-TdxLmDiagnosticCapture.ps1 @@ -0,0 +1,167 @@ +<# +.SYNOPSIS + Run one TDX LM repro and capture timestamp-bounded Hyper-V diagnostics. + +.EXAMPLE + .\Invoke-TdxLmDiagnosticCapture.ps1 -OutputDir .\diag -EnableAnalytic ` + -SerialLogPath .\tipmigtd.serial.log ` + -ReproCommand { .\Invoke-TdxLmLoopback.ps1 ... -CaptureSerial } +#> +[CmdletBinding()] +param( + [Parameter(Mandatory)] [scriptblock]$ReproCommand, + [Parameter(Mandatory)] [string]$OutputDir, + [string[]]$SerialLogPath, + [switch]$EnableAnalytic, + [switch]$CaptureEtw, + [string]$WprProfilePath = (Join-Path $PSScriptRoot 'TdxLmTraceProfile.wprp') +) + +$ErrorActionPreference = 'Stop' +$channels = @( + 'Microsoft-Windows-Hyper-V-VMMS-Admin', + 'Microsoft-Windows-Hyper-V-VMMS-Operational', + 'Microsoft-Windows-Hyper-V-Worker-Admin', + 'Microsoft-Windows-Hyper-V-Worker-Operational' +) +$analyticChannels = @( + 'Microsoft-Windows-Hyper-V-VMMS-Analytic', + 'Microsoft-Windows-Hyper-V-Worker-Analytic' +) +$changedChannels = [System.Collections.Generic.List[string]]::new() + +New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null +$OutputDir = (Resolve-Path $OutputDir).Path +$start = Get-Date +$reproError = $null +$wprStarted = $false + +Get-Process -Name igvmagent -ErrorAction SilentlyContinue | + Select-Object Id, ProcessName, Path, StartTime, Responding | + Format-List | + Out-File (Join-Path $OutputDir 'igvmagent-before.txt') + +try { + if ($EnableAnalytic) { + foreach ($channel in $analyticChannels) { + $log = Get-WinEvent -ListLog $channel -ErrorAction Stop + if (-not $log.IsEnabled) { + & wevtutil.exe sl $channel /e:true + if ($LASTEXITCODE -ne 0) { + throw "Failed to enable event channel: $channel" + } + $changedChannels.Add($channel) + } + } + $channels += $analyticChannels + } + + if ($CaptureEtw) { + if (-not (Test-Path $WprProfilePath)) { + throw "WPR profile not found: $WprProfilePath" + } + $WprProfilePath = (Resolve-Path $WprProfilePath).Path + & wpr.exe -start "$WprProfilePath!TdxLm" -filemode + if ($LASTEXITCODE -ne 0) { + throw "Failed to start WPR capture. Stop any existing WPR session and run from elevated PowerShell." + } + $wprStarted = $true + } + + try { + & $ReproCommand *>&1 | Tee-Object -FilePath (Join-Path $OutputDir 'repro-console.txt') + } catch { + $reproError = $_ + $_ | Format-List * -Force | Out-File (Join-Path $OutputDir 'repro-error.txt') + } +} finally { + $end = Get-Date + + if ($wprStarted) { + $etlPath = Join-Path $OutputDir 'tdxlm.etl' + & wpr.exe -stop $etlPath + if ($LASTEXITCODE -ne 0) { + & wpr.exe -cancel | Out-Null + Write-Warning "Failed to stop WPR capture cleanly; tdxlm.etl may be incomplete." + } + } + + # Analytic/direct channels must be read oldest-first and are most reliably + # readable after capture stops. Only disable channels this script enabled, + # preserving any channel that was already enabled by the operator. + foreach ($channel in $changedChannels) { + & wevtutil.exe sl $channel /e:false + } + + foreach ($channel in $channels) { + $safeName = $channel -replace '[^A-Za-z0-9.-]', '_' + $filter = @{ + LogName = $channel + StartTime = $start.AddSeconds(-2) + EndTime = $end.AddSeconds(2) + } + if ($analyticChannels -contains $channel) { + $events = @(Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue) + } else { + $events = @(Get-WinEvent -FilterHashtable $filter -ErrorAction SilentlyContinue) + } + $events | + Select-Object TimeCreated, Id, LevelDisplayName, ProviderName, Message | + Export-Clixml (Join-Path $OutputDir "$safeName.clixml") + $events | + Format-List TimeCreated, Id, LevelDisplayName, ProviderName, Message | + Out-File (Join-Path $OutputDir "$safeName.txt") + } + + foreach ($logPath in $SerialLogPath) { + if ($logPath -and (Test-Path $logPath)) { + Copy-Item $logPath (Join-Path $OutputDir (Split-Path $logPath -Leaf)) -Force + } + } + + Get-Process -Name igvmagent -ErrorAction SilentlyContinue | + Select-Object Id, ProcessName, Path, StartTime, Responding | + Format-List | + Out-File (Join-Path $OutputDir 'igvmagent-after.txt') +} + +$allText = Get-ChildItem $OutputDir -Filter '*.txt' | + Where-Object Name -ne 'summary.txt' | + Get-Content +$summary = [System.Collections.Generic.List[string]]::new() +$summary.Add("Capture start: $start") +$summary.Add("Capture end: $end") + +if ($allText -match 'tdxprotocol\.cpp\(\d+\)') { + $summary.Add('Boundary: VidTdxBind failed before MigTD approval.') +} +if ($allText -match '(?i)C0350071|0xC0350071') { + $summary.Add('Status 0xC0350071: ERROR_HV_OPERATION_FAILED (generic); inspect tdxlm.etl for the lower-level bind reason.') +} +if ($allText -match 'Failed to receive compatibility info') { + $summary.Add('VMMS: failed to receive compatibility info; inspect Worker events for the first error.') +} +if ($allText -match '(?i)20960|TDX LM approval failed') { + $summary.Add('MigTD approval path was reached; inspect event 20960 reason/details.') +} +if ($allText -match '(?i)20999|not yet fully implemented') { + $summary.Add('Host reported the TDX LM path as not fully implemented.') +} +$startVtl0TimedOut = (($allText -match 'StartVtl0') -and ($allText -match '(?i)800704C7|operation was canceled')) +if ($startVtl0TimedOut) { + $summary.Add('Boundary: management VTL did not signal VTL0 readiness before the 60-second worker timeout.') +} +if ($startVtl0TimedOut -and ($allText -match '(?im)^ProcessName\s*:\s*igvmagent')) { + $summary.Add('IGVMAgent was running during the StartVtl0 timeout. Verify that its RPC endpoint responds promptly, or use -NoPersistentSecrets to bypass target-VM attestation.') +} +if (($allText -match '(?i)get quote request failed') -and ($allText -match '(?i)80072F78')) { + $summary.Add('MigTD GetQuote reached IGVMAgent, but the response failed V2 validation with WININET_E_INVALID_SERVER_RESPONSE (0x80072F78). Check that the agent binary matches the host build and supports GetQuote V2.') +} + +$summary | Set-Content (Join-Path $OutputDir 'summary.txt') +$summary | ForEach-Object { Write-Host $_ } +Write-Host "Diagnostic bundle: $OutputDir" + +if ($reproError) { + throw $reproError +} diff --git a/.agents/skills/migtd-tip-troubleshoot/scripts/TdxLmTraceProfile.wprp b/.agents/skills/migtd-tip-troubleshoot/scripts/TdxLmTraceProfile.wprp new file mode 100644 index 000000000..a69ab280d --- /dev/null +++ b/.agents/skills/migtd-tip-troubleshoot/scripts/TdxLmTraceProfile.wprp @@ -0,0 +1,81 @@ +<?xml version="1.0" encoding="utf-8"?> +<WindowsPerformanceRecorder Version="1.0" Author="MigTD"> + <Profiles> + <EventCollector Id="TdxLmCollector" Name="TDX live migration"> + <BufferSize Value="512" /> + <Buffers Value="128" /> + </EventCollector> + + <EventProvider Id="Vmms" Name="4DDF50D0-75DE-4FBE-8F08-F8936638E7A1" NonPagedMemory="true"> + <Keywords><Keyword Value="0xFFFFFFFFFFFFFFFF" /></Keywords> + </EventProvider> + <EventProvider Id="Worker" Name="06C601B3-6957-4F8C-A15F-74875B24429D" NonPagedMemory="true"> + <Keywords><Keyword Value="0xFFFFFFFFFFFFFFFF" /></Keywords> + </EventProvider> + <EventProvider Id="VidWpp" Name="1111450B-DACC-40A3-84AB-F7DBA4A6E63A" NonPagedMemory="true"> + <Keywords><Keyword Value="0xFFFFFFFFFFFFFFFF" /></Keywords> + </EventProvider> + <EventProvider Id="VidTraceLogging" Name="5931D877-4860-4EE7-A95C-610A5F0D1407" NonPagedMemory="true"> + <Keywords><Keyword Value="0xFFFFFFFFFFFFFFFF" /></Keywords> + </EventProvider> + <EventProvider Id="Hypervisor" Name="6C5F119B-5B29-46A7-8E4A-282F8D935AE6" NonPagedMemory="true"> + <Keywords><Keyword Value="0xFFFFFFFFFFFFFFFF" /></Keywords> + </EventProvider> + <EventProvider Id="HypervisorDiagnostics" Name="F1C134A0-5523-5865-1AFF-B9F82E911CC3" NonPagedMemory="true"> + <Keywords><Keyword Value="0xFFFFFFFFFFFFFFFF" /></Keywords> + </EventProvider> + <EventProvider Id="WinHv" Name="D5927B1A-BC52-4D10-865A-7BF6A4DBFFFA" NonPagedMemory="true"> + <Keywords><Keyword Value="0xFFFFFFFFFFFFFFFF" /></Keywords> + </EventProvider> + <EventProvider Id="HypervisorEtw" Name="52FC89F8-995E-434C-A91E-199986449890" NonPagedMemory="true"> + <Keywords><Keyword Value="0xFFFFFFFFFFFFFFFF" /></Keywords> + </EventProvider> + <EventProvider Id="HypervisorEvents" Name="910C653D-A4EB-4719-B909-4588E3BAEC91" NonPagedMemory="true"> + <Keywords><Keyword Value="0xFFFFFFFFFFFFFFFF" /></Keywords> + </EventProvider> + <EventProvider Id="HyperVHcl" Name="DAA13987-7A63-5100-C6DB-A8701C0B29C4" NonPagedMemory="true"> + <Keywords><Keyword Value="0xFFFFFFFFFFFFFFFF" /></Keywords> + </EventProvider> + <EventProvider Id="HyperVHclKm" Name="6ADDD204-DF33-57C1-3793-F59543C0E590" NonPagedMemory="true"> + <Keywords><Keyword Value="0xFFFFFFFFFFFFFFFF" /></Keywords> + </EventProvider> + <EventProvider Id="GuestEmulationDevice" Name="42D1A745-54B2-5871-DB90-5F5804B1DC3B" NonPagedMemory="true"> + <Keywords><Keyword Value="0xFFFFFFFFFFFFFFFF" /></Keywords> + </EventProvider> + <EventProvider Id="GhciVDev" Name="AEFC8638-19A2-553A-06CB-C3984FFC7EE8" NonPagedMemory="true"> + <Keywords><Keyword Value="0xFFFFFFFFFFFFFFFF" /></Keywords> + </EventProvider> + + <Profile Id="TdxLm.Verbose.File" Name="TdxLm" Description="Focused TDX live migration trace" LoggingMode="File" DetailLevel="Verbose"> + <Collectors> + <EventCollectorId Value="TdxLmCollector"> + <EventProviders> + <EventProviderId Value="Vmms" /> + <EventProviderId Value="Worker" /> + <EventProviderId Value="VidWpp" /> + <EventProviderId Value="VidTraceLogging" /> + <EventProviderId Value="Hypervisor" /> + <EventProviderId Value="HypervisorDiagnostics" /> + <EventProviderId Value="WinHv" /> + <EventProviderId Value="HypervisorEtw" /> + <EventProviderId Value="HypervisorEvents" /> + <EventProviderId Value="HyperVHcl" /> + <EventProviderId Value="HyperVHclKm" /> + <EventProviderId Value="GuestEmulationDevice" /> + <EventProviderId Value="GhciVDev" /> + </EventProviders> + </EventCollectorId> + </Collectors> + </Profile> + + <Profile Id="GhciVDev.Verbose.File" Name="GhciVDev" Description="Microsoft.Windows.HyperV.GhciVDev trace" LoggingMode="File" DetailLevel="Verbose"> + <Collectors> + <EventCollectorId Value="TdxLmCollector"> + <EventProviders> + <EventProviderId Value="GhciVDev" /> + </EventProviders> + </EventCollectorId> + </Collectors> + </Profile> + </Profiles> +</WindowsPerformanceRecorder> diff --git a/.agents/skills/migtd-tip-troubleshoot/scripts/Test-MigTdHashBinding.ps1 b/.agents/skills/migtd-tip-troubleshoot/scripts/Test-MigTdHashBinding.ps1 new file mode 100644 index 000000000..f97b74531 --- /dev/null +++ b/.agents/skills/migtd-tip-troubleshoot/scripts/Test-MigTdHashBinding.ps1 @@ -0,0 +1,96 @@ +<# +.SYNOPSIS + Verify that the host MigTdHash equals the runtime TD Info Hash. +#> +[CmdletBinding()] +param( + [string]$SerialLogPath, + [string]$HashFilePath, + [string]$TdInfoHash, + [string]$MigTdHash, + [uint16]$ServTdType = 0, + [uint64]$ServTdAttr = 0 +) + +$ErrorActionPreference = 'Stop' + +function Convert-HexToBytes { + param([Parameter(Mandatory)] [string]$Hex) + $bytes = [byte[]]::new($Hex.Length / 2) + for ($i = 0; $i -lt $bytes.Length; $i++) { + $bytes[$i] = [Convert]::ToByte($Hex.Substring($i * 2, 2), 16) + } + return $bytes +} + +function Convert-BytesToHex { + param([Parameter(Mandatory)] [byte[]]$Bytes) + return (($Bytes | ForEach-Object { $_.ToString('x2') }) -join '') +} + +if (-not $TdInfoHash) { + if (-not $SerialLogPath -or -not (Test-Path $SerialLogPath)) { + throw 'Provide -TdInfoHash or an existing -SerialLogPath' + } + $match = Select-String -Path $SerialLogPath -Pattern 'TD Info Hash:\s*([0-9a-fA-F]{96})' | + Select-Object -Last 1 + if (-not $match) { + throw "No 96-hex-digit TD Info Hash found in $SerialLogPath" + } + $TdInfoHash = $match.Matches[0].Groups[1].Value +} + +if (-not $MigTdHash) { + if (-not $HashFilePath -or -not (Test-Path $HashFilePath)) { + throw 'Provide -MigTdHash or an existing -HashFilePath' + } + $MigTdHash = (Get-Content $HashFilePath -Raw).Trim() +} + +if ($TdInfoHash -notmatch '^[0-9a-fA-F]{96}$') { + throw 'TD Info Hash must be exactly 96 hexadecimal characters' +} +if ($MigTdHash -notmatch '^[0-9a-fA-F]{96}$') { + throw 'MigTdHash must be exactly 96 hexadecimal characters' +} + +$tdInfoHashNormalized = $TdInfoHash.ToLowerInvariant() +$migTdHashNormalized = $MigTdHash.ToLowerInvariant() + +# The composite SERVTD_HASH is useful in TDREPORT verification, but Hyper-V's +# MigTdHash is passed directly to TDH.SERVTD.PREBIND and must be SERVTD_INFO_HASH. +$inner = Convert-HexToBytes $tdInfoHashNormalized +$typeBytes = [BitConverter]::GetBytes($ServTdType) +$attrBytes = [BitConverter]::GetBytes($ServTdAttr) +if (-not [BitConverter]::IsLittleEndian) { + [Array]::Reverse($typeBytes) + [Array]::Reverse($attrBytes) +} + +$buffer = [byte[]]::new($inner.Length + $typeBytes.Length + $attrBytes.Length) +[Array]::Copy($inner, 0, $buffer, 0, $inner.Length) +[Array]::Copy($typeBytes, 0, $buffer, $inner.Length, $typeBytes.Length) +[Array]::Copy($attrBytes, 0, $buffer, $inner.Length + $typeBytes.Length, $attrBytes.Length) + +$sha384 = [System.Security.Cryptography.SHA384]::Create() +try { + $computed = Convert-BytesToHex ($sha384.ComputeHash($buffer)) +} finally { + $sha384.Dispose() +} + +[pscustomobject]@{ + TdInfoHash = $tdInfoHashNormalized + HostMigTdHash = $migTdHashNormalized + Match = ($tdInfoHashNormalized -eq $migTdHashNormalized) + ServTdType = $ServTdType + ServTdAttr = ('0x{0:x}' -f $ServTdAttr) + CompositeServTdHash = $computed +} | Format-List + +if ($tdInfoHashNormalized -ne $migTdHashNormalized) { + if ($computed -eq $migTdHashNormalized) { + Write-Error 'MigTdHash is the composite SERVTD_HASH. Use the direct TD Info Hash for Hyper-V prebind.' + } + exit 1 +} diff --git a/.agents/skills/migtd-tip-troubleshoot/scripts/Test-TdxLmLabBlade.ps1 b/.agents/skills/migtd-tip-troubleshoot/scripts/Test-TdxLmLabBlade.ps1 new file mode 100644 index 000000000..44ce7478b --- /dev/null +++ b/.agents/skills/migtd-tip-troubleshoot/scripts/Test-TdxLmLabBlade.ps1 @@ -0,0 +1,200 @@ +#Requires -Version 7.0 + +<# +.SYNOPSIS + Validate or configure a TDX live-migration lab blade. + +.EXAMPLE + .\Test-TdxLmLabBlade.ps1 -PowerTestPath 'C:\Program Files\PowerShell\Modules\PowerTest' + +.EXAMPLE + .\Test-TdxLmLabBlade.ps1 -PowerTestPath C:\PowerTest -HcsTestSource \\share\HCSTest -Configure +#> +[CmdletBinding(SupportsShouldProcess)] +param( + [string]$PowerTestPath = "$env:ProgramFiles\PowerShell\Modules\PowerTest", + [string]$HcsTestSource, + [string]$HcsTestInstallRoot = "$env:ProgramFiles\PowerShell\Modules", + [string]$TestSecFwName = 'secfw_test_GenuineIntel.dll', + [uint32]$FeatureId = 53058573, + [string]$StagingToolPath, + [switch]$Configure +) + +$ErrorActionPreference = 'Stop' +$results = [System.Collections.Generic.List[object]]::new() + +function Add-Result { + param([string]$Check, [string]$Status, [string]$Detail) + $results.Add([pscustomobject]@{ Check = $Check; Status = $Status; Detail = $Detail }) +} + +function Import-ModuleFile { + param([string]$Name) + $path = Join-Path $PowerTestPath $Name + if (-not (Test-Path $path)) { + throw "PowerTest module file not found: $path" + } + Import-Module $path -Force -DisableNameChecking +} + +if (-not (Test-Path $PowerTestPath)) { + throw "PowerTest path not found: $PowerTestPath" +} + +Import-ModuleFile 'TdxLiveMigrationUtilities.psm1' +Import-ModuleFile 'HCSUtilities.psm1' +Import-ModuleFile 'LiveMigrationUtilities.psm1' +Import-ModuleFile 'VmgsUtilities.psm1' + +$hcsTest = Get-Module HCSTest +if ($hcsTest) { + $loadedNestedName = ($hcsTest.NestedModules | Select-Object -First 1).Name + if ($loadedNestedName -notlike '*.v2') { + Add-Result 'HCSTest' 'FAIL' "Loaded non-v2 binary '$loadedNestedName'; close this PowerShell process and retry so the assembly can be replaced" + } +} else { + Import-Module HCSTest -ArgumentList @{ UseVersion2 = $true } -Global -Force -ErrorAction SilentlyContinue +} + +if (-not (Get-Module HCSTest) -and $HcsTestSource) { + if (-not (Test-Path $HcsTestSource)) { + throw "HCSTest source not found: $HcsTestSource" + } + $destination = Join-Path $HcsTestInstallRoot 'HCSTest' + if ($Configure -and $PSCmdlet.ShouldProcess($destination, "Install HCSTest from $HcsTestSource")) { + New-Item -ItemType Directory -Path $destination -Force | Out-Null + Copy-Item -Recurse -Force (Join-Path $HcsTestSource '*') $destination + Import-Module HCSTest -ArgumentList @{ UseVersion2 = $true } -Global -Force + } +} + +$hcsTest = Get-Module HCSTest +if ($hcsTest) { + $nestedName = ($hcsTest.NestedModules | Select-Object -First 1).Name + if ($nestedName -like '*.v2') { + Add-Result 'HCSTest' 'PASS' "Loaded $nestedName" + } elseif (-not ($results | Where-Object { $_.Check -eq 'HCSTest' -and $_.Status -eq 'FAIL' })) { + Add-Result 'HCSTest' 'FAIL' "Loaded non-v2 binary: $nestedName" + } +} elseif (-not ($results | Where-Object { $_.Check -eq 'HCSTest' -and $_.Status -eq 'FAIL' })) { + Add-Result 'HCSTest' 'FAIL' 'Not installed or not importable; provide -HcsTestSource and -Configure' +} + +foreach ($command in @( + 'New-TestHcsMigTd', + 'New-HcsSystemDocument', + 'Start-HcsSystem', + 'Add-VmHostMigrationTdMapping', + 'Set-VMHostMigrationPolicy', + 'Set-VmMigratablePolicy', + 'Get-VmMigratablePolicy', + 'Enable-LoopbackMigration' +)) { + if (Get-Command $command -ErrorAction SilentlyContinue) { + Add-Result $command 'PASS' 'Available' + } else { + Add-Result $command 'FAIL' 'Command unavailable' + } +} + +$vmStateCommand = Get-Command New-VmStateFile -ErrorAction SilentlyContinue +$vmgsTool = Get-Command vmgstool.exe -ErrorAction SilentlyContinue +if (-not $vmgsTool) { + $systemVmgsTool = Join-Path $env:SystemRoot 'System32\vmgstool.exe' + if (Test-Path $systemVmgsTool) { + $vmgsTool = $systemVmgsTool + } +} +if ($vmStateCommand) { + Add-Result 'VM state file creation' 'PASS' "New-VmStateFile from $($vmStateCommand.Source)" +} elseif ($vmgsTool -or (Get-Command New-GuestStateFile -ErrorAction SilentlyContinue)) { + Add-Result 'VM state file creation' 'WARN' 'New-VmStateFile absent; Invoke-TdxLmLoopback.ps1 will install its vmgstool/New-GuestStateFile shim' +} else { + Add-Result 'VM state file creation' 'FAIL' 'Neither New-VmStateFile, vmgstool.exe, nor New-GuestStateFile is available' +} + +$secFwPath = Join-Path "$env:SystemRoot\System32" $TestSecFwName +if (Test-Path $secFwPath) { + Add-Result 'Test SecFw file' 'PASS' $secFwPath +} else { + Add-Result 'Test SecFw file' 'FAIL' "$secFwPath not found" +} + +$secFwRegPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\Hypervisor' +$secFwValue = (Get-ItemProperty $secFwRegPath -Name SecFwFile -ErrorAction SilentlyContinue).SecFwFile +if ($secFwValue -eq $TestSecFwName) { + Add-Result 'SecFwFile registry' 'PASS' $secFwValue +} elseif ($Configure -and $PSCmdlet.ShouldProcess($secFwRegPath, "Set SecFwFile=$TestSecFwName")) { + Set-ItemProperty $secFwRegPath -Name SecFwFile -Value $TestSecFwName + Add-Result 'SecFwFile registry' 'CHANGED' "$secFwValue -> $TestSecFwName; reboot required" +} else { + Add-Result 'SecFwFile registry' 'FAIL' "Current='$secFwValue', expected='$TestSecFwName'" +} + +Import-Module Hyper-V -Force +$vmHost = Get-VMHost +if ($Configure) { + if (-not $vmHost.VirtualMachineMigrationEnabled -and $PSCmdlet.ShouldProcess('VMHost', 'Enable live migration')) { + Enable-VMMigration + } + if ($PSCmdlet.ShouldProcess('VMHost', 'Set Kerberos/any-network/compression migration settings')) { + Set-VMHost ` + -VirtualMachineMigrationAuthenticationType Kerberos ` + -UseAnyNetworkForMigration $true ` + -VirtualMachineMigrationPerformanceOption Compression + } + if ($PSCmdlet.ShouldProcess('VMHost', 'Enable loopback migration')) { + Enable-LoopbackMigration + } + if ($PSCmdlet.ShouldProcess('VMHost', 'Apply loopback migration directory workaround')) { + Enable-LoopbackMigrationDirectoryWorkaround + } + $vmHost = Get-VMHost +} + +Add-Result 'Live migration' $(if ($vmHost.VirtualMachineMigrationEnabled) { 'PASS' } else { 'FAIL' }) ` + "Enabled=$($vmHost.VirtualMachineMigrationEnabled)" +Add-Result 'Migration authentication' $(if ($vmHost.VirtualMachineMigrationAuthenticationType -eq 'Kerberos') { 'PASS' } else { 'FAIL' }) ` + "$($vmHost.VirtualMachineMigrationAuthenticationType)" +Add-Result 'Migration network' $(if ($vmHost.UseAnyNetworkForMigration) { 'PASS' } else { 'FAIL' }) ` + "UseAnyNetwork=$($vmHost.UseAnyNetworkForMigration)" + +$loopbackPath = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization\Migration' +$loopbackValue = (Get-ItemProperty $loopbackPath -Name EnableLoopbackMigration -ErrorAction SilentlyContinue).EnableLoopbackMigration +Add-Result 'Loopback migration' $(if ($loopbackValue -eq 1) { 'PASS' } else { 'FAIL' }) "Registry=$loopbackValue" + +$virtualizationSettingsPath = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization' +$requireIgvmAgent = (Get-ItemProperty $virtualizationSettingsPath -Name RequireIgvmAgent -ErrorAction SilentlyContinue).RequireIgvmAgent +if ($requireIgvmAgent -gt 0) { + Add-Result 'RequireIgvmAgent' 'INFO' "Registry=$requireIgvmAgent; VM startup requires an available agent endpoint" +} else { + Add-Result 'RequireIgvmAgent' 'PASS' 'Absent or zero; agent availability is not enforced at VM startup' +} + +$testAttestationAgents = @(Get-Process -Name igvmagent -ErrorAction SilentlyContinue) +if ($testAttestationAgents.Count -eq 0) { + Add-Result 'Test IGVM attestation agent' 'INFO' 'Not running; use a _mock_quote image plus -NoPersistentSecrets for a fully agent-free test' +} else { + $agentDetails = ($testAttestationAgents | ForEach-Object { + $path = try { $_.Path } catch { $null } + "PID=$($_.Id)" + $(if ($path) { " Path=$path" } else { '' }) + }) -join '; ' + Add-Result 'Test IGVM attestation agent' 'INFO' "Running: $agentDetails. Regular igvm-attest images require a compatible agent for MigTD GetQuote" +} + +if ($StagingToolPath) { + if (-not (Test-Path $StagingToolPath)) { + Add-Result "Velocity feature $FeatureId" 'FAIL' "StagingTool not found: $StagingToolPath" + } else { + $featureOutput = & $StagingToolPath /query $FeatureId 2>&1 + Add-Result "Velocity feature $FeatureId" 'INFO' ($featureOutput -join ' ') + } +} else { + Add-Result "Velocity feature $FeatureId" 'SKIP' 'Supply -StagingToolPath to query without PowerTest/BNS' +} + +$results | Format-Table -AutoSize -Wrap +if ($results.Status -contains 'FAIL') { + throw 'TDX live-migration lab-blade validation failed. Review the failed checks above.' +} diff --git a/.github/workflows/integration-emu.yml b/.github/workflows/integration-emu.yml index cf0d9f68a..92487fcad 100644 --- a/.github/workflows/integration-emu.yml +++ b/.github/workflows/integration-emu.yml @@ -21,6 +21,35 @@ permissions: contents: read jobs: + corim-only-policy: + name: "CoRIM-only Azure release policy" + runs-on: ubuntu-22.04 + timeout-minutes: 60 + + steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - name: Checkout sources + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + submodules: recursive + + - name: Setup build environment + uses: ./.github/actions/setup-build-environment + with: + install-tpm-tools: 'true' + + - name: Build and test CoRIM-only policy contract + run: | + export SPDM_CONFIG="$GITHUB_WORKSPACE/config/spdm_config.json" + cargo build \ + --no-default-features \ + --features "AzCVMEmu,policy_v2,test_mock_report,spdm_attestation,servtd_corim" + cargo test -p policy --features "policy_v2,servtd_corim" + emulation-tests: name: ${{ matrix.test-name }} runs-on: ubuntu-22.04 @@ -78,6 +107,20 @@ jobs: test-command: "./migtdemu.sh --policy-v2 --policy-file ./config/AzCVMEmu/policy_v2_signed.json --policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem --mock-report --features spdm_attestation --both --no-sudo --log-level info" artifact-name: "spdm-policy-v2-test-logs" + - test-name: "CoRIM-only SPDM Migration (Mock Report)" + test-type: "corim-migration" + install-jq: 'true' + timeout-seconds: 900 + test-command: "./migtdemu.sh --policy-v2 --policy-file ./config/AzCVMEmu/policy_v2_corim.json --servtd-signer-anchor-file ./config/AzCVMEmu/servtd_signer_anchor.bin --servtd-corim-file ./config/AzCVMEmu/tcb_mapping_corim.cose --mock-report --features spdm_attestation --both --no-sudo --log-level info" + artifact-name: "corim-migration-test-logs" + + - test-name: "CoRIM-only Rebind Prepare (Mock Report)" + test-type: "corim-rebind" + install-jq: 'true' + timeout-seconds: 900 + test-command: "./migtdemu.sh --operation rebind-prepare --policy-file ./config/AzCVMEmu/policy_v2_corim.json --servtd-signer-anchor-file ./config/AzCVMEmu/servtd_signer_anchor.bin --servtd-corim-file ./config/AzCVMEmu/tcb_mapping_corim.cose --mock-report --features spdm_attestation --both --no-sudo --log-level info" + artifact-name: "corim-rebind-test-logs" + - test-name: "SPDM Rebind Prepare (Skip RA)" test-type: "spdm-rebind-skip-ra" install-jq: 'true' @@ -127,6 +170,18 @@ jobs: test-command: "./migtdemu.sh --policy-v2 --src-policy-file ./config/AzCVMEmu/policy_v2_signed_a.json --src-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_a.pem --dst-policy-file ./config/AzCVMEmu/policy_v2_signed_pmi_b.json --dst-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_b.pem --mock-report --both --no-sudo --log-level info" artifact-name: "policy-v2-all-chains-rotation-test-logs" + # Negative test: the TCB-mapping signer certificate is revoked by the + # signer CRL embedded in collaterals.servtdCrl, so every MigTD must + # fail closed at policy init (PolicyError::SignerRevoked) and refuse + # to migrate. Uses the policy_v2_signed_revoked.json variant emitted + # by build_AzCVMEmu_policy_and_test.sh on both sides. + - test-name: "Policy v2 Signer Revocation (Mock Report)" + test-type: "policy-v2-revoked" + install-jq: 'true' + timeout-seconds: 300 + test-command: "./migtdemu.sh --policy-v2 --src-policy-file ./config/AzCVMEmu/policy_v2_signed_revoked.json --src-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem --dst-policy-file ./config/AzCVMEmu/policy_v2_signed_revoked.json --dst-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem --mock-report --both --no-sudo --log-level info" + artifact-name: "policy-v2-revoked-test-logs" + steps: - name: Harden the runner (Audit all outbound calls) uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 @@ -170,6 +225,12 @@ jobs: export SPDM_CONFIG="$(pwd)/config/spdm_config.json" cargo build --features "AzCVMEmu,policy_v2,test_disable_ra_and_accept_all,spdm_attestation" --no-default-features + - name: Build MigTD for signer revocation test + if: matrix.test-type == 'policy-v2-revoked' + run: | + echo "Prebuilding MigTD so the negative-test timeout covers runtime, not compilation..." + cargo build --release --features "AzCVMEmu,policy_v2,test_mock_report" --no-default-features + - name: Verify emulation script if: matrix.test-type == 'skip-ra' || matrix.test-type == 'rebind-skip-ra' || matrix.test-type == 'spdm-skip-ra' || matrix.test-type == 'spdm-rebind-skip-ra' run: | @@ -193,9 +254,18 @@ jobs: if: matrix.install-jq == 'true' run: | echo "Generating AzCVMEmu policy files with mock measurements..." - ./sh_script/build_AzCVMEmu_policy_and_test.sh --mock-report --skip-test + GEN_ARGS=(--mock-report --skip-test) + if [[ "${{ matrix.test-type }}" == corim-* ]]; then + GEN_ARGS+=(--corim-only) + fi + ./sh_script/build_AzCVMEmu_policy_and_test.sh "${GEN_ARGS[@]}" echo "Policy files generated:" ls -la config/AzCVMEmu/policy_v2_signed*.json config/AzCVMEmu/policy_issuer_chain*.pem + if [[ "${{ matrix.test-type }}" == corim-* ]]; then + ls -la config/AzCVMEmu/policy_v2_corim.json \ + config/AzCVMEmu/servtd_signer_anchor.bin \ + config/AzCVMEmu/tcb_mapping_corim.cose + fi - name: Run test id: test_run @@ -209,6 +279,31 @@ jobs: set -e echo "Test completed with exit code: $EXIT_CODE" + + # Negative test: a revoked TCB-mapping signer must make every MigTD + # fail closed at policy init (before any migration), logging + # PolicyError::SignerRevoked. Its presence is the definitive proof + # the revocation control fired — the MigTD crashes at boot, so it can + # never complete a migration. Pass on that evidence. + if [[ "${{ matrix.test-type }}" == "policy-v2-revoked" ]]; then + if [[ $EXIT_CODE -eq 0 ]]; then + echo "❌ Revoked-signer policy unexpectedly completed successfully" + echo "test_status=failed" >> $GITHUB_OUTPUT + exit 1 + elif grep -aq "SignerRevoked" migtd_migration_source.log migtd_migration_destination.log dest_*_out.log 2>/dev/null; then + echo "✅ Revocation enforced: MigTD refused a revoked-signer policy (SignerRevoked), exit=$EXIT_CODE" + echo "test_status=success" >> $GITHUB_OUTPUT + exit 0 + elif [[ $EXIT_CODE -eq 124 ]]; then + echo "❌ Revocation test timed out without reaching SignerRevoked" + echo "test_status=timeout" >> $GITHUB_OUTPUT + exit 1 + else + echo "❌ Expected a SignerRevoked error in the guest logs, but none was found (exit=$EXIT_CODE)" + echo "test_status=failed" >> $GITHUB_OUTPUT + exit 1 + fi + fi if [[ $EXIT_CODE -eq 0 ]]; then echo "✅ Test completed successfully" @@ -329,6 +424,38 @@ jobs: echo "✅ Quote retry verification passed (5 failures + success on both sides)" fi + # Prove the CoRIM-only scenarios did not fall back to legacy JSON + # servtdCollateral and that both peers attached the signed CoRIM. + if [[ "${{ matrix.test-type }}" == corim-* ]]; then + echo "" + echo "=== Verifying CoRIM-only runtime path ===" + if ! jq -e '.policyData | has("servtdCollateral") | not' config/AzCVMEmu/policy_v2_corim.json >/dev/null; then + echo "❌ CoRIM-only policy contains legacy servtdCollateral" + exit 1 + fi + if [[ $(wc -c < config/AzCVMEmu/servtd_signer_anchor.bin) -ne 48 ]]; then + echo "❌ ServTD signer anchor is not 48 bytes" + exit 1 + fi + for ROLE in source destination; do + LOG=$(find . -maxdepth 1 -name "migtd_*_${ROLE}.log" -print -quit) + if [[ -z "$LOG" ]] || ! grep -aq "Loaded signed ServTD CoRIM endorsement" "$LOG"; then + echo "❌ Missing signed-CoRIM attachment evidence for $ROLE" + exit 1 + fi + echo "✅ $ROLE attached the signed ServTD CoRIM" + done + fi + + # Dump revocation-related log lines for the signer-revocation test. + if [[ "${{ matrix.test-type }}" == "policy-v2-revoked" ]]; then + echo "" + echo "=== Signer revocation log lines ===" + grep -a "SignerRevoked\|Failed to initialize migration policy\|revoked" \ + migtd_migration_source.log migtd_migration_destination.log dest_*_out.log 2>/dev/null || \ + echo "(no revocation-related lines found)" + fi + - name: Upload test artifacts on failure if: failure() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 @@ -343,9 +470,13 @@ jobs: config/AzCVMEmu/policy_v2_signed_b.json config/AzCVMEmu/policy_v2_signed_pm_b.json config/AzCVMEmu/policy_v2_signed_pmi_b.json + config/AzCVMEmu/policy_v2_signed_revoked.json config/AzCVMEmu/policy_issuer_chain.pem config/AzCVMEmu/policy_issuer_chain_a.pem config/AzCVMEmu/policy_issuer_chain_b.pem + config/AzCVMEmu/policy_v2_corim.json + config/AzCVMEmu/servtd_signer_anchor.bin + config/AzCVMEmu/tcb_mapping_corim.cose target/release/migtd retention-days: 7 if-no-files-found: ignore diff --git a/.github/workflows/reproducible-igvm.yml b/.github/workflows/reproducible-igvm.yml new file mode 100644 index 000000000..b0667bba6 --- /dev/null +++ b/.github/workflows/reproducible-igvm.yml @@ -0,0 +1,122 @@ +# Validates that the Azure IGVM image is a reproducible build, using the pinned +# Docker toolchain we ship (sh_script/Azure/Dockerfile + docker_build_igvm.sh). +# +# The wrapper builds the IGVM inside the pinned ubuntu:26.04 container (root, +# /root/MigTD, frozen clang/llvm/nasm + Rust 1.88.0 -- the real Azure build +# environment). We run it twice from the same prepared sources and fail unless +# the two migtd.igvm files are byte-identical. Building inside the pinned image +# is what makes the result reproducible across machines/OS images: a different +# clang produces different bytes (see sh_script/Azure/reproducible_build.md). +# An identical image also implies an identical MRTD. +# +# This is intentionally the *faithful* check -- it exercises the shipped +# Dockerfile and wrapper and the exact toolchain the Azure image is built with, +# rather than the host runner's toolchain. +# +# It is heavy (a docker image build plus two full IGVM builds, each including +# the linux-sgx/OCaml attestation library and an LTO `cargo image`), so it runs +# weekly, on manual dispatch, and on PRs that touch inputs affecting the build. +name: reproducible-igvm + +on: + workflow_dispatch: + schedule: + # Weekly audit: Mondays 06:00 UTC. + - cron: "0 6 * * 1" + pull_request: + paths: + - "sh_script/Azure/**" + - ".github/workflows/reproducible-igvm.yml" + - "xtask/**" + - "Cargo.toml" + - "Cargo.lock" + - "rust-toolchain" + - "src/attestation/build.rs" + - "src/attestation/prune-unused-linux-sgx.sh" + - "src/attestation/test-prune-unused-linux-sgx.sh" + - "deps/linux-sgx" + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + reproducible-igvm: + name: Azure IGVM reproducibility (pinned Docker image) + runs-on: ubuntu-22.04 + timeout-minutes: 240 + + steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + with: + egress-policy: audit + + - name: Free up disk space + run: | + # A docker image build plus two full IGVM builds need headroom. + sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android \ + /opt/hostedtoolcache/CodeQL || true + docker image prune -af || true + df -h / + + - name: Checkout sources + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + submodules: recursive + + - name: Prepare sources (ring/spdm patches; git-only) + # docker_build_igvm.sh local mode builds an already-prepared tree; the + # actual IGVM build (clang/rust/nasm) happens inside the container. + run: bash sh_script/preparation.sh + + - name: Test linux-sgx pruning safety + run: bash src/attestation/test-prune-unused-linux-sgx.sh + + - name: Build Azure IGVM in the pinned container (run 1) + run: ./sh_script/Azure/docker_build_igvm.sh -t build-igvm -o "$RUNNER_TEMP/out1" + + - name: Build Azure IGVM in the pinned container (run 2) + # Reuses the builder image from run 1 but builds in a fresh container, so + # the two IGVMs are independent rebuilds in the same pinned environment. + run: ./sh_script/Azure/docker_build_igvm.sh -t build-igvm -o "$RUNNER_TEMP/out2" + + - name: Compare IGVM images + run: | + set -euo pipefail + A=$(awk '{print $1}' "$RUNNER_TEMP/out1/migtd.igvm.sha256") + B=$(awk '{print $1}' "$RUNNER_TEMP/out2/migtd.igvm.sha256") + { + echo "## Azure IGVM reproducibility (pinned Docker image)" + echo "" + echo "| run | sha256 |" + echo "|-----|--------|" + echo "| 1 | \`$A\` |" + echo "| 2 | \`$B\` |" + echo "" + } >> "$GITHUB_STEP_SUMMARY" + + if [ "$A" = "$B" ]; then + echo "Reproducible: two container builds produced an identical IGVM ($A)" + echo "**Result: reproducible** ✅" >> "$GITHUB_STEP_SUMMARY" + else + echo "NOT reproducible: $A != $B" + ls -l "$RUNNER_TEMP"/out1/migtd.igvm "$RUNNER_TEMP"/out2/migtd.igvm || true + echo "First differing bytes:" + cmp -l "$RUNNER_TEMP"/out1/migtd.igvm "$RUNNER_TEMP"/out2/migtd.igvm | head -20 || true + echo "**Result: NOT reproducible** ❌ — see job logs and uploaded artifacts." >> "$GITHUB_STEP_SUMMARY" + exit 1 + fi + + - name: Upload IGVM images on mismatch + if: failure() + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: igvm-repro-mismatch + path: | + ${{ runner.temp }}/out1/migtd.igvm + ${{ runner.temp }}/out2/migtd.igvm + if-no-files-found: ignore diff --git a/.gitignore b/.gitignore index 4bdfa2385..55e43a20e 100644 --- a/.gitignore +++ b/.gitignore @@ -3,6 +3,7 @@ # Cargo Junk target/ *.bin +!config/AzCVMEmu/corim/signer_anchor.bin *.o *.obj @@ -33,5 +34,20 @@ __pycache__ # Auto-generated policy files (regenerated by build_AzCVMEmu_policy_and_test.sh) config/AzCVMEmu/policy_v2_signed*.json config/AzCVMEmu/policy_issuer_chain*.pem +config/AzCVMEmu/policy_v2_corim.json +config/AzCVMEmu/servtd_signer_anchor.bin +config/AzCVMEmu/tcb_mapping_corim.cose config/Azure/policy_v2_signed*.json config/Azure/policy_issuer_chain*.pem +# Auto-generated collateral/tcb-mapping (fetched/regenerated by the mock-test builds) +config/AzCVMEmu/collateral_thim.json +config/AzCVMEmu/tcb_mapping.json +config/Azure/collateral_thim.json +config/Azure/tcb_mapping.json + +# TiP package build output (build_tip_package.sh default --out) +out/ + +# review tooling +.clawpatch/ +.copilot-review-issues/ diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 000000000..1e6fbbc62 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,181 @@ +# MigTD agent guide + +Rules for every AI-assisted change. + +## Start here + +- Read [`CONTRIBUTING.md`](CONTRIBUTING.md). +- Read the relevant [knowledge files](.agents/knowledge/index.md). +- Use the [review playbook](.agents/skills/migtd-review/SKILL.md). +- Inspect cited commits before copying a pattern. +- Confirm the target checkout and branch. +- Leave sibling checkouts untouched. + +## Security model + +- Firmware is single-core and single-threaded. +- Rust is `no_std`. +- Async execution is cooperative. +- Treat interrupt-shared state separately. +- Treat the VMM as untrusted. +- Ignore findings that only give the VMM more DoS. +- Trust `MRTD` and `RTMR0..3`. +- Treat certificate chains as transport. +- The policy root CA is measured into RTMR. +- Trust `VERIFIED_POLICY` only after `init_policy()`. +- Regular migration uses quotes. +- Quote REPORTDATA starts at byte 520. +- Use `verify_report_data_binding`. +- Rebind uses TDREPORT. +- TDREPORT REPORTDATA starts at byte 128. +- Use `verify_tdreport_data_binding`. +- Never mix the two paths. +- `MROwner` is the policy signer key hash. +- `MROwnerConfig` is the policy SVN. +- Check local TDINFO during startup. +- Require the same signer during migration. +- Require source SVN to meet destination SVN. +- Resolve both the initial and current MigTD hashes through the authenticated + source's verified one-hash mapping. +- Require the mapped initial SVN to be no greater than the mapped current SVN. +- Ignore the legacy wire Init_TDINFO after validating request framing. +- Keep `init_td_info` as the sole wire TDINFO field. +- Do not add redundant MigTD hash fields. +- Under `AzCVMEmu`, skip the local TDINFO check. +- Never upstream test-only security bypasses. +- Size-check every VMM-controlled byte range. +- Check `u32` offset arithmetic for wraparound. +- Use `#[repr(C)]` or explicit serialization at boundaries. +- `vmcall-raw` never returns `Ok(0)` or EOF. +- Per-buffer `data_status` filters broadcast wakes. +- Read [security bypasses](.agents/knowledge/security-bypasses.md). +- Read [domain facts](.agents/knowledge/domain-facts.md). + +## Code changes + +- Keep diffs small. +- Preserve existing names during functional work. +- Avoid unrelated cleanup. +- Format only touched files. +- Avoid `expect()` and `unwrap()` outside tests. +- Return errors. +- Prefer `LogErr` or `LogError`. +- Deduplicate only when reuse is real. +- Avoid one-use traits and macros. +- Do not add precautionary feature gates. +- Keep INFO logs sparse. +- Never dump full quotes, certs, or large blobs. +- Log length and short edge slices instead. +- Gate temporary diagnostics. +- Prove odd code is redundant before changing it. +- Preserve load-bearing workarounds. +- Keep their explanatory comments. +- Never grow a buffer to mask a bug. + +## Setup and build + +- Run `bash sh_script/preparation.sh` after: + - a fresh checkout; + - `git clean -fdx`; + - a submodule update; + - a branch switch that changes submodules. +- The script applies required `spdm-rs` patches. +- Missing patches can mimic baseline failures. +- Use repository build scripts. +- Treat CI commands as the source of truth. + +## Tests and validation + +- Run the smallest relevant checks first. +- Run `cargo fmt --check`. +- Run Clippy for the in-scope features. +- Deny warnings where required. +- Run tests for every touched crate. +- Run EMU tests for boundary changes. +- Boundary areas include: + - event log and RTMR replay; + - policy parsing and verification; + - migration, handshake, and rebind; + - SPDM transport; + - crypto, certificates, and PEM; + - vmcall transport. +- `cargo test` alone is insufficient there. +- Never run `migtdemu.sh` concurrently. +- It shares port, CPU, and output state. +- Before pushing code, run: + + ```bash + .agents/skills/migtd-review/scripts/run-ci-gauntlet.sh + ``` + +- Require every stage to pass. +- Stages: `prep`, `format`, `deny`, `main`, `emu`. +- Stop on failure. +- Fix the root cause. +- Resume from the failed stage. +- Do not skip failing checks. +- Documentation-only changes need no build or test. + +## Workflow + +- Keep independent fixes on independent branches. +- Confirm remote meaning from context. +- Prefer cherry-picking an existing upstream fix. +- Use `git rebase --onto` for targeted rebases. +- Resolve conflicts with minimal churn. +- Do not touch unrelated worktree changes. +- Do not track `.clawpatch/`. +- Do not track `.copilot-review-issues/`. +- Use `[Copilot Review]` for review issue titles. +- Check account permissions before filing issues. +- Under WSL, use Git or `gh` through their normal GitHub authentication flow. + A successful `git push` proves the cached Windows Git Credential Manager + credential is usable; do not query GCM directly and mistake an API prompt + without GitHub's authentication challenge for a missing cache. + +## Contribution and commits + +- Follow [`CONTRIBUTING.md`](CONTRIBUTING.md). +- Use `<type>(<crate/module>): <subject>`. +- Use `migtd` for repository-wide changes. +- Add a short body. +- Explain what changed and why. +- Keep each commit to one logical change. +- Use the configured human identity. +- Add the human DCO sign-off to every commit. +- Never sign off for an AI. +- Never name an AI in `Signed-off-by`. +- Never name an AI in `Co-authored-by`. +- Declare AI help with: + + ```text + Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2] + ``` + +- List only material specialist tools. +- Omit Git, compilers, formatters, editors, and test runners. +- Push to a personal fork. +- Never force-push shared remotes. +- If rewriting, use: + + ```text + --force-with-lease=<branch>:<known-sha> + ``` + +## Knowledge upkeep + +- Recheck the knowledge index at session end. +- Record durable, non-obvious learnings. +- Record human corrections. +- Record rejected hypotheses worth preserving. +- Correct stale guidance. +- Update the smallest relevant topical file. +- Cite a SHA, file, or test when useful. +- Explain removed guidance in the commit body. +- Keep task-specific state out of the knowledge base. +- Keep the decisions log append-only. +- Add new topics only when no current file fits. +- Add OKF frontmatter to new knowledge files. +- Link new files from `.agents/knowledge/index.md`. +- Link new files from `.agents/index.md`. +- Preserve knowledge before risky cleanup. diff --git a/Cargo.lock b/Cargo.lock index 93fafcddb..139eb0bdb 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -80,9 +80,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.103" +version = "1.0.75" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3" +checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6" [[package]] name = "argparse" @@ -152,7 +152,7 @@ name = "async_runtime" version = "0.1.0" dependencies = [ "futures-task", - "spin 0.12.0", + "spin 0.11.0", ] [[package]] @@ -315,9 +315,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a" [[package]] name = "bitflags" -version = "2.13.0" +version = "2.13.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8" +checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da" [[package]] name = "block-buffer" @@ -330,9 +330,9 @@ dependencies = [ [[package]] name = "block-buffer" -version = "0.12.0" +version = "0.12.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be" +checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa" dependencies = [ "hybrid-array", ] @@ -384,6 +384,17 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" +[[package]] +name = "chacha20" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +dependencies = [ + "cfg-if", + "cpufeatures 0.3.0", + "rand_core 0.10.1", +] + [[package]] name = "chrono" version = "0.4.42" @@ -464,6 +475,28 @@ version = "0.9.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8" +[[package]] +name = "corim" +version = "0.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "18ae0dacf8af1ae85596c375df3bf848ff57712a8b07d5a9ba36863d901f78d7" +dependencies = [ + "corim-macros", + "serde", + "thiserror 2.0.17", +] + +[[package]] +name = "corim-macros" +version = "0.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3c16ee2c7db3dde66570487ea3a6329bd07ca138652b57a3a442c200c75df495" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.106", +] + [[package]] name = "cpufeatures" version = "0.2.10" @@ -518,9 +551,9 @@ dependencies = [ [[package]] name = "crypto-common" -version = "0.2.1" +version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "77727bb15fa921304124b128af125e7e3b968275d1b108b379190264f4423710" +checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453" dependencies = [ "hybrid-array", ] @@ -588,12 +621,12 @@ dependencies = [ [[package]] name = "digest" -version = "0.11.2" +version = "0.11.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4850db49bf08e663084f7fb5c87d202ef91a3907271aff24a94eb97ff039153c" +checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2" dependencies = [ - "block-buffer 0.12.0", - "crypto-common 0.2.1", + "block-buffer 0.12.1", + "crypto-common 0.2.2", ] [[package]] @@ -821,15 +854,15 @@ dependencies = [ [[package]] name = "getrandom" -version = "0.3.4" +version = "0.4.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" +checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099" dependencies = [ "cfg-if", "js-sys", "libc", - "r-efi 5.3.0", - "wasip2", + "r-efi 6.0.0", + "rand_core 0.10.1", "wasm-bindgen", ] @@ -932,9 +965,9 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4" [[package]] name = "hybrid-array" -version = "0.4.10" +version = "0.4.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3944cf8cf766b40e2a1a333ee5e9b563f854d5fa49d6a8ca2764e97c6eddb214" +checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c" dependencies = [ "typenum", ] @@ -1260,7 +1293,7 @@ version = "0.1.10" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "416f7e718bdb06000964960ffa43b4335ad4012ae8b99060261aa4a8088d5ccb" dependencies = [ - "bitflags 2.13.0", + "bitflags 2.13.1", "libc", ] @@ -1421,9 +1454,12 @@ dependencies = [ "clap", "crypto", "env_logger", + "hex", "log", - "migtd", + "policy", + "r-efi 3.2.0", "serde_json", + "td-layout", "td-shim-interface", "td-shim-tools", ] @@ -1582,11 +1618,11 @@ dependencies = [ [[package]] name = "openssl" -version = "0.10.80" +version = "0.10.81" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a45fa2aa886c42762255da344f0a0d313e254066c46aad76f300c3d3da62d967" +checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45" dependencies = [ - "bitflags 2.13.0", + "bitflags 2.13.1", "cfg-if", "foreign-types", "libc", @@ -1607,18 +1643,18 @@ dependencies = [ [[package]] name = "openssl-src" -version = "300.5.4+3.5.4" +version = "300.6.1+3.6.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a507b3792995dae9b0df8a1c1e3771e8418b7c2d9f0baeba32e6fe8b06c7cb72" +checksum = "46eb8fb9fb3b61ce1c0f8a026c4c1a0714d3a9e138e7fbde78753ce2babc3846" dependencies = [ "cc", ] [[package]] name = "openssl-sys" -version = "0.9.116" +version = "0.9.117" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f28a22dc7140cda5f096e5e7724a6962ca81a7f8bfd2979f9b18c11af56318c4" +checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695" dependencies = [ "cc", "libc", @@ -1723,6 +1759,7 @@ name = "policy" version = "0.1.0" dependencies = [ "cc-measurement", + "corim", "crypto", "log", "serde", @@ -1746,15 +1783,6 @@ version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391" -[[package]] -name = "ppv-lite86" -version = "0.2.21" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9" -dependencies = [ - "zerocopy 0.8.27", -] - [[package]] name = "proc-macro2" version = "1.0.101" @@ -1786,14 +1814,15 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.14" +version = "0.11.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098" +checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560" dependencies = [ "bytes", - "getrandom 0.3.4", + "getrandom 0.4.3", "lru-slab", "rand", + "rand_pcg", "ring", "rustc-hash", "rustls", @@ -1836,28 +1865,19 @@ checksum = "6198999a900fd9cf051f2109ec3b9589b5c67cbfc77ff82c9fdff24aec83aa7b" [[package]] name = "r-efi" -version = "5.3.0" +version = "6.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f" +checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" [[package]] name = "rand" -version = "0.9.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea" -dependencies = [ - "rand_chacha", - "rand_core 0.9.3", -] - -[[package]] -name = "rand_chacha" -version = "0.9.0" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb" +checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" dependencies = [ - "ppv-lite86", - "rand_core 0.9.3", + "chacha20", + "getrandom 0.4.3", + "rand_core 0.10.1", ] [[package]] @@ -1871,11 +1891,17 @@ dependencies = [ [[package]] name = "rand_core" -version = "0.9.3" +version = "0.10.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38" +checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69" + +[[package]] +name = "rand_pcg" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a" dependencies = [ - "getrandom 0.3.4", + "rand_core 0.10.1", ] [[package]] @@ -1899,7 +1925,7 @@ version = "11.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186" dependencies = [ - "bitflags 2.13.0", + "bitflags 2.13.1", ] [[package]] @@ -2031,7 +2057,7 @@ version = "0.38.20" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "67ce50cb2e16c2903e30d1cbccfd8387a74b9d4c938b6a4c5ec6cc7556f7a8a0" dependencies = [ - "bitflags 2.13.0", + "bitflags 2.13.1", "errno", "libc", "linux-raw-sys", @@ -2212,7 +2238,7 @@ checksum = "c2ff74d7e7d1cc172f3a45adec74fbeee928d71df095b85aaaf66eb84e1e31e6" dependencies = [ "base64 0.22.1", "bitfield 0.19.3", - "bitflags 2.13.0", + "bitflags 2.13.1", "byteorder", "dirs", "hex", @@ -2244,7 +2270,7 @@ checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4" dependencies = [ "cfg-if", "cpufeatures 0.3.0", - "digest 0.11.2", + "digest 0.11.3", ] [[package]] @@ -2320,13 +2346,19 @@ dependencies = [ [[package]] name = "spin" -version = "0.12.0" +version = "0.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1527984ca054dfca79333baec451042863f485fbee01b7bf6d911de915cac865" +checksum = "783f3f6f6b01e295a669edfc402133a5f2553d1f0e81284b3ba4594e80bdd4a2" dependencies = [ "lock_api", ] +[[package]] +name = "spin" +version = "0.12.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8abadc99fd9c7bbb7d0ca2b31d72a067d0c0dcd7aad25ab8cac71ba91417694b" + [[package]] name = "spinning_top" version = "0.2.5" @@ -2638,12 +2670,12 @@ name = "tdx-tdcall-emu" version = "0.1.0" dependencies = [ "az-tdx-vtpm", - "bitflags 2.13.0", + "bitflags 2.13.1", "interrupt-emu", "lazy_static", "log", "sha2 0.11.0", - "spin 0.12.0", + "spin 0.12.2", "tdx-mock-data", "tdx-tdcall", "tokio", @@ -2840,7 +2872,7 @@ version = "0.6.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8" dependencies = [ - "bitflags 2.13.0", + "bitflags 2.13.1", "bytes", "futures-util", "http", @@ -2936,9 +2968,9 @@ dependencies = [ [[package]] name = "typenum" -version = "1.17.0" +version = "1.20.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825" +checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20" [[package]] name = "unicode-ident" @@ -3121,15 +3153,6 @@ version = "0.11.0+wasi-snapshot-preview1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423" -[[package]] -name = "wasip2" -version = "1.0.1+wasi-0.2.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7" -dependencies = [ - "wit-bindgen", -] - [[package]] name = "wasm-bindgen" version = "0.2.104" @@ -3512,12 +3535,6 @@ version = "0.53.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650" -[[package]] -name = "wit-bindgen" -version = "0.46.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59" - [[package]] name = "writeable" version = "0.6.1" @@ -3571,7 +3588,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0f042214de98141e9c8706e8192b73f56494087cc55ebec28ce10f26c5c364ae" dependencies = [ "bit_field", - "bitflags 2.13.0", + "bitflags 2.13.1", "rustversion", "volatile 0.4.6", ] diff --git a/Cargo.toml b/Cargo.toml index 9ae05208d..00c16d746 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -46,7 +46,9 @@ strip = true [profile.release] panic = "abort" # disable stack unwinding on panic opt-level = "z" -lto = true +lto = "fat" +codegen-units = 1 +strip = true [patch.crates-io] ring = { path = "deps/td-shim/library/ring" } diff --git a/config/AzCVMEmu/corim/signer_anchor.bin b/config/AzCVMEmu/corim/signer_anchor.bin new file mode 100644 index 000000000..09c3c4100 Binary files /dev/null and b/config/AzCVMEmu/corim/signer_anchor.bin differ diff --git a/config/AzCVMEmu/corim/tcb_mapping.cose b/config/AzCVMEmu/corim/tcb_mapping.cose new file mode 100644 index 000000000..db34110f5 Binary files /dev/null and b/config/AzCVMEmu/corim/tcb_mapping.cose differ diff --git a/config/AzCVMEmu/tcb_mapping.json b/config/AzCVMEmu/tcb_mapping.json index ba58d2e7a..e2849a1b8 100644 --- a/config/AzCVMEmu/tcb_mapping.json +++ b/config/AzCVMEmu/tcb_mapping.json @@ -1 +1,7 @@ -{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","mrSigner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","isvProdId":1,"svnMappings":[{"tdMeasurements":{"mrtd":"E2C7DA7CF0D93973480F0A34A6FE52A204EA81B4F1B6CD16018F5B4CAEE7B3B544A9738464A7C95E1705E20687A0ADA6","rtmr0":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","rtmr1":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"},"isvsvn":1}]} +{ + "id": "BB9668CA-4EE8-4523-941A-B3B03BE46E03", + "version": 1, + "issueDate": "2025-01-01T00:00:00Z", + "nextUpdate": "2026-01-01T00:00:00Z", + "svnMappings": [] +} diff --git a/config/AzCVMEmu/td_identity.json b/config/AzCVMEmu/td_identity.json index bba297175..dd1e8a55b 100644 --- a/config/AzCVMEmu/td_identity.json +++ b/config/AzCVMEmu/td_identity.json @@ -1 +1,15 @@ -{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbEvaluationNumber":1,"xfam":"E71A060000000000","attributes":"0000000000000000","mrConfigId":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwnerConfig":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrsigner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","isvProdId":1,"tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}]} \ No newline at end of file +{ + "id": "A0998F0F-B2F3-4872-8138-FBC2B853E8C6", + "version": 1, + "issueDate": "2025-01-01T00:00:00Z", + "nextUpdate": "2026-01-01T00:00:00Z", + "tcbLevels": [ + { + "tcb": { + "isvsvn": 1 + }, + "tcbDate": "2024-01-01T00:00:00Z", + "tcbStatus": "UpToDate" + } + ] +} \ No newline at end of file diff --git a/config/Azure/policy_data_raw.json b/config/Azure/policy_data_raw.json index 78a93212b..20cd3fe00 100644 --- a/config/Azure/policy_data_raw.json +++ b/config/Azure/policy_data_raw.json @@ -1 +1 @@ -{"id":"251E9C0A-0BB3-4B1F-8BEB-381F155CB8C6","version":"2.0","policySvn":1,"policy":[{"global":{"tcb":{"tcbDate":{"operation":"greater-or-equal","reference":"2023-08-09T00:00:00Z"}},"platform":{"fmspc":{"operation":"equal","reference":"90C06F000000"}}}},{"servtd":{"migtdIdentity":{"tcbDate":{"operation":"greater-or-equal","reference":"2026-04-03T00:00:00Z"}}}}]} \ No newline at end of file +{"id":"251E9C0A-0BB3-4B1F-8BEB-381F155CB8C6","version":"2.0","policySvn":1,"policy":[{"global":{"tcb":{"tcbDate":{"operation":"greater-or-equal","reference":"2023-08-09T00:00:00Z"}},"platform":{"fmspc":{"operation":"equal","reference":"90C06F000000"}}}},{"servtd":{"migtdIdentity":{"isvsvn":{"operation":"greater-or-equal","reference":"self"}}}}]} \ No newline at end of file diff --git a/config/Azure/policy_reject_data_raw.json b/config/Azure/policy_reject_data_raw.json new file mode 100644 index 000000000..8b6380114 --- /dev/null +++ b/config/Azure/policy_reject_data_raw.json @@ -0,0 +1 @@ +{"id":"251E9C0A-0BB3-4B1F-8BEB-381F155CB8C6","version":"2.0","policySvn":1,"policy":[{"global":{"tcb":{"tcbDate":{"operation":"greater-or-equal","reference":"2023-08-09T00:00:00Z"}},"platform":{"fmspc":{"operation":"equal","reference":"DEADBEEF0000"}}}},{"servtd":{"migtdIdentity":{"tcbDate":{"operation":"greater-or-equal","reference":"2026-04-03T00:00:00Z"}}}}]} \ No newline at end of file diff --git a/config/Azure/td_identity.json b/config/Azure/td_identity.json new file mode 100644 index 000000000..58fed0a9c --- /dev/null +++ b/config/Azure/td_identity.json @@ -0,0 +1 @@ +{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2026-05-20T22:49:55Z","nextUpdate":"2027-04-03T00:00:00Z","tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2026-05-20T22:49:55Z","tcbStatus":"UpToDate"}]} \ No newline at end of file diff --git a/config/templates/policy_issuer_chain.pem b/config/templates/policy_issuer_chain.pem index 151d4abd6..8a43f97ec 100644 --- a/config/templates/policy_issuer_chain.pem +++ b/config/templates/policy_issuer_chain.pem @@ -1,46 +1,47 @@ -----BEGIN CERTIFICATE----- -MIICaDCCAe6gAwIBAgIUI42jpwfmZAB+N0e+h+6KCfklh40wCgYIKoZIzj0EAwMw +MIICfzCCAgWgAwIBAgIUb4Ary1FxNDv2tgK5KjW92D71wx8wCgYIKoZIzj0EAwMw dDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy YTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV -TWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcwMTEwNTA0NFoXDTI3MDcwMTEw -NTA0NFowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50 +TWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcyMTAyMjIzMVoXDTI3MDcyMTAy +MjIzMVowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50 YSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ -bmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABPwrt1m60ICixce/2ugR -GSQhPzgWcbe9JYkFB49ttKJRcxluthFr1spPZerKDUwdvvGCHdoqxKT6itswbZS3 -ahmVUhAsrXPDmKxDCTizZm7ceyRWZ1k7+wR3rlZTSMRoYqNSMFAwDgYDVR0PAQH/ -BAQDAgeAMB0GA1UdDgQWBBT157AdCLS2hROQ1D6welT+Ajy3TjAfBgNVHSMEGDAW -gBRVgv61R6StRYHfVgRYfD1ejdJSgTAKBggqhkjOPQQDAwNoADBlAjASRh3kf2O1 -0EOhJiZEelug2E0+qWqN3AydrbGBn2ZJt5g5jUxhoXlcqXFPiBn83XECMQCn6Wia -Q9PpGUg1E9K9sk22W55z8vDre3VyWkj4nJl4rvk208ugBLWrezdEHasLsOc= +bmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL+t1XLepbWKHwd7iVJl +Uy3P5ZC/XmlelGaGAVHtzT+uyqf95dCdppfmATm5iL6mPCMi/B0EdUVWC8IsRrAb +tIVKOT+6uQvaqjgBDy8/jpULNFU2amH+tFXaK+3mI3FoXaNpMGcwDgYDVR0PAQH/ +BAQDAgeAMBUGA1UdJQQOMAwGCisGAQQBgf1ZAQEwHQYDVR0OBBYEFAQ3bgBAZVtA +xB6bSKABbGXJzUg9MB8GA1UdIwQYMBaAFKrpv7T3Goq7ozzv7XybB7KDXfwqMAoG +CCqGSM49BAMDA2gAMGUCMAC9OBINzzySAY9e6iqUSdueZuL6hNbS7FJjzd4AhLBt +aFDNptrDJzq8QG7TqgDZVAIxAOH/CNjzoJ4Vy/9Wc1gYQvFp/Y8OyIchE+LooQim +3TOl4G9HofEZt+KxtJ2RtWDESw== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIICdTCCAfugAwIBAgIUbqZePdS7UEe0psj4wUNa57MrET0wCgYIKoZIzj0EAwMw +MIICdTCCAfugAwIBAgIUDNYWZVBywkKMCpLBMn/ZrbpVAngwCgYIKoZIzj0EAwMw XzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy YTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB -MB4XDTI2MDcwMTEwNTA0NFoXDTMxMDYzMDEwNTA0NFowdDELMAkGA1UEBhMCVVMx +MB4XDTI2MDcyMTAyMjIzMVoXDTMxMDcyMDAyMjIzMVowdDELMAkGA1UEBhMCVVMx CzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln VEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp -YXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdsL/cjUrCPa00GusnZsRjOxo -8otNIO1a4Ls1rz5Ew7ilQ4X2WNWwNvmwaNY0qFc+MXXSnMY4Q6QmoJesSqCfp5J1 -ooXjIB25lYdXl3bxCMrRmvNzDOWHSKrNkFBpm1p+o2MwYTAPBgNVHRMBAf8EBTAD -AQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUVYL+tUekrUWB31YEWHw9Xo3S -UoEwHwYDVR0jBBgwFoAUCtxBCuwlgOzy1VZm81dXlo69pNgwCgYIKoZIzj0EAwMD -aAAwZQIwP0qNIE1ZMEKV309QREX+zoHgDYp1CgKrRPnCwZSLat80h7GTlYdc8aUN -hGNhIlzjAjEA52OKlaqU1we3OPeoozPyE+H8gr6tRZSX9GhBVnC1yb/OBX5jLN3l -MSh0m8g8dWtL +YXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhtbR7QbD7v9wmJHiLUdRE9SX +OeGsIpHD2yVPsKeYthmXkK9URtDY4DoeUIxjTPOvJPuH+oGBxuJoQB1DlHNud1e4 +ARK1un5WLqJQAM7YH4MDk4e8IgzildxR68Wf5S4Mo2MwYTAPBgNVHRMBAf8EBTAD +AQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUqum/tPcairujPO/tfJsHsoNd +/CowHwYDVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwCgYIKoZIzj0EAwMD +aAAwZQIwTq/MJUn2EN0Ky18A4BLrKyJvrpozm2JLzPZeMJC7JS8hLCXOtpTF1V9l +gSKpqbi9AjEAuMTlfVDUvFQGMR6cAOKScwHOJnUMB5eyyIg7AYlY5WcjwLNaV//d +zw3fC7CR1QR/ -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIICTzCCAdagAwIBAgIUYTquwcbmxr8y1BBPK5eTmYdTB1MwCgYIKoZIzj0EAwMw +MIICTzCCAdagAwIBAgIUYTmEV7kebAA5XSFYNCudbbU/Co8wCgYIKoZIzj0EAwMw XzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy YTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB -MB4XDTI2MDcwMTEwNTA0NFoXDTM2MDYyODEwNTA0NFowXzELMAkGA1UEBhMCVVMx +MB4XDTI2MDcyMTAyMjIzMVoXDTM2MDcxODAyMjIzMVowXzELMAkGA1UEBhMCVVMx CzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln VEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF -K4EEACIDYgAEOApWwQJHtYcFaq0EHH058knEo3Hz6kMqHiuiaB9XUttM1PGvwrux -gnxq1SNp8tfXDQlmjXP/m1TJ+BdFX+9cqSG26/W7doazDHW1MNRir4E/v4mMzIox -86pnu7/7oTnvo1MwUTAdBgNVHQ4EFgQUCtxBCuwlgOzy1VZm81dXlo69pNgwHwYD -VR0jBBgwFoAUCtxBCuwlgOzy1VZm81dXlo69pNgwDwYDVR0TAQH/BAUwAwEB/zAK -BggqhkjOPQQDAwNnADBkAjBGru+cELo1WJH/pxCN1q0adDrhJavW2yVm1A6UbZYm -XvKKVqOsgSf/fhMRGb/htQ8CMBkFmbplQzY3SVlkTT8aBfNq3a1yNZJRw5HQUz9R -DrAL9xNFgVm3//brLnWNpVOtcw== +K4EEACIDYgAEKVtiVC3icjTPZ6yEwO46wmbk38a9N5GZEkTnjXypSwTsC/GfXLA4 +e4wvvwZ/1+sGrogN5DBX/auAFeicLw0CMFNiSocyqalh+LNjYB0vkBLqC5+PQoCa +avI9zsLmyJjUo1MwUTAdBgNVHQ4EFgQULZkd6aI5/Xdm7qbmkrf4JOIgdtEwHwYD +VR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwDwYDVR0TAQH/BAUwAwEB/zAK +BggqhkjOPQQDAwNnADBkAjAGWyxXJ4x3oWj1xDkLpcsYCBas0SNIGhXHPQmMbVqM +mtcDX//3RwD26+yBeZguCIYCMHgCQotN2FZ9PHwcmkA5tQkusL4Ab55d9JfvkjZ7 +HFibzfq7pmApshWt7mQ80fRu/Q== -----END CERTIFICATE----- diff --git a/config/templates/policy_v2.json b/config/templates/policy_v2.json index efb9487c1..3f4f40f14 100644 --- a/config/templates/policy_v2.json +++ b/config/templates/policy_v2.json @@ -1 +1 @@ -{"id":"B87BFE45-9CC7-46F9-8F2C-A6CB55BF7101","version":"2.0","policySvn":1,"policy":[{"global":{"tcb":{"tcbEvaluationDataNumber":{"operation":"greater-or-equal","reference":5},"tcbDate":{"operation":"greater-or-equal","reference":"2022-11-09T00:00:00Z"},"tcbStatusAccepted":{"operation":"allow-list","reference":["UpToDate","ConfigurationNeeded"]}},"platform":{"fmspc":{"operation":"allow-list","reference":["00706A000000","00706E170000","00A068070000","20C06F000000","10A06E040000","40806F000000","10706A000000","10A067110000","20606A000000","10906EA50000","20906EA10000","10906EB10000","10806F000000","00706E070000","50A06D000000","10606A000000","10706A800000","10706A100000","B0806F000000","00706D050000","10806EB70000","10906ED10000","00A06F010000","00A06D070000","40806F200000","60806F000000","10A06E050000","40A06D000000","10606C040000","50A06F000000","00A06D000000","10806EA60000","00706D010000","10806F070000","20D06D010000","00706E270000","00A06F000000","10A06D050000","00C06F000000","30806F000000","20906EA50000","10706E370000","20806F070000","10906EC50000","10806F040000","10D06D000000","10906EA10000","20806F000000","10A067010000","30A06E000000","10A06F000000","70806F000000","10906EC10000","20A06D050000","00606A000000"]}},"crl":{"pckCrlNum":{"operation":"greater-or-equal","reference":1},"rootCaCrlNum":{"operation":"greater-or-equal","reference":1}}}}],"collaterals":{"majorVersion":1,"minorVersion":0,"teeType":129,"rootCa":"-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----","pckCrlIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICmjCCAkCgAwIBAgIUWSPTp0qoY1QuOXCt4A8HK1ckKrcwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTM0MTAzMTEyMzM0N1owcDEiMCAG\nA1UEAwwZSW50ZWwgU0dYIFBDSyBQbGF0Zm9ybSBDQTEaMBgGA1UECgwRSW50ZWwg\nQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEL\nMAkGA1UEBhMCVVMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQwp+Lc+TUBtg1H\n+U8JIsMsbjHjCkTtXb8jPM6r2dhu9zIblhDZ7INfqt3Ix8XcFKD8k0NEXrkZ66qJ\nXa1KzLIKo4G/MIG8MB8GA1UdIwQYMBaAFOnoRFJTNlxLGJoR/EMYLKXcIIBIMFYG\nA1UdHwRPME0wS6BJoEeGRWh0dHBzOi8vc2J4LWNlcnRpZmljYXRlcy50cnVzdGVk\nc2VydmljZXMuaW50ZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQU\nWSPTp0qoY1QuOXCt4A8HK1ckKrcwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQI\nMAYBAf8CAQAwCgYIKoZIzj0EAwIDSAAwRQIhAJ1q+FTz+gUuVfBQuCgJsFrL2TTS\ne1aBZ53O52TjFie6AiAriPaRahUX9Oa9kGLlAchWXKT6j4RWSR50BqhrN3UT4A==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","rootCaCrl":"-----BEGIN X509 CRL-----\nMIIBITCByAIBATAKBggqhkjOPQQDAjBoMRowGAYDVQQDDBFJbnRlbCBTR1ggUm9v\ndCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRh\nIENsYXJhMQswCQYDVQQIDAJDQTELMAkGA1UEBhMCVVMXDTI1MDkxNjExNTMxMloX\nDTI2MDkxNjExNTMxMlqgLzAtMAoGA1UdFAQDAgEBMB8GA1UdIwQYMBaAFOnoRFJT\nNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMCA0gAMEUCIQDv5KEBogNCzPgupOPj\nFIYJaOubypBPCGqnE0XcYTgFDwIgeSfXk71tIbV5lqp6gWCpN98/xu/8c7y36EV3\npkfootI=\n-----END X509 CRL-----","pckCrl":"-----BEGIN X509 CRL-----\nMIIBKTCB0AIBATAKBggqhkjOPQQDAjBwMSIwIAYDVQQDDBlJbnRlbCBTR1ggUENL\nIFBsYXRmb3JtIENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3JhdGlvbjEUMBIGA1UE\nBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQGEwJVUxcNMjYwNzAx\nMDk0NjIzWhcNMjYwNzMxMDk0NjIzWqAvMC0wCgYDVR0UBAMCAQEwHwYDVR0jBBgw\nFoAUWSPTp0qoY1QuOXCt4A8HK1ckKrcwCgYIKoZIzj0EAwIDSAAwRQIgcGtzcbJl\n2S3wCJYxAd7KNnRsztqrU+u2NaDupYb0lTgCIQCA6I7FwSIA0s2r9sVOz6dIqV1w\naBnaP08fyNmvo7VbCA==\n-----END X509 CRL-----","platforms":[{"fmspc":"20C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20C06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"3d0d3653b9341dc41c362f8f7cd38e9f4b829d057811ce6cafbcc77f167b6447522b4717b3d5c58a71648eec12af0b8e935edbb6cd773c4ceb7ad90e68cf001e\"}"},{"fmspc":"0400F1300000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1300000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"bcb9b79749670cca6342f83b2a5590595faf905d450ec175c7efdf9ff4dca6ad1dc3d10b8570ab0318a5bc3fd24c58a1729f09994b47bd0f82d49cfbb71ee3dd\"}"},{"fmspc":"10A06E040000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06E040000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"3bb24f39c796226e15a38616fe60e4c28d7ec28acb5d67e25b659555b29f404f472a7b0f9ee26fa065941ce915966f7c3759f52e27dc07bb1c2a29da08bb094d\"}"},{"fmspc":"40806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"40806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5320e541877e904a23caa7ee30c8ca7d794a72617b4c16cf6028746731fee7248f2583eda07683edcbd3e08e14e91d846cfafa7355866e10d6150bf8b47ae269\"}"},{"fmspc":"0400F1370000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1370000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"361c382377cc1515aa6f6f5d74a3b8ab02aca6eafb30f97322715f61fdfcfffa549c12f4e74e4769fd248483124cc2228c134577cf3bd199fbd3d03244a80610\"}"},{"fmspc":"0400F1100000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1100000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d33030e843729d88c8b9c5a4aae1185f6a0f43a2fc6bdbf7eff62ae0dc14411ae097b3a50ae6d411748950aa2c0953adbbb128d59bc337bede6792b0248a2a3b\"}"},{"fmspc":"10806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T09:46:20Z\",\"nextUpdate\":\"2026-07-31T09:46:20Z\",\"fmspc\":\"10806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":10,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":10,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2020-05-28T00:00:00Z\",\"tcbStatus\":\"OutOfDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":9,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2020-03-22T00:00:00Z\",\"tcbStatus\":\"OutOfDate\"}]},\"signature\":\"19a007d6ca2b8a300ce6ff7d34f93ef32a98462b6c1b003a8a230743be6c7ec80cfcb869dfb9be29c5e30d4d14817899d5249ddb1d146f04b623f87010837657\"}"},{"fmspc":"50A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"50A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"28e87299fb0ed2b63890a895f6b8fe86abcf087c7023f79cb93aaa3ceb8fdefd694ec5bcaed2fb00e83e9696557ff70b1649107de1269f477723db74cd815653\"}"},{"fmspc":"B0806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"B0806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"da0312fbe582e1d32136ddd517abf928c2c9ccdcb686d3306a6c4401a96190d6fdd753da816ffaa27d7b536298713f48de3f45d1a7a8e364d3ea75159452614c\"}"},{"fmspc":"00A06F010000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06F010000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"a1309265fe850a27482fc8cdb2854cab6ff10f5ca4099af209a676a062b4b45943155227d431d4058c47c70be382dc43defde577b980412653b59ec4e298a23b\"}"},{"fmspc":"00A06D070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06D070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"98641e3b215e1134191c0637028cd6031ab109354d8c68083769bd63757418d83c2837f396ecad4f7e1e13176b0b2367e46cd1045dc6032df731c7edebe124e2\"}"},{"fmspc":"60806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"60806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"85ecac3694bcca3320c5ce5cdbc67bbec0d85ae9642561a13e47e6dafb1bec844c9b023760b33ea981bec268d814aa039e27063674b41671e079f39bb3509cfd\"}"},{"fmspc":"10A06E050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06E050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"0a8a99b3c165ef65b54c2e313764342850bfd1c31aa201f2cfdb93399a115ae3f20faabbf53f1bb66565c58763eb300c852a0fa796aa065b64b79138585f5682\"}"},{"fmspc":"40A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"40A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"f049caf6905eebfbba2a1eccc7e96268a4c4f3d7d8a31ca340f260ea2035ec596cf5fe7bef4e86f42ecd2014b6a10feace6e622df152ce6faf74eafb54329dee\"}"},{"fmspc":"0400F1000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":0,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"589d8a6a5a60f3e12b303f6bd0ab9b3e70ad77500216936a5245c734443c6ea847a682b28324aa99e705f974446a66bad79fab7ee0291d62650db0c7681bd61b\"}"},{"fmspc":"50A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"50A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"8ef380408be7b4d51e2e19c03cecd5685467d0203719efeeac19c44d79b2b4358695345ec7adfb3abb71698001ddeb0de24adba24cc82ede59c4c828b3c52f59\"}"},{"fmspc":"00A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"126fd0874cbcee488f4fa793f0ca020f41a5f44965622b6e7768f9b4e677e7920105bbf3c3735e3ed7c6ad3f4e501534ee8e6c29df6a0c4367287d3d5176c72f\"}"},{"fmspc":"0400F1070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"b35cffb8b5af48c3026ee5ae3ad56bb1b45ef872ca2ec744a562073ffb57940cff890454f385ef57a39a5941fd4aa6049ce502be027ef5cf1b33f12bb4af9fd0\"}"},{"fmspc":"10806F070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10806F070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"9ed0865391001855b2e35740fdeb3978b284364201d1d568cc8c85bd640e707767c73cad516c00e2b29a2e81963fe5560c93ef20f391e936b33db74c1aa5b26c\"}"},{"fmspc":"20D06D010000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20D06D010000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5214de9edac3522fe9a68abba903fc88c59c37651c8f4bf2b79bebf2381fc32907dc9790ed883d15a948b7ba91f4ad8fe1712c56390d8398ac0641a55eb80f21\"}"},{"fmspc":"00A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"ac626a284a933532e9ad33ce2c2dbc24ad7e79dbef9a33dc8697fed09e2c46e5a8f508d057dc619d801eded0536502fb9be503a626cc5cbb2b02dd3da1f0b921\"}"},{"fmspc":"10A06D050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06D050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":0,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5ab60c67e4c6477c8767bf2b615cf985211e1ee3a3ecb06cd045b2907f5e120cd3f2dad24c2143d887e0596b8ffdb477e0edf417509a871f932e06debceff864\"}"},{"fmspc":"00C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00C06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"f787aeb769a57e7aa4e8cd64ba199b71966d6ffb441b9a5de66bcbc4e93b65f049da696bdefad506e3ece86249a4688b12f077bb559f1cace27899a5a4541f2c\"}"},{"fmspc":"30806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"30806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"c7bfb3a1d338bb64803c232efff231a25871dd14b06ecd4d119adc6998b0c90bd8d3f109af79f40d4cb24c2e939c596c2ab0896b289569b8d3dadc920900a98a\"}"},{"fmspc":"0400F1200000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1200000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"8c8c10f373ab61fa882f2f10f3885cea3b4ad34cfcbef833be573cbf631e7e84c31ad26ec05ee640fd91aa0ef0433e53c4d0fbc82c14cf055aabd698a96da216\"}"},{"fmspc":"20806F070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20806F070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d6154c177ad2e3f782dba2df4bf13e2fe2f6a07e20ae09d63cd4e1c3a7caca1afdecbc2c6959619e810926f6d6df4fe5b6d62e7a3f3abfc0bc440e768084298d\"}"},{"fmspc":"10806F040000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10806F040000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"c04cb69c8a57965018da713e624baa6c11f290f762b1b73cf01f90087334ba8d6c33e10fb3ca766b7dd99d87387b8b4241f25f3e91328c160c193deb70ec0bdb\"}"},{"fmspc":"10D06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10D06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"29ec7d93a60c101cd878f061467e933088dd0f393d8cbfd26ecba14cdf22c839b89b9fca57440105770449c022b3f7c1c514b294a46e504718b81deda3620d76\"}"},{"fmspc":"20806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"89ccc75f7e47334690d6ac8ba90d0ea84850d837ce51698dfe7b4b778476afd09fcd3119e3bc93e660b195e7db805d69cf8ed4ce1705eed3beaca4de8027ec8d\"}"},{"fmspc":"30A06E000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"30A06E000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d5550e6e74aed8bd2806e47cbdc99ed75b833401896a662727b5ff62e205e118e17afc952158d54b132719eebe45a5dde9e8c501dcba827320f76f1053460f8b\"}"},{"fmspc":"10A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"7ce7382154fbea591d0851952f283b16edf79ce56cba3757dd2297cfd0296c6bc3408eaa416ae14d13936f7662ba42741f4e718888dc0ad9f2630fde233810fa\"}"},{"fmspc":"20A06D050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20A06D050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"4fceb18caf6eb5ba2ca7138d55d24a6b8d81f99147383bcb5dec755572bf5a24d496fdcdbda75ce076682703685fdac3c9b0f0f53059ab2a3d8d0a8cba9631eb\"}"}],"qeIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","qeIdentity":"{\"enclaveIdentity\":{\"id\":\"TD_QE\",\"version\":2,\"issueDate\":\"2026-07-01T10:33:44Z\",\"nextUpdate\":\"2026-07-31T10:33:44Z\",\"tcbEvaluationDataNumber\":5,\"miscselect\":\"00000000\",\"miscselectMask\":\"FFFFFFFF\",\"attributes\":\"11000000000000000000000000000000\",\"attributesMask\":\"FBFFFFFFFFFFFFFF0000000000000000\",\"mrsigner\":\"DC9E2A7C6F948F17474E34A7FC43ED030F7C1563F1BABDDF6340C82E0E54A8C5\",\"isvprodid\":2,\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"bccb9464275b040819102bd2357fb77e2f1936f218c4d06afebe55b97d7bf416c7d70839897df145c94c6cc65a090c274f94df9b158c245fd37c344272527703\"}"},"servtdCollateral":{"majorVersion":1,"minorVersion":0,"servtdIdentity":{"tdIdentity":{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbEvaluationNumber":1,"xfam":"E71A060000000000","attributes":"0000000000000000","mrConfigId":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwnerConfig":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrsigner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","isvProdId":1,"tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}]},"signature":"3066023100E903D592DF599196522B27BF9AC5B6DAC650CC092E0E901B9D9DCA85595286E4D324400D022D6B5D5601C8172842D465023100D200B5F89F368BC875B6792AE553B7563E9B4DBFF15220BF04D0E06AA1E2E841A0B74CC118927D3BACB5F54B027C25AD"},"servtdIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICaDCCAe6gAwIBAgIUI42jpwfmZAB+N0e+h+6KCfklh40wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcwMTEwNTA0NFoXDTI3MDcwMTEw\nNTA0NFowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABPwrt1m60ICixce/2ugR\nGSQhPzgWcbe9JYkFB49ttKJRcxluthFr1spPZerKDUwdvvGCHdoqxKT6itswbZS3\nahmVUhAsrXPDmKxDCTizZm7ceyRWZ1k7+wR3rlZTSMRoYqNSMFAwDgYDVR0PAQH/\nBAQDAgeAMB0GA1UdDgQWBBT157AdCLS2hROQ1D6welT+Ajy3TjAfBgNVHSMEGDAW\ngBRVgv61R6StRYHfVgRYfD1ejdJSgTAKBggqhkjOPQQDAwNoADBlAjASRh3kf2O1\n0EOhJiZEelug2E0+qWqN3AydrbGBn2ZJt5g5jUxhoXlcqXFPiBn83XECMQCn6Wia\nQ9PpGUg1E9K9sk22W55z8vDre3VyWkj4nJl4rvk208ugBLWrezdEHasLsOc=\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUbqZePdS7UEe0psj4wUNa57MrET0wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcwMTEwNTA0NFoXDTMxMDYzMDEwNTA0NFowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdsL/cjUrCPa00GusnZsRjOxo\n8otNIO1a4Ls1rz5Ew7ilQ4X2WNWwNvmwaNY0qFc+MXXSnMY4Q6QmoJesSqCfp5J1\nooXjIB25lYdXl3bxCMrRmvNzDOWHSKrNkFBpm1p+o2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUVYL+tUekrUWB31YEWHw9Xo3S\nUoEwHwYDVR0jBBgwFoAUCtxBCuwlgOzy1VZm81dXlo69pNgwCgYIKoZIzj0EAwMD\naAAwZQIwP0qNIE1ZMEKV309QREX+zoHgDYp1CgKrRPnCwZSLat80h7GTlYdc8aUN\nhGNhIlzjAjEA52OKlaqU1we3OPeoozPyE+H8gr6tRZSX9GhBVnC1yb/OBX5jLN3l\nMSh0m8g8dWtL\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTquwcbmxr8y1BBPK5eTmYdTB1MwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcwMTEwNTA0NFoXDTM2MDYyODEwNTA0NFowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEOApWwQJHtYcFaq0EHH058knEo3Hz6kMqHiuiaB9XUttM1PGvwrux\ngnxq1SNp8tfXDQlmjXP/m1TJ+BdFX+9cqSG26/W7doazDHW1MNRir4E/v4mMzIox\n86pnu7/7oTnvo1MwUTAdBgNVHQ4EFgQUCtxBCuwlgOzy1VZm81dXlo69pNgwHwYD\nVR0jBBgwFoAUCtxBCuwlgOzy1VZm81dXlo69pNgwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjBGru+cELo1WJH/pxCN1q0adDrhJavW2yVm1A6UbZYm\nXvKKVqOsgSf/fhMRGb/htQ8CMBkFmbplQzY3SVlkTT8aBfNq3a1yNZJRw5HQUz9R\nDrAL9xNFgVm3//brLnWNpVOtcw==\n-----END CERTIFICATE-----\n","servtdTcbMapping":{"tdTcbMapping":{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","issueDate":"2025-01-01T00:00:00Z","isvProdId":1,"mrSigner":"00000000000000000000000000000000","nextUpdate":"2026-01-01T00:00:00Z","svnMappings":[{"isvsvn":1,"tdMeasurements":{"mrtd":"0E200328149B9BAAFD0E68557A426EFF78553D13E2536862EDDD8299A80C986567A8E03CB86F7D3EC75E99F386C3490B","rtmr0":"518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4","rtmr1":"C3C3F42541603E01B85F8B5BD89B45A1B386CB76D56182F63AF73589F81B3280D35545FFD3BF3BDBD5649ABD2E3C3C3E"}}],"version":1},"signature":"306502305E23F4D150336BB6CD0C873C63AB7359556DF5260689324DD242EA0F3007A7C37BFADE5C099A3859D7F9C6978A29E077023100911C7AD3F666F8CE8659F7F4F9474CF9D557AEAEA647F3B9549FF434A6589E697D0588F7E82CF87F2F794FC0E305EC51"},"servtdTcbMappingIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICaDCCAe6gAwIBAgIUI42jpwfmZAB+N0e+h+6KCfklh40wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcwMTEwNTA0NFoXDTI3MDcwMTEw\nNTA0NFowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABPwrt1m60ICixce/2ugR\nGSQhPzgWcbe9JYkFB49ttKJRcxluthFr1spPZerKDUwdvvGCHdoqxKT6itswbZS3\nahmVUhAsrXPDmKxDCTizZm7ceyRWZ1k7+wR3rlZTSMRoYqNSMFAwDgYDVR0PAQH/\nBAQDAgeAMB0GA1UdDgQWBBT157AdCLS2hROQ1D6welT+Ajy3TjAfBgNVHSMEGDAW\ngBRVgv61R6StRYHfVgRYfD1ejdJSgTAKBggqhkjOPQQDAwNoADBlAjASRh3kf2O1\n0EOhJiZEelug2E0+qWqN3AydrbGBn2ZJt5g5jUxhoXlcqXFPiBn83XECMQCn6Wia\nQ9PpGUg1E9K9sk22W55z8vDre3VyWkj4nJl4rvk208ugBLWrezdEHasLsOc=\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUbqZePdS7UEe0psj4wUNa57MrET0wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcwMTEwNTA0NFoXDTMxMDYzMDEwNTA0NFowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdsL/cjUrCPa00GusnZsRjOxo\n8otNIO1a4Ls1rz5Ew7ilQ4X2WNWwNvmwaNY0qFc+MXXSnMY4Q6QmoJesSqCfp5J1\nooXjIB25lYdXl3bxCMrRmvNzDOWHSKrNkFBpm1p+o2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUVYL+tUekrUWB31YEWHw9Xo3S\nUoEwHwYDVR0jBBgwFoAUCtxBCuwlgOzy1VZm81dXlo69pNgwCgYIKoZIzj0EAwMD\naAAwZQIwP0qNIE1ZMEKV309QREX+zoHgDYp1CgKrRPnCwZSLat80h7GTlYdc8aUN\nhGNhIlzjAjEA52OKlaqU1we3OPeoozPyE+H8gr6tRZSX9GhBVnC1yb/OBX5jLN3l\nMSh0m8g8dWtL\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTquwcbmxr8y1BBPK5eTmYdTB1MwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcwMTEwNTA0NFoXDTM2MDYyODEwNTA0NFowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEOApWwQJHtYcFaq0EHH058knEo3Hz6kMqHiuiaB9XUttM1PGvwrux\ngnxq1SNp8tfXDQlmjXP/m1TJ+BdFX+9cqSG26/W7doazDHW1MNRir4E/v4mMzIox\n86pnu7/7oTnvo1MwUTAdBgNVHQ4EFgQUCtxBCuwlgOzy1VZm81dXlo69pNgwHwYD\nVR0jBBgwFoAUCtxBCuwlgOzy1VZm81dXlo69pNgwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjBGru+cELo1WJH/pxCN1q0adDrhJavW2yVm1A6UbZYm\nXvKKVqOsgSf/fhMRGb/htQ8CMBkFmbplQzY3SVlkTT8aBfNq3a1yNZJRw5HQUz9R\nDrAL9xNFgVm3//brLnWNpVOtcw==\n-----END CERTIFICATE-----\n"}} \ No newline at end of file +{"id":"E6643BDC-E50A-4315-9EF7-F217CE8AF9A6","version":"2.0","policySvn":1,"policy":[{"global":{"tcb":{"tcbEvaluationDataNumber":{"operation":"greater-or-equal","reference":5},"tcbDate":{"operation":"greater-or-equal","reference":"2022-11-09T00:00:00Z"},"tcbStatusAccepted":{"operation":"allow-list","reference":["UpToDate","ConfigurationNeeded"]}},"platform":{"fmspc":{"operation":"allow-list","reference":["00706A000000","00706E170000","00A068070000","20C06F000000","10A06E040000","40806F000000","10706A000000","10A067110000","20606A000000","10906EA50000","20906EA10000","10906EB10000","10806F000000","00706E070000","50A06D000000","10606A000000","10706A800000","10706A100000","B0806F000000","00706D050000","10806EB70000","10906ED10000","00A06F010000","00A06D070000","40806F200000","60806F000000","10A06E050000","40A06D000000","10606C040000","50A06F000000","00A06D000000","10806EA60000","00706D010000","10806F070000","20D06D010000","00706E270000","00A06F000000","10A06D050000","00C06F000000","30806F000000","20906EA50000","10706E370000","20806F070000","10906EC50000","10806F040000","10D06D000000","10906EA10000","20806F000000","10A067010000","30A06E000000","10A06F000000","70806F000000","10906EC10000","20A06D050000","00606A000000"]}},"crl":{"pckCrlNum":{"operation":"greater-or-equal","reference":1},"rootCaCrlNum":{"operation":"greater-or-equal","reference":1}}}}],"collaterals":{"majorVersion":1,"minorVersion":0,"teeType":129,"rootCa":"-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----","pckCrlIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICmjCCAkCgAwIBAgIUWSPTp0qoY1QuOXCt4A8HK1ckKrcwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTM0MTAzMTEyMzM0N1owcDEiMCAG\nA1UEAwwZSW50ZWwgU0dYIFBDSyBQbGF0Zm9ybSBDQTEaMBgGA1UECgwRSW50ZWwg\nQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEL\nMAkGA1UEBhMCVVMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQwp+Lc+TUBtg1H\n+U8JIsMsbjHjCkTtXb8jPM6r2dhu9zIblhDZ7INfqt3Ix8XcFKD8k0NEXrkZ66qJ\nXa1KzLIKo4G/MIG8MB8GA1UdIwQYMBaAFOnoRFJTNlxLGJoR/EMYLKXcIIBIMFYG\nA1UdHwRPME0wS6BJoEeGRWh0dHBzOi8vc2J4LWNlcnRpZmljYXRlcy50cnVzdGVk\nc2VydmljZXMuaW50ZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQU\nWSPTp0qoY1QuOXCt4A8HK1ckKrcwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQI\nMAYBAf8CAQAwCgYIKoZIzj0EAwIDSAAwRQIhAJ1q+FTz+gUuVfBQuCgJsFrL2TTS\ne1aBZ53O52TjFie6AiAriPaRahUX9Oa9kGLlAchWXKT6j4RWSR50BqhrN3UT4A==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","rootCaCrl":"-----BEGIN X509 CRL-----\nMIIBITCByAIBATAKBggqhkjOPQQDAjBoMRowGAYDVQQDDBFJbnRlbCBTR1ggUm9v\ndCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRh\nIENsYXJhMQswCQYDVQQIDAJDQTELMAkGA1UEBhMCVVMXDTI1MDkxNjExNTMxMloX\nDTI2MDkxNjExNTMxMlqgLzAtMAoGA1UdFAQDAgEBMB8GA1UdIwQYMBaAFOnoRFJT\nNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMCA0gAMEUCIQDv5KEBogNCzPgupOPj\nFIYJaOubypBPCGqnE0XcYTgFDwIgeSfXk71tIbV5lqp6gWCpN98/xu/8c7y36EV3\npkfootI=\n-----END X509 CRL-----","pckCrl":"-----BEGIN X509 CRL-----\nMIIBKTCB0AIBATAKBggqhkjOPQQDAjBwMSIwIAYDVQQDDBlJbnRlbCBTR1ggUENL\nIFBsYXRmb3JtIENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3JhdGlvbjEUMBIGA1UE\nBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQGEwJVUxcNMjYwNzAx\nMDk0NjIzWhcNMjYwNzMxMDk0NjIzWqAvMC0wCgYDVR0UBAMCAQEwHwYDVR0jBBgw\nFoAUWSPTp0qoY1QuOXCt4A8HK1ckKrcwCgYIKoZIzj0EAwIDSAAwRQIgcGtzcbJl\n2S3wCJYxAd7KNnRsztqrU+u2NaDupYb0lTgCIQCA6I7FwSIA0s2r9sVOz6dIqV1w\naBnaP08fyNmvo7VbCA==\n-----END X509 CRL-----","platforms":[{"fmspc":"20C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20C06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"3d0d3653b9341dc41c362f8f7cd38e9f4b829d057811ce6cafbcc77f167b6447522b4717b3d5c58a71648eec12af0b8e935edbb6cd773c4ceb7ad90e68cf001e\"}"},{"fmspc":"0400F1300000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1300000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"bcb9b79749670cca6342f83b2a5590595faf905d450ec175c7efdf9ff4dca6ad1dc3d10b8570ab0318a5bc3fd24c58a1729f09994b47bd0f82d49cfbb71ee3dd\"}"},{"fmspc":"10A06E040000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06E040000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"3bb24f39c796226e15a38616fe60e4c28d7ec28acb5d67e25b659555b29f404f472a7b0f9ee26fa065941ce915966f7c3759f52e27dc07bb1c2a29da08bb094d\"}"},{"fmspc":"40806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"40806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5320e541877e904a23caa7ee30c8ca7d794a72617b4c16cf6028746731fee7248f2583eda07683edcbd3e08e14e91d846cfafa7355866e10d6150bf8b47ae269\"}"},{"fmspc":"0400F1370000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1370000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"361c382377cc1515aa6f6f5d74a3b8ab02aca6eafb30f97322715f61fdfcfffa549c12f4e74e4769fd248483124cc2228c134577cf3bd199fbd3d03244a80610\"}"},{"fmspc":"0400F1100000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1100000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d33030e843729d88c8b9c5a4aae1185f6a0f43a2fc6bdbf7eff62ae0dc14411ae097b3a50ae6d411748950aa2c0953adbbb128d59bc337bede6792b0248a2a3b\"}"},{"fmspc":"10806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T09:46:20Z\",\"nextUpdate\":\"2026-07-31T09:46:20Z\",\"fmspc\":\"10806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":10,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":10,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2020-05-28T00:00:00Z\",\"tcbStatus\":\"OutOfDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":9,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2020-03-22T00:00:00Z\",\"tcbStatus\":\"OutOfDate\"}]},\"signature\":\"19a007d6ca2b8a300ce6ff7d34f93ef32a98462b6c1b003a8a230743be6c7ec80cfcb869dfb9be29c5e30d4d14817899d5249ddb1d146f04b623f87010837657\"}"},{"fmspc":"50A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"50A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"28e87299fb0ed2b63890a895f6b8fe86abcf087c7023f79cb93aaa3ceb8fdefd694ec5bcaed2fb00e83e9696557ff70b1649107de1269f477723db74cd815653\"}"},{"fmspc":"B0806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"B0806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"da0312fbe582e1d32136ddd517abf928c2c9ccdcb686d3306a6c4401a96190d6fdd753da816ffaa27d7b536298713f48de3f45d1a7a8e364d3ea75159452614c\"}"},{"fmspc":"00A06F010000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06F010000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"a1309265fe850a27482fc8cdb2854cab6ff10f5ca4099af209a676a062b4b45943155227d431d4058c47c70be382dc43defde577b980412653b59ec4e298a23b\"}"},{"fmspc":"00A06D070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06D070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"98641e3b215e1134191c0637028cd6031ab109354d8c68083769bd63757418d83c2837f396ecad4f7e1e13176b0b2367e46cd1045dc6032df731c7edebe124e2\"}"},{"fmspc":"60806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"60806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"85ecac3694bcca3320c5ce5cdbc67bbec0d85ae9642561a13e47e6dafb1bec844c9b023760b33ea981bec268d814aa039e27063674b41671e079f39bb3509cfd\"}"},{"fmspc":"10A06E050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06E050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"0a8a99b3c165ef65b54c2e313764342850bfd1c31aa201f2cfdb93399a115ae3f20faabbf53f1bb66565c58763eb300c852a0fa796aa065b64b79138585f5682\"}"},{"fmspc":"40A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"40A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"f049caf6905eebfbba2a1eccc7e96268a4c4f3d7d8a31ca340f260ea2035ec596cf5fe7bef4e86f42ecd2014b6a10feace6e622df152ce6faf74eafb54329dee\"}"},{"fmspc":"0400F1000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":0,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"589d8a6a5a60f3e12b303f6bd0ab9b3e70ad77500216936a5245c734443c6ea847a682b28324aa99e705f974446a66bad79fab7ee0291d62650db0c7681bd61b\"}"},{"fmspc":"50A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"50A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"8ef380408be7b4d51e2e19c03cecd5685467d0203719efeeac19c44d79b2b4358695345ec7adfb3abb71698001ddeb0de24adba24cc82ede59c4c828b3c52f59\"}"},{"fmspc":"00A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"126fd0874cbcee488f4fa793f0ca020f41a5f44965622b6e7768f9b4e677e7920105bbf3c3735e3ed7c6ad3f4e501534ee8e6c29df6a0c4367287d3d5176c72f\"}"},{"fmspc":"0400F1070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"b35cffb8b5af48c3026ee5ae3ad56bb1b45ef872ca2ec744a562073ffb57940cff890454f385ef57a39a5941fd4aa6049ce502be027ef5cf1b33f12bb4af9fd0\"}"},{"fmspc":"10806F070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10806F070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"9ed0865391001855b2e35740fdeb3978b284364201d1d568cc8c85bd640e707767c73cad516c00e2b29a2e81963fe5560c93ef20f391e936b33db74c1aa5b26c\"}"},{"fmspc":"20D06D010000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20D06D010000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5214de9edac3522fe9a68abba903fc88c59c37651c8f4bf2b79bebf2381fc32907dc9790ed883d15a948b7ba91f4ad8fe1712c56390d8398ac0641a55eb80f21\"}"},{"fmspc":"00A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"ac626a284a933532e9ad33ce2c2dbc24ad7e79dbef9a33dc8697fed09e2c46e5a8f508d057dc619d801eded0536502fb9be503a626cc5cbb2b02dd3da1f0b921\"}"},{"fmspc":"10A06D050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06D050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":0,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5ab60c67e4c6477c8767bf2b615cf985211e1ee3a3ecb06cd045b2907f5e120cd3f2dad24c2143d887e0596b8ffdb477e0edf417509a871f932e06debceff864\"}"},{"fmspc":"00C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00C06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"f787aeb769a57e7aa4e8cd64ba199b71966d6ffb441b9a5de66bcbc4e93b65f049da696bdefad506e3ece86249a4688b12f077bb559f1cace27899a5a4541f2c\"}"},{"fmspc":"30806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"30806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"c7bfb3a1d338bb64803c232efff231a25871dd14b06ecd4d119adc6998b0c90bd8d3f109af79f40d4cb24c2e939c596c2ab0896b289569b8d3dadc920900a98a\"}"},{"fmspc":"0400F1200000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1200000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"8c8c10f373ab61fa882f2f10f3885cea3b4ad34cfcbef833be573cbf631e7e84c31ad26ec05ee640fd91aa0ef0433e53c4d0fbc82c14cf055aabd698a96da216\"}"},{"fmspc":"20806F070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20806F070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d6154c177ad2e3f782dba2df4bf13e2fe2f6a07e20ae09d63cd4e1c3a7caca1afdecbc2c6959619e810926f6d6df4fe5b6d62e7a3f3abfc0bc440e768084298d\"}"},{"fmspc":"10806F040000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10806F040000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"c04cb69c8a57965018da713e624baa6c11f290f762b1b73cf01f90087334ba8d6c33e10fb3ca766b7dd99d87387b8b4241f25f3e91328c160c193deb70ec0bdb\"}"},{"fmspc":"10D06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10D06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"29ec7d93a60c101cd878f061467e933088dd0f393d8cbfd26ecba14cdf22c839b89b9fca57440105770449c022b3f7c1c514b294a46e504718b81deda3620d76\"}"},{"fmspc":"20806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"89ccc75f7e47334690d6ac8ba90d0ea84850d837ce51698dfe7b4b778476afd09fcd3119e3bc93e660b195e7db805d69cf8ed4ce1705eed3beaca4de8027ec8d\"}"},{"fmspc":"30A06E000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"30A06E000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d5550e6e74aed8bd2806e47cbdc99ed75b833401896a662727b5ff62e205e118e17afc952158d54b132719eebe45a5dde9e8c501dcba827320f76f1053460f8b\"}"},{"fmspc":"10A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"7ce7382154fbea591d0851952f283b16edf79ce56cba3757dd2297cfd0296c6bc3408eaa416ae14d13936f7662ba42741f4e718888dc0ad9f2630fde233810fa\"}"},{"fmspc":"20A06D050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20A06D050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"4fceb18caf6eb5ba2ca7138d55d24a6b8d81f99147383bcb5dec755572bf5a24d496fdcdbda75ce076682703685fdac3c9b0f0f53059ab2a3d8d0a8cba9631eb\"}"}],"qeIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","qeIdentity":"{\"enclaveIdentity\":{\"id\":\"TD_QE\",\"version\":2,\"issueDate\":\"2026-07-01T10:33:44Z\",\"nextUpdate\":\"2026-07-31T10:33:44Z\",\"tcbEvaluationDataNumber\":5,\"miscselect\":\"00000000\",\"miscselectMask\":\"FFFFFFFF\",\"attributes\":\"11000000000000000000000000000000\",\"attributesMask\":\"FBFFFFFFFFFFFFFF0000000000000000\",\"mrsigner\":\"DC9E2A7C6F948F17474E34A7FC43ED030F7C1563F1BABDDF6340C82E0E54A8C5\",\"isvprodid\":2,\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"bccb9464275b040819102bd2357fb77e2f1936f218c4d06afebe55b97d7bf416c7d70839897df145c94c6cc65a090c274f94df9b158c245fd37c344272527703\"}"},"servtdCollateral":{"majorVersion":1,"minorVersion":0,"servtdTcbMapping":{"tdTcbMapping":{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","svnMappings":[{"tdMeasurements":{"tdinfo_hash":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"},"isvsvn":1}]},"signature":"306502302DF213408E43734941EE22050FB1566E9C3AB600D0C0ADE9EDD99A0C91E2D2E44DD54C6B6658C5C2277BD63EF6EE33B702310092B91C8CDED39E93D0E67B02813388445116123AA2298E956559917FE817B8143CA12A9352DA7CCEC2F6D1F58E025F92"},"servtdTcbMappingIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICfzCCAgWgAwIBAgIUb4Ary1FxNDv2tgK5KjW92D71wx8wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcyMTAyMjIzMVoXDTI3MDcyMTAy\nMjIzMVowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL+t1XLepbWKHwd7iVJl\nUy3P5ZC/XmlelGaGAVHtzT+uyqf95dCdppfmATm5iL6mPCMi/B0EdUVWC8IsRrAb\ntIVKOT+6uQvaqjgBDy8/jpULNFU2amH+tFXaK+3mI3FoXaNpMGcwDgYDVR0PAQH/\nBAQDAgeAMBUGA1UdJQQOMAwGCisGAQQBgf1ZAQEwHQYDVR0OBBYEFAQ3bgBAZVtA\nxB6bSKABbGXJzUg9MB8GA1UdIwQYMBaAFKrpv7T3Goq7ozzv7XybB7KDXfwqMAoG\nCCqGSM49BAMDA2gAMGUCMAC9OBINzzySAY9e6iqUSdueZuL6hNbS7FJjzd4AhLBt\naFDNptrDJzq8QG7TqgDZVAIxAOH/CNjzoJ4Vy/9Wc1gYQvFp/Y8OyIchE+LooQim\n3TOl4G9HofEZt+KxtJ2RtWDESw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUDNYWZVBywkKMCpLBMn/ZrbpVAngwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTMxMDcyMDAyMjIzMVowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhtbR7QbD7v9wmJHiLUdRE9SX\nOeGsIpHD2yVPsKeYthmXkK9URtDY4DoeUIxjTPOvJPuH+oGBxuJoQB1DlHNud1e4\nARK1un5WLqJQAM7YH4MDk4e8IgzildxR68Wf5S4Mo2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUqum/tPcairujPO/tfJsHsoNd\n/CowHwYDVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwCgYIKoZIzj0EAwMD\naAAwZQIwTq/MJUn2EN0Ky18A4BLrKyJvrpozm2JLzPZeMJC7JS8hLCXOtpTF1V9l\ngSKpqbi9AjEAuMTlfVDUvFQGMR6cAOKScwHOJnUMB5eyyIg7AYlY5WcjwLNaV//d\nzw3fC7CR1QR/\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTmEV7kebAA5XSFYNCudbbU/Co8wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTM2MDcxODAyMjIzMVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEKVtiVC3icjTPZ6yEwO46wmbk38a9N5GZEkTnjXypSwTsC/GfXLA4\ne4wvvwZ/1+sGrogN5DBX/auAFeicLw0CMFNiSocyqalh+LNjYB0vkBLqC5+PQoCa\navI9zsLmyJjUo1MwUTAdBgNVHQ4EFgQULZkd6aI5/Xdm7qbmkrf4JOIgdtEwHwYD\nVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjAGWyxXJ4x3oWj1xDkLpcsYCBas0SNIGhXHPQmMbVqM\nmtcDX//3RwD26+yBeZguCIYCMHgCQotN2FZ9PHwcmkA5tQkusL4Ab55d9JfvkjZ7\nHFibzfq7pmApshWt7mQ80fRu/Q==\n-----END CERTIFICATE-----\n","servtdIdentity":{"tdIdentity":{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}]},"signature":"3066023100A3895AA95723C3DD3975C55480676494940833B0F9D83F8E7DD8F011DEF212B3326EE32FFA1BDF3C41941FF4D4FD86E6023100A5A52A633A85C39D9FE64516256763ADC84E2D548655935508053FD61AA03DB8CDA1FD5116E5A38CD08DAA2C44FFB42C"},"servtdIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICfzCCAgWgAwIBAgIUb4Ary1FxNDv2tgK5KjW92D71wx8wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcyMTAyMjIzMVoXDTI3MDcyMTAy\nMjIzMVowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL+t1XLepbWKHwd7iVJl\nUy3P5ZC/XmlelGaGAVHtzT+uyqf95dCdppfmATm5iL6mPCMi/B0EdUVWC8IsRrAb\ntIVKOT+6uQvaqjgBDy8/jpULNFU2amH+tFXaK+3mI3FoXaNpMGcwDgYDVR0PAQH/\nBAQDAgeAMBUGA1UdJQQOMAwGCisGAQQBgf1ZAQEwHQYDVR0OBBYEFAQ3bgBAZVtA\nxB6bSKABbGXJzUg9MB8GA1UdIwQYMBaAFKrpv7T3Goq7ozzv7XybB7KDXfwqMAoG\nCCqGSM49BAMDA2gAMGUCMAC9OBINzzySAY9e6iqUSdueZuL6hNbS7FJjzd4AhLBt\naFDNptrDJzq8QG7TqgDZVAIxAOH/CNjzoJ4Vy/9Wc1gYQvFp/Y8OyIchE+LooQim\n3TOl4G9HofEZt+KxtJ2RtWDESw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUDNYWZVBywkKMCpLBMn/ZrbpVAngwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTMxMDcyMDAyMjIzMVowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhtbR7QbD7v9wmJHiLUdRE9SX\nOeGsIpHD2yVPsKeYthmXkK9URtDY4DoeUIxjTPOvJPuH+oGBxuJoQB1DlHNud1e4\nARK1un5WLqJQAM7YH4MDk4e8IgzildxR68Wf5S4Mo2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUqum/tPcairujPO/tfJsHsoNd\n/CowHwYDVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwCgYIKoZIzj0EAwMD\naAAwZQIwTq/MJUn2EN0Ky18A4BLrKyJvrpozm2JLzPZeMJC7JS8hLCXOtpTF1V9l\ngSKpqbi9AjEAuMTlfVDUvFQGMR6cAOKScwHOJnUMB5eyyIg7AYlY5WcjwLNaV//d\nzw3fC7CR1QR/\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTmEV7kebAA5XSFYNCudbbU/Co8wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTM2MDcxODAyMjIzMVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEKVtiVC3icjTPZ6yEwO46wmbk38a9N5GZEkTnjXypSwTsC/GfXLA4\ne4wvvwZ/1+sGrogN5DBX/auAFeicLw0CMFNiSocyqalh+LNjYB0vkBLqC5+PQoCa\navI9zsLmyJjUo1MwUTAdBgNVHQ4EFgQULZkd6aI5/Xdm7qbmkrf4JOIgdtEwHwYD\nVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjAGWyxXJ4x3oWj1xDkLpcsYCBas0SNIGhXHPQmMbVqM\nmtcDX//3RwD26+yBeZguCIYCMHgCQotN2FZ9PHwcmkA5tQkusL4Ab55d9JfvkjZ7\nHFibzfq7pmApshWt7mQ80fRu/Q==\n-----END CERTIFICATE-----\n"}} \ No newline at end of file diff --git a/config/templates/policy_v2_signed.json b/config/templates/policy_v2_signed.json index 31bfc81a4..2edd0606a 100644 --- a/config/templates/policy_v2_signed.json +++ b/config/templates/policy_v2_signed.json @@ -1 +1 @@ -{"policyData":{"id":"B87BFE45-9CC7-46F9-8F2C-A6CB55BF7101","version":"2.0","policySvn":1,"policy":[{"global":{"tcb":{"tcbEvaluationDataNumber":{"operation":"greater-or-equal","reference":5},"tcbDate":{"operation":"greater-or-equal","reference":"2022-11-09T00:00:00Z"},"tcbStatusAccepted":{"operation":"allow-list","reference":["UpToDate","ConfigurationNeeded"]}},"platform":{"fmspc":{"operation":"allow-list","reference":["00706A000000","00706E170000","00A068070000","20C06F000000","10A06E040000","40806F000000","10706A000000","10A067110000","20606A000000","10906EA50000","20906EA10000","10906EB10000","10806F000000","00706E070000","50A06D000000","10606A000000","10706A800000","10706A100000","B0806F000000","00706D050000","10806EB70000","10906ED10000","00A06F010000","00A06D070000","40806F200000","60806F000000","10A06E050000","40A06D000000","10606C040000","50A06F000000","00A06D000000","10806EA60000","00706D010000","10806F070000","20D06D010000","00706E270000","00A06F000000","10A06D050000","00C06F000000","30806F000000","20906EA50000","10706E370000","20806F070000","10906EC50000","10806F040000","10D06D000000","10906EA10000","20806F000000","10A067010000","30A06E000000","10A06F000000","70806F000000","10906EC10000","20A06D050000","00606A000000"]}},"crl":{"pckCrlNum":{"operation":"greater-or-equal","reference":1},"rootCaCrlNum":{"operation":"greater-or-equal","reference":1}}}}],"collaterals":{"majorVersion":1,"minorVersion":0,"teeType":129,"rootCa":"-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----","pckCrlIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICmjCCAkCgAwIBAgIUWSPTp0qoY1QuOXCt4A8HK1ckKrcwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTM0MTAzMTEyMzM0N1owcDEiMCAG\nA1UEAwwZSW50ZWwgU0dYIFBDSyBQbGF0Zm9ybSBDQTEaMBgGA1UECgwRSW50ZWwg\nQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEL\nMAkGA1UEBhMCVVMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQwp+Lc+TUBtg1H\n+U8JIsMsbjHjCkTtXb8jPM6r2dhu9zIblhDZ7INfqt3Ix8XcFKD8k0NEXrkZ66qJ\nXa1KzLIKo4G/MIG8MB8GA1UdIwQYMBaAFOnoRFJTNlxLGJoR/EMYLKXcIIBIMFYG\nA1UdHwRPME0wS6BJoEeGRWh0dHBzOi8vc2J4LWNlcnRpZmljYXRlcy50cnVzdGVk\nc2VydmljZXMuaW50ZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQU\nWSPTp0qoY1QuOXCt4A8HK1ckKrcwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQI\nMAYBAf8CAQAwCgYIKoZIzj0EAwIDSAAwRQIhAJ1q+FTz+gUuVfBQuCgJsFrL2TTS\ne1aBZ53O52TjFie6AiAriPaRahUX9Oa9kGLlAchWXKT6j4RWSR50BqhrN3UT4A==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","rootCaCrl":"-----BEGIN X509 CRL-----\nMIIBITCByAIBATAKBggqhkjOPQQDAjBoMRowGAYDVQQDDBFJbnRlbCBTR1ggUm9v\ndCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRh\nIENsYXJhMQswCQYDVQQIDAJDQTELMAkGA1UEBhMCVVMXDTI1MDkxNjExNTMxMloX\nDTI2MDkxNjExNTMxMlqgLzAtMAoGA1UdFAQDAgEBMB8GA1UdIwQYMBaAFOnoRFJT\nNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMCA0gAMEUCIQDv5KEBogNCzPgupOPj\nFIYJaOubypBPCGqnE0XcYTgFDwIgeSfXk71tIbV5lqp6gWCpN98/xu/8c7y36EV3\npkfootI=\n-----END X509 CRL-----","pckCrl":"-----BEGIN X509 CRL-----\nMIIBKTCB0AIBATAKBggqhkjOPQQDAjBwMSIwIAYDVQQDDBlJbnRlbCBTR1ggUENL\nIFBsYXRmb3JtIENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3JhdGlvbjEUMBIGA1UE\nBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQGEwJVUxcNMjYwNzAx\nMDk0NjIzWhcNMjYwNzMxMDk0NjIzWqAvMC0wCgYDVR0UBAMCAQEwHwYDVR0jBBgw\nFoAUWSPTp0qoY1QuOXCt4A8HK1ckKrcwCgYIKoZIzj0EAwIDSAAwRQIgcGtzcbJl\n2S3wCJYxAd7KNnRsztqrU+u2NaDupYb0lTgCIQCA6I7FwSIA0s2r9sVOz6dIqV1w\naBnaP08fyNmvo7VbCA==\n-----END X509 CRL-----","platforms":[{"fmspc":"20C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20C06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"3d0d3653b9341dc41c362f8f7cd38e9f4b829d057811ce6cafbcc77f167b6447522b4717b3d5c58a71648eec12af0b8e935edbb6cd773c4ceb7ad90e68cf001e\"}"},{"fmspc":"0400F1300000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1300000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"bcb9b79749670cca6342f83b2a5590595faf905d450ec175c7efdf9ff4dca6ad1dc3d10b8570ab0318a5bc3fd24c58a1729f09994b47bd0f82d49cfbb71ee3dd\"}"},{"fmspc":"10A06E040000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06E040000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"3bb24f39c796226e15a38616fe60e4c28d7ec28acb5d67e25b659555b29f404f472a7b0f9ee26fa065941ce915966f7c3759f52e27dc07bb1c2a29da08bb094d\"}"},{"fmspc":"40806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"40806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5320e541877e904a23caa7ee30c8ca7d794a72617b4c16cf6028746731fee7248f2583eda07683edcbd3e08e14e91d846cfafa7355866e10d6150bf8b47ae269\"}"},{"fmspc":"0400F1370000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1370000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"361c382377cc1515aa6f6f5d74a3b8ab02aca6eafb30f97322715f61fdfcfffa549c12f4e74e4769fd248483124cc2228c134577cf3bd199fbd3d03244a80610\"}"},{"fmspc":"0400F1100000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1100000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d33030e843729d88c8b9c5a4aae1185f6a0f43a2fc6bdbf7eff62ae0dc14411ae097b3a50ae6d411748950aa2c0953adbbb128d59bc337bede6792b0248a2a3b\"}"},{"fmspc":"10806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T09:46:20Z\",\"nextUpdate\":\"2026-07-31T09:46:20Z\",\"fmspc\":\"10806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":10,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":10,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2020-05-28T00:00:00Z\",\"tcbStatus\":\"OutOfDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":9,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2020-03-22T00:00:00Z\",\"tcbStatus\":\"OutOfDate\"}]},\"signature\":\"19a007d6ca2b8a300ce6ff7d34f93ef32a98462b6c1b003a8a230743be6c7ec80cfcb869dfb9be29c5e30d4d14817899d5249ddb1d146f04b623f87010837657\"}"},{"fmspc":"50A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"50A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"28e87299fb0ed2b63890a895f6b8fe86abcf087c7023f79cb93aaa3ceb8fdefd694ec5bcaed2fb00e83e9696557ff70b1649107de1269f477723db74cd815653\"}"},{"fmspc":"B0806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"B0806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"da0312fbe582e1d32136ddd517abf928c2c9ccdcb686d3306a6c4401a96190d6fdd753da816ffaa27d7b536298713f48de3f45d1a7a8e364d3ea75159452614c\"}"},{"fmspc":"00A06F010000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06F010000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"a1309265fe850a27482fc8cdb2854cab6ff10f5ca4099af209a676a062b4b45943155227d431d4058c47c70be382dc43defde577b980412653b59ec4e298a23b\"}"},{"fmspc":"00A06D070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06D070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"98641e3b215e1134191c0637028cd6031ab109354d8c68083769bd63757418d83c2837f396ecad4f7e1e13176b0b2367e46cd1045dc6032df731c7edebe124e2\"}"},{"fmspc":"60806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"60806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"85ecac3694bcca3320c5ce5cdbc67bbec0d85ae9642561a13e47e6dafb1bec844c9b023760b33ea981bec268d814aa039e27063674b41671e079f39bb3509cfd\"}"},{"fmspc":"10A06E050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06E050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"0a8a99b3c165ef65b54c2e313764342850bfd1c31aa201f2cfdb93399a115ae3f20faabbf53f1bb66565c58763eb300c852a0fa796aa065b64b79138585f5682\"}"},{"fmspc":"40A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"40A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"f049caf6905eebfbba2a1eccc7e96268a4c4f3d7d8a31ca340f260ea2035ec596cf5fe7bef4e86f42ecd2014b6a10feace6e622df152ce6faf74eafb54329dee\"}"},{"fmspc":"0400F1000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":0,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"589d8a6a5a60f3e12b303f6bd0ab9b3e70ad77500216936a5245c734443c6ea847a682b28324aa99e705f974446a66bad79fab7ee0291d62650db0c7681bd61b\"}"},{"fmspc":"50A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"50A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"8ef380408be7b4d51e2e19c03cecd5685467d0203719efeeac19c44d79b2b4358695345ec7adfb3abb71698001ddeb0de24adba24cc82ede59c4c828b3c52f59\"}"},{"fmspc":"00A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"126fd0874cbcee488f4fa793f0ca020f41a5f44965622b6e7768f9b4e677e7920105bbf3c3735e3ed7c6ad3f4e501534ee8e6c29df6a0c4367287d3d5176c72f\"}"},{"fmspc":"0400F1070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"b35cffb8b5af48c3026ee5ae3ad56bb1b45ef872ca2ec744a562073ffb57940cff890454f385ef57a39a5941fd4aa6049ce502be027ef5cf1b33f12bb4af9fd0\"}"},{"fmspc":"10806F070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10806F070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"9ed0865391001855b2e35740fdeb3978b284364201d1d568cc8c85bd640e707767c73cad516c00e2b29a2e81963fe5560c93ef20f391e936b33db74c1aa5b26c\"}"},{"fmspc":"20D06D010000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20D06D010000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5214de9edac3522fe9a68abba903fc88c59c37651c8f4bf2b79bebf2381fc32907dc9790ed883d15a948b7ba91f4ad8fe1712c56390d8398ac0641a55eb80f21\"}"},{"fmspc":"00A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"ac626a284a933532e9ad33ce2c2dbc24ad7e79dbef9a33dc8697fed09e2c46e5a8f508d057dc619d801eded0536502fb9be503a626cc5cbb2b02dd3da1f0b921\"}"},{"fmspc":"10A06D050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06D050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":0,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5ab60c67e4c6477c8767bf2b615cf985211e1ee3a3ecb06cd045b2907f5e120cd3f2dad24c2143d887e0596b8ffdb477e0edf417509a871f932e06debceff864\"}"},{"fmspc":"00C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00C06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"f787aeb769a57e7aa4e8cd64ba199b71966d6ffb441b9a5de66bcbc4e93b65f049da696bdefad506e3ece86249a4688b12f077bb559f1cace27899a5a4541f2c\"}"},{"fmspc":"30806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"30806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"c7bfb3a1d338bb64803c232efff231a25871dd14b06ecd4d119adc6998b0c90bd8d3f109af79f40d4cb24c2e939c596c2ab0896b289569b8d3dadc920900a98a\"}"},{"fmspc":"0400F1200000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1200000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"8c8c10f373ab61fa882f2f10f3885cea3b4ad34cfcbef833be573cbf631e7e84c31ad26ec05ee640fd91aa0ef0433e53c4d0fbc82c14cf055aabd698a96da216\"}"},{"fmspc":"20806F070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20806F070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d6154c177ad2e3f782dba2df4bf13e2fe2f6a07e20ae09d63cd4e1c3a7caca1afdecbc2c6959619e810926f6d6df4fe5b6d62e7a3f3abfc0bc440e768084298d\"}"},{"fmspc":"10806F040000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10806F040000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"c04cb69c8a57965018da713e624baa6c11f290f762b1b73cf01f90087334ba8d6c33e10fb3ca766b7dd99d87387b8b4241f25f3e91328c160c193deb70ec0bdb\"}"},{"fmspc":"10D06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10D06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"29ec7d93a60c101cd878f061467e933088dd0f393d8cbfd26ecba14cdf22c839b89b9fca57440105770449c022b3f7c1c514b294a46e504718b81deda3620d76\"}"},{"fmspc":"20806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"89ccc75f7e47334690d6ac8ba90d0ea84850d837ce51698dfe7b4b778476afd09fcd3119e3bc93e660b195e7db805d69cf8ed4ce1705eed3beaca4de8027ec8d\"}"},{"fmspc":"30A06E000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"30A06E000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d5550e6e74aed8bd2806e47cbdc99ed75b833401896a662727b5ff62e205e118e17afc952158d54b132719eebe45a5dde9e8c501dcba827320f76f1053460f8b\"}"},{"fmspc":"10A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"7ce7382154fbea591d0851952f283b16edf79ce56cba3757dd2297cfd0296c6bc3408eaa416ae14d13936f7662ba42741f4e718888dc0ad9f2630fde233810fa\"}"},{"fmspc":"20A06D050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20A06D050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"4fceb18caf6eb5ba2ca7138d55d24a6b8d81f99147383bcb5dec755572bf5a24d496fdcdbda75ce076682703685fdac3c9b0f0f53059ab2a3d8d0a8cba9631eb\"}"}],"qeIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","qeIdentity":"{\"enclaveIdentity\":{\"id\":\"TD_QE\",\"version\":2,\"issueDate\":\"2026-07-01T10:33:44Z\",\"nextUpdate\":\"2026-07-31T10:33:44Z\",\"tcbEvaluationDataNumber\":5,\"miscselect\":\"00000000\",\"miscselectMask\":\"FFFFFFFF\",\"attributes\":\"11000000000000000000000000000000\",\"attributesMask\":\"FBFFFFFFFFFFFFFF0000000000000000\",\"mrsigner\":\"DC9E2A7C6F948F17474E34A7FC43ED030F7C1563F1BABDDF6340C82E0E54A8C5\",\"isvprodid\":2,\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"bccb9464275b040819102bd2357fb77e2f1936f218c4d06afebe55b97d7bf416c7d70839897df145c94c6cc65a090c274f94df9b158c245fd37c344272527703\"}"},"servtdCollateral":{"majorVersion":1,"minorVersion":0,"servtdIdentity":{"tdIdentity":{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbEvaluationNumber":1,"xfam":"E71A060000000000","attributes":"0000000000000000","mrConfigId":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwnerConfig":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrsigner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","isvProdId":1,"tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}]},"signature":"3066023100E903D592DF599196522B27BF9AC5B6DAC650CC092E0E901B9D9DCA85595286E4D324400D022D6B5D5601C8172842D465023100D200B5F89F368BC875B6792AE553B7563E9B4DBFF15220BF04D0E06AA1E2E841A0B74CC118927D3BACB5F54B027C25AD"},"servtdIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICaDCCAe6gAwIBAgIUI42jpwfmZAB+N0e+h+6KCfklh40wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcwMTEwNTA0NFoXDTI3MDcwMTEw\nNTA0NFowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABPwrt1m60ICixce/2ugR\nGSQhPzgWcbe9JYkFB49ttKJRcxluthFr1spPZerKDUwdvvGCHdoqxKT6itswbZS3\nahmVUhAsrXPDmKxDCTizZm7ceyRWZ1k7+wR3rlZTSMRoYqNSMFAwDgYDVR0PAQH/\nBAQDAgeAMB0GA1UdDgQWBBT157AdCLS2hROQ1D6welT+Ajy3TjAfBgNVHSMEGDAW\ngBRVgv61R6StRYHfVgRYfD1ejdJSgTAKBggqhkjOPQQDAwNoADBlAjASRh3kf2O1\n0EOhJiZEelug2E0+qWqN3AydrbGBn2ZJt5g5jUxhoXlcqXFPiBn83XECMQCn6Wia\nQ9PpGUg1E9K9sk22W55z8vDre3VyWkj4nJl4rvk208ugBLWrezdEHasLsOc=\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUbqZePdS7UEe0psj4wUNa57MrET0wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcwMTEwNTA0NFoXDTMxMDYzMDEwNTA0NFowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdsL/cjUrCPa00GusnZsRjOxo\n8otNIO1a4Ls1rz5Ew7ilQ4X2WNWwNvmwaNY0qFc+MXXSnMY4Q6QmoJesSqCfp5J1\nooXjIB25lYdXl3bxCMrRmvNzDOWHSKrNkFBpm1p+o2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUVYL+tUekrUWB31YEWHw9Xo3S\nUoEwHwYDVR0jBBgwFoAUCtxBCuwlgOzy1VZm81dXlo69pNgwCgYIKoZIzj0EAwMD\naAAwZQIwP0qNIE1ZMEKV309QREX+zoHgDYp1CgKrRPnCwZSLat80h7GTlYdc8aUN\nhGNhIlzjAjEA52OKlaqU1we3OPeoozPyE+H8gr6tRZSX9GhBVnC1yb/OBX5jLN3l\nMSh0m8g8dWtL\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTquwcbmxr8y1BBPK5eTmYdTB1MwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcwMTEwNTA0NFoXDTM2MDYyODEwNTA0NFowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEOApWwQJHtYcFaq0EHH058knEo3Hz6kMqHiuiaB9XUttM1PGvwrux\ngnxq1SNp8tfXDQlmjXP/m1TJ+BdFX+9cqSG26/W7doazDHW1MNRir4E/v4mMzIox\n86pnu7/7oTnvo1MwUTAdBgNVHQ4EFgQUCtxBCuwlgOzy1VZm81dXlo69pNgwHwYD\nVR0jBBgwFoAUCtxBCuwlgOzy1VZm81dXlo69pNgwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjBGru+cELo1WJH/pxCN1q0adDrhJavW2yVm1A6UbZYm\nXvKKVqOsgSf/fhMRGb/htQ8CMBkFmbplQzY3SVlkTT8aBfNq3a1yNZJRw5HQUz9R\nDrAL9xNFgVm3//brLnWNpVOtcw==\n-----END CERTIFICATE-----\n","servtdTcbMapping":{"tdTcbMapping":{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","issueDate":"2025-01-01T00:00:00Z","isvProdId":1,"mrSigner":"00000000000000000000000000000000","nextUpdate":"2026-01-01T00:00:00Z","svnMappings":[{"isvsvn":1,"tdMeasurements":{"mrtd":"0E200328149B9BAAFD0E68557A426EFF78553D13E2536862EDDD8299A80C986567A8E03CB86F7D3EC75E99F386C3490B","rtmr0":"518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4","rtmr1":"C3C3F42541603E01B85F8B5BD89B45A1B386CB76D56182F63AF73589F81B3280D35545FFD3BF3BDBD5649ABD2E3C3C3E"}}],"version":1},"signature":"306502305E23F4D150336BB6CD0C873C63AB7359556DF5260689324DD242EA0F3007A7C37BFADE5C099A3859D7F9C6978A29E077023100911C7AD3F666F8CE8659F7F4F9474CF9D557AEAEA647F3B9549FF434A6589E697D0588F7E82CF87F2F794FC0E305EC51"},"servtdTcbMappingIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICaDCCAe6gAwIBAgIUI42jpwfmZAB+N0e+h+6KCfklh40wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcwMTEwNTA0NFoXDTI3MDcwMTEw\nNTA0NFowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABPwrt1m60ICixce/2ugR\nGSQhPzgWcbe9JYkFB49ttKJRcxluthFr1spPZerKDUwdvvGCHdoqxKT6itswbZS3\nahmVUhAsrXPDmKxDCTizZm7ceyRWZ1k7+wR3rlZTSMRoYqNSMFAwDgYDVR0PAQH/\nBAQDAgeAMB0GA1UdDgQWBBT157AdCLS2hROQ1D6welT+Ajy3TjAfBgNVHSMEGDAW\ngBRVgv61R6StRYHfVgRYfD1ejdJSgTAKBggqhkjOPQQDAwNoADBlAjASRh3kf2O1\n0EOhJiZEelug2E0+qWqN3AydrbGBn2ZJt5g5jUxhoXlcqXFPiBn83XECMQCn6Wia\nQ9PpGUg1E9K9sk22W55z8vDre3VyWkj4nJl4rvk208ugBLWrezdEHasLsOc=\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUbqZePdS7UEe0psj4wUNa57MrET0wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcwMTEwNTA0NFoXDTMxMDYzMDEwNTA0NFowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdsL/cjUrCPa00GusnZsRjOxo\n8otNIO1a4Ls1rz5Ew7ilQ4X2WNWwNvmwaNY0qFc+MXXSnMY4Q6QmoJesSqCfp5J1\nooXjIB25lYdXl3bxCMrRmvNzDOWHSKrNkFBpm1p+o2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUVYL+tUekrUWB31YEWHw9Xo3S\nUoEwHwYDVR0jBBgwFoAUCtxBCuwlgOzy1VZm81dXlo69pNgwCgYIKoZIzj0EAwMD\naAAwZQIwP0qNIE1ZMEKV309QREX+zoHgDYp1CgKrRPnCwZSLat80h7GTlYdc8aUN\nhGNhIlzjAjEA52OKlaqU1we3OPeoozPyE+H8gr6tRZSX9GhBVnC1yb/OBX5jLN3l\nMSh0m8g8dWtL\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTquwcbmxr8y1BBPK5eTmYdTB1MwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcwMTEwNTA0NFoXDTM2MDYyODEwNTA0NFowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEOApWwQJHtYcFaq0EHH058knEo3Hz6kMqHiuiaB9XUttM1PGvwrux\ngnxq1SNp8tfXDQlmjXP/m1TJ+BdFX+9cqSG26/W7doazDHW1MNRir4E/v4mMzIox\n86pnu7/7oTnvo1MwUTAdBgNVHQ4EFgQUCtxBCuwlgOzy1VZm81dXlo69pNgwHwYD\nVR0jBBgwFoAUCtxBCuwlgOzy1VZm81dXlo69pNgwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjBGru+cELo1WJH/pxCN1q0adDrhJavW2yVm1A6UbZYm\nXvKKVqOsgSf/fhMRGb/htQ8CMBkFmbplQzY3SVlkTT8aBfNq3a1yNZJRw5HQUz9R\nDrAL9xNFgVm3//brLnWNpVOtcw==\n-----END CERTIFICATE-----\n"}},"signature":"30640230474DB4EC90C4373CF6B1253CBC6618781C92DC2B8C18362E381FCDE805B8D2DB84E79442D6B72493D37AF7D47F27D86102304756D5C501FF43F97D8468D989B8D0C14C34BA3C1A80DAFF7FCC51789F1CFA9974C2E18E1FDAC23F2A496142E03E0AD3"} \ No newline at end of file +{"policyData":{"id":"E6643BDC-E50A-4315-9EF7-F217CE8AF9A6","version":"2.0","policySvn":1,"policy":[{"global":{"tcb":{"tcbEvaluationDataNumber":{"operation":"greater-or-equal","reference":5},"tcbDate":{"operation":"greater-or-equal","reference":"2022-11-09T00:00:00Z"},"tcbStatusAccepted":{"operation":"allow-list","reference":["UpToDate","ConfigurationNeeded"]}},"platform":{"fmspc":{"operation":"allow-list","reference":["00706A000000","00706E170000","00A068070000","20C06F000000","10A06E040000","40806F000000","10706A000000","10A067110000","20606A000000","10906EA50000","20906EA10000","10906EB10000","10806F000000","00706E070000","50A06D000000","10606A000000","10706A800000","10706A100000","B0806F000000","00706D050000","10806EB70000","10906ED10000","00A06F010000","00A06D070000","40806F200000","60806F000000","10A06E050000","40A06D000000","10606C040000","50A06F000000","00A06D000000","10806EA60000","00706D010000","10806F070000","20D06D010000","00706E270000","00A06F000000","10A06D050000","00C06F000000","30806F000000","20906EA50000","10706E370000","20806F070000","10906EC50000","10806F040000","10D06D000000","10906EA10000","20806F000000","10A067010000","30A06E000000","10A06F000000","70806F000000","10906EC10000","20A06D050000","00606A000000"]}},"crl":{"pckCrlNum":{"operation":"greater-or-equal","reference":1},"rootCaCrlNum":{"operation":"greater-or-equal","reference":1}}}}],"collaterals":{"majorVersion":1,"minorVersion":0,"teeType":129,"rootCa":"-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----","pckCrlIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICmjCCAkCgAwIBAgIUWSPTp0qoY1QuOXCt4A8HK1ckKrcwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTM0MTAzMTEyMzM0N1owcDEiMCAG\nA1UEAwwZSW50ZWwgU0dYIFBDSyBQbGF0Zm9ybSBDQTEaMBgGA1UECgwRSW50ZWwg\nQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEL\nMAkGA1UEBhMCVVMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQwp+Lc+TUBtg1H\n+U8JIsMsbjHjCkTtXb8jPM6r2dhu9zIblhDZ7INfqt3Ix8XcFKD8k0NEXrkZ66qJ\nXa1KzLIKo4G/MIG8MB8GA1UdIwQYMBaAFOnoRFJTNlxLGJoR/EMYLKXcIIBIMFYG\nA1UdHwRPME0wS6BJoEeGRWh0dHBzOi8vc2J4LWNlcnRpZmljYXRlcy50cnVzdGVk\nc2VydmljZXMuaW50ZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQU\nWSPTp0qoY1QuOXCt4A8HK1ckKrcwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQI\nMAYBAf8CAQAwCgYIKoZIzj0EAwIDSAAwRQIhAJ1q+FTz+gUuVfBQuCgJsFrL2TTS\ne1aBZ53O52TjFie6AiAriPaRahUX9Oa9kGLlAchWXKT6j4RWSR50BqhrN3UT4A==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","rootCaCrl":"-----BEGIN X509 CRL-----\nMIIBITCByAIBATAKBggqhkjOPQQDAjBoMRowGAYDVQQDDBFJbnRlbCBTR1ggUm9v\ndCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRh\nIENsYXJhMQswCQYDVQQIDAJDQTELMAkGA1UEBhMCVVMXDTI1MDkxNjExNTMxMloX\nDTI2MDkxNjExNTMxMlqgLzAtMAoGA1UdFAQDAgEBMB8GA1UdIwQYMBaAFOnoRFJT\nNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMCA0gAMEUCIQDv5KEBogNCzPgupOPj\nFIYJaOubypBPCGqnE0XcYTgFDwIgeSfXk71tIbV5lqp6gWCpN98/xu/8c7y36EV3\npkfootI=\n-----END X509 CRL-----","pckCrl":"-----BEGIN X509 CRL-----\nMIIBKTCB0AIBATAKBggqhkjOPQQDAjBwMSIwIAYDVQQDDBlJbnRlbCBTR1ggUENL\nIFBsYXRmb3JtIENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3JhdGlvbjEUMBIGA1UE\nBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQGEwJVUxcNMjYwNzAx\nMDk0NjIzWhcNMjYwNzMxMDk0NjIzWqAvMC0wCgYDVR0UBAMCAQEwHwYDVR0jBBgw\nFoAUWSPTp0qoY1QuOXCt4A8HK1ckKrcwCgYIKoZIzj0EAwIDSAAwRQIgcGtzcbJl\n2S3wCJYxAd7KNnRsztqrU+u2NaDupYb0lTgCIQCA6I7FwSIA0s2r9sVOz6dIqV1w\naBnaP08fyNmvo7VbCA==\n-----END X509 CRL-----","platforms":[{"fmspc":"20C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20C06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"3d0d3653b9341dc41c362f8f7cd38e9f4b829d057811ce6cafbcc77f167b6447522b4717b3d5c58a71648eec12af0b8e935edbb6cd773c4ceb7ad90e68cf001e\"}"},{"fmspc":"0400F1300000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1300000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"bcb9b79749670cca6342f83b2a5590595faf905d450ec175c7efdf9ff4dca6ad1dc3d10b8570ab0318a5bc3fd24c58a1729f09994b47bd0f82d49cfbb71ee3dd\"}"},{"fmspc":"10A06E040000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06E040000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"3bb24f39c796226e15a38616fe60e4c28d7ec28acb5d67e25b659555b29f404f472a7b0f9ee26fa065941ce915966f7c3759f52e27dc07bb1c2a29da08bb094d\"}"},{"fmspc":"40806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"40806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5320e541877e904a23caa7ee30c8ca7d794a72617b4c16cf6028746731fee7248f2583eda07683edcbd3e08e14e91d846cfafa7355866e10d6150bf8b47ae269\"}"},{"fmspc":"0400F1370000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1370000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"361c382377cc1515aa6f6f5d74a3b8ab02aca6eafb30f97322715f61fdfcfffa549c12f4e74e4769fd248483124cc2228c134577cf3bd199fbd3d03244a80610\"}"},{"fmspc":"0400F1100000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1100000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d33030e843729d88c8b9c5a4aae1185f6a0f43a2fc6bdbf7eff62ae0dc14411ae097b3a50ae6d411748950aa2c0953adbbb128d59bc337bede6792b0248a2a3b\"}"},{"fmspc":"10806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T09:46:20Z\",\"nextUpdate\":\"2026-07-31T09:46:20Z\",\"fmspc\":\"10806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":10,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":10,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2020-05-28T00:00:00Z\",\"tcbStatus\":\"OutOfDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":9,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2020-03-22T00:00:00Z\",\"tcbStatus\":\"OutOfDate\"}]},\"signature\":\"19a007d6ca2b8a300ce6ff7d34f93ef32a98462b6c1b003a8a230743be6c7ec80cfcb869dfb9be29c5e30d4d14817899d5249ddb1d146f04b623f87010837657\"}"},{"fmspc":"50A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"50A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"28e87299fb0ed2b63890a895f6b8fe86abcf087c7023f79cb93aaa3ceb8fdefd694ec5bcaed2fb00e83e9696557ff70b1649107de1269f477723db74cd815653\"}"},{"fmspc":"B0806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"B0806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"da0312fbe582e1d32136ddd517abf928c2c9ccdcb686d3306a6c4401a96190d6fdd753da816ffaa27d7b536298713f48de3f45d1a7a8e364d3ea75159452614c\"}"},{"fmspc":"00A06F010000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06F010000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"a1309265fe850a27482fc8cdb2854cab6ff10f5ca4099af209a676a062b4b45943155227d431d4058c47c70be382dc43defde577b980412653b59ec4e298a23b\"}"},{"fmspc":"00A06D070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06D070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"98641e3b215e1134191c0637028cd6031ab109354d8c68083769bd63757418d83c2837f396ecad4f7e1e13176b0b2367e46cd1045dc6032df731c7edebe124e2\"}"},{"fmspc":"60806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"60806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"85ecac3694bcca3320c5ce5cdbc67bbec0d85ae9642561a13e47e6dafb1bec844c9b023760b33ea981bec268d814aa039e27063674b41671e079f39bb3509cfd\"}"},{"fmspc":"10A06E050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06E050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"0a8a99b3c165ef65b54c2e313764342850bfd1c31aa201f2cfdb93399a115ae3f20faabbf53f1bb66565c58763eb300c852a0fa796aa065b64b79138585f5682\"}"},{"fmspc":"40A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"40A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"f049caf6905eebfbba2a1eccc7e96268a4c4f3d7d8a31ca340f260ea2035ec596cf5fe7bef4e86f42ecd2014b6a10feace6e622df152ce6faf74eafb54329dee\"}"},{"fmspc":"0400F1000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":0,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"589d8a6a5a60f3e12b303f6bd0ab9b3e70ad77500216936a5245c734443c6ea847a682b28324aa99e705f974446a66bad79fab7ee0291d62650db0c7681bd61b\"}"},{"fmspc":"50A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"50A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"8ef380408be7b4d51e2e19c03cecd5685467d0203719efeeac19c44d79b2b4358695345ec7adfb3abb71698001ddeb0de24adba24cc82ede59c4c828b3c52f59\"}"},{"fmspc":"00A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"126fd0874cbcee488f4fa793f0ca020f41a5f44965622b6e7768f9b4e677e7920105bbf3c3735e3ed7c6ad3f4e501534ee8e6c29df6a0c4367287d3d5176c72f\"}"},{"fmspc":"0400F1070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"b35cffb8b5af48c3026ee5ae3ad56bb1b45ef872ca2ec744a562073ffb57940cff890454f385ef57a39a5941fd4aa6049ce502be027ef5cf1b33f12bb4af9fd0\"}"},{"fmspc":"10806F070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10806F070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"9ed0865391001855b2e35740fdeb3978b284364201d1d568cc8c85bd640e707767c73cad516c00e2b29a2e81963fe5560c93ef20f391e936b33db74c1aa5b26c\"}"},{"fmspc":"20D06D010000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20D06D010000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5214de9edac3522fe9a68abba903fc88c59c37651c8f4bf2b79bebf2381fc32907dc9790ed883d15a948b7ba91f4ad8fe1712c56390d8398ac0641a55eb80f21\"}"},{"fmspc":"00A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"ac626a284a933532e9ad33ce2c2dbc24ad7e79dbef9a33dc8697fed09e2c46e5a8f508d057dc619d801eded0536502fb9be503a626cc5cbb2b02dd3da1f0b921\"}"},{"fmspc":"10A06D050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06D050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":0,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5ab60c67e4c6477c8767bf2b615cf985211e1ee3a3ecb06cd045b2907f5e120cd3f2dad24c2143d887e0596b8ffdb477e0edf417509a871f932e06debceff864\"}"},{"fmspc":"00C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00C06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"f787aeb769a57e7aa4e8cd64ba199b71966d6ffb441b9a5de66bcbc4e93b65f049da696bdefad506e3ece86249a4688b12f077bb559f1cace27899a5a4541f2c\"}"},{"fmspc":"30806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"30806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"c7bfb3a1d338bb64803c232efff231a25871dd14b06ecd4d119adc6998b0c90bd8d3f109af79f40d4cb24c2e939c596c2ab0896b289569b8d3dadc920900a98a\"}"},{"fmspc":"0400F1200000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1200000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"8c8c10f373ab61fa882f2f10f3885cea3b4ad34cfcbef833be573cbf631e7e84c31ad26ec05ee640fd91aa0ef0433e53c4d0fbc82c14cf055aabd698a96da216\"}"},{"fmspc":"20806F070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20806F070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d6154c177ad2e3f782dba2df4bf13e2fe2f6a07e20ae09d63cd4e1c3a7caca1afdecbc2c6959619e810926f6d6df4fe5b6d62e7a3f3abfc0bc440e768084298d\"}"},{"fmspc":"10806F040000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10806F040000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"c04cb69c8a57965018da713e624baa6c11f290f762b1b73cf01f90087334ba8d6c33e10fb3ca766b7dd99d87387b8b4241f25f3e91328c160c193deb70ec0bdb\"}"},{"fmspc":"10D06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10D06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"29ec7d93a60c101cd878f061467e933088dd0f393d8cbfd26ecba14cdf22c839b89b9fca57440105770449c022b3f7c1c514b294a46e504718b81deda3620d76\"}"},{"fmspc":"20806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"89ccc75f7e47334690d6ac8ba90d0ea84850d837ce51698dfe7b4b778476afd09fcd3119e3bc93e660b195e7db805d69cf8ed4ce1705eed3beaca4de8027ec8d\"}"},{"fmspc":"30A06E000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"30A06E000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d5550e6e74aed8bd2806e47cbdc99ed75b833401896a662727b5ff62e205e118e17afc952158d54b132719eebe45a5dde9e8c501dcba827320f76f1053460f8b\"}"},{"fmspc":"10A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"7ce7382154fbea591d0851952f283b16edf79ce56cba3757dd2297cfd0296c6bc3408eaa416ae14d13936f7662ba42741f4e718888dc0ad9f2630fde233810fa\"}"},{"fmspc":"20A06D050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20A06D050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"4fceb18caf6eb5ba2ca7138d55d24a6b8d81f99147383bcb5dec755572bf5a24d496fdcdbda75ce076682703685fdac3c9b0f0f53059ab2a3d8d0a8cba9631eb\"}"}],"qeIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","qeIdentity":"{\"enclaveIdentity\":{\"id\":\"TD_QE\",\"version\":2,\"issueDate\":\"2026-07-01T10:33:44Z\",\"nextUpdate\":\"2026-07-31T10:33:44Z\",\"tcbEvaluationDataNumber\":5,\"miscselect\":\"00000000\",\"miscselectMask\":\"FFFFFFFF\",\"attributes\":\"11000000000000000000000000000000\",\"attributesMask\":\"FBFFFFFFFFFFFFFF0000000000000000\",\"mrsigner\":\"DC9E2A7C6F948F17474E34A7FC43ED030F7C1563F1BABDDF6340C82E0E54A8C5\",\"isvprodid\":2,\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"bccb9464275b040819102bd2357fb77e2f1936f218c4d06afebe55b97d7bf416c7d70839897df145c94c6cc65a090c274f94df9b158c245fd37c344272527703\"}"},"servtdCollateral":{"majorVersion":1,"minorVersion":0,"servtdTcbMapping":{"tdTcbMapping":{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","svnMappings":[{"tdMeasurements":{"tdinfo_hash":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"},"isvsvn":1}]},"signature":"306502302DF213408E43734941EE22050FB1566E9C3AB600D0C0ADE9EDD99A0C91E2D2E44DD54C6B6658C5C2277BD63EF6EE33B702310092B91C8CDED39E93D0E67B02813388445116123AA2298E956559917FE817B8143CA12A9352DA7CCEC2F6D1F58E025F92"},"servtdTcbMappingIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICfzCCAgWgAwIBAgIUb4Ary1FxNDv2tgK5KjW92D71wx8wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcyMTAyMjIzMVoXDTI3MDcyMTAy\nMjIzMVowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL+t1XLepbWKHwd7iVJl\nUy3P5ZC/XmlelGaGAVHtzT+uyqf95dCdppfmATm5iL6mPCMi/B0EdUVWC8IsRrAb\ntIVKOT+6uQvaqjgBDy8/jpULNFU2amH+tFXaK+3mI3FoXaNpMGcwDgYDVR0PAQH/\nBAQDAgeAMBUGA1UdJQQOMAwGCisGAQQBgf1ZAQEwHQYDVR0OBBYEFAQ3bgBAZVtA\nxB6bSKABbGXJzUg9MB8GA1UdIwQYMBaAFKrpv7T3Goq7ozzv7XybB7KDXfwqMAoG\nCCqGSM49BAMDA2gAMGUCMAC9OBINzzySAY9e6iqUSdueZuL6hNbS7FJjzd4AhLBt\naFDNptrDJzq8QG7TqgDZVAIxAOH/CNjzoJ4Vy/9Wc1gYQvFp/Y8OyIchE+LooQim\n3TOl4G9HofEZt+KxtJ2RtWDESw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUDNYWZVBywkKMCpLBMn/ZrbpVAngwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTMxMDcyMDAyMjIzMVowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhtbR7QbD7v9wmJHiLUdRE9SX\nOeGsIpHD2yVPsKeYthmXkK9URtDY4DoeUIxjTPOvJPuH+oGBxuJoQB1DlHNud1e4\nARK1un5WLqJQAM7YH4MDk4e8IgzildxR68Wf5S4Mo2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUqum/tPcairujPO/tfJsHsoNd\n/CowHwYDVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwCgYIKoZIzj0EAwMD\naAAwZQIwTq/MJUn2EN0Ky18A4BLrKyJvrpozm2JLzPZeMJC7JS8hLCXOtpTF1V9l\ngSKpqbi9AjEAuMTlfVDUvFQGMR6cAOKScwHOJnUMB5eyyIg7AYlY5WcjwLNaV//d\nzw3fC7CR1QR/\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTmEV7kebAA5XSFYNCudbbU/Co8wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTM2MDcxODAyMjIzMVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEKVtiVC3icjTPZ6yEwO46wmbk38a9N5GZEkTnjXypSwTsC/GfXLA4\ne4wvvwZ/1+sGrogN5DBX/auAFeicLw0CMFNiSocyqalh+LNjYB0vkBLqC5+PQoCa\navI9zsLmyJjUo1MwUTAdBgNVHQ4EFgQULZkd6aI5/Xdm7qbmkrf4JOIgdtEwHwYD\nVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjAGWyxXJ4x3oWj1xDkLpcsYCBas0SNIGhXHPQmMbVqM\nmtcDX//3RwD26+yBeZguCIYCMHgCQotN2FZ9PHwcmkA5tQkusL4Ab55d9JfvkjZ7\nHFibzfq7pmApshWt7mQ80fRu/Q==\n-----END CERTIFICATE-----\n","servtdIdentity":{"tdIdentity":{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}]},"signature":"3066023100A3895AA95723C3DD3975C55480676494940833B0F9D83F8E7DD8F011DEF212B3326EE32FFA1BDF3C41941FF4D4FD86E6023100A5A52A633A85C39D9FE64516256763ADC84E2D548655935508053FD61AA03DB8CDA1FD5116E5A38CD08DAA2C44FFB42C"},"servtdIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICfzCCAgWgAwIBAgIUb4Ary1FxNDv2tgK5KjW92D71wx8wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcyMTAyMjIzMVoXDTI3MDcyMTAy\nMjIzMVowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL+t1XLepbWKHwd7iVJl\nUy3P5ZC/XmlelGaGAVHtzT+uyqf95dCdppfmATm5iL6mPCMi/B0EdUVWC8IsRrAb\ntIVKOT+6uQvaqjgBDy8/jpULNFU2amH+tFXaK+3mI3FoXaNpMGcwDgYDVR0PAQH/\nBAQDAgeAMBUGA1UdJQQOMAwGCisGAQQBgf1ZAQEwHQYDVR0OBBYEFAQ3bgBAZVtA\nxB6bSKABbGXJzUg9MB8GA1UdIwQYMBaAFKrpv7T3Goq7ozzv7XybB7KDXfwqMAoG\nCCqGSM49BAMDA2gAMGUCMAC9OBINzzySAY9e6iqUSdueZuL6hNbS7FJjzd4AhLBt\naFDNptrDJzq8QG7TqgDZVAIxAOH/CNjzoJ4Vy/9Wc1gYQvFp/Y8OyIchE+LooQim\n3TOl4G9HofEZt+KxtJ2RtWDESw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUDNYWZVBywkKMCpLBMn/ZrbpVAngwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTMxMDcyMDAyMjIzMVowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhtbR7QbD7v9wmJHiLUdRE9SX\nOeGsIpHD2yVPsKeYthmXkK9URtDY4DoeUIxjTPOvJPuH+oGBxuJoQB1DlHNud1e4\nARK1un5WLqJQAM7YH4MDk4e8IgzildxR68Wf5S4Mo2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUqum/tPcairujPO/tfJsHsoNd\n/CowHwYDVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwCgYIKoZIzj0EAwMD\naAAwZQIwTq/MJUn2EN0Ky18A4BLrKyJvrpozm2JLzPZeMJC7JS8hLCXOtpTF1V9l\ngSKpqbi9AjEAuMTlfVDUvFQGMR6cAOKScwHOJnUMB5eyyIg7AYlY5WcjwLNaV//d\nzw3fC7CR1QR/\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTmEV7kebAA5XSFYNCudbbU/Co8wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTM2MDcxODAyMjIzMVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEKVtiVC3icjTPZ6yEwO46wmbk38a9N5GZEkTnjXypSwTsC/GfXLA4\ne4wvvwZ/1+sGrogN5DBX/auAFeicLw0CMFNiSocyqalh+LNjYB0vkBLqC5+PQoCa\navI9zsLmyJjUo1MwUTAdBgNVHQ4EFgQULZkd6aI5/Xdm7qbmkrf4JOIgdtEwHwYD\nVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjAGWyxXJ4x3oWj1xDkLpcsYCBas0SNIGhXHPQmMbVqM\nmtcDX//3RwD26+yBeZguCIYCMHgCQotN2FZ9PHwcmkA5tQkusL4Ab55d9JfvkjZ7\nHFibzfq7pmApshWt7mQ80fRu/Q==\n-----END CERTIFICATE-----\n"}},"signature":"3065023100C621FF5BCB1C20AC294F2AE46BE90549D8C5CFB7FF1C156D9A58C7EFB4A525B88F4F1909769ECC906A7A7AA01BFDD0F5023034AD6F84B41DC0CD63D2603D3F7FA8FB8D5E17FD30D400C1D48AEAF9C688BD8C6E8AC64D833DF12DC910250A23601CA8"} \ No newline at end of file diff --git a/config/templates/servtd_collateral.json b/config/templates/servtd_collateral.json index 3ef094075..fdd106337 100644 --- a/config/templates/servtd_collateral.json +++ b/config/templates/servtd_collateral.json @@ -1 +1 @@ -{"majorVersion":1,"minorVersion":0,"servtdIdentity":{"tdIdentity":{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbEvaluationNumber":1,"xfam":"E71A060000000000","attributes":"0000000000000000","mrConfigId":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwnerConfig":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrsigner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","isvProdId":1,"tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}]},"signature":"3066023100E903D592DF599196522B27BF9AC5B6DAC650CC092E0E901B9D9DCA85595286E4D324400D022D6B5D5601C8172842D465023100D200B5F89F368BC875B6792AE553B7563E9B4DBFF15220BF04D0E06AA1E2E841A0B74CC118927D3BACB5F54B027C25AD"},"servtdIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICaDCCAe6gAwIBAgIUI42jpwfmZAB+N0e+h+6KCfklh40wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcwMTEwNTA0NFoXDTI3MDcwMTEw\nNTA0NFowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABPwrt1m60ICixce/2ugR\nGSQhPzgWcbe9JYkFB49ttKJRcxluthFr1spPZerKDUwdvvGCHdoqxKT6itswbZS3\nahmVUhAsrXPDmKxDCTizZm7ceyRWZ1k7+wR3rlZTSMRoYqNSMFAwDgYDVR0PAQH/\nBAQDAgeAMB0GA1UdDgQWBBT157AdCLS2hROQ1D6welT+Ajy3TjAfBgNVHSMEGDAW\ngBRVgv61R6StRYHfVgRYfD1ejdJSgTAKBggqhkjOPQQDAwNoADBlAjASRh3kf2O1\n0EOhJiZEelug2E0+qWqN3AydrbGBn2ZJt5g5jUxhoXlcqXFPiBn83XECMQCn6Wia\nQ9PpGUg1E9K9sk22W55z8vDre3VyWkj4nJl4rvk208ugBLWrezdEHasLsOc=\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUbqZePdS7UEe0psj4wUNa57MrET0wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcwMTEwNTA0NFoXDTMxMDYzMDEwNTA0NFowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdsL/cjUrCPa00GusnZsRjOxo\n8otNIO1a4Ls1rz5Ew7ilQ4X2WNWwNvmwaNY0qFc+MXXSnMY4Q6QmoJesSqCfp5J1\nooXjIB25lYdXl3bxCMrRmvNzDOWHSKrNkFBpm1p+o2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUVYL+tUekrUWB31YEWHw9Xo3S\nUoEwHwYDVR0jBBgwFoAUCtxBCuwlgOzy1VZm81dXlo69pNgwCgYIKoZIzj0EAwMD\naAAwZQIwP0qNIE1ZMEKV309QREX+zoHgDYp1CgKrRPnCwZSLat80h7GTlYdc8aUN\nhGNhIlzjAjEA52OKlaqU1we3OPeoozPyE+H8gr6tRZSX9GhBVnC1yb/OBX5jLN3l\nMSh0m8g8dWtL\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTquwcbmxr8y1BBPK5eTmYdTB1MwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcwMTEwNTA0NFoXDTM2MDYyODEwNTA0NFowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEOApWwQJHtYcFaq0EHH058knEo3Hz6kMqHiuiaB9XUttM1PGvwrux\ngnxq1SNp8tfXDQlmjXP/m1TJ+BdFX+9cqSG26/W7doazDHW1MNRir4E/v4mMzIox\n86pnu7/7oTnvo1MwUTAdBgNVHQ4EFgQUCtxBCuwlgOzy1VZm81dXlo69pNgwHwYD\nVR0jBBgwFoAUCtxBCuwlgOzy1VZm81dXlo69pNgwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjBGru+cELo1WJH/pxCN1q0adDrhJavW2yVm1A6UbZYm\nXvKKVqOsgSf/fhMRGb/htQ8CMBkFmbplQzY3SVlkTT8aBfNq3a1yNZJRw5HQUz9R\nDrAL9xNFgVm3//brLnWNpVOtcw==\n-----END CERTIFICATE-----\n","servtdTcbMapping":{"tdTcbMapping":{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","issueDate":"2025-01-01T00:00:00Z","isvProdId":1,"mrSigner":"00000000000000000000000000000000","nextUpdate":"2026-01-01T00:00:00Z","svnMappings":[{"isvsvn":1,"tdMeasurements":{"mrtd":"0E200328149B9BAAFD0E68557A426EFF78553D13E2536862EDDD8299A80C986567A8E03CB86F7D3EC75E99F386C3490B","rtmr0":"518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4","rtmr1":"C3C3F42541603E01B85F8B5BD89B45A1B386CB76D56182F63AF73589F81B3280D35545FFD3BF3BDBD5649ABD2E3C3C3E"}}],"version":1},"signature":"306502305E23F4D150336BB6CD0C873C63AB7359556DF5260689324DD242EA0F3007A7C37BFADE5C099A3859D7F9C6978A29E077023100911C7AD3F666F8CE8659F7F4F9474CF9D557AEAEA647F3B9549FF434A6589E697D0588F7E82CF87F2F794FC0E305EC51"},"servtdTcbMappingIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICaDCCAe6gAwIBAgIUI42jpwfmZAB+N0e+h+6KCfklh40wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcwMTEwNTA0NFoXDTI3MDcwMTEw\nNTA0NFowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABPwrt1m60ICixce/2ugR\nGSQhPzgWcbe9JYkFB49ttKJRcxluthFr1spPZerKDUwdvvGCHdoqxKT6itswbZS3\nahmVUhAsrXPDmKxDCTizZm7ceyRWZ1k7+wR3rlZTSMRoYqNSMFAwDgYDVR0PAQH/\nBAQDAgeAMB0GA1UdDgQWBBT157AdCLS2hROQ1D6welT+Ajy3TjAfBgNVHSMEGDAW\ngBRVgv61R6StRYHfVgRYfD1ejdJSgTAKBggqhkjOPQQDAwNoADBlAjASRh3kf2O1\n0EOhJiZEelug2E0+qWqN3AydrbGBn2ZJt5g5jUxhoXlcqXFPiBn83XECMQCn6Wia\nQ9PpGUg1E9K9sk22W55z8vDre3VyWkj4nJl4rvk208ugBLWrezdEHasLsOc=\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUbqZePdS7UEe0psj4wUNa57MrET0wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcwMTEwNTA0NFoXDTMxMDYzMDEwNTA0NFowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdsL/cjUrCPa00GusnZsRjOxo\n8otNIO1a4Ls1rz5Ew7ilQ4X2WNWwNvmwaNY0qFc+MXXSnMY4Q6QmoJesSqCfp5J1\nooXjIB25lYdXl3bxCMrRmvNzDOWHSKrNkFBpm1p+o2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUVYL+tUekrUWB31YEWHw9Xo3S\nUoEwHwYDVR0jBBgwFoAUCtxBCuwlgOzy1VZm81dXlo69pNgwCgYIKoZIzj0EAwMD\naAAwZQIwP0qNIE1ZMEKV309QREX+zoHgDYp1CgKrRPnCwZSLat80h7GTlYdc8aUN\nhGNhIlzjAjEA52OKlaqU1we3OPeoozPyE+H8gr6tRZSX9GhBVnC1yb/OBX5jLN3l\nMSh0m8g8dWtL\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTquwcbmxr8y1BBPK5eTmYdTB1MwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcwMTEwNTA0NFoXDTM2MDYyODEwNTA0NFowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEOApWwQJHtYcFaq0EHH058knEo3Hz6kMqHiuiaB9XUttM1PGvwrux\ngnxq1SNp8tfXDQlmjXP/m1TJ+BdFX+9cqSG26/W7doazDHW1MNRir4E/v4mMzIox\n86pnu7/7oTnvo1MwUTAdBgNVHQ4EFgQUCtxBCuwlgOzy1VZm81dXlo69pNgwHwYD\nVR0jBBgwFoAUCtxBCuwlgOzy1VZm81dXlo69pNgwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjBGru+cELo1WJH/pxCN1q0adDrhJavW2yVm1A6UbZYm\nXvKKVqOsgSf/fhMRGb/htQ8CMBkFmbplQzY3SVlkTT8aBfNq3a1yNZJRw5HQUz9R\nDrAL9xNFgVm3//brLnWNpVOtcw==\n-----END CERTIFICATE-----\n"} \ No newline at end of file +{"majorVersion":1,"minorVersion":0,"servtdTcbMapping":{"tdTcbMapping":{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","svnMappings":[{"tdMeasurements":{"tdinfo_hash":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"},"isvsvn":1}]},"signature":"306502302DF213408E43734941EE22050FB1566E9C3AB600D0C0ADE9EDD99A0C91E2D2E44DD54C6B6658C5C2277BD63EF6EE33B702310092B91C8CDED39E93D0E67B02813388445116123AA2298E956559917FE817B8143CA12A9352DA7CCEC2F6D1F58E025F92"},"servtdTcbMappingIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICfzCCAgWgAwIBAgIUb4Ary1FxNDv2tgK5KjW92D71wx8wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcyMTAyMjIzMVoXDTI3MDcyMTAy\nMjIzMVowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL+t1XLepbWKHwd7iVJl\nUy3P5ZC/XmlelGaGAVHtzT+uyqf95dCdppfmATm5iL6mPCMi/B0EdUVWC8IsRrAb\ntIVKOT+6uQvaqjgBDy8/jpULNFU2amH+tFXaK+3mI3FoXaNpMGcwDgYDVR0PAQH/\nBAQDAgeAMBUGA1UdJQQOMAwGCisGAQQBgf1ZAQEwHQYDVR0OBBYEFAQ3bgBAZVtA\nxB6bSKABbGXJzUg9MB8GA1UdIwQYMBaAFKrpv7T3Goq7ozzv7XybB7KDXfwqMAoG\nCCqGSM49BAMDA2gAMGUCMAC9OBINzzySAY9e6iqUSdueZuL6hNbS7FJjzd4AhLBt\naFDNptrDJzq8QG7TqgDZVAIxAOH/CNjzoJ4Vy/9Wc1gYQvFp/Y8OyIchE+LooQim\n3TOl4G9HofEZt+KxtJ2RtWDESw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUDNYWZVBywkKMCpLBMn/ZrbpVAngwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTMxMDcyMDAyMjIzMVowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhtbR7QbD7v9wmJHiLUdRE9SX\nOeGsIpHD2yVPsKeYthmXkK9URtDY4DoeUIxjTPOvJPuH+oGBxuJoQB1DlHNud1e4\nARK1un5WLqJQAM7YH4MDk4e8IgzildxR68Wf5S4Mo2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUqum/tPcairujPO/tfJsHsoNd\n/CowHwYDVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwCgYIKoZIzj0EAwMD\naAAwZQIwTq/MJUn2EN0Ky18A4BLrKyJvrpozm2JLzPZeMJC7JS8hLCXOtpTF1V9l\ngSKpqbi9AjEAuMTlfVDUvFQGMR6cAOKScwHOJnUMB5eyyIg7AYlY5WcjwLNaV//d\nzw3fC7CR1QR/\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTmEV7kebAA5XSFYNCudbbU/Co8wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTM2MDcxODAyMjIzMVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEKVtiVC3icjTPZ6yEwO46wmbk38a9N5GZEkTnjXypSwTsC/GfXLA4\ne4wvvwZ/1+sGrogN5DBX/auAFeicLw0CMFNiSocyqalh+LNjYB0vkBLqC5+PQoCa\navI9zsLmyJjUo1MwUTAdBgNVHQ4EFgQULZkd6aI5/Xdm7qbmkrf4JOIgdtEwHwYD\nVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjAGWyxXJ4x3oWj1xDkLpcsYCBas0SNIGhXHPQmMbVqM\nmtcDX//3RwD26+yBeZguCIYCMHgCQotN2FZ9PHwcmkA5tQkusL4Ab55d9JfvkjZ7\nHFibzfq7pmApshWt7mQ80fRu/Q==\n-----END CERTIFICATE-----\n","servtdIdentity":{"tdIdentity":{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}]},"signature":"3066023100A3895AA95723C3DD3975C55480676494940833B0F9D83F8E7DD8F011DEF212B3326EE32FFA1BDF3C41941FF4D4FD86E6023100A5A52A633A85C39D9FE64516256763ADC84E2D548655935508053FD61AA03DB8CDA1FD5116E5A38CD08DAA2C44FFB42C"},"servtdIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICfzCCAgWgAwIBAgIUb4Ary1FxNDv2tgK5KjW92D71wx8wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcyMTAyMjIzMVoXDTI3MDcyMTAy\nMjIzMVowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL+t1XLepbWKHwd7iVJl\nUy3P5ZC/XmlelGaGAVHtzT+uyqf95dCdppfmATm5iL6mPCMi/B0EdUVWC8IsRrAb\ntIVKOT+6uQvaqjgBDy8/jpULNFU2amH+tFXaK+3mI3FoXaNpMGcwDgYDVR0PAQH/\nBAQDAgeAMBUGA1UdJQQOMAwGCisGAQQBgf1ZAQEwHQYDVR0OBBYEFAQ3bgBAZVtA\nxB6bSKABbGXJzUg9MB8GA1UdIwQYMBaAFKrpv7T3Goq7ozzv7XybB7KDXfwqMAoG\nCCqGSM49BAMDA2gAMGUCMAC9OBINzzySAY9e6iqUSdueZuL6hNbS7FJjzd4AhLBt\naFDNptrDJzq8QG7TqgDZVAIxAOH/CNjzoJ4Vy/9Wc1gYQvFp/Y8OyIchE+LooQim\n3TOl4G9HofEZt+KxtJ2RtWDESw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUDNYWZVBywkKMCpLBMn/ZrbpVAngwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTMxMDcyMDAyMjIzMVowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhtbR7QbD7v9wmJHiLUdRE9SX\nOeGsIpHD2yVPsKeYthmXkK9URtDY4DoeUIxjTPOvJPuH+oGBxuJoQB1DlHNud1e4\nARK1un5WLqJQAM7YH4MDk4e8IgzildxR68Wf5S4Mo2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUqum/tPcairujPO/tfJsHsoNd\n/CowHwYDVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwCgYIKoZIzj0EAwMD\naAAwZQIwTq/MJUn2EN0Ky18A4BLrKyJvrpozm2JLzPZeMJC7JS8hLCXOtpTF1V9l\ngSKpqbi9AjEAuMTlfVDUvFQGMR6cAOKScwHOJnUMB5eyyIg7AYlY5WcjwLNaV//d\nzw3fC7CR1QR/\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTmEV7kebAA5XSFYNCudbbU/Co8wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTM2MDcxODAyMjIzMVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEKVtiVC3icjTPZ6yEwO46wmbk38a9N5GZEkTnjXypSwTsC/GfXLA4\ne4wvvwZ/1+sGrogN5DBX/auAFeicLw0CMFNiSocyqalh+LNjYB0vkBLqC5+PQoCa\navI9zsLmyJjUo1MwUTAdBgNVHQ4EFgQULZkd6aI5/Xdm7qbmkrf4JOIgdtEwHwYD\nVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjAGWyxXJ4x3oWj1xDkLpcsYCBas0SNIGhXHPQmMbVqM\nmtcDX//3RwD26+yBeZguCIYCMHgCQotN2FZ9PHwcmkA5tQkusL4Ab55d9JfvkjZ7\nHFibzfq7pmApshWt7mQ80fRu/Q==\n-----END CERTIFICATE-----\n"} \ No newline at end of file diff --git a/config/templates/tcb_mapping.json b/config/templates/tcb_mapping.json index 82e3fd452..6104aa184 100644 --- a/config/templates/tcb_mapping.json +++ b/config/templates/tcb_mapping.json @@ -1 +1 @@ -{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","issueDate":"2025-01-01T00:00:00Z","isvProdId":1,"mrSigner":"00000000000000000000000000000000","nextUpdate":"2026-01-01T00:00:00Z","svnMappings":[{"isvsvn":1,"tdMeasurements":{"mrtd":"0E200328149B9BAAFD0E68557A426EFF78553D13E2536862EDDD8299A80C986567A8E03CB86F7D3EC75E99F386C3490B","rtmr0":"518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4","rtmr1":"C3C3F42541603E01B85F8B5BD89B45A1B386CB76D56182F63AF73589F81B3280D35545FFD3BF3BDBD5649ABD2E3C3C3E"}}],"version":1} \ No newline at end of file +{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","svnMappings":[{"tdMeasurements":{"tdinfo_hash":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"},"isvsvn":1}]} \ No newline at end of file diff --git a/config/templates/tcb_mapping_seed.json b/config/templates/tcb_mapping_seed.json new file mode 100644 index 000000000..44562f229 --- /dev/null +++ b/config/templates/tcb_mapping_seed.json @@ -0,0 +1 @@ +{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","svnMappings":[]} diff --git a/config/templates/tcb_mapping_signed.json b/config/templates/tcb_mapping_signed.json index de339aed6..48fa4663a 100644 --- a/config/templates/tcb_mapping_signed.json +++ b/config/templates/tcb_mapping_signed.json @@ -1 +1 @@ -{"tdTcbMapping":{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","issueDate":"2025-01-01T00:00:00Z","isvProdId":1,"mrSigner":"00000000000000000000000000000000","nextUpdate":"2026-01-01T00:00:00Z","svnMappings":[{"isvsvn":1,"tdMeasurements":{"mrtd":"0E200328149B9BAAFD0E68557A426EFF78553D13E2536862EDDD8299A80C986567A8E03CB86F7D3EC75E99F386C3490B","rtmr0":"518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4","rtmr1":"C3C3F42541603E01B85F8B5BD89B45A1B386CB76D56182F63AF73589F81B3280D35545FFD3BF3BDBD5649ABD2E3C3C3E"}}],"version":1},"signature":"306502305E23F4D150336BB6CD0C873C63AB7359556DF5260689324DD242EA0F3007A7C37BFADE5C099A3859D7F9C6978A29E077023100911C7AD3F666F8CE8659F7F4F9474CF9D557AEAEA647F3B9549FF434A6589E697D0588F7E82CF87F2F794FC0E305EC51"} \ No newline at end of file +{"tdTcbMapping":{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","svnMappings":[{"tdMeasurements":{"tdinfo_hash":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"},"isvsvn":1}]},"signature":"306502302DF213408E43734941EE22050FB1566E9C3AB600D0C0ADE9EDD99A0C91E2D2E44DD54C6B6658C5C2277BD63EF6EE33B702310092B91C8CDED39E93D0E67B02813388445116123AA2298E956559917FE817B8143CA12A9352DA7CCEC2F6D1F58E025F92"} \ No newline at end of file diff --git a/config/templates/td_identity.json b/config/templates/td_identity.json index bba297175..5f35f2f56 100644 --- a/config/templates/td_identity.json +++ b/config/templates/td_identity.json @@ -1 +1 @@ -{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbEvaluationNumber":1,"xfam":"E71A060000000000","attributes":"0000000000000000","mrConfigId":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwnerConfig":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrsigner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","isvProdId":1,"tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}]} \ No newline at end of file +{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}]} \ No newline at end of file diff --git a/config/templates/td_identity_signed.json b/config/templates/td_identity_signed.json index 30b23e719..2a11b235f 100644 --- a/config/templates/td_identity_signed.json +++ b/config/templates/td_identity_signed.json @@ -1 +1 @@ -{"tdIdentity":{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbEvaluationNumber":1,"xfam":"E71A060000000000","attributes":"0000000000000000","mrConfigId":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwnerConfig":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrsigner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","isvProdId":1,"tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}]},"signature":"3066023100E903D592DF599196522B27BF9AC5B6DAC650CC092E0E901B9D9DCA85595286E4D324400D022D6B5D5601C8172842D465023100D200B5F89F368BC875B6792AE553B7563E9B4DBFF15220BF04D0E06AA1E2E841A0B74CC118927D3BACB5F54B027C25AD"} \ No newline at end of file +{"tdIdentity":{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}]},"signature":"3066023100A3895AA95723C3DD3975C55480676494940833B0F9D83F8E7DD8F011DEF212B3326EE32FFA1BDF3C41941FF4D4FD86E6023100A5A52A633A85C39D9FE64516256763ADC84E2D548655935508053FD61AA03DB8CDA1FD5116E5A38CD08DAA2C44FFB42C"} \ No newline at end of file diff --git a/deps/td-shim b/deps/td-shim index fb220373c..cf187e3f2 160000 --- a/deps/td-shim +++ b/deps/td-shim @@ -1 +1 @@ -Subproject commit fb220373cc281429364fdefde616838c4c34e136 +Subproject commit cf187e3f295268e76a07b6bf8fad7f0d383b6302 diff --git a/deps/td-shim-AzCVMEmu/azcvm-extract-report/Cargo.lock b/deps/td-shim-AzCVMEmu/azcvm-extract-report/Cargo.lock index 7d1a3398f..a5711cc67 100644 --- a/deps/td-shim-AzCVMEmu/azcvm-extract-report/Cargo.lock +++ b/deps/td-shim-AzCVMEmu/azcvm-extract-report/Cargo.lock @@ -234,9 +234,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b" [[package]] name = "bytes" -version = "1.10.1" +version = "1.12.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a" +checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04" [[package]] name = "cc" @@ -839,15 +839,14 @@ checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe" [[package]] name = "openssl" -version = "0.10.74" +version = "0.10.81" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "24ad14dd45412269e1a30f52ad8f0664f0f4f4a89ee8fe28c3b3527021ebb654" +checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45" dependencies = [ "bitflags 2.13.1", "cfg-if", "foreign-types", "libc", - "once_cell", "openssl-macros", "openssl-sys", ] @@ -865,18 +864,18 @@ dependencies = [ [[package]] name = "openssl-src" -version = "300.5.4+3.5.4" +version = "300.6.1+3.6.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a507b3792995dae9b0df8a1c1e3771e8418b7c2d9f0baeba32e6fe8b06c7cb72" +checksum = "46eb8fb9fb3b61ce1c0f8a026c4c1a0714d3a9e138e7fbde78753ce2babc3846" dependencies = [ "cc", ] [[package]] name = "openssl-sys" -version = "0.9.110" +version = "0.9.117" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0a9f0075ba3c21b09f8e8b2026584b1d18d49388648f2fbbf3c97ea8deced8e2" +checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695" dependencies = [ "cc", "libc", diff --git a/deps/td-shim-AzCVMEmu/td-shim-interface/src/file_ops.rs b/deps/td-shim-AzCVMEmu/td-shim-interface/src/file_ops.rs index 1327ebab5..df44b07c3 100644 --- a/deps/td-shim-AzCVMEmu/td-shim-interface/src/file_ops.rs +++ b/deps/td-shim-AzCVMEmu/td-shim-interface/src/file_ops.rs @@ -156,3 +156,18 @@ pub fn init_file_based_emulation_with_policy_chain( crate::td_uefi_pi::fv::load_policy_issuer_chain_from_file(policy_issuer_chain_path); policy_loaded && chain_loaded } + +/// Initialize policy-v2 emulation with the CoRIM-only release inputs +#[cfg(feature = "policy_v2")] +pub fn init_file_based_emulation_with_corim( + policy_path: &str, + servtd_signer_anchor_path: &str, + servtd_corim_path: &str, +) -> bool { + crate::td_uefi_pi::fv::set_file_reader(real_file_reader); + let policy_loaded = crate::td_uefi_pi::fv::load_policy_from_file(policy_path); + let anchor_loaded = + crate::td_uefi_pi::fv::load_servtd_signer_anchor_from_file(servtd_signer_anchor_path); + let corim_loaded = crate::td_uefi_pi::fv::load_servtd_corim_from_file(servtd_corim_path); + policy_loaded && anchor_loaded && corim_loaded +} diff --git a/deps/td-shim-AzCVMEmu/td-shim-interface/src/lib.rs b/deps/td-shim-AzCVMEmu/td-shim-interface/src/lib.rs index 90e80cae2..88604c1e6 100644 --- a/deps/td-shim-AzCVMEmu/td-shim-interface/src/lib.rs +++ b/deps/td-shim-AzCVMEmu/td-shim-interface/src/lib.rs @@ -41,12 +41,16 @@ pub mod td_uefi_pi; // Re-export key functions for convenience pub use td_uefi_pi::fv::{ - load_policy_from_file, load_root_ca_from_file, set_policy_data, set_root_ca_data, + load_policy_from_file, load_root_ca_from_file, load_servtd_corim_from_file, + load_servtd_signer_anchor_from_file, set_policy_data, set_root_ca_data, + set_servtd_corim_data, set_servtd_signer_anchor_data, }; #[cfg(feature = "policy_v2")] pub use td_uefi_pi::fv::load_policy_issuer_chain_from_file; #[cfg(feature = "policy_v2")] -pub use file_ops::init_file_based_emulation_with_policy_chain; +pub use file_ops::{ + init_file_based_emulation_with_corim, init_file_based_emulation_with_policy_chain, +}; pub use file_ops::init_file_based_emulation_with_real_files; diff --git a/deps/td-shim-AzCVMEmu/td-shim-interface/src/td_uefi_pi/fv.rs b/deps/td-shim-AzCVMEmu/td-shim-interface/src/td_uefi_pi/fv.rs index 366e1c36c..b319e11f8 100644 --- a/deps/td-shim-AzCVMEmu/td-shim-interface/src/td_uefi_pi/fv.rs +++ b/deps/td-shim-AzCVMEmu/td-shim-interface/src/td_uefi_pi/fv.rs @@ -4,11 +4,11 @@ // SPDX-License-Identifier: BSD-2-Clause-Patent //! Firmware Volume emulation -//! Provides file-based emulation for policy and root CA files in migtd +//! Provides file-based emulation for MigTD configuration-volume files use crate::td_uefi_pi::pi::fv::FV_FILETYPE_RAW; use core::ptr; -use core::sync::atomic::{AtomicBool, Ordering}; +use core::sync::atomic::{AtomicBool, AtomicU8, Ordering}; use r_efi::efi::Guid; // Static buffers to store emulated files @@ -25,7 +25,20 @@ static mut POLICY_ISSUER_CHAIN_BUFFER: [u8; 8192] = [0; 8192]; // 8KB for policy static mut POLICY_ISSUER_CHAIN_SIZE: usize = 0; static POLICY_ISSUER_CHAIN_INITIALIZED: AtomicBool = AtomicBool::new(false); -/// Known GUIDs for policy and root CA files in migtd +static mut SERVTD_SIGNER_ANCHOR_BUFFER: [u8; 48] = [0; 48]; +static mut SERVTD_SIGNER_ANCHOR_SIZE: usize = 0; +static SERVTD_SIGNER_ANCHOR_STATE: AtomicU8 = AtomicU8::new(FILE_UNINITIALIZED); + +const SERVTD_CORIM_BUFFER_SIZE: usize = 1024 * 1024; +static mut SERVTD_CORIM_BUFFER: [u8; SERVTD_CORIM_BUFFER_SIZE] = [0; SERVTD_CORIM_BUFFER_SIZE]; +static mut SERVTD_CORIM_SIZE: usize = 0; +static SERVTD_CORIM_STATE: AtomicU8 = AtomicU8::new(FILE_UNINITIALIZED); + +const FILE_UNINITIALIZED: u8 = 0; +const FILE_INITIALIZING: u8 = 1; +const FILE_READY: u8 = 2; + +/// Known GUIDs for configuration-volume files in MigTD const MIGTD_POLICY_FFS_GUID: Guid = Guid::from_fields( 0x0BE92DC3, 0x6221, @@ -54,6 +67,26 @@ pub const MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID: Guid = Guid::from_fields( &[0xD3, 0xEA, 0xB3, 0x9F, 0x8A, 0xEB], ); +// {2B9D5A84-6F3C-4E71-8A2D-0C7E1F4B6A93} +pub const MIGTD_SERVTD_SIGNER_ANCHOR_FFS_GUID: Guid = Guid::from_fields( + 0x2B9D5A84, + 0x6F3C, + 0x4E71, + 0x8A, + 0x2D, + &[0x0C, 0x7E, 0x1F, 0x4B, 0x6A, 0x93], +); + +// {7E5B9C11-2D4A-4F6E-9B3C-1A2B3C4D5E6F} +pub const MIGTD_SERVTD_CORIM_FFS_GUID: Guid = Guid::from_fields( + 0x7E5B9C11, + 0x2D4A, + 0x4F6E, + 0x9B, + 0x3C, + &[0x1A, 0x2B, 0x3C, 0x4D, 0x5E, 0x6F], +); + /// Set policy data for emulation pub fn set_policy_data(data: &[u8]) -> bool { unsafe { @@ -63,7 +96,7 @@ pub fn set_policy_data(data: &[u8]) -> bool { } let policy_size_ptr = ptr::addr_of_mut!(POLICY_SIZE); - (*policy_buffer_ptr)[..data.len()].copy_from_slice(data); + (&mut (*policy_buffer_ptr))[..data.len()].copy_from_slice(data); *policy_size_ptr = data.len(); } POLICY_INITIALIZED.store(true, Ordering::SeqCst); @@ -79,7 +112,7 @@ pub fn set_root_ca_data(data: &[u8]) -> bool { } let root_ca_size_ptr = ptr::addr_of_mut!(ROOT_CA_SIZE); - (*root_ca_buffer_ptr)[..data.len()].copy_from_slice(data); + (&mut (*root_ca_buffer_ptr))[..data.len()].copy_from_slice(data); *root_ca_size_ptr = data.len(); } ROOT_CA_INITIALIZED.store(true, Ordering::SeqCst); @@ -95,13 +128,67 @@ pub fn set_policy_issuer_chain_data(data: &[u8]) -> bool { } let chain_size_ptr = ptr::addr_of_mut!(POLICY_ISSUER_CHAIN_SIZE); - (*chain_buffer_ptr)[..data.len()].copy_from_slice(data); + (&mut (*chain_buffer_ptr))[..data.len()].copy_from_slice(data); *chain_size_ptr = data.len(); } POLICY_ISSUER_CHAIN_INITIALIZED.store(true, Ordering::SeqCst); true } +/// Set the 48-byte ServTD signer anchor for emulation +pub fn set_servtd_signer_anchor_data(data: &[u8]) -> bool { + if data.len() != 48 { + return false; + } + if SERVTD_SIGNER_ANCHOR_STATE + .compare_exchange( + FILE_UNINITIALIZED, + FILE_INITIALIZING, + Ordering::AcqRel, + Ordering::Acquire, + ) + .is_err() + { + return false; + } + + unsafe { + let anchor_buffer_ptr = ptr::addr_of_mut!(SERVTD_SIGNER_ANCHOR_BUFFER); + let anchor_size_ptr = ptr::addr_of_mut!(SERVTD_SIGNER_ANCHOR_SIZE); + (*anchor_buffer_ptr).copy_from_slice(data); + *anchor_size_ptr = data.len(); + } + SERVTD_SIGNER_ANCHOR_STATE.store(FILE_READY, Ordering::Release); + true +} + +/// Set the signed ServTD CoRIM for emulation +pub fn set_servtd_corim_data(data: &[u8]) -> bool { + if data.is_empty() || data.len() > SERVTD_CORIM_BUFFER_SIZE { + return false; + } + if SERVTD_CORIM_STATE + .compare_exchange( + FILE_UNINITIALIZED, + FILE_INITIALIZING, + Ordering::AcqRel, + Ordering::Acquire, + ) + .is_err() + { + return false; + } + + unsafe { + let corim_buffer_ptr = ptr::addr_of_mut!(SERVTD_CORIM_BUFFER); + let corim_size_ptr = ptr::addr_of_mut!(SERVTD_CORIM_SIZE); + (&mut (*corim_buffer_ptr))[..data.len()].copy_from_slice(data); + *corim_size_ptr = data.len(); + } + SERVTD_CORIM_STATE.store(FILE_READY, Ordering::Release); + true +} + // File reader function type type FileReader = fn(&str) -> Option<Vec<u8>>; @@ -155,12 +242,40 @@ pub fn load_policy_issuer_chain_from_file(path: &str) -> bool { false } -/// Get a file from firmware volume - emulated version supporting policy and root CA files +/// Load the ServTD signer anchor from a file path +pub fn load_servtd_signer_anchor_from_file(path: &str) -> bool { + unsafe { + let file_reader_ptr = ptr::addr_of!(FILE_READER); + if let Some(reader) = *file_reader_ptr { + if let Some(data) = reader(path) { + return set_servtd_signer_anchor_data(&data); + } + } + } + false +} + +/// Load the signed ServTD CoRIM from a file path +pub fn load_servtd_corim_from_file(path: &str) -> bool { + unsafe { + let file_reader_ptr = ptr::addr_of!(FILE_READER); + if let Some(reader) = *file_reader_ptr { + if let Some(data) = reader(path) { + return set_servtd_corim_data(&data); + } + } + } + false +} + +/// Get a file from the emulated firmware volume /// /// This implementation supports common files needed by migtd: /// - Policy files (using MIGTD_POLICY_FFS_GUID) /// - Root CA files (using MIGTD_ROOT_CA_FFS_GUID) /// - Policy issuer chain files (using MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID) +/// - ServTD signer anchor (using MIGTD_SERVTD_SIGNER_ANCHOR_FFS_GUID) +/// - Signed ServTD CoRIM (using MIGTD_SERVTD_CORIM_FFS_GUID) /// /// Other files will return None pub fn get_file_from_fv( @@ -177,19 +292,37 @@ pub fn get_file_from_fv( unsafe { let policy_buffer_ptr = ptr::addr_of!(POLICY_BUFFER); let policy_size_ptr = ptr::addr_of!(POLICY_SIZE); - Some(&(*policy_buffer_ptr)[..*policy_size_ptr]) + Some(&(&(*policy_buffer_ptr))[..*policy_size_ptr]) } } else if file_name == MIGTD_ROOT_CA_FFS_GUID && ROOT_CA_INITIALIZED.load(Ordering::SeqCst) { unsafe { let root_ca_buffer_ptr = ptr::addr_of!(ROOT_CA_BUFFER); let root_ca_size_ptr = ptr::addr_of!(ROOT_CA_SIZE); - Some(&(*root_ca_buffer_ptr)[..*root_ca_size_ptr]) + Some(&(&(*root_ca_buffer_ptr))[..*root_ca_size_ptr]) } - } else if file_name == MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID && POLICY_ISSUER_CHAIN_INITIALIZED.load(Ordering::SeqCst) { + } else if file_name == MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID + && POLICY_ISSUER_CHAIN_INITIALIZED.load(Ordering::SeqCst) + { unsafe { let chain_buffer_ptr = ptr::addr_of!(POLICY_ISSUER_CHAIN_BUFFER); let chain_size_ptr = ptr::addr_of!(POLICY_ISSUER_CHAIN_SIZE); - Some(&(*chain_buffer_ptr)[..*chain_size_ptr]) + Some(&(&(*chain_buffer_ptr))[..*chain_size_ptr]) + } + } else if file_name == MIGTD_SERVTD_SIGNER_ANCHOR_FFS_GUID + && SERVTD_SIGNER_ANCHOR_STATE.load(Ordering::Acquire) == FILE_READY + { + unsafe { + let anchor_buffer_ptr = ptr::addr_of!(SERVTD_SIGNER_ANCHOR_BUFFER); + let anchor_size_ptr = ptr::addr_of!(SERVTD_SIGNER_ANCHOR_SIZE); + Some(&(&(*anchor_buffer_ptr))[..*anchor_size_ptr]) + } + } else if file_name == MIGTD_SERVTD_CORIM_FFS_GUID + && SERVTD_CORIM_STATE.load(Ordering::Acquire) == FILE_READY + { + unsafe { + let corim_buffer_ptr = ptr::addr_of!(SERVTD_CORIM_BUFFER); + let corim_size_ptr = ptr::addr_of!(SERVTD_CORIM_SIZE); + Some(&(&(*corim_buffer_ptr))[..*corim_size_ptr]) } } else { None diff --git a/deps/td-shim-AzCVMEmu/tdx-tdcall/src/tdx_emu.rs b/deps/td-shim-AzCVMEmu/tdx-tdcall/src/tdx_emu.rs index 7b2b95f41..2cd8461eb 100644 --- a/deps/td-shim-AzCVMEmu/tdx-tdcall/src/tdx_emu.rs +++ b/deps/td-shim-AzCVMEmu/tdx-tdcall/src/tdx_emu.rs @@ -137,6 +137,10 @@ pub fn set_emulated_start_migration( target_td_uuid, binding_handle, }); + + // Migration reads SERVTD_EXT just like rebinding. Populate the emulated + // target-TD fields so policy-v2 can authenticate init/current SVN order. + populate_servtd_fields(binding_handle, target_td_uuid); } /// Helper: Set a GetTDReport request @@ -234,18 +238,12 @@ fn populate_servtd_fields(binding_handle: u64, target_td_uuid: [u64; 4]) { core::mem::size_of_val(&report.tdinfo), ) }; - let info_hash: [u8; 48] = Sha384::digest(td_info_bytes).into(); + // Per TDX module spec: init_servtd_info_hash = SHA384(TDINFO masked by + // servtd_attr). With servtd_attr=0 (production), no masking is applied. + let servtd_info_hash: [u8; 48] = Sha384::digest(td_info_bytes).into(); - const SERVTD_TYPE_MIGTD: u16 = 0; let servtd_attr: u64 = 0; - let mut buffer = [0u8; 48 + 2 + 8]; - buffer[..48].copy_from_slice(&info_hash); - buffer[48..50].copy_from_slice(&SERVTD_TYPE_MIGTD.to_le_bytes()); - buffer[50..58].copy_from_slice(&servtd_attr.to_le_bytes()); - - let servtd_info_hash: [u8; 48] = Sha384::digest(&buffer).into(); - let write_field = |field_base: u64, data: &[u8], elem_size: usize| { for (idx, chunk) in data.chunks(elem_size).enumerate() { let mut bytes = [0u8; 8]; diff --git a/doc/MigTD_Functionality_Summary.md b/doc/MigTD_Functionality_Summary.md new file mode 100644 index 000000000..a05ddd34a --- /dev/null +++ b/doc/MigTD_Functionality_Summary.md @@ -0,0 +1,335 @@ +# MigTD — Implemented Functionality Summary (Azure Build) + +A high-level summary of the **main functionalities** implemented in this MigTD +(Migration TD) codebase, focused on the **Azure TDX CVM build configuration**. +MigTD is a no_std Rust TDX **Service TD** that evaluates whether a migration +source and destination platform both satisfy the TD Migration Policy, then +securely transfers the **Migration Session Key (MSK)** between them so the VMM +can live-migrate a user TD. + +> **Focus / scope.** This document describes the **Azure build**, which uses: +> - **IGVM** image format +> - **`igvm-attest`** for quote retrieval (attestation) +> - **`vmcall-raw`** for the GHCI guest–host channel +> - **SPDM** as the mutual-attestation / secure-session protocol +> - **policy v2** (signed policy + ServTD collateral) +> +> Build feature set (`sh_script/Azure/Makefile`): +> `vmcall-raw, stack-guard, main, vmcall-interrupt, oneshot-apic, +> spdm_attestation, igvm-attest` built with `--image-format igvm --policy-v2`. +> +> The recent proof-of-concept work for the **one-hash TCB-mapping with CoRIM +> hash endorsement** (the `servtd_corim` feature / latest redesign commits) is +> intentionally **excluded** here; the pre-existing policy v2 / ServTD-collateral +> functionality *is* covered. Non-Azure options (RA-TLS, virtio/vsock +> transports, `bin` image format) are out of scope. + +--- + +## 1. Overview & Role + +- MigTD runs as a TDX Service TD (`SERVTD_TYPE = 0`) bound to a user TD via + `TDH.SERVTD.BIND` / `TDH.SERVTD.PREBIND`. +- It is the migration-policy decision point: the source MigTD (MigTD-S) and the + destination MigTD (MigTD-D) **mutually remote-attest** each other over SPDM, + check each other against policy v2, and only then exchange the MSK. +- Built for `x86_64-unknown-none` on top of the **td-shim** payload framework and + packaged as an **IGVM** image for Azure. It can also be built as a normal + user-space app for Azure CVM emulation (**AzCVMEmu**). +- Entry point: `src/migtd/src/lib.rs` (`_start`) → runtime init → `main()` in + `src/migtd/src/bin/migtd/main.rs`. + +--- + +## 2. End-to-End Migration Flow + +Orchestrated in `src/migtd/src/bin/migtd/main.rs` and +`src/migtd/src/migration/session.rs`: + +1. **Boot & self-measurement** (`do_measurements`): read the signed policy and + the policy issuer chain from the Configuration Firmware Volume (CFV), verify + the policy, and extend the measurements into RTMRs via the CCEL event log. +2. **VMM logging init** (`init_vmm_logger`, `create_logarea`): set up per-vCPU + log areas for the `vmcall-raw` channel. +3. **Wait for request** (`wait_for_request`): receive a request from the VMM over + the `vmcall-raw` GHCI channel. An async dispatcher supports up to **12 + concurrent** requests. +4. **Dispatch** by request type (see §3) — for a migration, `exchange_msk` sets + up the transport, performs the SPDM mutual attestation, negotiates the + migration version, and exchanges the MSK. +5. **Write MSK & report status** (`write_msk`, `report_status`): write the MSK + into the TDX module and report success/error back to the VMM. + +### MSK handling +- `MigrationSessionKey` = 4 × `u64`, **zeroize-on-drop** + (`src/migtd/src/migration/data.rs`). +- Read from the TDX module via `tdcall_servtd_rd` (`TDCS_FIELD_MIG_ENC_KEY`), + written via `tdcall_servtd_wr` (`TDCS_FIELD_MIG_DEC_KEY`) + (`session.rs: read_msk` / `write_msk`). +- **Migration version negotiation** (`exchange_info`, `cal_mig_version`, + `set_mig_version`) reads the TDX-module export/import min/max version fields and + computes a common version. The forward/backward MSK and versions are carried + inside the SPDM session. + +--- + +## 3. MigTD ↔ VMM Interface (`vmcall-raw` GHCI) + +Implemented in `src/migtd/src/migration/{data.rs, session.rs, event.rs}`: + +- Guest–host communication uses the **`vmcall-raw`** channel (TDVMCALL), with a + shared **request/response data buffer** (`RequestDataBuffer` / + `RequestDataBufferHeader { datastatus, length }`). +- Event-driven notification via `SetupEventNotifyInterrupt` (interrupt vector + `0x50`, `event.rs`). +- Request set (`WaitForRequestResponse`): + - `StartMigration` — run the MSK key-exchange flow. + - `StartRebinding` — approve rebinding the user TD to a new MigTD (policy v2). + - `GetTdReport` — return a TD report for given report data. + - `EnableLogArea` — enable/raise the VMM log level for a request. + - `GetMigtdData` — return MigTD attestation data (policy v2). +- `ReportStatus` returns the per-request result (`ReportStatusResponse` carries + the pre-migration status + error code). +- **Guest-crash reporting**: fatal init/runtime failures call + `panic_with_guest_crash_reg_report`, surfacing a crash code/message to the VMM + via MSR (`driver/crash.rs`, `driver/vmcall_raw.rs`). +- HOB parsing for migration information and policy (`data.rs: read_mig_info`). + +--- + +## 4. Remote Attestation (`igvm-attest`) + +### Quote generation (`src/attestation/src/igvmattest.rs`, `quote.rs`) +- Produce a TD report (`tdcall_report`) over the report data, then obtain a quote + through the **IGVM attest** path: + - `get_quote_igvm` builds a `ServtdTdxQuoteHdr` + the TD report into a 16-page + shared request buffer and calls `servtd_get_quote` (GHCI `GetQuote` via + TDVMCALL); the VMM fills in the quote, which is then extracted. + - `get_quote_with_retry` retries `Busy` with exponential backoff. + +### Quote verification (`src/attestation/src/attest.rs`) +- Wraps the Intel attestation verification library via FFI. The Azure build (via + policy v2 → `attest-lib-ext`) uses **`verify_quote_integrity_ex`** with the + **collateral** (`QveCollateral`) sourced from **Azure THIM** + (`config/Azure/collateral_thim.json`). +- Verifies against the enrolled Intel SGX root CA public key + (`attestation::root_ca`), returning an 822-byte verified TD report block that + policy evaluation consumes. + +### Measurement & Event Log (`src/migtd/src/event_log.rs`) +- `write_tagged_event_log`: SHA-384 of measured data → `tdcall_extend_rtmr` → + append a tagged CCEL event. +- Measured items: the **policy issuer chain** (RTMR1, as a stable *signer + anchor*) and the canonical **`policyData`** bytes (RTMR2, with + `servtdTcbMapping` redacted so it stays updatable). +- `verify_event_log` replays the event log against the RTMRs from the verified + quote (bypassed under `AzCVMEmu` / `use-mock-quote` test builds). + +--- + +## 5. Mutual Attestation & Secure Session (**SPDM**) + +The `spdm_attestation` feature makes **SPDM** the mutual-attestation and +secure-session protocol that carries both the attestation evidence and the MSK +exchange (`src/migtd/src/spdm/`, `migration/spdm_session.rs`): + +- **SPDM 1.2** over `spdm-rs` (`spdmlib` with `spdm-ring`): ECDSA P-384 / + SHA-384 / SECP384R1 / AES-256-GCM, **mutual authentication**, key exchange, + public-key-ID auth, chunking. +- Requester = MigTD-S, Responder = MigTD-D, both driven through + `finalize_spdm_session` (60-second timeout). The SPDM transport is VMM-mediated + via `MigtdTransport` implementing `SpdmDeviceIo` over the `vmcall-raw` channel. +- Attestation material, policy, versions and keys are exchanged via + **vendor-defined messages (VDM)**: + - `ExchangePubKey` — provision peer public keys before attestation. + - `ExchangeMigrationAttestInfo` — exchange **quote**, **event log**, **policy + hash**, **SERVTD_EXT**, and **init TD info**. + - `ExchangeMigrationInfo` — exchange migration export/import versions and the + **forward/backward Migration Session Key**. + - plus **rebind** variants for the `StartRebinding` flow. +- Security hygiene: the session is torn down on policy-hash mismatch and the + requester app-context buffer is zeroized on all paths. + +### Pre-session policy exchange +Because policy + issuer-chain data can exceed the secure-session message size, +they are exchanged up-front via `pre_session_data_exchange` +(`migration/pre_session_data.rs`, 60-second timeout) and then bound during SPDM +attestation. + +--- + +## 6. Migration Policy (v2) + +Implemented in `src/policy/` and `src/migtd/src/mig_policy.rs`; the signed policy +is enrolled into the IGVM image and measured into RTMR at boot. + +### What it enforces +- Platform/quote collateral: FMSPC, TCB info, TCB status & date, TCB evaluation + data number, PCK/root-CA CRLs, QE identity, TDX-module identity (from THIM + collateral). +- MigTD/ServTD identity: TD `ATTRIBUTES`, `XFAM`, `MRTD`, `MRCONFIGID`, + `MROWNER`, `MROWNERCONFIG`, `RTMR0–3` from the verified report. + +### Policy v2 structure & verification +- A **signed `policyData` wrapper**, a **policy issuer chain** (X.509 v3, + ECDSA-P384/SHA-384), and **signed ServTD collateral** containing a signed **TD + identity** and **TCB mapping**, each with their own issuer chains. +- Runtime: `init_policy` verifies the signed policy and sets the root CA; + `authenticate_remote*` verifies the quote/TDREPORT, event-log integrity, policy + signature & integrity, peer issuer-chain compatibility, and TCB relationships. +- **Measurement binding:** RTMR1 ← issuer-chain *signer anchor*; RTMR2 ← + canonical `policyData` (with `servtdTcbMapping` redacted). The same canonical + bytes are reproduced offline by `migtd-hash --policy-v2`. +- Self-check: MigTD verifies its own `TDINFO.MROWNER/MROWNERCONFIG` against the + policy key/SVN (`verify_own_tdinfo`). +- See `doc/policy_v2.md` and `doc/policy_v2_measurements.md`. + +--- + +## 7. TD Binding, Pre-binding & Rebinding + +- **Binding / pre-binding** (`readme.md`): MigTD is bound to a user TD by process + ID (`TDH.SERVTD.BIND`) or pre-bound by `SERVTD_INFO_HASH` + (`TDH.SERVTD.PREBIND`). +- **`verify_servtd_attr`** validates `SERVTD_ATTR` against a hardcoded expected + value to defend against a malicious VMM. +- **SERVTD_EXT** (`migration/servtd_ext.rs`): optional extended Service-TD + binding info (gated on TDCS `ATTRIBUTES` bit 17) — init SERVTD info hash, init + attributes, CPUSVN, and TEE TCB SVN. +- **Rebinding** (`migration/rebinding.rs`): the `StartRebinding` flow approves + rebinding a user TD to a new MigTD on the destination using + `tdcall_servtd_rebind_approve` and a rebind accept token. + +--- + +## 8. Guest–Host Transport (`vmcall-raw`) + +- The migration channel uses the **`vmcall-raw`** transport — a raw migration + channel built directly on TDVMCALL/VMCALL (`src/devices/vmcall_raw`, + `migration/transport.rs`). +- A transport abstraction (`setup_transport` / `shutdown_transport`) keeps the + session code transport-agnostic; the Azure build selects `vmcall-raw` + (`VmcallRaw::new_with_mid(...).connect()`). +- An **8-second** connection timeout is enforced after a migration is triggered. + +--- + +## 9. Cryptography (`src/crypto`) + +- Provides the primitives used by SPDM and policy v2: **ECDSA P-384 / SHA-384** + sign/verify (via `ring`), **SHA-384** hashing, secure random. +- X.509 / PEM handling: PEM↔DER, minimal cert builder, chain split/validation, + signature verification, **COSE_Sign1 (ES384 + x5chain)** verification, and CRL + number parsing — used to validate the signed policy, ServTD collateral, and + issuer chains. + +--- + +## 10. Device Drivers & Async Runtime + +- **Drivers** (`src/migtd/src/driver/`, `src/devices/`) relevant to the Azure + build: the **`vmcall-raw`** channel, the **APIC timer** with one-shot mode + (`oneshot-apic`, used when TSC-deadline is unavailable), the **system tick** + clock, and **guest-crash MSR reporting**. +- **Async runtime** (`src/async/async_runtime`, `src/async/async_io`): a tiny + single-threaded no_std executor (poll-based futures, `ArcWake`, task queue) + with `AsyncRead`/`AsyncWrite` traits and timeout combinators. It lets the + single-threaded firmware drive asynchronous migration I/O. Under AzCVMEmu a real + **tokio** runtime is used instead. + +--- + +## 11. Build, IGVM Image & Hashing + +- **`cargo image --image-format igvm`** builds the MigTD **IGVM** image and + enrolls the signed policy, policy issuer chain, and root CA into the CFV + (`xtask`). Supports `--log-level` and `--debug`. +- The **Azure Makefile** (`sh_script/Azure/Makefile`) is the canonical build: + `cargo image --no-default-features --features + vmcall-raw,stack-guard,main,vmcall-interrupt,oneshot-apic,spdm_attestation,igvm-attest + --image-format igvm --policy-v2 ...`. +- **`cargo hash` / `migtd-hash --policy-v2`** computes `SERVTD_INFO_HASH` + (for pre-binding) and reproduces the RTMR2 canonical `policyData` digest for the + IGVM image. +- Hardening: **`stack-guard`** is enabled in the Azure build (with optional + `cet-shstk`). + +--- + +## 12. Developer Tools (`tools/`) + +- **migtd-hash** — compute MigTD measurements (`SERVTD_INFO_HASH`) and, in v2 + mode, the `tdinfo_hash` for `tcb_mapping.json`. +- **migtd-collateral-generator** — fetch platform collateral from **Azure THIM** + (or Intel PCS) and emit collateral JSON. +- **migtd-policy-generator** — generate v2 `policyData` by merging base policy + + platform collateral + ServTD collateral. +- **servtd-collateral-generator** — bundle signed ServTD identity + signed TCB + mapping + issuer chains. +- **json-signer** — sign / finalize / verify JSON for `policyData`, `tdIdentity`, + and `tdTcbMapping`. +- **migtd-policy-verifier** — verify a signed policy JSON and its issuer chain. + +--- + +## 13. AzCVMEmu Emulation Mode + +- Builds MigTD as a **standard Rust user-space app** that runs inside an Azure + TDX CVM for development/testing (`doc/AzCVMEmu.md`, + `src/migtd/src/bin/migtd/cvmemu.rs`). +- Replaces TDX payload/tdcall interfaces with `*-emu` shims, uses a tokio + runtime, and reads policy/root-CA from environment/files. +- Uses the same **`vmcall-raw`** transport as the production Azure build; supports + real or mocked (`use-mock-quote`, `test_mock_report`) attestation for + end-to-end flow testing. + +--- + +## 14. Testing & Quality + +- **Azure mock-quote test flow** (`sh_script/Azure/Makefile`, + `build_azure_mock_test.sh`): build IGVM variants with allow-all / bad-FMSPC + (reject) / mock-quote v2 policies to exercise accept and reject paths without a + real quoting service. +- **Unit tests** across crates, with coverage tooling + (`sh_script/unit_test_coverage.sh`). +- **Integration tests** (QEMU + pytest) and **fuzzing** harnesses for migtd, + policy, crypto, virtio, virtio-serial, vsock, and vmcall-raw. +- **Security** and **memory-usage** test documentation + (`doc/security_test.md`, `doc/memory_usage_test.md`). +- **Test bypass** `test_disable_ra_and_accept_all` exists for test images and is + **compile-time blocked** from combining with production attestation features + (`spdm_attestation` / `policy_v2`) in non-emulator builds. + +--- + +## 15. Configuration & Feature Flags + +### Azure config files (`config/Azure/`) +- `collateral_thim.json` — Azure THIM platform collateral. +- `policy_data_raw.json` / `policy_v2_signed.json` — v2 policy (raw / signed). +- `td_identity.json`, `tcb_mapping.json` — ServTD collateral inputs. +- `servtd_info.json` — TD config manifest used for hashing. + +### Azure build feature flags (`src/migtd/Cargo.toml`) +- `vmcall-raw` — GHCI / migration transport. +- `igvm-attest` — IGVM quote retrieval. +- `spdm_attestation` — SPDM mutual-attestation secure session. +- `policy_v2` — signed policy + ServTD collateral (also enables + `attestation/attest-lib-ext` collateral verification). +- `stack-guard`, `vmcall-interrupt`, `oneshot-apic`, `main` — hardening, event + interrupt, APIC one-shot timer, and the migration binary. + +--- + +## 16. Migration Error Codes (host-visible) + +| Code | Cause | +|:----:|-------| +| 1 | VMM-provided data not as expected | +| 3 | Out of memory | +| 4 | TDX module error (often mismatched `SERVTD_INFO_HASH`) | +| 5 | Failed to establish host communication channel | +| 6 | SPDM/secure-session error (e.g. remote quote verification or handshake aborted) | +| 7 | Unable to obtain the quote | +| 8 | Remote quote does not satisfy the migration policy | diff --git a/doc/code_coverage.md b/doc/code_coverage.md new file mode 100644 index 000000000..5bd534bc7 --- /dev/null +++ b/doc/code_coverage.md @@ -0,0 +1,177 @@ +# MigTD Code Coverage Proposal + +Status: **DRAFT for review.** Aggregation backend decided: **Codecov**. No implementation yet. + +This document proposes a per-PR code-coverage flow that combines unit tests and CI integration +tests into a single, line-by-line report, and outlines how to reach the production-only code paths +that only the real-hardware tests exercise. + +## 1. Current state + +Coverage exists only as **local, manual scripts** — nothing runs in CI, nothing is aggregated, +uploaded, or shown per-PR. + +| Asset | What it does | Gaps | +|---|---|---| +| [`sh_script/unit_test_coverage.sh`](../sh_script/unit_test_coverage.sh) | `RUSTFLAGS=-Cinstrument-coverage` + `cargo test -p policy -p migtd -p crypto -p virtio -p vsock` → `grcov -t html`. Source-based LLVM coverage. | Local only; HTML only (no lcov); default features only (misses `policy_v2` / `vmcall-raw` / `spdm` legs that `xtask lib-test` builds); not in CI. | +| [`sh_script/fuzzing.sh`](../sh_script/fuzzing.sh) `-c` | Per-fuzz-target grcov HTML. | Local only; fuzz-only. | + +CI test surfaces today (none produce coverage): + +- **[`library.yml`](../.github/workflows/library.yml)** → `cargo xtask lib-test`: unit tests across + crates and feature combos (migtd default / `policy_v2` / `main,policy_v2,vmcall-raw --lib`, + policy v1+v2, etc.). +- **[`integration-emu.yml`](../.github/workflows/integration-emu.yml)** → 13-leg matrix driving + [`migtdemu.sh`](../migtdemu.sh) (AzCVMEmu). Builds a **std host binary** + (`x86_64-unknown-linux-gnu`, no `--target`) and runs source+destination as ordinary Linux + processes with **mock quote / mock report**. Covers skip-RA, policy v2, IGVM-attest, SPDM, + rebind, key-rotation, mapping-rotation, quote-retry. +- **[`integration-tdx.yml`](../.github/workflows/integration-tdx.yml)** → `[self-hosted, tdx]` + runners; builds the **firmware image** (`cargo image`, no_std `x86_64-unknown-none`, `migtd.bin`) + and runs `pytest` inside real TD guests with **real attestation**. Marked "Optional/Broken", + `workflow_dispatch` only. + +## 2. Goals + +1. **Per-PR combined coverage** = unit tests ∪ CI integration tests, as one number + report. +2. Integration layer = the **AzCVMEmu** legs in `integration-emu.yml` — they run directly on the + build runner with a mock quote, so they are directly instrumentable. +3. Reach toward **production-only code paths** that AzCVMEmu + mock_report does **not** exercise + (real attestation / quote generation / TDX GHCI vmcalls / no_std firmware runtime) — these are + only hit by the **real-hardware TDX** tests. +4. **Line-by-line** visibility: which source lines are covered, plus PR **diff** coverage. +5. Must run **per-PR**, but a **minimal covering subset** of legs is acceptable if it yields the + same coverage (keep CI fast). +6. Prefer **GitHub-native** flow. **Decision: use Codecov** for aggregation/reporting. + +## 3. Technical foundation (verified) + +- Standardize on **source-based LLVM coverage** (`-Cinstrument-coverage`) — already the repo's + approach via grcov. +- The AzCVMEmu binary is a **std host build** → directly instrumentable. `migtdemu.sh` launches it + through `env "${kv[@]}" … "$binary"`, which **inherits** the parent environment, so exporting + `LLVM_PROFILE_FILE=…/%p-%m.profraw` makes **both** the source and destination processes emit + `.profraw` with **no script change**. +- Emit **LCOV** (`grcov … -t lcov`) as the interchange format → line-by-line in Codecov + local HTML. +- Merging reports from **different feature-variant builds** yields the **union** of covered lines — + exactly the "covered by all CI tests combined" semantic. Lines `cfg`-gated out of a given build + are simply absent from that report; a line counts as covered if **any** configuration hits it. +- The [`setup-build-environment`](../.github/actions/setup-build-environment/action.yml) action + installs Rust 1.88.0 + `rust-src` but **not** `llvm-tools-preview`/grcov ([`fuzz.yml`](../.github/workflows/fuzz.yml) + already adds `llvm-tools-preview`); coverage jobs must add both. + +## 4. Coverage by test layer + +### 4a. Unit tests — EASY +Enhance `unit_test_coverage.sh` to also emit `-t lcov`, and align its feature combos with +`xtask lib-test` (add `policy_v2` / `vmcall-raw` / `spdm` runs) so unit coverage reflects what CI +tests. Upload under flag **`unittests`**. + +### 4b. AzCVMEmu integration — EASY/MODERATE +Per selected leg: add `llvm-tools-preview` + grcov; build with `RUSTFLAGS=-Cinstrument-coverage`; +`export LLVM_PROFILE_FILE=$PWD/emu-cov/<leg>-%p-%m.profraw`; run the existing `test-command`; then + +```bash +grcov emu-cov --binary-path target/release/ -s . -t lcov \ + --ignore 'deps/*' --ignore 'target/*' -o emu-<leg>.lcov +``` + +Upload under flag **`integration`**. (Instrumentation forces a full instrumented rebuild of deps → +slower; see §6.) + +### 4c. Real-hardware TDX firmware — HARD (production-only paths) +**Why it matters:** real attestation, quote generation, TDX GHCI vmcalls, and the no_std firmware +runtime are **only** exercised here; AzCVMEmu + mock cannot cover them. + +**Why it's hard:** the firmware is `no_std`, `x86_64-unknown-none`, has **no filesystem** to write +`.profraw`, may never cleanly "exit", and is a **measured** image (instrumentation changes MRTD/RTMR). + +**Feasible approach — [`minicov`](https://github.com/Amanieu/minicov)** (the standard no_std coverage runtime): +1. Build the firmware with `-Cinstrument-coverage` and link the `minicov` no_std runtime. +2. Reserve a memory region / linker section for the LLVM counters in the firmware memory map. +3. Under a **test-only feature**, call `minicov::capture_coverage()` at end-of-test and stream the + buffer out-of-band over an existing channel (serial log / vsock), base64-encoded. +4. Host side: decode → reconstruct `.profraw` → grcov/llvm-cov → lcov. + +**Risks / caveats to weigh:** +- Firmware **memory-layout & size budget**: counter sections may not fit the fixed firmware layout. +- **Measurement change:** instrumenting changes MRTD, so attestation policy / pre-production certs + must be **regenerated to match the instrumented image** (the emu policy generator already does + this by hashing the actual image; real-HW needs equivalent handling). Otherwise the very + attestation path you want to cover will reject the image. +- **Cadence:** these run on self-hosted TDX and are currently optional/broken — they will not run on + every PR. + +**Recommended handling:** treat firmware coverage as a Codecov **carryforward flag** `hardware` — +when the hardware job doesn't run on a PR, Codecov carries the **last** hardware coverage forward so +the combined per-PR number still reflects production-path coverage without blocking the PR. + +## 5. Line-by-line coverage + +Yes, fully supported. `grcov -t lcov` (or `-t html`) gives per-line + branch data; **Codecov** +renders per-line covered/uncovered in the web UI **and** PR **diff coverage** (which changed lines +are covered). Locally, `grcov -t html` or `genhtml` produces a browsable line-by-line report. +With per-flag uploads (`unittests` / `integration` / `hardware`) you can also see which **layer** +covers a given line. + +## 6. Per-PR cost control & "minimal covering subset" + +Instrumented builds rebuild all deps (slower), and the emu matrix is 13 legs — instrumenting all of +them per-PR is heavy. Plan: + +1. Run a **one-time full-matrix** instrumented pass; compute each leg's **marginal** line contribution. +2. The 13 legs vary along a few axes — attestation mode (skip-ra / mock-report / igvm-attest / spdm), + policy (v1/v2), operation (migration / rebind / key-rotation / mapping-rotation), retry. A + **representative subset (~4–6 legs)** whose union ≈ the full union is very likely. +3. Run the **subset per-PR**; run the **full matrix nightly/weekly** (or on label) to detect drift. +4. Optionally isolate everything in a **dedicated `coverage.yml`** so instrumented rebuilds never + slow the existing fast PR matrix. + +## 7. Alternatives considered + +### Aggregation / reporting (decided: A — Codecov) +| Option | Pros | Cons | +|---|---|---| +| **A. Codecov flag-merge (+carryforward) — chosen** | GitHub-native; auto-merges matrix + unit + hardware uploads into one total with per-flag breakdown; per-line + PR diff coverage; carryforward solves "hardware not run every PR"; tokenless for public repo; historical trend UI | external service; fork PRs may need `CODECOV_TOKEN`; org must allow the Codecov app | +| B. Self-contained: artifacts + merge job + genhtml | no third party; data stays in GitHub; full control | must build/maintain merge, threshold, PR-comment, and carryforward-equivalent logic; no trend UI | +| C. Coveralls | similar to A; parallel/flag support | same external-service concerns; smaller feature set than Codecov flags/carryforward | +| D. ADO Cobertura + `PublishCodeCoverageResults@2` | native Coverage tab; merges multiple Cobertura; good if org mandates ADO | CI already lives in GitHub Actions → extra system; weaker per-PR GitHub annotations | + +### Coverage tooling sub-choice +| Option | Pros | Cons | +|---|---|---| +| **grcov** (current) | already used by repo scripts; consumes raw profraw from externally-launched processes (fits `migtdemu.sh`); lcov/html/cobertura | external binary to install | +| cargo-llvm-cov | great for `cargo test`/`cargo run`; one command | awkward for binaries launched by a shell script out-of-band (the emu case) | +| raw llvm-tools (`llvm-profdata`+`llvm-cov`) | no extra deps beyond `llvm-tools-preview` | more manual; grcov already wraps this | + +→ Keep **grcov** for uniformity (unit + emu + firmware-via-minicov all converge on profraw → lcov). + +### Firmware coverage sub-choice +| Option | Pros | Cons | +|---|---|---| +| **minicov no_std runtime** | purpose-built for bare-metal; capture + dump over serial/vsock | code changes (dep, linker section, test hook); measurement regen; size budget | +| RAM-dump hack of profile runtime | no extra crate | very invasive/custom; fragile | +| Skip firmware coverage | zero effort | loses production-only path coverage (the main reason hardware tests exist) | + +## 8. Recommendation (phased) + +- **Phase 1 (now — high ROI, low effort):** unit + a minimal emu subset → grcov `-t lcov` → + **Codecov** flags `unittests` + `integration`. Per-PR, line-by-line + diff coverage. Use a + dedicated `coverage.yml` (or extend existing workflows) running the subset per-PR, full matrix + nightly. +- **Phase 2 (later — high effort, high value):** firmware coverage on the self-hosted TDX runner via + **minicov**, uploaded under a **carryforward `hardware`** flag so production-only paths enrich the + combined number without running on every PR. +- **Phase 3 (tuning):** lock in the covering subset, set a coverage threshold / PR status, and decide + gating policy (informational vs blocking). + +Default tooling: **grcov → lcov → Codecov flag-merge**, reusing the repo's existing approach. + +## 9. Open questions for reviewers + +1. **Per-PR CI time budget** — is the instrumented subset acceptable inline, or should it live in a + separate `coverage.yml` workflow? +2. **Invest in firmware/minicov now or defer** to Phase 2? (Requires firmware code + measurement-regen work.) +3. **Gating policy** — informational coverage report vs a blocking threshold / diff-coverage gate? +4. **Codecov onboarding** — confirm the Codecov GitHub app is enabled for the org, and whether a + `CODECOV_TOKEN` secret is needed for fork PRs. diff --git a/doc/dependency_preparation.md b/doc/dependency_preparation.md new file mode 100644 index 000000000..6056ecc06 --- /dev/null +++ b/doc/dependency_preparation.md @@ -0,0 +1,56 @@ +# Dependency Preparation + +Run the repository preparation script after a fresh clone, submodule update, or +`git clean -fdx`: + +```bash +bash sh_script/preparation.sh +``` + +## Why the script patches `ring` + +Both `td-shim` and `spdm-rs` contain a `ring` submodule based on ring 0.17.14, +commit `2723abbca`. When they are built independently, each subproject prepares +its own copy. The MigTD workspace instead resolves every crates.io `ring` +dependency to the td-shim copy: + +```toml +[patch.crates-io] +ring = { path = "deps/td-shim/library/ring" } +``` + +Consequently, spdm-rs's own `[patch.crates-io]` entry for +`deps/spdm-rs/external/ring` does not select that copy during a top-level MigTD +build. The SPDM-specific changes must be applied to +`deps/td-shim/library/ring`, which is the copy Cargo compiles. + +Preparation happens in this order: + +1. `deps/td-shim/sh_script/preparation.sh` resets td-shim's ring and applies + its `x86_64-unknown-none` and CPU-feature patches. +2. MigTD applies spdm-rs patches `0003` and `0004` to that same ring tree. +3. `deps/spdm-rs/sh_script/pre-build.sh` prepares spdm-rs and its standalone + ring copy. + +The SPDM patches add APIs required to preserve intermediate SPDM context: + +- `EphemeralPrivateKey::export_private_key_bytes` and + `EphemeralPrivateKey::from_private_key_bytes` preserve an in-progress DHE + key exchange. +- `digest::Context::to_bytes` and `digest::Context::from_bytes` preserve + in-progress transcript hashes. + +Without these APIs, builds using `spdm_attestation` fail because spdmlib calls +methods absent from the selected ring source. + +## Why a ring upgrade does not remove the patches + +The serialization APIs are downstream spdm-rs extensions, not APIs in ring +0.17.14 or the upstream development branch. In particular, exporting an +ephemeral private key and serializing digest implementation state do not +naturally fit ring's public abstractions. + +Removing these preparation steps therefore requires either upstream support, +a single maintained ring fork shared by td-shim and spdm-rs, or an spdm-rs +checkpoint design that uses only upstream ring APIs. Merely changing the ring +version is not sufficient. diff --git a/doc/integration_test.md b/doc/integration_test.md index 117673399..02a63c35b 100644 --- a/doc/integration_test.md +++ b/doc/integration_test.md @@ -6,6 +6,11 @@ git clone https://github.com/intel/MigTD.git git submodule update --init --recursive ./sh_script/preparation.sh ``` + +The preparation step patches the ring source selected by the MigTD workspace. +See [Dependency Preparation](dependency_preparation.md) for why this is +required. + ## Setup pytest environment Please use recommend configuration in [integration_test.py](../sh_script/test/integration_test.py). diff --git a/doc/integration_test_azure_tip.md b/doc/integration_test_azure_tip.md new file mode 100644 index 000000000..9e7fb00a1 --- /dev/null +++ b/doc/integration_test_azure_tip.md @@ -0,0 +1,269 @@ +# Azure MigTD Integration Test (TiP) — Design + +Status: Draft · Scope: per-PR validation of MigTD changes on real Azure TDX +hardware. Self-contained: built and tested with MigTD-native tooling only. + +## 1. Goal + +Gate every MigTD change with a real source⇄destination TD **live migration** on a +TDX host. Build the MigTD IGVM and its measurement hash with MigTD tooling, then +drive a loopback migration through the host's HCS/VMM interfaces and assert the +outcome (accept, reject, real-policy, rebind). + +The images built here use the same names the **Azure OS PR gate** consumes +prebuilt from the `TDX_LM_IGVM_Binaries` vpack +(`test-migtd-{accept-all,reject-all,getquote-all}.igvm` + `.hash`), so a MigTD +change can be validated with source-built binaries before they ship as a vpack. +Production signing/release is out of scope — the test needs a functional image +and its hash, not a signed release. + +## 2. Prerequisites + +### 2.1 Build host (Linux, e.g. Ubuntu 22.04) + +- Rust **1.88.0** with `rust-src` and the `x86_64-unknown-none` target. +- Authenticated cargo access to the private `ms-crates-io` feed (msrustup token); + without it `cargo` fails with `Interactive operation required`. +- Build packages: `build-essential ocaml ocamlbuild wget pkg-config libtool unzip + clang llvm nasm jq openssl libssl-dev git cmake perl python-is-python3`. +- Submodules initialized (handled by `./sh_script/preparation.sh`). +- Optional: outbound access to Azure THIM for `--fetch-collaterals` (fresh + platform/QE collateral); otherwise the committed collateral is used. + +### 2.2 TDX lab blade (Windows TDX host) + +- TDX-capable Hyper-V host (e.g. `DC*es_v6`-class) with the **TDX module** + installed and host OS/VMM exposing the required **GHCI** APIs. +- **Test Secure Firmware** (`secfw_test_GenuineIntel.dll`) in + `C:\Windows\System32` with `HKLM\SYSTEM\CurrentControlSet\Control\Hypervisor\ + SecFwFile` set → **reboot** required (one-time). +- TDX-LM velocity feature **`53058573`** enabled. +- Live migration enabled: `Enable-VMMigration`, Kerberos auth, + `Enable-LoopbackMigration` (one-time `Initialize-TdxLmMachine`). +- PowerShell modules available: **PowerTest** (`TdxLiveMigrationUtilities.psm1`), + **Hyper-V**, **HCSTest** (v2). +- **Elevated PowerShell 7**; free disk for the TD's VMGS/VHD. + +## 3. Build & policy (MigTD-native) + +`sh_script/Azure/tip/build_tip_package.sh` performs, per variant: + +1. `./sh_script/preparation.sh` — submodules + build prep. +2. For regular variants, generate the signed policy + issuer chain with + `sh_script/Azure/build_azure_mock_test.sh --skip-test [--allow-all|--reject| + <default real>] [--fetch-collaterals]` → + `config/Azure/policy_v2_signed.json` + `config/Azure/policy_issuer_chain.pem`. +3. Build regular IGVMs with: + `cargo image --policy-v2 --debug --image-format igvm --no-default-features + --features vmcall-raw,stack-guard,main,vmcall-interrupt,oneshot-apic, + spdm_attestation,igvm-attest --policy-issuer-chain <chain> --policy <policy> + --output <image>` (add `test-get-quote` for the getquote variant). + Build `_mock_quote` variants through the matching targets in + `sh_script/Azure/Makefile`; these replace `igvm-attest` with + `use-mock-quote`. +4. Compute the host prebind hash: + `migtd-hash --manifest config/Azure/servtd_info.json --image <image> + --policy-v2`. The tool prints an `MRTD Hash: …` line first, then the 48-byte + **SERVTD_INFO_HASH** as the last line. That final 96-char hex is written to + `<image>.hash`; Hyper-V passes it directly to `TDH.SERVTD.PREBIND`. + `--calc-servtd-hash` must not be used here because it produces the distinct + outer TDREPORT `SERVTD_HASH`. +5. Bundle PowerTest, HCSTest PowerShell v2 source, and TDX live-migration test + source from `--os-root`. This source package does not require Linux access + to `\\winbuilds`. On Windows, `Publish-TipPackage.ps1` resolves the selected + build's `<archflavor>\test_automation_bins`, adds HCSTest's + `coreclr\Microsoft.HostCompute.Test.PowerShell.v2.dll`, VmgsTool, and test + Secure Firmware, validates the result, and copies it to the lab destination. + +No dummy/base rebuild and no production signing are needed: the policy is built +from the `config/Azure/` templates (measurements via `azcvm-extract-report`) and +signed with a local test key by `build_azure_mock_test.sh`. + +## 4. Package contents + +`out/tip-package/` (≈7.4 MB per IGVM, debug build): + +| File | Variant / role | +|------|----------------| +| `test-migtd-accept-all.igvm` + `.hash` | allow-all policy → migration **succeeds** | +| `test-migtd-reject-all.igvm` + `.hash` | bad-FMSPC (`DEADBEEF0000`) → migration **rejected** | +| `test-migtd.igvm` + `.hash` | real `config/Azure/policy_data_raw.json` (FMSPC `90C06F000000`) → succeeds iff node FMSPC/TCB match (MigTD-only extra) | +| `test-migtd_rebind.igvm` + `.hash` | same real policy/signing key with `policySvn` incremented by one | +| `test-migtd_key_rotation.igvm` + `.hash` | same real policy SVN/root/leaf Subject Name with a new policy leaf key | +| `test-migtd-getquote-all.igvm` + `.hash` | GetQuote initialization image | +| `test-migtd-accept-all_mock_quote.igvm` + `.hash` | allow-all policy with `use-mock-quote`; no host GetQuote agent required | +| `test-migtd-reject-all_mock_quote.igvm` + `.hash` | reject policy with `use-mock-quote` | +| `test-migtd_mock_quote.igvm` + `.hash` | policy generated from mock measurements with `use-mock-quote` | +| `test-migtd_mock_quote_rebind.igvm` + `.hash` | same mock-quote real policy/signing key with `policySvn` incremented by one | +| `test-migtd_mock_quote_key_rotation.igvm` + `.hash` | mock-quote counterpart with the rotated policy leaf key | +| `test-migtd{,_rebind,_key_rotation,_mock_quote,_mock_quote_rebind,_mock_quote_key_rotation}.policy.json` | signed policy snapshots embedded in the real-policy images | +| `Invoke-TdxLmLoopback.ps1`, `Run-TipTests.ps1`, `README.md` | migration test scripts | +| `Test-TdxMigTdStartupRequests.ps1` | validate startup `EnableLogArea` and an explicit post-start `GetTDReport` health-check query through HCS and GHCI VDev ETW; optionally validate GetQuote | +| `Test-TdxServTdExtPrebind.ps1` | validates both prebound ServTdExt hash slots and reserved zero ranges after target startup | +| `Test-TdxLmRebind.ps1` | rebinds a running TD between two same- or different-image MigTD instances | +| `Publish-TipPackage.ps1` | enriches a source package using a selected winbuild | +| `Install-TipDependencies.ps1` | installs bundled modules, VmgsTool, and optional test SecFw on the blade | +| `troubleshooting/Invoke-GhciVDevDiagnosticCapture.ps1` | captures a focused `Microsoft.Windows.HyperV.GhciVDev` ETL around one repro | +| `troubleshooting/Export-GhciVDevEvents.ps1` | exports raw and provider-filtered GHCI VDev events from an ETL | +| `troubleshooting/Export-MigTdMigrationTimeline.ps1` | emits normalized VMMS/Worker/VID/GHCI CSV, CLIXML, and text timelines | +| `troubleshooting/Compare-MigTdNodeTraces.ps1` | correlates source and destination timelines around a migration request | +| `troubleshooting/Get-MigTdDeploymentProvenance.ps1` | records host build, source revisions, artifacts, mappings, and HCS state | +| `troubleshooting/Test-CrossNodeMigTdBinding.ps1` | preflights the destination MigTD hash mapping and running HCS instance | +| `dependencies/Source` | OS-source PowerTest, HCSTest v2, and TDX live-migration scripts | +| `dependencies/PowerTest`, `dependencies/HCSTest` | installable host modules | +| `dependencies/Tools/VmgsTool.exe` | build-matched VMGS tool | +| `dependencies/SecFw` | optional build-matched `secfw_test_GenuineIntel.dll` | + +## 5. Manual lab-blade test + +Build on the Linux host: + +```bash +./sh_script/Azure/tip/build_tip_package.sh \ + --out out/tip-package \ + --os-root /path/to/os.2020 +# add --fetch-collaterals to refresh Azure THIM collateral for the real variant +# optional one-stage inputs: --hcstest-dir, --vmgstool-file, --secfw-file +``` + +On a Windows machine with winbuild and lab access: + +```powershell +.\Publish-TipPackage.ps1 ` + -PackageDir C:\staging\tip-package ` + -WinBuildRoot \\winbuilds\release\<branch>\<build> ` + -ArchFlavor amd64fre ` + -SecFwFile \\winbuilds\...\secfw_test_GenuineIntel.dll ` + -Destination \\labblade\share\tip-package ` + -Force +``` + +Then use an **elevated PowerShell 7** process on the TDX lab blade: + +```powershell +# one-time dependency install and host prep; reboot if requested +.\Run-TipTests.ps1 -InstallDependencies -ConfigureHost + +# default agent-independent migration + ServTdExt tests +.\Run-TipTests.ps1 + +# optionally add regular IGVMAgent-dependent cases +.\Run-TipTests.ps1 -IncludeAgentCases + +# or a single case +.\Invoke-TdxLmLoopback.ps1 -IgvmFilePath .\test-migtd-accept-all.igvm -PowerTestPath C:\path\to\PowerTest +.\Invoke-TdxLmLoopback.ps1 -IgvmFilePath .\test-migtd-reject-all.igvm -ExpectReject -PowerTestPath C:\path\to\PowerTest + +# fully IGVMAgent-independent smoke test +.\Invoke-TdxLmLoopback.ps1 ` + -IgvmFilePath .\test-migtd-accept-all_mock_quote.igvm ` + -NoPersistentSecrets + +# validate prebind ServTdExt without Move-VM +.\Test-TdxServTdExtPrebind.ps1 ` + -IgvmFilePath .\test-migtd-accept-all_mock_quote.igvm ` + -NoPersistentSecrets + +# rebind between different or identical MigTD images +.\Test-TdxLmRebind.ps1 ` + -OldIgvmFilePath .\test-migtd_mock_quote.igvm ` + -NewIgvmFilePath .\test-migtd_mock_quote_rebind.igvm +``` + +Policy leaf-key rotation is tested in both directions at the same policy SVN: + +```powershell +.\Test-TdxLmRebind.ps1 ` + -OldIgvmFilePath .\test-migtd_mock_quote.igvm ` + -NewIgvmFilePath .\test-migtd_mock_quote_key_rotation.igvm +.\Test-TdxLmRebind.ps1 ` + -OldIgvmFilePath .\test-migtd_mock_quote_key_rotation.igvm ` + -NewIgvmFilePath .\test-migtd_mock_quote.igvm +``` + +For both real-quote and mock-quote real-policy images, the builder creates an +original/rebind pair with a common policy signer. The rebind policy copies the +fully merged original `policyData` and changes only `policySvn`, incrementing +it by one. The real-quote pair maps the final image's measured +MRTD/RTMR0/RTMR1. The mock-quote pair retains the static mock measurements; +both migration and rebinding derive MigTD TCB metadata from the mock quote +instead of matching the live TDREPORT. The signed `.policy.json` snapshots +allow this relationship to be checked without extracting the IGVM firmware +volume. Each final image hash is calculated independently; equal hashes are +handled by the test's synthetic second mapping key. + +The key-rotation images keep `policySvn` equal to the baseline so A→B and B→A +both satisfy policy SVN ordering. Only the outer policy-signing leaf changes: +the new leaf has a different key, the same Subject Name, and the identical root +CA. Embedded TD identity and TCB mapping collateral retain the original signer. +Each policy independently maps its own image measurements. Once the peer policy +and its embedded mapping/identity chains pass the same-root and same-leaf- +Subject-Name checks, the peer's signed TCB mapping supplies its MigTD SVN and +identity; the destination does not require those measurements in its local +mapping. This permits migration and rebinding back and forth while a new +policy-signing leaf is rolled out, without rebuilding the older image. + +ServTdExt still binds init TDINFO, while the authenticated source +MROWNER/MROWNERCONFIG comparison enforces a matching policy signer and +`Source policySvn >= INIT policySvn`. The removed local TCB-mapping lookup only +tested whether the destination already knew the init measurements; its returned +engine SVN was unused. Current `REVERT_ME` test builds log some owner-binding +failures instead of aborting, so production must restore those checks as hard +failures for the SVN invariant to be strict. +The default `Run-TipTests.ps1` suite runs both mock-quote directions; +`-IncludeAgentCases` adds both regular-quote directions. + +Each case performs: `New-TestHcsMigTd → Start-HcsSystem → +Add-VmHostMigrationTdMapping -MigTdHash <hash> -VmId → +Set-VMHostMigrationPolicy DisabledByDefault <hash> → +New-VM -GuestStateIsolation TDX → +Set-VmMigratablePolicy EnabledIfHostPermits → +Update-VmMigrationPolicy → Start-VM → +Move-VM -DestinationHost localhost`, asserts the result, then cleans up +while leaving the host policy `DisabledByDefault` before removing the mapping +and VM. This policy sequence is shared by migration, expected-rejection, +ServTdExt prebind, and rebind tests. Key VM settings: HCS schema 2.1, VM version +12.5, 1 vCPU, 512 MB. + +## 6. Test cases + +1. **startup and health-check WaitForRequest** → starting MigTD must produce + `EnableLogAreaRequest_Success` and `InternalGetReport_TdInfoCached`. The test + then submits an explicit HCS `MigTdReport` query with a random REPORTDATA + nonce and requires `CreateMigTdGetReportRequest` plus + `GetTdReportRequest_Success`. It validates the nonce echo, TDREPORT internal + hashes, and the image's expected TD Info Hash. +2. **accept-all** → migration succeeds. +3. **reject-all** → migration rejected. +4. **real policy** → succeeds when the node's FMSPC/TCB match `policy_data_raw.json`; + `policy_reject_data_raw.json` is the negative twin. +5. **getquote-all** → exercises initialization GetQuote and requires Worker + Analytic event 18670 when `-IncludeAgentCases` is set. +6. **mock-quote variants** → exercise migration without host GHCI GetQuote; + combine with `-NoPersistentSecrets` to avoid all IGVMAgent calls. +7. **ServTdExt prebind** → after target startup, verify the 272-byte runtime + extension contains the expected hash at offsets 0 and 112 with zero + attributes/reserved ranges. +8. **rebind** → bind a running TD to the first MigTD, register a second MigTD, + and invoke `UpgradeMigrationPolicy`. The two inputs may have different + hashes or the same hash; same-hash tests use a synthetic second mapping key + while verifying that the partition retains the real IGVM measurement. +9. **WaitForRequest coverage matrix** → operations 1–4 are exercised on the + real host. Operation 5 (`GetMigtdData`) remains reported as unavailable: + current Host OS `GhciRequestOperation` exposes only operations 1–4 and has + no PowerShell/HCS trigger for operation 5. +10. **cycle** → repeat a case N times. + +`TdxLiveMigrationUtilities.psm1` provides the host interfaces; reuse is optional — +any driver hitting the same HCS/VMM cmdlets works. + +## 7. CI & open items + +A self-hosted TDX agent can run the same build → register → migrate → assert → +cleanup flow per PR, publishing the IGVMs, `.hash` files, and migration logs; +the same artifacts can later promote into the `TDX_LM_IGVM_Binaries` vpack. + +Open: provision the self-hosted TDX agent; collateral refresh cadence; optional +release-mode (non-debug) build. The QEMU/vsock/serial flow in +`doc/integration_test.md` stays out of scope (Azure uses the `vmcall-raw` +transport). diff --git a/doc/policy_v2.md b/doc/policy_v2.md index 32e894d62..7fafd97ed 100644 --- a/doc/policy_v2.md +++ b/doc/policy_v2.md @@ -60,6 +60,10 @@ cargo build -p migtd-policy-generator -o policy_v2.json ``` +For CoRIM-only enrollment, omit `--servtd-collateral` and pass +`--servtd-crl /path/to/servtd_signer_crl.pem`; the CRL is stored as measured +top-level `servtdCrl` and applies to the separately enrolled CoRIM `x5chain`. + Sign the policy: ```sh @@ -113,17 +117,29 @@ cargo build popd ``` -### Generate new measurement with updated TCB mapping +### Generate new measurement with cumulative TCB mapping + +Use the previous release's authority-maintained mapping signing payload as the +history source. `config/templates/tcb_mapping_seed.json` is only a +first-release seed. + ``` ./target/debug/migtd-hash --manifest config/servtd_info.json \ --image target/release/migtd.bin \ --policy-v2 \ - --update-tcb-mapping config/templates/tcb_mapping.json + --update-tcb-mapping release-N-1/tcb_mapping.json \ + --output-tcb-mapping release-N/tcb_mapping.json \ + --mapping-isvsvn <release-N-isvsvn> ``` +The updater preserves historical hashes, replaces the current hash by key, +rejects conflicting duplicates, and sorts entries deterministically before +signing. Remove an unsupported release only with the reviewed +`--revoke-tdinfo-hash <hash>` operation. + ### Resign policy with generated keys ``` -bash sh_script/build_policy_v2.sh [preprod/prod] +bash sh_script/build_policy_v2.sh [preprod/prod] release-N/tcb_mapping.json ``` ### Rebuild migtd with new policy ``` diff --git a/doc/policy_v2_measurements.md b/doc/policy_v2_measurements.md new file mode 100644 index 000000000..71b5a6a8f --- /dev/null +++ b/doc/policy_v2_measurements.md @@ -0,0 +1,451 @@ +# MigTD Policy v2 — MRTD / RTMR Measurements (`build-igvm-get-quote`) + +This document summarizes exactly **what is measured into `MRTD` and `RTMR0`–`RTMR3`** +for a MigTD image produced by the `build-igvm-get-quote` target in +[`sh_script/Azure/Makefile`](../sh_script/Azure/Makefile) — i.e. the regular +**Azure** build (IGVM format) with **Policy v2** and real Intel `GetQuote` attestation. + +For each register it describes the measured artifact, *who* measures it +(TDX module, td-shim firmware, or the MigTD runtime), *when*, the hashing +algorithm, and reference / reproduction values. + +> The equivalent **non-IGVM (TDVF `.bin`) Linux build** — `cargo image` without +> `--image-format igvm` — is covered in [§7](#7-the-linux-non-igvm-tdvf-bin-build): +> only the **MRTD derivation** differs; **RTMR0–RTMR3 are identical**. + +--- + +## 1. The build target + +```make +IGVM_FEATURES_BASE = vmcall-raw,stack-guard,main,vmcall-interrupt,oneshot-apic,spdm_attestation +IGVM_FEATURES_GET_QUOTE = $(IGVM_FEATURES_BASE),igvm-attest + +build-igvm-get-quote: + cargo image --no-default-features --features $(IGVM_FEATURES_GET_QUOTE) ... \ + --image-format igvm --output target/release/migtd.igvm --debug \ + --policy-v2 --policy config/templates/policy_v2_signed.json \ + --policy-issuer-chain config/templates/policy_issuer_chain.pem \ + --root-ca config/Intel_SGX_Provisioning_Certification_RootCA_preproduction.cer +``` + +`generate-hash-get-quote` then runs the reference tool +`migtd-hash --policy-v2 --manifest config/Azure/servtd_info.json` to reproduce the +register values offline (see §6). + +### What `--policy-v2` enrolls into the image (CFV) + +The build runs `td-shim-enroll` to place two raw files into the **Configuration +Firmware Volume (CFV)** (see `xtask/src/build.rs:267`): + +| CFV file (FFS GUID) | Content | +| ----------------------------------------------------- | -------------------------------- | +| `0BE92DC3-…-8EEFFD70DE5A` (`MIGTD_POLICY_FFS_GUID`) | `policy_v2_signed.json` | +| `3F2FB27A-…-D3EAB39F8AEB` (`MIGTD_POLICY_ISSUER_CHAIN`) | `policy_issuer_chain.pem` | + +> Note: in Policy v2 the **root CA is *not* enrolled** (the `--root-ca` argument is +> ignored — it is only used by the v1 path). The SGX root CA is delivered at runtime +> through the policy *collaterals* instead, so it is **not** measured into any RTMR. + +--- + +## 2. Measurement model + +A TDX `TDREPORT.TD_INFO` exposes one static register and four runtime registers, +all **SHA-384 (48 bytes)**: + +- **`MRTD`** — build-time measurement of the initial TD memory, finalized by the + **TDX module** at `TDH.MR.FINALIZE` (before the guest runs). It is *not* + runtime-extendable. +- **`RTMR0`–`RTMR3`** — runtime registers extended by guest software via + `TDG.MR.RTMR.EXTEND`. Every extension is also appended to the TDX event log + (CCEL / `TDEL`) so a verifier can replay it. + +**RTMR extend formula** (one event): + +``` +RTMR_new = SHA384( RTMR_old(48B) || SHA384(event_data) ) +``` + +**Event-log `mr_index` → register** mapping used throughout MigTD +(`src/migtd/src/event_log.rs:164`): + +| `mr_index` | 1 | 2 | 3 | 4 | +| ---------- | ----- | ----- | ----- | ----- | +| register | RTMR0 | RTMR1 | RTMR2 | RTMR3 | + +MigTD fills the registers in two stages: + +1. **td-shim firmware** runs first and writes only an `EV_SEPARATOR` into RTMR0/RTMR1. +2. **MigTD core** (`main.rs::do_measurements`, gated by the `policy_v2` feature) + then extends RTMR1 and RTMR2. + +--- + +## 3. Summary + +| Register | Measured content (Policy v2) | Measured by | Stage | +| -------- | ------------------------------------------------------------------------ | ------------------ | --------- | +| `MRTD` | Initial TD image: **td-shim BFV** + **MigTD core Payload** page contents, plus the GPAs of all added private pages. (CFV content **excluded**.) | TDX module (static) | TD build | +| `RTMR0` | One `EV_SEPARATOR` event (`u32` `0x0000_0000`). Nothing else. | td-shim firmware | Boot | +| `RTMR1` | `EV_SEPARATOR`, **then the policy issuer chain** (`policy_issuer_chain.pem`). | td-shim, then MigTD | Boot | +| `RTMR2` | **The migration policy** (`policy_v2_signed.json`). No root CA in v2. | MigTD core | Boot | +| `RTMR3` | *Nothing* — stays all-zero. | — | — | + +--- + +## 4. Per-register detail + +### MRTD — the MigTD firmware identity + +The TDX module measures every private page the VMM adds before launch. The +reference tool reproduces this from the IGVM file +(`TdInfoStruct::build_igvmmrtd`, `deps/td-shim/td-shim-tools/src/tee_info_hash.rs:376`): + +- For **each** non-shared page → `TDH.MEM.PAGE.ADD`: the page **GPA** is hashed + (a 128-byte `"MEM.PAGE.ADD"` + GPA buffer). +- For each **measured** page (not flagged "unmeasured") → `TDH.MR.EXTEND`: the page + **content** is hashed 256 bytes at a time. + +Which sections are content-extended is driven by `config/metadata.json` +(`Attributes = 0x1` ⇒ `PAGE.ADD + MR.EXTEND`): + +| Section | Attributes | In MRTD? | +| --------- | ---------- | ----------------------------------------- | +| `BFV` | `0x1` | ✅ GPA **and** content (td-shim firmware) | +| `Payload` | `0x1` | ✅ GPA **and** content (MigTD core binary) | +| `CFV` | `0x0` | ⚠️ GPA only — **content not extended** | +| `TempMem` | `0x0` | GPA only (pre-added zero pages) | +| `PermMem` | `0x2` | ❌ not measured (PAGE.AUG — accepted dynamically after launch) | + +**Consequence:** `MRTD` is the identity of the td-shim firmware + the MigTD core +code and its fixed memory layout. Because the CFV **content** is excluded, changing +the policy or issuer chain does **not** change `MRTD`. + +### RTMR0 — firmware separator only + +td-shim calls `create_seperator()`, which extends **RTMR0 and RTMR1** with the +digest of the 4-byte value `0x0000_0000` +(`deps/td-shim/cc-measurement/src/log.rs:58`). For MigTD nothing else reaches RTMR0: + +- The TD-HOB is logged into RTMR0 *only if* td-shim consumes one + (`main.rs:131`). MigTD uses a pre-allocated `PermMem` region and consumes no + TD-HOB, so this is skipped. +- The payload binary is *not* re-measured into an RTMR (`payload_extend_rtmr` is + false — the payload is already covered by `MRTD`). + +`RTMR0` is therefore a **constant** for every MigTD build: + +``` +RTMR0 = SHA384( 0x00*48 || SHA384(0x00000000) ) + = 518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4 +``` + +(verified against `config/templates/tcb_mapping.json`). + +### RTMR1 — separator + policy issuer chain + +After the firmware separator, the MigTD core measures the **policy issuer chain** +read from the CFV (`get_policy_issuer_chain_and_measure`, `src/migtd/src/bin/migtd/main.rs:312`) +into `mr_index = 2` (RTMR1), tagged `POLICY_ISSUER_CHAIN`: + +``` +RTMR1 = SHA384( RTMR0_separator(48B) || SHA384(policy_issuer_chain.pem) ) +``` + +This step exists **only** under the `policy_v2` feature. + +### RTMR2 — migration policy + +The MigTD core measures the **migration policy** read from the CFV +(`get_policy_and_measure`, `src/migtd/src/bin/migtd/main.rs:262`) into +`mr_index = 3` (RTMR2), tagged `POLICY`. RTMR2 starts from zero (no separator): + +``` +RTMR2 = SHA384( 0x00*48 || SHA384(policy_v2_signed.json) ) +``` + +> The bytes **extended** are the full signed policy file. The event-log *payload* +> for this entry is just the policy SVN/version string, but the RTMR digest is over +> the whole policy. +> In Policy v1 the root CA would also be extended into RTMR2; in v2 it is not. + +### RTMR3 — unused + +No MigTD measurement targets `mr_index = 4`. `RTMR3` remains all-zero +(`00…00`) in the normal Policy v2 flow. +(The `test_disable_ra_and_accept_all` debug feature is **not** part of this target.) + +--- + +## 5. Reference values for this target + +`RTMR0` is constant. `RTMR1`/`RTMR2` depend on the exact bytes of the enrolled +files, so they are shown here as reproduced from the current +`config/templates/*` artifacts (regenerate whenever the policy or issuer chain +changes): + +| Register | Value | +| -------- | -------------------------------------------------------------------------------------------------- | +| `RTMR0` | `518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4` | +| `RTMR1` | `279EB652F7D7B7D15EA1E593B29EEEB20C6AFD33BE432C66A7B237107A00F5276919AEF490A8DC000886552F79748B0F` | +| `RTMR2` | `07AF01E95CEFCDC4885A5DC5C5BB1CBE05913FD9486BCD1141C195C3C399939D5127F9E0D5F2F0E09D62B571B562EC36` | +| `RTMR3` | `000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000` | +| `MRTD` | build-specific (measures the firmware image; e.g. `E2C7DA7C…` in the committed template). | + +> ⚠️ The `rtmr0`/`rtmr1` placeholders committed in `config/templates/tcb_mapping.json` +> are both `518923B0…`. That is only the firmware-separator stage; the live +> `RTMR1` of a Policy v2 TD additionally includes the issuer chain (as shown above) +> and is what `TdTcbMapping::get_engine_svn_by_report` compares against the TDREPORT +> (`src/policy/src/v2/servtd_collateral.rs:192`). Regenerate the mapping with +> `migtd-hash --policy-v2` before signing a deployable policy. + +The non-register `TD_INFO` fields (`ATTRIBUTES`, `XFAM`, `MRCONFIGID`, `MROWNER`, +`MROWNERCONFIG`) come from the manifest `config/Azure/servtd_info.json`, not from +the measured registers. + +--- + +## 6. Reproducing the values + +```sh +# Build the image (writes target/release/migtd.igvm) +make -C sh_script/Azure build-igvm-get-quote + +# Print MRTD + RTMR0..3 from the image and CFV +cargo run -p migtd-hash -- \ + --image target/release/migtd.igvm \ + --manifest config/Azure/servtd_info.json \ + --policy-v2 --verbose +``` + +The tool's `build_td_info` (`tools/migtd-hash/src/lib.rs:37`) implements exactly the +flow above: `build_igvmmrtd` (MRTD), `build_rtmr_with_seperator(0)` (RTMR0/RTMR1 +seed), then `rtmr1()` (+ issuer chain) and `rtmr2()` (policy) for Policy v2. + +--- + +## 7. The Linux non-IGVM (TDVF `.bin`) build + +The standard Linux / KVM build produces a **TDVF flat image** `target/release/migtd.bin` +instead of an IGVM file — `cargo image` defaults to `--image-format tdvf` +(`xtask/src/build.rs:19,439`): + +```sh +# Non-IGVM build (default format = tdvf) -> target/release/migtd.bin +cargo image --policy-v2 \ + --policy config/templates/policy_v2_signed.json \ + --policy-issuer-chain config/templates/policy_issuer_chain.pem + +# Reproduce MRTD + RTMR0..3 (the .bin extension auto-selects the TDVF path) +cargo hash --image target/release/migtd.bin --policy-v2 +``` + +(`cargo image` / `cargo hash` are aliases for `xtask image` / `xtask hash`; +`hash` supports the same `--policy-v2` flag — `xtask/src/servtd_info_hash.rs:50`.) + +### What changes vs the IGVM build + +| Register | TDVF `.bin` build | Same value as IGVM? | +| ------------- | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------- | +| `MRTD` | Derived by `TdInfoStruct::build_mrtd` — walks the OVMF GUID table / TDVF metadata in the 16 MB image and replays `TDH.MEM.PAGE.ADD` / `TDH.MR.EXTEND` per `config/metadata.json` | **Derivation differs** — see below | +| `RTMR0` | separator only | ✅ identical (`518923B0…`) | +| `RTMR1` | separator + policy issuer chain | ✅ identical (same `policy_issuer_chain.pem`) | +| `RTMR2` | policy | ✅ identical (same `policy_v2_signed.json`) | +| `RTMR3` | all-zero | ✅ identical | + +- **RTMR0–RTMR3 are unchanged.** The firmware separator, the runtime + `do_measurements` flow, and the CFV content (policy + issuer chain, enrolled + identically by `td-shim-enroll`) are all image-format-independent. In the `.bin` + the CFV is simply the first `TD_SHIM_CONFIG_SIZE` bytes, which the reference tool + reads directly instead of de-duplicating IGVM pages + (`tools/migtd-hash/src/lib.rs:66`). So the §5 values for RTMR0–RTMR3 apply + verbatim to the non-IGVM build. +- **MRTD is the only difference — and it is structural, not content.** For a given + feature set the BFV (td-shim) and Payload (MigTD core) are the *same compiled + binaries* in both formats; only `td-shim-ld -i <format>` (`xtask/src/build.rs:246`) + packages them differently. `MRTD` is a single SHA-384 over an **ordered** stream of + per-page `TDH.MEM.PAGE.ADD` / `TDH.MR.EXTEND` records (each carries the page GPA, + and for extended pages the 256-byte content). The two formats feed that stream in a + **different order**: + - TDVF `build_mrtd` replays `config/metadata.json` sections in order: + **BFV → Payload → CFV → TempMem**. + - IGVM `build_igvmmrtd` replays the linker's `PageData` directives, emitted as + **CFV → mailbox → temp-stack → temp-heap → Payload → BFV** + (`deps/td-shim/td-shim-tools/src/linker.rs:429`, `build_igvm`). + + BFV is measured *first* under TDVF but *last* under IGVM, so even with byte-identical + firmware/payload content and identical GPAs the two digests differ. `build_td_info` + selects the algorithm from the file extension (`tools/migtd-hash/src/lib.rs:56`). + Always derive `MRTD` from the exact image you deploy. + +> There is no `build-igvm-get-quote` equivalent for `.bin` in `sh_script/Azure/Makefile` +> (that Makefile is IGVM-only). Use `cargo image --policy-v2 …` as shown above, or +> the general build helpers under `sh_script/` (e.g. `build_final.sh`). + +--- + +## 8. Design note: why the MigTD core is in MRTD, not RTMR1 + +A common assumption (true for *generic* td-shim / TDVF images) is: **MRTD measures +only the firmware, then the firmware loads the payload and extends it into RTMR1.** +**This is *not* how MigTD is configured** — for MigTD the core (Payload) is part of +`MRTD`, and td-shim does **not** extend any RTMR with it. + +### What MigTD does + +`config/metadata.json` marks **both** firmware and core sections with the `MR.EXTEND` +attribute `0x1`, so the **VMM / TDX module** measures both into `MRTD` via +`TDH.MEM.PAGE.ADD` + `TDH.MR.EXTEND` during TD build — *before* td-shim runs and +finalizes at `TDH.MR.FINALIZE`. (MRTD is produced by the host/TDX module, not by +td-shim; td-shim is itself one of the measured payloads, and so is the migtd core.) + +| Section | `Attributes` | Lands in | +| ---------------------- | ------------ | -------- | +| `BFV` (td-shim) | `0x1` | `MRTD` | +| `Payload` (MigTD core) | `0x1` | `MRTD` | + +### Why td-shim does not extend RTMR1 with the payload + +td-shim *supports* the "measure payload into RTMR1" behaviour — +`log_payload_binary()` extends the payload blob into `mr_index = 2` → **RTMR1** +(`deps/td-shim/td-shim/src/event_log.rs:76`; `mr_index 2 → RTMR1` via +`deps/td-shim/td-shim/src/bin/td-shim/td/tdx.rs:53`). But it is **gated** on the +payload *not* already being in MRTD (`deps/td-shim/td-shim/src/bin/td-shim/shim_info.rs:91`): + +```rust +// payload_extend_rtmr is true ONLY when the Payload section is not measured into MRTD +if section.r#type == TDX_METADATA_SECTION_TYPE_PAYLOAD && section.attributes == 0 { + payload_extend_rtmr = true; +} +``` + +MigTD's Payload attribute is `0x1` (not `0`), so `payload_extend_rtmr()` is **false** +and the RTMR1 extension is **skipped** — preventing the core from being measured +twice (`src/migtd/src/bin/migtd/main.rs` boot flow calls `log_payload_binary` only +under this flag). + +### Rationale + +1. **MigTD ships as one fixed image.** Firmware + core are bundled into a single + `migtd.bin` / `migtd.igvm`, fully known at build time and placed in guest memory + by the VMM before launch. Measuring the whole image into `MRTD` yields one + **static identity** for the complete MigTD. +2. **The RTMR1-payload model is for *separately-loaded* payloads.** The generic + td-shim path exists when the payload is a distinct, variable artifact loaded at + boot (e.g. a Linux kernel) and therefore absent from the launch image — it *must* + then be measured dynamically into an RTMR. MigTD has no such separation. +3. **It matches ServTD binding.** A user TD binds to MigTD by its measurement + (`SERVTD_HASH` derived from `TD_INFO`); a static `MRTD` that already pins the exact + core is the natural, immutable anchor, independent of runtime ordering. +4. **No double-counting.** The attribute gate guarantees the core is measured into + exactly one register (`MRTD`), never both. + +**Net:** for MigTD, `MRTD` = td-shim (BFV) **+** migtd core (Payload); `RTMR1` = +firmware separator (+ policy issuer chain at runtime under Policy v2). The core is +**never** in `RTMR1`. + +--- + +## 9. Experimental evidence: MRTD covers the MigTD core + +To confirm that the MigTD core (the `Payload` section) really is part of `MRTD` — and +that it is *not* in any RTMR — each image was built **twice** with a single +optimization-proof change to the core, and the registers were compared. The +experiment was run for **both** image formats: the standard KVM TDVF `.bin` build and +the regular Azure IGVM Policy v2 build (`build-igvm-get-quote`). + +**Environment** (both experiments) + +- Commit: `intel/main` @ `e29440454028ea5eab6180e21f521cb9d32e5db6` (clean tree; `HEAD == intel/main`) +- Toolchain: Rust `1.88.0` + +**The change** — identical for both — in the MigTD core, +`src/migtd/src/bin/migtd/main.rs`: + +```diff + fn basic_info() { ++ core::hint::black_box(0xA5A5_5A5A_DEAD_BEEFu64); // temporary marker, reverted after + info!("MigTD Version - {}\n", MIGTD_VERSION); + } +``` + +`core::hint::black_box` forces the constant into the compiled payload, so the core +binary differs by a few bytes while nothing else (firmware, CFV, layout) changes. +**A** = baseline (clean), **B** = with the change, **C** = change reverted. + +### 9.1 Standard KVM build (TDVF `.bin`) + +- Build: `cargo image` → `target/release/migtd.bin` +- Measure: `cargo run -p migtd-hash -- --image target/release/migtd.bin --manifest config/servtd_info.json --output-td-info <out>.json` + +| Build | MRTD | +| ----- | -------------------------------------------------------------------------------------------------- | +| **A** | `560703c6259a4efebf5dc13de6220e0ab2b2b85a838a441a38b0bc6971908d0211a4d0a0398fa440c7310cc5803f37d8` | +| **B** | `71956de175eca87f8b958a8ac283ea8bc45bbd638ecfe0d51818ad8989261912ad2f4eec3aac6974a48ebea14683beaf` | +| **C** | `560703c6259a4efebf5dc13de6220e0ab2b2b85a838a441a38b0bc6971908d0211a4d0a0398fa440c7310cc5803f37d8` | + +RTMRs — **identical** across A, B, C (this default build is the **v1** image, so +`rtmr1` is the separator only and `rtmr2` carries policy + root CA): + +``` +rtmr0 = 518923b0f955d08da077c96aaba522b9decede61c599cea6c41889cfbea4ae4d50529d96fe4d1afdafb65e7f95bf23c4 +rtmr1 = 518923b0f955d08da077c96aaba522b9decede61c599cea6c41889cfbea4ae4d50529d96fe4d1afdafb65e7f95bf23c4 +rtmr2 = 00738709463174735612b421f112c600a153ad659d54c1ffdfe58967904996a1ef1ed7d130acbee7ea861b70c15454f3 +rtmr3 = 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +``` + +### 9.2 Regular Azure build (IGVM, Policy v2) — `build-igvm-get-quote` + +- Build: `make -C sh_script/Azure build-igvm-get-quote` → `target/release/migtd.igvm` +- Measure: `cargo run -p migtd-hash -- --image target/release/migtd.igvm --manifest config/Azure/servtd_info.json --policy-v2 --output-td-info <out>.json` + +| Build | MRTD | +| ----- | -------------------------------------------------------------------------------------------------- | +| **A** | `582f87da119c826a56af55891450f8e26627114929b137d66b60d951f0b0297fca81421d3818f720852257e790ed5a76` | +| **B** | `c359d539c5e758f6a28b973bc11d2014bc327103a808c699917c2fafe7dc9cd994c1cac7d25a602ec30817a1915bc4b1` | +| **C** | `582f87da119c826a56af55891450f8e26627114929b137d66b60d951f0b0297fca81421d3818f720852257e790ed5a76` | + +RTMRs — **identical** across A, B, C. This is the **Policy v2** image, so `rtmr1` +carries the issuer chain and `rtmr2` the policy — and these match the reference values +computed in §5: + +``` +rtmr0 = 518923b0f955d08da077c96aaba522b9decede61c599cea6c41889cfbea4ae4d50529d96fe4d1afdafb65e7f95bf23c4 +rtmr1 = 279eb652f7d7b7d15ea1e593b29eeeb20c6afd33be432c66a7b237107a00f5276919aef490a8dc000886552f79748b0f +rtmr2 = 07af01e95cefcdc4885a5dc5c5bb1cbe05913fd9486bcd1141c195c3c399939d5127f9e0d5f2f0e09d62b571b562ec36 +rtmr3 = 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +``` + +### Conclusion (both builds) + +- **A ≠ B** — a one-line change to the MigTD core changes `MRTD` ⇒ **`MRTD` covers the + MigTD core (Payload)**, not just the td-shim firmware. Holds for the TDVF *and* the + Azure IGVM Policy v2 image. +- **RTMR0–3 unchanged between A and B** ⇒ the core is **not** measured into any RTMR — + the firmware does not extend the payload into RTMR1 (confirming §8). +- **A == C** — reverting restores the exact baseline `MRTD`, confirming the build is + deterministic and the difference was caused solely by the core change. +- The two formats yield **different** `MRTD` baselines (§7); note the `.bin` build here + is release+v1 and the IGVM build is debug+v2, so their absolute `MRTD` values are not + directly comparable — each experiment is self-contained (same format, A vs B). + +--- + +## 10. Source references + +| Concern | Location | +| ----------------------------- | -------------------------------------------------------------- | +| Build target / CFV enrollment | `sh_script/Azure/Makefile`, `xtask/src/build.rs:267` | +| MRTD (IGVM) computation | `deps/td-shim/td-shim-tools/src/tee_info_hash.rs:376` | +| MRTD (TDVF `.bin`) computation | `deps/td-shim/td-shim-tools/src/tee_info_hash.rs:196` | +| IGVM page emission order | `deps/td-shim/td-shim-tools/src/linker.rs:429` (`build_igvm`) | +| RTMR0/RTMR1 separator | `deps/td-shim/cc-measurement/src/log.rs:58` | +| Reference RTMR1/RTMR2 build | `tools/migtd-hash/src/lib.rs:123` (`rtmr1`/`rtmr2`) | +| MRTD format selection | `tools/migtd-hash/src/lib.rs:56` (`build_td_info`) | +| Runtime measurement flow | `src/migtd/src/bin/migtd/main.rs:184` (`do_measurements`, v2) | +| Core in MRTD (Payload attr) | `config/metadata.json` (`Payload` `Attributes 0x1`) | +| Payload→RTMR1 gate | `deps/td-shim/td-shim/src/bin/td-shim/shim_info.rs:91` (`payload_extend_rtmr`) | +| Payload→RTMR1 extension | `deps/td-shim/td-shim/src/event_log.rs:76` (`log_payload_binary`) | +| `mr_index` → RTMR mapping | `src/migtd/src/event_log.rs:164` (`extend_rtmr`) | +| TCB-mapping comparison | `src/policy/src/v2/servtd_collateral.rs:192` | diff --git a/doc/release.md b/doc/release.md index 0a1d1b01e..a30afce72 100644 --- a/doc/release.md +++ b/doc/release.md @@ -37,6 +37,25 @@ 5. Create branch `v<major>.<minor>`. 6. Upload the release content to branch `v<major>.<minor>`. +### Cumulative MigTD SVN mapping + +The prior release's `tcb_mapping.json` signing payload is the +authority-maintained source of truth for supported MigTD releases. Generate +the next mapping with +`migtd-hash --update-tcb-mapping <prior> --output-tcb-mapping <next> +--mapping-isvsvn <svn>` so the new `tdinfo_hash` is added without dropping +historical hashes. The tool canonicalizes ordering for reproducible signing +input and rejects conflicting duplicate hashes. + +Removing support is a separate reviewed revocation step: +`--revoke-tdinfo-hash <hash>`. Never create a release from +`tcb_mapping_seed.json` after the first release, and never remove an old +mapping by replacing array index zero. + +The Azure and AzCVMEmu policy builders accept +`--tcb-mapping <prior-release-file>` and reuse an existing output mapping by +default. + ## Release Test Feature: 1. Migration Flow diff --git a/doc/rtmr1_signer_anchor_proposal.md b/doc/rtmr1_signer_anchor_proposal.md new file mode 100644 index 000000000..180da4224 --- /dev/null +++ b/doc/rtmr1_signer_anchor_proposal.md @@ -0,0 +1,384 @@ +RTMR1 Signer-Anchor Measurement & servTD Signer Revocation +================================================ + +> This proposal has two coupled parts: (1) **what MigTD measures into RTMR1** — a +> stable *signer anchor* (root fingerprint + required leaf EKU) rather than the raw +> issuer-chain bytes, with MigTD-to-MigTD peer validation updated to enforce that same +> signer fingerprint — and (2) the **servTD signer-key revocation** control that mitigates +> the one security relaxation the anchor introduces. The RTMR2 / TCB-mapping +> circular-dependency work is covered separately in +> [tcb_mapping_design_proposal.md](./tcb_mapping_design_proposal.md); +> the anchor is the companion change called out there under *"RTMR1 signer anchor for +> key rotation"*. +> For the concrete current measurement values see +> [policy_v2_measurements.md](./policy_v2_measurements.md). + +# Current design — RTMR1 measures the raw issuer cert chain + +Today RTMR1 is, after the firmware boot separator, a **runtime extend over the raw +bytes of the policy issuer certificate chain** (`policy_issuer_chain.pem`), +loaded from the CFV slot `MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID`. The MigTD core measures +it at boot into `mr_index = 2` → RTMR1 (`get_policy_issuer_chain_and_measure`, +`src/migtd/src/bin/migtd/main.rs`; tag `TAGGED_EVENT_ID_POLICY_ISSUER_CHAIN`). The +offline reference tool reproduces it as `rtmr1()` in `tools/migtd-hash/src/lib.rs`. + +``` +RTMR1_1 = SHA384( 0x00*48 || SHA384(separator 0x00000000) ) (td-shim) +RTMR1_final = SHA384( RTMR1_1 || SHA384(issuer_chain_bytes) ) (MigTD core) + ▲ + └── the ENTIRE PEM chain, byte-for-byte +``` + +RTMR1 is part of `TDINFO`, so it folds into `tdinfo_hash = SHA384(TDINFO)` — the value +the TCB-mapping proposal uses as the `svnMappings` key and as the endorsed +`init/cur_servtd_info_hash`. + +**What the chain is actually for.** The chain establishes the *trust anchor* for the +policy signer (the signer whose chain RTMR1 measures; it signs `servtdTcbMapping`). At +runtime, MigTD-to-MigTD peer validation +(`validate_peer_cert_chain`, `src/crypto/src/lib.rs:290`) enforces only: + +1. the peer chain's internal signatures are valid, +2. **the root CA matches by DER byte comparison**, +3. **the leaf certificate Subject Name matches**, and +4. every issuer in the chain is a CA (non-CA issuers rejected). + +Note what the trust model does **not** require: an identical *leaf certificate* or an +identical *leaf public key*. Two MigTDs trust each other as long as they share the same +root CA and the same leaf Subject — the leaf key may differ. + +The trust model also **does not pin intermediate-CA identity**: intermediate cert contents +are not compared against the local chain's intermediates, so either side may rotate its +intermediate CA(s) independently — as long as the shared root and the leaf Subject stay +stable and every issuer in the chain is itself a CA (check 4). Intermediates are still +validated *structurally* — signature integrity (check 1) and the CA attribute (check 4) — +just not by identity. + +This rests on an **assumption about usage identity**: today the leaf's Subject Name is taken +to uniquely identify the intended usage for the product/model — distinct usages need distinct +Subjects. The proposal below makes that usage identity **explicit** as a dedicated Extended Key +Usage (EKU) OID and commits to it in both the RTMR1 anchor and the updated peer validation, +rather than relying on Subject-DN convention. + +``` + Runtime trust model (peer validation) RTMR1 measurement (today) + ─────────────────────────────────── ───────────────────────── + cares about: root DER + leaf Subject hashes: the WHOLE chain + ignores: leaf key, leaf cert bytes (every byte, incl. leaf key) + + ⇒ RTMR1 is far MORE sensitive than the trust model it encodes +``` + +# Problem 1: leaf-key rotation churns RTMR1 + +Issuers rotate the leaf signing key periodically (routine key rotation), issuing a new +leaf certificate under the *same root CA and same leaf Subject*. + +**Peer-to-peer attestation already supports this.** As described above, peer validation +keys on the root CA and leaf Subject — not the leaf key — so old- and new-key builds +interoperate in a rolling deployment (commit `2d238cf3`). + +**The attestation service does not.** Because RTMR1 hashes the *raw chain bytes*, the new +leaf changes RTMR1 → changes `tdinfo_hash`, so each rotation forces: + +- a new MigTD **build** (the rotated chain is baked into the measured image), and +- a new **endorsement** entry keyed on the new `tdinfo_hash`, published to the attestation + service so tenant TDs bound to the rotated MigTD still attest successfully. + +So a rotation the runtime treats as a no-op becomes a build-and-endorsement update the +attestation service must track — deployment complexity for a change that does not touch the +trust anchor. RTMR1 is measuring the wrong granularity: the leaf key, not the trust anchor. + +# Problem 2: regional leaf certificates fragment the RTMR1 measurement + +Independently of the attestation format, the issuer may use a **different leaf certificate +per region** (regional keys / HSMs) while keeping the same root CA and same leaf Subject. +The runtime trust model treats all of these as the *same* anchor. But raw-chain RTMR1 +hashes the exact chain bytes, so each region produces a *different* RTMR1 — and therefore a +different RTMR1 contribution to `tdinfo_hash` — for identical MigTD code and an identical +trust anchor: + +``` + region A leaf ─┐ + region B leaf ─┼─ same root + same leaf Subject, different leaf cert/chain + region C leaf ─┘ + raw chain in RTMR1: 3 different RTMR1 (chain bytes differ per region) + signer anchor: 1 RTMR1 anchor (root + signer identity identical) +``` + +So the trust-anchor measurement fragments by region for no trust-relevant reason — each +region needs its own `svnMappings` / endorsement entry even though the MigTD code and the +trust anchor are identical. + +# Problem 3: CoRIM reuse for Azure attestation duplicates the cert chain + +A goal of the TCB-mapping proposal is to make the signed `servtdTcbMapping` reusable +as-is by the tenant attestation service — instead of relying on separate out-of-band +endorsements. To realize that reuse in the **Microsoft Azure** environment, the mapping +must be reformatted as a **CoRIM** endorsement — the endorsement / reference-value format +consumed by the **Microsoft Azure Attestation (MAA)** service. A CoRIM endorsement +**embeds the signer's certificate chain** (the COSE `x5chain` parameter) so a verifier can +establish the signer trust anchor from the artifact itself. + +If RTMR1 *also* folds the raw chain bytes into `tdinfo_hash`, the same chain is carried +twice — once inside the CoRIM, once inside the measurement — and the two copies must be +kept byte-consistent forever (two sources of truth for one signer). + +``` + CoRIM endorsement (signed) RTMR1 → tdinfo_hash + ┌──────────────────────────────┐ ┌──────────────────────────────┐ + │ svnMappings / measurements │ │ SHA384( … || SHA384(chain) ) │ + │ x5chain: [leaf, …, root] ◄───┼── same │ full chain bytes again ◄───┤ + └──────────────────────────────┘ chain └──────────────────────────────┘ + ▲ ▲ + └──── duplicated, must stay in sync ┘ +``` + +# Proposal — measure a stable signer anchor + +Replace the raw-chain RTMR1 extend with an extend over a **signer anchor** `A` that +commits to a stable *signer fingerprint* — the root CA and the leaf's required signer-purpose +EKU — and nothing else. This proposal also updates MigTD-to-MigTD peer validation to key on the +**same** signer fingerprint (replacing today's leaf-Subject-name match), so the measured value +and the runtime trust check ask one identical question. + +| | Today | Proposed | +|---|-------|----------| +| **RTMR1 extend input** | `SHA384(raw issuer chain PEM bytes)` | `SHA384(A)` where `A` is the signer anchor below | +| **CFV slot `MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID`** | full signing cert chain (unchanged) | full signing cert chain (**unchanged**) | +| **What RTMR1 is sensitive to** | every byte of the chain (incl. leaf key) | root CA fingerprint + required leaf EKU only | + +The CFV still ships the **full** chain (peer validation and policy-signer signature +verification still need it); only **what is hashed into RTMR1** changes — a small, +stable anchor derived from the chain rather than the chain's raw bytes. + +## RTMR1 signer-anchor formula + +Define `H(x) = SHA384(x)`. + +1. Root fingerprint: `R = H(DER(root_certificate))` +2. Signer purpose: `EKU_OID` — the OID of the required leaf Extended Key Usage: a dedicated OID + under the issuer's org arc (e.g. `1.3.6.1.4.1.343.<n>`) identifying the MigTD servTD signer. +3. Domain-separated anchor: `A = H("MIGTD-RTMR1-ANCHOR-V1" || 0x00 || R || 0x00 || EKU_OID)` +4. RTMR extend chain: + - `RTMR1_0 = 48-byte zero` + - `RTMR1_1 = H( RTMR1_0 || H(separator_event_payload) )` *(td-shim boot separator, unchanged)* + - `RTMR1_final = H( RTMR1_1 || H(A) )` *(MigTD core, anchor event)* + +`R` is the SHA-384 fingerprint of the root CA's DER, and `EKU_OID` is the required signer EKU as a +DER-encoded OID. The `"MIGTD-RTMR1-ANCHOR-V1"` tag provides domain separation and a version hook +for future formula changes. + +`A` deliberately commits to **only** the root CA and the required leaf EKU — **not** the leaf +public key and **not** the intermediate CAs — so leaf-key and intermediate-CA rotation under the +same root + EKU leave RTMR1 unchanged. + +# Benefits + +- **No rotation churn** — leaf-key *and* intermediate-CA rotation under the same root + EKU leave + `A` unchanged (and, with the companion RTMR2, the whole `tdinfo_hash`), so no rebuild and no new + endorsement / `svnMappings` entry (Problem 1). +- **Region-independent** — regional leaves sharing root + EKU yield the **same** RTMR1, so one + endorsement covers all regions instead of one per region (Problem 2). +- **No CoRIM duplication** — RTMR1 commits to the signer fingerprint, not the chain bytes, so the + CoRIM stays the single carrier of the full chain (Problem 3). +- **Measurement matches the trust model** — the anchor and the updated `validate_peer_cert_chain` + enforce the identical fingerprint, so the measured value answers exactly the runtime's question. +- **Trust-anchor changes stay visible** — changing the **root CA** changes `R` and thus RTMR1 + (intended); only leaf-key / intermediate churn is decoupled. + +# Design details + +## Alignment with runtime peer validation + +The anchor and peer validation share **one** definition — the *signer fingerprint* +(root CA fingerprint + required leaf EKU). This proposal updates `validate_peer_cert_chain` +(`src/crypto/src/lib.rs:290`) to enforce that fingerprint, **replacing** today's +leaf-Subject-name match, so the measured value and the runtime check ask the identical +question: + +| Signer-fingerprint element | Peer validation (updated) | Anchor component | +|----------------------------|---------------------------|------------------| +| Root CA | must match (DER / fingerprint) | `R = H(DER(root))` | +| Leaf signer purpose | leaf must assert the required `EKU_OID` | `EKU_OID` | +| Intermediate-CA identity | **not** pinned (independent rotation allowed) | not folded into `A` | +| Chain signatures valid; non-CA issuers rejected | enforced at runtime | integrity, not identity — not in `A` | + +The EKU OID must be provisioned (a dedicated org-arc OID) and issued into signer leaves; the +updated peer check requires the leaf to assert it, exactly as the anchor commits to it. + +Contrast with `get_policy_signer_key_hash` (`src/crypto/src/lib.rs:105`), which hashes +the **leaf public key** and therefore *does* change on rotation. The anchor deliberately +avoids the leaf key so that rotation is measurement-stable. + +## What changes when the leaf signing key rotates + +Assumption: only the leaf signing key rotates — MigTD code, policy rules, root CA, and +required leaf EKU are unchanged. + +| Component | Changes? | Why | +|-----------|----------|-----| +| **MRTD** | No | Cert chain lives in the CFV (unmeasured content of the IGVM image) | +| **RTMR0** | No | MigTD binary code unchanged | +| **RTMR1** | **No** | `A` depends on root fingerprint + required leaf EKU, not the leaf key | +| **RTMR2** | No¹ | the companion RTMR2 (policy without TCBMapping) is unchanged here | +| **`tdinfo_hash` / endorsement** | No | no register changed, so the hash — and its existing endorsement — still apply | +| **IGVM rebuild** | No | only the CFV leaf cert is swapped (`td-shim-enroll`); the measurement is unchanged | + +¹ RTMR2 is the companion [TCB-mapping proposal](./tcb_mapping_design_proposal.md)'s domain; +the anchor changes only RTMR1. RTMR2 redacts `servtdTcbMapping`, so rotating the policy +signing leaf — the trust authority RTMR1 anchors — leaves RTMR2 (and the hash) unchanged. + +## Regional leaf certificates + +Regional leaf certificates are the spatial version of rotation. Operators provision each +region's leaf into that region's CFV slot (`MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID`); since all +share root + EKU, they yield one RTMR1 and the authority publishes **one** `svnMappings` entry +for all regions. Cross-region migration passes because peer validation also keys on root + EKU. + +## Boot & offline measurement flow + +- **Boot (MigTD core):** load the chain from CFV → parse the root certificate and the + leaf's Extended Key Usage → compute `R`, `A` → extend RTMR1 with `H(A)` and + emit one event-log entry. The full chain remains available for signature verification + and peer validation. +- **Offline (`migtd-hash` `rtmr1()`):** compute the identical `A` from the same CFV + chain so the reproduced `tdinfo_hash` matches the running TD. This replaces the current + "extend over raw chain bytes" path. + +# Security considerations — signing-key compromise + +The anchor lowers RTMR1's sensitivity from the exact issuer-chain bytes to **root CA + required +leaf EKU**. That relaxation is the source of the proposal's rotation/region agility — and of one +new risk. This section states what the change introduces and what it leaves unchanged. + +## Limitation introduced: stolen intermediate cert chain + +Raw-chain RTMR1 (today) hashes the exact chain bytes, so **any** certificate change in the chain +alters RTMR1 — and therefore `tdinfo_hash` — including a leaf freshly minted by a **stolen +intermediate CA** under the same root and asserting the same leaf EKU. The signer anchor commits +to root + EKU only, so that same stolen-intermediate-minted leaf becomes +**measurement-indistinguishable**: identical `A`, identical RTMR1, identical `tdinfo_hash`. + +``` + stolen intermediate CA key (same root + required leaf EKU) + │ mints a new leaf, signs + ▼ + forged servtdTcbMapping: { tdinfo_hash(vulnerable_MigTD) → high SVN } + │ + ▼ passes validate_peer_cert_chain (root + EKU + CA-attr) and CoRIM x5chain + ▼ + vulnerable MigTD resolves to high SVN → clears the baseline → accepted + + raw-chain RTMR1 : new leaf ⇒ different tdinfo_hash (measurement-visible) + signer anchor : same root+EKU ⇒ SAME tdinfo_hash (measurement-INvisible) ← new risk +``` + +The anchor trades away RTMR1's ability to distinguish a different signing certificate under the +same root + EKU. A **stolen intermediate CA** — which can issue an arbitrary leaf bearing the +required EKU — is the concrete exposure this proposal introduces, and it must be mitigated at the +PKI/authorization layer (below). + +## Not introduced here: stolen leaf key (reused certificate) + +A stolen **leaf private key** reusing its existing certificate changes no certificate bytes, so +it is invisible to RTMR1 with or without the anchor — a **pre-existing** risk the anchor neither +adds nor removes (unlike the stolen-intermediate limitation above, which is new). Like that case, +it is a signer-authorization question measurement cannot answer, mitigated by revocation (below). + +## Mitigations + +Neither attack is visible to measurement, so both are handled at the PKI/policy layer. Three +controls apply, each covering the two attacks differently: + +- **Strict key protection, especially of intermediate CA keys** — the primary control, since the + anchor cannot distinguish a rogue leaf bearing the required EKU minted by a stolen intermediate. Keep + signing keys offline in an HSM, rarely used, ideally under m-of-n quorum. +- **Certificate revocation (CRL)** — revoke the leaked leaf or intermediate certificate and have + consumers reject it. It covers **both** attacks and is the only in-guest control that closes a + stolen intermediate (revoking the intermediate rejects its whole subtree). MigTD performs no + revocation check today; the *Revocation* section below sketches an in-guest design. +- **`notBefore` floor** — a lightweight complement: a policy date requiring each signer leaf's + `notBefore ≥ floor`. On a detected leak the authority raises the floor to the detection date, + rejecting the leaked certificate while re-issued certs pass. It is simpler than a CRL, needs no + trusted clock (it compares two static values), and cannot be bypassed by a reused leaf cert — but + it does **not** stop a stolen intermediate (which mints a fresh, current-dated leaf) and is + coarser, rejecting every certificate older than the floor. + +**Recommendation.** Prevent these compromises with strict key protection. The long-term solution is the CRL as the in-guest control. A servTD signer CRL, similar to the Intel platform CRLs, is proposed below. + +# Revocation — the servTD signer CRL + +The attestation-service side is standard PKI (CRL/OCSP over the CoRIM `x5chain`) and is out of +scope. The in-guest side is the new work: ship a CRL for the servTD signer chain in the policy and +enforce it fail-closed, reusing the existing platform-CRL machinery (`src/crypto/src/crl.rs`, the +`pck_crl_num` / `root_ca_crl_num` floor pattern). + +| Concern | Mechanism | +|---------|-----------| +| **Delivery** | Top-level `servtdCrl` — an optional measured PEM CRL that works for JSON and CoRIM-only enrollment. The legacy `servtdCollateral.servtdCrl` location remains accepted. Optional for backward compatibility: a policy without either form skips the check. | +| **Authentication** | The CRL signature is verified against the issuing CA in the RTMR1-anchored signer chain before its contents are trusted; only a CA (`cA=TRUE`) may issue it, so a peer cannot forge one without the shared root key. | +| **Enforcement** | Every certificate in the policy-signer and identity-signer chains is checked against the CRL; a revoked serial fails closed. | +| **Anti-rollback** | A monotonic `servtd_crl_num` policy floor rejects a CRL older than required, mirroring `pck_crl_num` / `root_ca_crl_num`. | + +**Enforcement points.** The local policy's CRL is checked at boot (during policy verification) +against every JSON signer chain and the CoRIM `x5chain` — a MigTD whose own policy revokes its +signer refuses to start — and, during migration, against the peer JSON chains plus the local CoRIM +authority used for peer TCB lookup. The peer check uses the **local** CRL (the peer's chain root is +already bound to the local root by `validate_peer_cert_chain`), so a peer cannot launder a +revocation-free CRL of its own. Production policies should therefore always ship a `servtdCrl`, +empty if nothing is revoked. + +**No trusted clock.** Guest time is VMM-supplied, so the CRL `nextUpdate` window cannot be +enforced in-guest; freshness relies on the `servtd_crl_num` floor. Time-window checks are left to +the attestation service. + +**Interaction with measurement.** `servtdCrl` is inside the measured `policyData`, so updating it +churns `tdinfo_hash` — revoking a signer becomes a policy re-release + re-endorsement. That is +acceptable for a rare, deliberate event and matches the platform `root_ca_crl` / `pck_crl` process. If +in-place updates without re-endorsement are ever needed, `servtdCrl` could be redacted from the +RTMR2 extend (like `servtdTcbMapping`), leaving `servtd_crl_num` as the sole anti-rollback control. + +## Residual risks & open questions + +- **Stolen key with a not-yet-revoked certificate** stays invisible until the authority detects + the compromise and publishes a revoking CRL — inherent to CRL-based revocation. +- **Service-side revocation** (CRL/OCSP over the CoRIM `x5chain`, plus `nextUpdate` time-window + checks) is standard PKI, tracked separately. +- **CoRIM delivery.** When the servTD collateral is a signed CoRIM (COSE `x5chain`, RFC 9360), + revocation should thread the CRL through the COSE flow or run CRL/OCSP on the `x5chain`. + +# Notes + +- **The anchor changes only RTMR1.** RTMR2 (the policy) is the companion + [TCB-mapping proposal](./tcb_mapping_design_proposal.md)'s concern. Together the two keep + `tdinfo_hash` the same across leaf rotation and across regions whenever the code, policy + content, and trust anchor (root + EKU) are unchanged, while still binding the exact + policy content. (A genuine content change — e.g. re-issuing `servtdIdentity` — does + change RTMR2 and the hash, as intended.) +- **Orthogonal to the TCB-mapping proposal's RTMR2 changes.** That proposal's removal of the + outer policy signature (now part of the proposal itself, not a future item) and its remaining + *Future consideration* of dropping `servtdIdentity` both affect only **RTMR2** (the signed + `policyData`), not RTMR1; the anchor is orthogonal to either and can ship before, + after, or without them. +- **Security trade-off — anchor binds identity, not the leaf key.** `A` commits to the + root CA and the required leaf EKU — **not** the leaf public key, and **not** the intermediate + CAs. A leaf key (or an intermediate CA) compromised under the same root + EKU is + therefore *not* distinguished by RTMR1 alone. This matches the updated runtime trust + model (which likewise keys on root + EKU) and makes the root CA the unit of trust — the + intended, explicit trade-off. Its + consequences for a forged TCB mapping, and the mitigations, are detailed in + *[Security considerations — signing-key compromise](#security-considerations--signing-key-compromise)* above. +- **Root rotation still visible.** Rotating or adding a *root* CA changes `R` and thus + RTMR1 — intended, since that is a genuine trust-anchor change that should re-endorse. + +# Current RTMR1 implementation (reference) + +| Concern | Location | +|---------|----------| +| RTMR1 runtime extend (raw chain today) | `src/migtd/src/bin/migtd/main.rs` (`get_policy_issuer_chain_and_measure`) | +| `mr_index 2 → RTMR1`, tag id | `src/migtd/src/event_log.rs` (`MR_INDEX_POLICY_ISSUER_CHAIN`, `TAGGED_EVENT_ID_POLICY_ISSUER_CHAIN`) | +| Offline RTMR1 reproduction | `tools/migtd-hash/src/lib.rs` (`rtmr1`) | +| Peer trust model (root DER + leaf Subject today; **updated** to root + leaf EKU) | `src/crypto/src/lib.rs:290` (`validate_peer_cert_chain`) | +| Leaf-public-key hash (changes on rotation; not used by anchor) | `src/crypto/src/lib.rs:105` (`get_policy_signer_key_hash`) | +| CFV slot holding the chain | `MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID` (`src/migtd/src/config.rs`) | diff --git a/doc/tcb_mapping_design_proposal.md b/doc/tcb_mapping_design_proposal.md new file mode 100644 index 000000000..4f730c619 --- /dev/null +++ b/doc/tcb_mapping_design_proposal.md @@ -0,0 +1,403 @@ +TCB Mapping Design for One-Hash Endorsement +=================================================== +# Current TCB Mapping inside Policy V2 + + +**Current TCBMapping without full measurement of MigTD and policy in svnMappings** + +``` +┌─────────────────────────────────────────────────────────────────────┐ +│ Signed Policy Blob │ +│ ┌───────────────────────────────────────────────────────────────┐ │ +│ │ policyData │ │ +│ │ ├── policy (migration rules) │ │ +│ │ ├── collaterals (platform TCB info) │ │ +│ │ └── servtdCollateral │ │ +│ │ ├── servtdIdentity {tdIdentity, signature} │ │ +│ │ └── servtdTcbMapping │ │ +│ │ └── svnMappings[]: │ │ +│ │ {[MRTD, RTMR0, RTMR1], isvsvn} │ │ +│ │ ───────────────────── │ │ +│ │ RTMR2, RTMR3 excluded to avoid circularity │ │ +│ └─────────────────────┬─────────────────────────────────────────┘ │ +│ │ │ +│ signature │ │ +└────────────────────────┼────────────────────────────────────────────┘ + │ entire blob measured into + ▼ + ┌─────────────────────┐ + │ RTMR2 │ ← depends on svnMappings content + └─────────────────────┘ (inside the measured blob) + + Result: svnMappings cannot include RTMR2 without creating a + circular dependency, so RTMR2 is excluded — leaving the TCB + mapping unable to fully bind MigTD identity to policy content. +``` + +Policy v2 bundles `{policy, collaterals, servtdCollateral (signed TCB mapping + signed identity)}` into one signed blob that is measured into RTMR2. This creates a **circular dependency**: binding RTMR2 into `svnMappings` requires RTMR2 to be known before the TCB mapping is generated, yet RTMR2 is computed over policy content that already contains that TCB mapping. + +To avoid the cycle, today's `svnMappings` exclude RTMR2 and key only on `[MRTD, RTMR0, RTMR1]`. The signed TCB mapping therefore binds the MigTD code measurement and policy-signer anchor but **not** the policy content measured into RTMR2. This results in two problems described below. + + +# Problem 1: source MigTD cannot map the init hash to an SVN locally + +The source MigTD cannot map `init_servtd_info_hash` (= `SHA384(TDINFO)`) to an SVN directly, so it must accept the full init TDINFO from the untrusted VMM on every request and re-derive the registers after verifying the init TDINFO. + +**Init MigTD (rebinding/migration) TCB evaluation - current svnMappings require init TDINFO from VMM:** + +``` + VMM / Host OS Current MigTD (source) + ┌─────────────────────┐ ┌──────────────────────────────────┐ + │ │ │ │ + │ TDX Module provides│ │ Needs to determine TCB level │ + │ init_servtd_info_ │ │ of init MigTD bound to target │ + │ hash to MigTD │ │ │ + │ (from servtd_ext) │ │ svnMappings only has: │ + │ But svnMappings │ │ {[MRTD, RTMR0, RTMR1], isvsvn}│ + │ uses [MRTD,RTMR0, │ │ │ + │ RTMR1] not full │ │ Cannot derive [MRTD, RTMR0, │ + │ tdinfo_hash │ │ RTMR1] from init_servtd_info_ │ + │ │ │ hash alone! │ + │ │ │ │ + │ ┌───────────────┐ │ per-request │ │ + │ │ init TDINFO │──┼──────────────►│ Verify: │ + │ │ (full struct) │ │ VMM carries │ SHA384(TDINFO) == │ + │ └───────────────┘ │ untrusted │ init_servtd_info_hash? ✓ │ + │ │ input │ │ + │ │ │ Extract [MRTD, RTMR0, RTMR1] │ + │ │ │ from verified TDINFO │ + │ │ │ │ │ + │ │ │ ▼ │ + │ │ │ Look up svnMappings → isvsvn │ + └─────────────────────┘ └──────────────────────────────────┘ + + Problem: VMM must supply full init TDINFO struct on every migration + request. MigTD verifies it against init_servtd_info_hash, then + extracts individual registers to look up SVN. This adds: + - VMM implementation complexity (carry and supply TDINFO per request) + - Larger untrusted input surface per migration handshake +``` + +# Problem 2: attestation service cannot match the info hash to svnMappings + +The tenant TD attestation service holds only `init/cur_servtd_info_hash` (hashes over *all* registers) and cannot match them against the subset-keyed `svnMappings`, forcing reliance on separate hash-based endorsements. + + +**Tenant TD attestation — current svnMappings not useful:** + +``` + TD Quote (authenticated by QE signature) + ┌──────────────────────────────────────────────────────────┐ + │ tdinfo │ + │ ├── MRTD, RTMR0, RTMR1, RTMR2, RTMR3, ... │ + │ └── Servtd_hash = SHA384(SERVTD_EXT_STRUCT) ───────┐ │ + └──────────────────────────────────────────────────────┼───┘ + │ + SERVTD_EXT_STRUCT (carried alongside quote) │ + ┌──────────────────────────────────────────────────┐ │ + │ init_servtd_info_hash (48 bytes) │◄──┘ authenticated + │ init_servtd_attr │ by Servtd_hash + │ cur_servtd_info_hash (48 bytes) │ + │ cur_servtd_attr │ + └──────────────┬──────────────────┬────────────────┘ + │ │ + ▼ ▼ + init_servtd_info_hash cur_servtd_info_hash + = SHA384(init TDINFO) = SHA384(cur TDINFO) + │ │ + ▼ ▼ + ┌──────────────────────────────────────────────────────────────┐ + │ Attestation Service │ + │ │ + │ Has: init_servtd_info_hash, cur_servtd_info_hash │ + │ (single hashes of full TDINFO including ALL registers) │ + │ │ + │ svnMappings provides: │ + │ {[MRTD, RTMR0, RTMR1], isvsvn} │ + │ ───────────────────────────── │ + │ Incomplete! Missing RTMR2, RTMR3. │ + │ │ + │ ✗ Cannot match init/cur_servtd_info_hash against │ + │ svnMappings — the hash covers ALL registers but │ + │ svnMappings only lists a subset. │ + │ │ + │ ✗ Cannot reconstruct tdinfo_hash from partial registers │ + │ without knowing RTMR2 (which svnMappings excludes). │ + │ │ + │ → Must rely on separate endorsements (CoRIM) that │ + │ directly map tdinfo_hash → SVN, bypassing svnMappings. │ + └──────────────────────────────────────────────────────────────┘ +``` + +*Note:* `SERVTD_EXT_STRUCT` is constructed by the TDX module at runtime using the tenant's TDCS and is not directly included in the TD report. Its hash, `SHA384(SERVTD_EXT_STRUCT)`, is included as `tdinfo.Servtd_hash`. The structure is read by the host OS and supplied to the Quoting service (QTD/QE), which verifies it against the hash and includes it in the TD Quote. MigTD can also read it from the bound target tenant TD's TDCS and use the hash to verify the tdinfo from VMM. + +```rust +struct ServtdExt { + init_servtd_info_hash: [u8; 48], + init_servtd_attr: [u8; 8], + reserved: [u8; 8], + init_cpusvn: [u8; 16], + init_tee_tcb_svn: [u8; 16], + init_tee_model: [u8; 12], + reserved1: [u8; 4], + cur_servtd_info_hash: [u8; 48], + cur_servtd_attr: [u8; 8], + reserved2: [u8; 104], +} +``` + +# Proposal + + +Break policy content into independent measured components so RTMR2 no longer depends on TCB mapping content: + +**Measurement register layout** (RTMR extends): + +| Register | Before | Proposed | +|----------|--------|----------| +| **RTMR1** | Policy issuer cert chain | Policy issuer cert chain (**unchanged**) — the policy signer now also signs `servtdTcbMapping` | +| **RTMR2** | Signed policy blob (contains policy rules + collaterals + signed TCB mapping + signed identity) | **Single canonical-bytes extend** of `policyData` with `servtdCollateral.servtdTcbMapping` removed. By construction this binds every other top-level `policyData` field — `version`, `id`, `policySvn`, `policy`, `forwardPolicy`, `backwardPolicy`, `collaterals`, and the rest of `servtdCollateral` (including the issuer-signed `{tdIdentity, signature}` and `servtdIdentityIssuerChain`). `servtdTcbMapping` is signed by the policy signer, whose chain is measured into RTMR1. See "RTMR2 single redacted extend" below. | + +**IGVM CFV file layout** (configuration firmware volume slots loaded at boot): + +| CFV slot | Before | Proposed | Measured into | +|----------|--------|----------|---------------| +| `MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID` | Policy issuer cert chain | Policy issuer cert chain (**unchanged**) | **RTMR1** | +| `MIGTD_POLICY_FFS_GUID` | Signed policy with collaterals | Policy with collaterals (no outer signature), updated `svnMappings` semantics | **RTMR2** | + +With this split: +- RTMR2 = measurement of canonical `policyData` with `servtdCollateral.servtdTcbMapping` redacted — every other field is automatically bound by being inside the canonical object. This is the escape hatch that preserves circularity-freedom and lets the mapping content be re-issued after the IGVM is shipped without touching `tdinfo_hash`. +- TCB mapping can bind `tdinfo_hash` (= `init_servtd_info_hash` = `SHA384(TDINFO)` for attr=0) to SVN without circularity. (See "Schema note" at the end.) +- RTMR1 = measurement of the policy issuer chain, **unchanged** — the policy signer now also signs `servtdTcbMapping`, so no separate TCB-mapping signer chain is introduced. +- The outer policy-blob signature is removed. + +**New design — full tdinfo hash in svnMappings but unmeasured, removing circular dependency:** + +``` +┌────────────────────────────────────────────────────────────────────────┐ +│ Policy Blob (no outer signature) │ +│ ┌──────────────────────────────────────────────────────────────────┐ │ +│ │ policyData │ │ +│ │ ├── policy, version, id, policySvn, collaterals, ... [measured]│ │ +│ │ └── servtdCollateral │ │ +│ │ ├── servtdIdentity {tdIdentity, signature} [measured]│ │ +│ │ ├── servtdIdentityIssuerChain [measured]│ │ +│ │ └── servtdTcbMapping [NOT measured]│ │ +│ │ └── svnMappings[]: {tdinfo_hash, isvsvn} │ │ +│ └──────────────────────────────────────────────────────────────────┘ │ +└────────────────────────────────────────────────────────────────────────┘ + + RTMR2 = SHA384(canonical( policyData minus servtdTcbMapping )) + │ + ▼ + tdinfo_hash = SHA384(TDINFO) over MRTD, RTMR0, RTMR1, RTMR2 + │ + ▼ + svnMappings[].tdinfo_hash ← populated AFTER measurement (no circularity) +``` + + +# Benefits + +- **Breaks the circular dependency** — `tdinfo_hash` is computable from build inputs before the TCB mapping is signed. +- **Problem 1 solved with simpler rebind/migration** — MigTD maps `servtd_ext.init_servtd_info_hash` to an SVN locally; the VMM no longer supplies init TDINFO per request. +- **Problem 2 solved with TCB Mapping reused for attestation** — the service matches `init/cur_servtd_info_hash` directly against `svnMappings`, needing no out-of-band endorsements. + +# Design details + +## Implementation note + +To minimize code branching, the proposed design **replaces** the current implementation outright — it is **not** feature-gated. No runtime or build-time toggle is kept between the old subset-keyed (`[MRTD, RTMR0, RTMR1]`) scheme and the new full-`tdinfo_hash` scheme; the new behavior is the only path. + +## RTMR2 single redacted extend + +RTMR2 is extended **once** with the canonical bytes of `policyData` with +`servtdCollateral.servtdTcbMapping` removed. Every other +`policyData` field — including `version`, `id`, `policySvn`, `policy`, +`forwardPolicy`, `backwardPolicy`, `collaterals`, and the rest of +`servtdCollateral` (`majorVersion`, `minorVersion`, the issuer-signed +`{tdIdentity, signature}` object, `servtdIdentityIssuerChain`) — is bound +into RTMR2 by virtue of being inside the canonical object bytes. Redacting +`servtdTcbMapping` is the escape hatch that makes its content updateable +after the IGVM is shipped without perturbing `tdinfo_hash`. `servtdTcbMapping` +is signed by the policy signer, whose chain is measured into RTMR1. + +This single extend folds together two security properties: +detecting drift between the authority-endorsed `policyData` bytes and the bytes loaded +into the running MigTD (covered by canonicalizing the whole `policyData` +sub-tree), and — whenever `servtdIdentity` is used for policy — defeating +its playback / TCB-downgrade attacks (covered by including +`servtdCollateral.servtdIdentity` in that sub-tree; see below). + +**`servtdIdentity` — measured for free, retained for compatibility:** + +- `servtdIdentity.tcbLevels` is an optional enrichment layer on top of the `tdinfo_hash → SVN` mapping: it translates a resolved SVN into a `tcbStatus` / `tcbDate`, enabling richer recovery policy (status labels, date thresholds, per-SVN revocation) that pure SVN ordering cannot express. The core identity and anti-downgrade guarantee comes from the TCB mapping and holds with or without it. +- **Initial implementation:** retain `servtdIdentity` unchanged so existing `tcbDate` / `tcbStatus` policies keep working; it is measured into RTMR2 for free by the redacted-`policyData` extend — no extra code, tag, or event-log entry. +- **Must be measured whenever used:** unmeasured, an attacker could boot a peer with an obsolete-but-still-signed `servtdIdentity` and present revoked SVNs as `UpToDate` (playback / downgrade). Measured, a different `servtdIdentity` yields a different `tdinfo_hash` that falls outside the authority's `svnMappings`, so migration fails closed. + +**Why include the signature too:** + +- Hash scope = **full canonical `policyData` minus `servtdTcbMapping`**, which includes the `{tdIdentity, signature}` object verbatim (canonical bytes, sorted keys, no whitespace). +- Including the signature means that **any** authority re-signing event (even of byte-identical content) changes RTMR2. This is intentional: operators must re-release the MigTD image whenever the issuer re-issues `servtdIdentity`, and `svnMappings[]` for the new image must be re-computed by the authority. This eliminates ambiguity over "which issuance is bound here". + +**Why `servtdTcbMapping` is the redacted field:** + +- Measuring `servtdTcbMapping` would defeat the entire purpose of the proposal: it carries `svnMappings[].tdinfo_hash` (which is what `tdinfo_hash` itself derives from), and so binding it back into RTMR2 would re-introduce the circular dependency. +- `servtdTcbMapping` is signed by the **policy signer**, whose issuer chain is measured into RTMR1 — the mapping needs no separate signer chain. Re-issuing the mapping *content* is hash-neutral, but rotating the **policy signing key** changes RTMR1 (and `tdinfo_hash`) and needs a new IGVM unless the RTMR1 signer-anchor change (see Future considerations) is adopted. +- The redaction is what enables the authority to re-issue the `servtdTcbMapping` content (adding/removing `svnMappings[]` entries, bumping `nextUpdate`, etc.) without changing RTMR2. Operators just swap the signed TCB mapping artifact alongside the existing IGVM. + +**Why measure by construction:** + +- The single redacted-`policyData` extend automatically binds every top-level `policyData` field, including any added in the future, without requiring an explicit whitelist update. +- `servtdIdentityIssuerChain` is covered for free by the RTMR2 extend: an attacker who substituted it could weaponise it to validate an arbitrary identity, and this scheme rules that out by construction. `servtdTcbMapping` is signed by the policy signer, whose chain is measured into RTMR1 rather than RTMR2. +- Optional blocks (`forwardPolicy` / `backwardPolicy`) are covered the same way — no separate extend, no separate tag, no separate event-log entry. + +**Alternatives considered** + +| Scheme | Result | Why chosen / rejected | +|--------|--------|-----------------------| +| **Single canonical extend over `policyData` with `servtdTcbMapping` redacted** *(chosen)* | One RTMR2 extend, one tag, one event-log entry. | Breaks the circular dependency by redacting the field that contains `tdinfo_hash`; binds every other field by construction. | +| **Per-field extends** | N RTMR2 extends, each with own tag and event-log entry. | Requires discipline to add a new extend for every new `policyData` field — easy to forget, silently leaving fields unmeasured. Rejected. | +| **Single extend over raw (non-canonical) bytes** | One extend, no canonicalization. | Brittle: any whitespace or key-order difference between policy generator, CFV, and offline hash tool produces a different digest. Rejected. | +| **Single canonical extend over full `policyData` (no redaction)** | One extend covering `servtdTcbMapping` too. | Re-introduces the circular dependency. Rejected. | + +## Build flow + +The release artifact is produced in two stages: a build stage that compiles the MigTD binary into a *base IGVM* with a dummy CFV, and a release stage that signs the issuer collateral (`servtdIdentity` and `servtdTcbMapping`) and enrolls the production bytes into the base IGVM's CFV via `td-shim-enroll` (a byte-level FFS slot replacement — no Rust rebuild). + +1. **Build stage — base IGVM.** Compile MigTD and embed a dummy CFV containing the same canonical `policyData` content the final policy will carry, so the single redacted-`policyData` RTMR2 extend matches the final image byte-for-byte. The production policy issuer chain is also enrolled into the `MIGTD_POLICY_ISSUER_CHAIN` CFV slot so RTMR1 already matches the final IGVM. The embedded `servtdIdentity` is signed by an ephemeral build-time key (the build environment has no access to production signing). This yields the base IGVM and a *preview* `tdinfo_hash`. + +2. **Release stage — pre-final IGVM (CFV swap).** Re-sign `servtdIdentity` under production signing. Assemble a *pre-final* `policyData` with an empty `servtdTcbMapping` sentinel (the redacted RTMR2 extend ignores this field). Run `td-shim-enroll` to overwrite the CFV slots. Measure the re-enrolled binary to obtain the production `tdinfo_hash`. + +3. **Release stage — TCB mapping.** Create `svnMappings: [{tdinfo_hash, isvsvn}]` using the production `tdinfo_hash`, then sign the TCB mapping. + +4. **Release stage — final IGVM.** Assemble the final policy (now including the signed TCB mapping) and re-run `td-shim-enroll`. Verify its `tdinfo_hash` equals the pre-final value — a CI gate enforcing the "`tcbMapping` is not measured" invariant. + +5. **Endorsements.** Compute endorsed `tdinfo_hash` (= `init_servtd_info_hash` = `SHA384(TDINFO)`) from the final image. This hash captures policy content (via the single RTMR2 extend). + +## Init_servTD verification - how problem 1 solved + +With `svnMappings` keyed on the full `tdinfo_hash`, the source MigTD maps `servtd_ext.init_servtd_info_hash` to an SVN entirely from its locally-measured TCB mapping — the VMM no longer supplies the init TDINFO struct per request. + +**Init MigTD (rebinding/migration) TCB evaluation — proposed svnMappings need no TDINFO from VMM:** + +``` + VMM / Host OS Proposed MigTD (source) + ┌─────────────────────┐ ┌──────────────────────────────────┐ + │ │ │ │ + │ TDX Module provides│ │ Needs to determine TCB level │ + │ init_servtd_info_ │ │ of init MigTD bound to target │ + │ hash to MigTD │ │ │ + │ (from servtd_ext) │ │ svnMappings now keyed on full │ + │ │ no per- │ tdinfo_hash: │ + │ │ request │ {tdinfo_hash, isvsvn} │ + │ (no init TDINFO │ TDINFO │ │ + │ struct needed) │──────────────►│ Direct lookup: │ + │ │ │ init_servtd_info_hash == │ + │ │ │ svnMappings[].tdinfo_hash? ✓ │ + │ │ │ │ │ + │ │ │ ▼ │ + │ │ │ → isvsvn │ + │ │ │ (no VMM input, no register │ + │ │ │ re-derivation) │ + └─────────────────────┘ └──────────────────────────────────┘ + + Result: MigTD maps init_servtd_info_hash → SVN from its locally-measured + TCB mapping. The VMM supplies nothing per request, removing the + untrusted-input surface and VMM implementation complexity. +``` + + +## Attestation verification - how problem 2 solved + +The attestation service receives the Tenant TD Quote, which includes for each bound MigTD: + +* `init_migtd_hash` ← `servtd_ext.init_servtd_info_hash` — the hash of the MigTD originally bound to the tenant TD. +* `cur_migtd_hash` ← `servtd_ext.cur_servtd_info_hash` — the hash of the currently bound MigTD. + +Both values are authenticated by `tdinfo.Servtd_hash` (the `SHA384(SERVTD_EXT_STRUCT)` carried in the quote). + +The service consults two signed endorsement artifacts: + +1. **Authorization endorsement** (`servtd_info_hash → SVN`) — translates `init_migtd_hash` and `cur_migtd_hash` into `init_migtd_svn` and `cur_migtd_svn`. Cumulative across releases — must include historical entries so past `init_migtd_hash` values still resolve. + +2. **Trust / baseline endorsement** — declares the minimum acceptable MigTD SVN. The service evaluates **both** initial and current bound MigTDs against this baseline (`init_migtd_svn >= min_migtd_svn` and `cur_migtd_svn >= min_migtd_svn`). A failure on either fails the attestation — catching both "originally bound to a now-revoked MigTD" and "currently bound to an out-of-date MigTD" cases. + +**Proposed tenant TD attestation — self-contained reverse lookup:** + +``` + TD Quote (authenticated by QE signature) + ┌──────────────────────────────────────────────────────────┐ + │ tdinfo │ + │ └── Servtd_hash = SHA384(SERVTD_EXT_STRUCT) ───────┐ │ + └──────────────────────────────────────────────────────┼───┘ + │ + SERVTD_EXT_STRUCT (carried alongside quote) │ + ┌──────────────────────────────────────────────────┐ │ + │ init_servtd_info_hash ─────────────────────┐ │◄──┘ authenticated + │ cur_servtd_info_hash ──────────────────┐ │ │ by Servtd_hash + └───────────────────────────────────────────┼──┼───┘ + │ │ + ▼ ▼ + ┌───────────────────────────────────────────────────────────────────┐ + │ Attestation Service │ + │ │ + │ Step 1: Authorization endorsement (svnMappings in TCB mapping) │ + │ ┌─────────────────────────────────────────────────────────────┐ │ + │ │ svnMappings[]: │ │ + │ │ {tdinfo_hash: "abc123...", isvsvn: 3} │ │ + │ │ {tdinfo_hash: "def456...", isvsvn: 2} ← historical │ │ + │ │ {tdinfo_hash: "ghi789...", isvsvn: 1} ← historical │ │ + │ │ │ │ + │ │ ✓ Direct lookup: │ │ + │ │ init_servtd_info_hash == tdinfo_hash? → init_migtd_svn │ │ + │ │ cur_servtd_info_hash == tdinfo_hash? → cur_migtd_svn │ │ + │ └─────────────────────────────────────────────────────────────┘ │ + │ │ │ + │ ▼ │ + │ Step 2: Trust baseline endorsement │ + │ ┌─────────────────────────────────────────────────────────────┐ │ + │ │ min_migtd_svn = 2 │ │ + │ │ │ │ + │ │ init_migtd_svn >= min_migtd_svn? (e.g. 3 >= 2 ✓) │ │ + │ │ cur_migtd_svn >= min_migtd_svn? (e.g. 3 >= 2 ✓) │ │ + │ │ │ │ + │ │ Both pass → attestation succeeds │ │ + │ │ Either fails → attestation denied │ │ + │ └─────────────────────────────────────────────────────────────┘ │ + └───────────────────────────────────────────────────────────────────┘ + + Key improvement: svnMappings now uses tdinfo_hash (= SHA384(full TDINFO)) + as the lookup key. The attestation service matches init/cur_servtd_info_hash + directly against svnMappings — no out-of-band endorsements needed. +``` + +This design enables self-contained reverse lookup: the attestation service can derive MigTD identity and trustworthiness entirely from the `tdinfo_hash` → SVN mapping and the trust baseline, without requiring additional out-of-band endorsements. + +# Future considerations + +These items are out of scope for the circular-dependency fix above but are enabled by it. + +## Dropping `servtdIdentity` (pure-SVN policy) + +If migration policy is expressed purely as SVN comparisons, `servtdIdentity` can be dropped: the peer's SVN is derived solely from the TCB mapping (`tdinfo_hash → SVN`), independent of `servtdIdentity`. Trade-off: loses the `tcbStatus` / `tcbDate` axes and non-monotonic per-SVN revocation (mark SVN N `Revoked` while keeping N−1), and requires SVN monotonicity ("higher SVN ≥ as trustworthy"); build-specific revocation still works by removing that build's `tdinfo_hash` entry from the mapping. + +## RTMR1 signer anchor for key rotation + +Today RTMR1 measures the full issuer cert chain, so any leaf re-issuance (e.g. routine key rotation) changes RTMR1 — and therefore `tdinfo_hash` — forcing a new `svnMappings` entry and IGVM release per rotation. A future change can measure a stable *signer anchor* instead of the raw chain bytes — e.g. RTMR1 = `SHA384(root-CA identity || leaf subject)` rather than the DER chain — so rotating the leaf key while keeping the same root and subject leaves RTMR1 (and `tdinfo_hash`) unchanged, decoupling key rotation from measurement churn. + +# Schema note — flat `tdinfo_hash` vs measurement registers (MRs) + +Throughout this document `svnMappings[]` entries are written in the flattened form `{tdinfo_hash, isvsvn}` for readability. In the actual CoRIM/`policyData` schema the measurement is nested under `tdMeasurements` (e.g. `svnMappings[].tdMeasurements.tdinfo_hash`, see `src/policy/src/v2/servtd_collateral.rs`), and `tdMeasurements` is the place that can also carry the individual measurement registers / MRs (`MRTD`, `RTMR0`–`RTMR3`). This proposal keys the mapping on the single composite `tdinfo_hash` (= `SHA384(TDINFO)`, which already folds in all MRs) rather than the per-register subset used today; the implementation should populate `tdMeasurements.tdinfo_hash` accordingly. + +# MRTD / RTMR measurements -current implementation + +| Register | Measured content (Policy v2) | Measured by | Stage | +| -------- | ------------------------------------------------------------------------ | ------------------ | --------- | +| `MRTD` | Initial TD image: **td-shim BFV** + **MigTD core Payload** page contents, plus the GPAs of all added private pages. (CFV content **excluded**.) | TDX module (static) | TD build | +| `RTMR0` | One `EV_SEPARATOR` event (`u32` `0x0000_0000`). Nothing else. | td-shim firmware | Boot | +| `RTMR1` | `EV_SEPARATOR`, **then the policy issuer chain** (`policy_issuer_chain.pem`). | td-shim, then MigTD | Boot | +| `RTMR2` | **The migration policy** (`policy_v2_signed.json`). No root CA in v2. | MigTD core | Boot | +| `RTMR3` | *Nothing* — stays all-zero. | — | — | + +See [policy_v2_measurements.md](./policy_v2_measurements.md) for details. \ No newline at end of file diff --git a/migtdemu.sh b/migtdemu.sh index 49b422316..c2a4a084c 100755 --- a/migtdemu.sh +++ b/migtdemu.sh @@ -28,6 +28,7 @@ USE_POLICY_V2=false MOCK_QUOTE_FILE="" # Optional mock quote file path EXPLICIT_POLICY_FILE=false EXPLICIT_POLICY_ISSUER_CHAIN=false +USE_CORIM_ONLY=false USE_MOCK_QUOTE_RETRY=false DEFAULT_RUST_BACKTRACE="1" # Default RUST_LOG: verbose in debug, info in release; can be overridden by env @@ -56,13 +57,19 @@ show_usage() { echo " --policy-file FILE Set policy file path (default: config/policy.json)" echo " --root-ca-file FILE Set root CA file path (default: config/Intel_SGX_Provisioning_Certification_RootCA.cer)" echo " --policy-issuer-chain-file FILE Set policy issuer chain file path (required when using --policy-v2)" + echo " --servtd-signer-anchor-file FILE Set the 48-byte signer anchor for a CoRIM-only policy" + echo " --servtd-corim-file FILE Set the signed TCB-mapping CoRIM for a CoRIM-only policy" echo " --src-policy-file FILE Set source-specific policy file (overrides --policy-file for source)" echo " --src-policy-issuer-chain-file FILE Set source-specific policy issuer chain file" + echo " --src-servtd-signer-anchor-file FILE Set source-specific signer anchor" + echo " --src-servtd-corim-file FILE Set source-specific signed TCB-mapping CoRIM" echo " --dst-policy-file FILE Set destination-specific policy file (overrides --policy-file for destination)" echo " --dst-policy-issuer-chain-file FILE Set destination-specific policy issuer chain file" + echo " --dst-servtd-signer-anchor-file FILE Set destination-specific signer anchor" + echo " --dst-servtd-corim-file FILE Set destination-specific signed TCB-mapping CoRIM" echo " --debug Build in debug mode (default: release)" echo " --release Build in release mode (default)" - echo " --policy-v2 Enable policy v2 support (requires --policy-file and --policy-issuer-chain-file to be specified)" + echo " --policy-v2 Enable policy v2 support" echo " --skip-ra Skip remote attestation (uses mock TD reports/quotes for non-TDX environments)" echo " --mock-report Use mock report data for RA and policy v2 (non-TDX, but full attestation flow)" echo " --mock-quote-file FILE Path to mock quote file (used with --mock-report, defaults to output_data_v4.bin)" @@ -86,8 +93,8 @@ show_usage() { echo " - Mock report mode (--mock-report) uses the test_mock_report feature to generate mock" echo " TD reports/quotes but still performs the full attestation flow. This is useful for" echo " testing attestation logic without requiring real TDX hardware." - echo " - When using --policy-v2, you must explicitly specify a policy file with --policy-file and" - echo " a policy issuer chain file with --policy-issuer-chain-file. You can use the provided" + echo " - When using --policy-v2, specify a policy file plus either an issuer chain or both" + echo " CoRIM-only inputs (--servtd-signer-anchor-file and --servtd-corim-file). You can use the provided" echo " example files in config/AzCVMEmu. Some reference values in those files for the ServTD may become" echo " outdated over time. Use ./sh_script/build_AzCVMEmu_policy_and_test.sh to generate updated policy" echo " and issuer chain files." @@ -222,10 +229,16 @@ DEST_PORT="$DEFAULT_DEST_PORT" POLICY_FILE="$DEFAULT_POLICY_FILE" ROOT_CA_FILE="$DEFAULT_ROOT_CA_FILE" POLICY_ISSUER_CHAIN_FILE="" # No default - mandatory when using --policy-v2 +SERVTD_SIGNER_ANCHOR_FILE="" +SERVTD_CORIM_FILE="" SRC_POLICY_FILE="" # Per-side overrides (optional) SRC_POLICY_ISSUER_CHAIN_FILE="" +SRC_SERVTD_SIGNER_ANCHOR_FILE="" +SRC_SERVTD_CORIM_FILE="" DST_POLICY_FILE="" DST_POLICY_ISSUER_CHAIN_FILE="" +DST_SERVTD_SIGNER_ANCHOR_FILE="" +DST_SERVTD_CORIM_FILE="" BUILD_MODE="$DEFAULT_BUILD_MODE" NUM_CPUS="$DEFAULT_NUM_CPUS" OPERATION="$DEFAULT_OPERATION" @@ -267,20 +280,48 @@ while [[ $# -gt 0 ]]; do EXPLICIT_POLICY_ISSUER_CHAIN=true shift 2 ;; + --servtd-signer-anchor-file) + SERVTD_SIGNER_ANCHOR_FILE="$2" + shift 2 + ;; + --servtd-corim-file) + SERVTD_CORIM_FILE="$2" + shift 2 + ;; --src-policy-file) SRC_POLICY_FILE="$2" + EXPLICIT_POLICY_FILE=true shift 2 ;; --src-policy-issuer-chain-file) SRC_POLICY_ISSUER_CHAIN_FILE="$2" + EXPLICIT_POLICY_ISSUER_CHAIN=true + shift 2 + ;; + --src-servtd-signer-anchor-file) + SRC_SERVTD_SIGNER_ANCHOR_FILE="$2" + shift 2 + ;; + --src-servtd-corim-file) + SRC_SERVTD_CORIM_FILE="$2" shift 2 ;; --dst-policy-file) DST_POLICY_FILE="$2" + EXPLICIT_POLICY_FILE=true shift 2 ;; --dst-policy-issuer-chain-file) DST_POLICY_ISSUER_CHAIN_FILE="$2" + EXPLICIT_POLICY_ISSUER_CHAIN=true + shift 2 + ;; + --dst-servtd-signer-anchor-file) + DST_SERVTD_SIGNER_ANCHOR_FILE="$2" + shift 2 + ;; + --dst-servtd-corim-file) + DST_SERVTD_CORIM_FILE="$2" shift 2 ;; --debug) @@ -365,6 +406,13 @@ if [[ "$OPERATION" == "rebind-prepare" || "$OPERATION" == "rebind-finalize" ]]; USE_POLICY_V2=true fi +if [[ -n "$SERVTD_SIGNER_ANCHOR_FILE" || -n "$SERVTD_CORIM_FILE" || + -n "$SRC_SERVTD_SIGNER_ANCHOR_FILE" || -n "$SRC_SERVTD_CORIM_FILE" || + -n "$DST_SERVTD_SIGNER_ANCHOR_FILE" || -n "$DST_SERVTD_CORIM_FILE" ]]; then + USE_CORIM_ONLY=true + USE_POLICY_V2=true +fi + # Automatically enable mock-report mode when mock-quote-file is specified if [[ -n "$MOCK_QUOTE_FILE" && "$USE_MOCK_REPORT" != true ]]; then echo -e "${YELLOW}Note: --mock-quote-file specified, automatically enabling --mock-report${NC}" @@ -415,6 +463,14 @@ if [[ "$RUN_BOTH" != true ]]; then fi fi +if [[ "$RUN_BOTH" == true ]]; then + ACTIVE_SIDES=(SRC DST) +elif [[ "$ROLE" == "source" ]]; then + ACTIVE_SIDES=(SRC) +else + ACTIVE_SIDES=(DST) +fi + # Change to MigTD directory cd "$(dirname "$0")" @@ -456,6 +512,16 @@ if [[ "$USE_POLICY_V2" == true && "$USE_MOCK_REPORT" == true && "$EXPLICIT_POLIC POLICY_ISSUER_CHAIN_FILE="./config/AzCVMEmu/policy_issuer_chain.pem" fi +# Resolve per-side policy and collateral files (fall back to shared values) +EFFECTIVE_SRC_POLICY_FILE="${SRC_POLICY_FILE:-$POLICY_FILE}" +EFFECTIVE_SRC_POLICY_ISSUER_CHAIN_FILE="${SRC_POLICY_ISSUER_CHAIN_FILE:-$POLICY_ISSUER_CHAIN_FILE}" +EFFECTIVE_SRC_SERVTD_SIGNER_ANCHOR_FILE="${SRC_SERVTD_SIGNER_ANCHOR_FILE:-$SERVTD_SIGNER_ANCHOR_FILE}" +EFFECTIVE_SRC_SERVTD_CORIM_FILE="${SRC_SERVTD_CORIM_FILE:-$SERVTD_CORIM_FILE}" +EFFECTIVE_DST_POLICY_FILE="${DST_POLICY_FILE:-$POLICY_FILE}" +EFFECTIVE_DST_POLICY_ISSUER_CHAIN_FILE="${DST_POLICY_ISSUER_CHAIN_FILE:-$POLICY_ISSUER_CHAIN_FILE}" +EFFECTIVE_DST_SERVTD_SIGNER_ANCHOR_FILE="${DST_SERVTD_SIGNER_ANCHOR_FILE:-$SERVTD_SIGNER_ANCHOR_FILE}" +EFFECTIVE_DST_SERVTD_CORIM_FILE="${DST_SERVTD_CORIM_FILE:-$SERVTD_CORIM_FILE}" + # Validate policy v2 requirements if [[ "$USE_POLICY_V2" == true ]]; then if [[ "$POLICY_FILE" == "$DEFAULT_POLICY_FILE" && -z "$SRC_POLICY_FILE" && -z "$DST_POLICY_FILE" ]]; then @@ -463,19 +529,22 @@ if [[ "$USE_POLICY_V2" == true ]]; then echo -e "${YELLOW}Example: $0 --policy-v2 --policy-file ./config/AzCVMEmu/policy_v2_signed.json --policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem --debug --both${NC}" >&2 exit 1 fi - if [[ -z "$POLICY_ISSUER_CHAIN_FILE" && -z "$SRC_POLICY_ISSUER_CHAIN_FILE" && -z "$DST_POLICY_ISSUER_CHAIN_FILE" ]]; then - echo -e "${RED}Error: When using --policy-v2, you must specify a policy issuer chain file with --policy-issuer-chain-file${NC}" >&2 - echo -e "${YELLOW}Example: $0 --policy-v2 --policy-file ./config/AzCVMEmu/policy_v2_signed.json --policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem --debug --both${NC}" >&2 - exit 1 - fi + for side in "${ACTIVE_SIDES[@]}"; do + eval "chain=\$EFFECTIVE_${side}_POLICY_ISSUER_CHAIN_FILE" + eval "anchor=\$EFFECTIVE_${side}_SERVTD_SIGNER_ANCHOR_FILE" + eval "corim=\$EFFECTIVE_${side}_SERVTD_CORIM_FILE" + if [[ -n "$anchor" || -n "$corim" ]]; then + if [[ -z "$anchor" || -z "$corim" ]]; then + echo -e "${RED}Error: ${side} signer anchor and signed CoRIM must be specified together${NC}" >&2 + exit 1 + fi + elif [[ -z "$chain" ]]; then + echo -e "${RED}Error: ${side} policy v2 requires an issuer chain or both CoRIM-only inputs${NC}" >&2 + exit 1 + fi + done fi -# Resolve per-side policy files (fall back to shared values) -EFFECTIVE_SRC_POLICY_FILE="${SRC_POLICY_FILE:-$POLICY_FILE}" -EFFECTIVE_SRC_POLICY_ISSUER_CHAIN_FILE="${SRC_POLICY_ISSUER_CHAIN_FILE:-$POLICY_ISSUER_CHAIN_FILE}" -EFFECTIVE_DST_POLICY_FILE="${DST_POLICY_FILE:-$POLICY_FILE}" -EFFECTIVE_DST_POLICY_ISSUER_CHAIN_FILE="${DST_POLICY_ISSUER_CHAIN_FILE:-$POLICY_ISSUER_CHAIN_FILE}" - # Build features string based on configuration build_features_string() { local features="AzCVMEmu" @@ -494,6 +563,10 @@ build_features_string() { features="$features,mock_quote_retry" fi + if [[ "$USE_CORIM_ONLY" == true ]]; then + features="$features,servtd_corim" + fi + if [[ -n "$EXTRA_FEATURES" ]]; then features="$features,$EXTRA_FEATURES" fi @@ -515,11 +588,22 @@ else fi # Check if configuration files exist -check_file "$EFFECTIVE_SRC_POLICY_FILE" "Source Policy" -check_file "$EFFECTIVE_DST_POLICY_FILE" "Destination Policy" +for side in "${ACTIVE_SIDES[@]}"; do + eval "policy=\$EFFECTIVE_${side}_POLICY_FILE" + check_file "$policy" "$side Policy" +done if [[ "$USE_POLICY_V2" == true ]]; then - check_file "$EFFECTIVE_SRC_POLICY_ISSUER_CHAIN_FILE" "Source Policy Issuer Chain" - check_file "$EFFECTIVE_DST_POLICY_ISSUER_CHAIN_FILE" "Destination Policy Issuer Chain" + for side in "${ACTIVE_SIDES[@]}"; do + eval "chain=\$EFFECTIVE_${side}_POLICY_ISSUER_CHAIN_FILE" + eval "anchor=\$EFFECTIVE_${side}_SERVTD_SIGNER_ANCHOR_FILE" + eval "corim=\$EFFECTIVE_${side}_SERVTD_CORIM_FILE" + if [[ -n "$anchor" ]]; then + check_file "$anchor" "$side ServTD Signer Anchor" + check_file "$corim" "$side Signed ServTD CoRIM" + else + check_file "$chain" "$side Policy Issuer Chain" + fi + done else check_file "$ROOT_CA_FILE" "Root CA" fi @@ -561,9 +645,17 @@ run_cmd() { esac done if $USE_SUDO; then - sudo env "${env_kv[@]}" $TASKSET_CMD "$@" + sudo env \ + -u MIGTD_POLICY_ISSUER_CHAIN_FILE \ + -u MIGTD_SERVTD_SIGNER_ANCHOR_FILE \ + -u MIGTD_SERVTD_CORIM_FILE \ + "${env_kv[@]}" $TASKSET_CMD "$@" else - env "${env_kv[@]}" $TASKSET_CMD "$@" + env \ + -u MIGTD_POLICY_ISSUER_CHAIN_FILE \ + -u MIGTD_SERVTD_SIGNER_ANCHOR_FILE \ + -u MIGTD_SERVTD_CORIM_FILE \ + "${env_kv[@]}" $TASKSET_CMD "$@" fi } @@ -631,7 +723,12 @@ elif [[ -n "$SRC_POLICY_FILE" || -n "$DST_POLICY_FILE" ]]; then echo " Dest policy file: $EFFECTIVE_DST_POLICY_FILE" echo " Dest issuer chain: $EFFECTIVE_DST_POLICY_ISSUER_CHAIN_FILE" else - echo " Policy issuer chain file: $POLICY_ISSUER_CHAIN_FILE" + if [[ "$USE_CORIM_ONLY" == true ]]; then + echo " ServTD signer anchor: $SERVTD_SIGNER_ANCHOR_FILE" + echo " Signed ServTD CoRIM: $SERVTD_CORIM_FILE" + else + echo " Policy issuer chain file: $POLICY_ISSUER_CHAIN_FILE" + fi fi if [[ -n "$MOCK_QUOTE_FILE" ]]; then @@ -672,7 +769,12 @@ if [[ "$RUN_BOTH" == true ]]; then DEST_OUT_LOG="dest_${OPERATION}_out.log" # Build environment variable list for destination - DEST_ENV_VARS=("MIGTD_POLICY_FILE=$EFFECTIVE_DST_POLICY_FILE" "MIGTD_POLICY_ISSUER_CHAIN_FILE=$EFFECTIVE_DST_POLICY_ISSUER_CHAIN_FILE" "MIGTD_LOG_FILE=$DEST_LOG_FILE" "RUST_BACKTRACE=$RUST_BACKTRACE" "RUST_LOG=$RUST_LOG") + DEST_ENV_VARS=("MIGTD_POLICY_FILE=$EFFECTIVE_DST_POLICY_FILE" "MIGTD_LOG_FILE=$DEST_LOG_FILE" "RUST_BACKTRACE=$RUST_BACKTRACE" "RUST_LOG=$RUST_LOG") + if [[ -n "$EFFECTIVE_DST_SERVTD_SIGNER_ANCHOR_FILE" ]]; then + DEST_ENV_VARS+=("MIGTD_SERVTD_SIGNER_ANCHOR_FILE=$EFFECTIVE_DST_SERVTD_SIGNER_ANCHOR_FILE" "MIGTD_SERVTD_CORIM_FILE=$EFFECTIVE_DST_SERVTD_CORIM_FILE") + else + DEST_ENV_VARS+=("MIGTD_POLICY_ISSUER_CHAIN_FILE=$EFFECTIVE_DST_POLICY_ISSUER_CHAIN_FILE") + fi if [[ "$USE_POLICY_V2" != true ]]; then DEST_ENV_VARS+=("MIGTD_ROOT_CA_FILE=$ROOT_CA_FILE") fi @@ -714,7 +816,12 @@ if [[ "$RUN_BOTH" == true ]]; then SRC_LOG_FILE="migtd_${OPERATION}_source.log" # Build environment variable list for source - SRC_ENV_VARS=("MIGTD_POLICY_FILE=$EFFECTIVE_SRC_POLICY_FILE" "MIGTD_POLICY_ISSUER_CHAIN_FILE=$EFFECTIVE_SRC_POLICY_ISSUER_CHAIN_FILE" "MIGTD_LOG_FILE=$SRC_LOG_FILE" "RUST_BACKTRACE=$RUST_BACKTRACE" "RUST_LOG=$RUST_LOG") + SRC_ENV_VARS=("MIGTD_POLICY_FILE=$EFFECTIVE_SRC_POLICY_FILE" "MIGTD_LOG_FILE=$SRC_LOG_FILE" "RUST_BACKTRACE=$RUST_BACKTRACE" "RUST_LOG=$RUST_LOG") + if [[ -n "$EFFECTIVE_SRC_SERVTD_SIGNER_ANCHOR_FILE" ]]; then + SRC_ENV_VARS+=("MIGTD_SERVTD_SIGNER_ANCHOR_FILE=$EFFECTIVE_SRC_SERVTD_SIGNER_ANCHOR_FILE" "MIGTD_SERVTD_CORIM_FILE=$EFFECTIVE_SRC_SERVTD_CORIM_FILE") + else + SRC_ENV_VARS+=("MIGTD_POLICY_ISSUER_CHAIN_FILE=$EFFECTIVE_SRC_POLICY_ISSUER_CHAIN_FILE") + fi if [[ "$USE_POLICY_V2" != true ]]; then SRC_ENV_VARS+=("MIGTD_ROOT_CA_FILE=$ROOT_CA_FILE") fi @@ -774,9 +881,19 @@ else # Build environment variable list (use per-side values based on role) if [[ "$ROLE" == "source" ]]; then - ENV_VARS=("MIGTD_POLICY_FILE=$EFFECTIVE_SRC_POLICY_FILE" "MIGTD_POLICY_ISSUER_CHAIN_FILE=$EFFECTIVE_SRC_POLICY_ISSUER_CHAIN_FILE" "RUST_BACKTRACE=$RUST_BACKTRACE" "RUST_LOG=$RUST_LOG") + ENV_VARS=("MIGTD_POLICY_FILE=$EFFECTIVE_SRC_POLICY_FILE" "RUST_BACKTRACE=$RUST_BACKTRACE" "RUST_LOG=$RUST_LOG") + if [[ -n "$EFFECTIVE_SRC_SERVTD_SIGNER_ANCHOR_FILE" ]]; then + ENV_VARS+=("MIGTD_SERVTD_SIGNER_ANCHOR_FILE=$EFFECTIVE_SRC_SERVTD_SIGNER_ANCHOR_FILE" "MIGTD_SERVTD_CORIM_FILE=$EFFECTIVE_SRC_SERVTD_CORIM_FILE") + else + ENV_VARS+=("MIGTD_POLICY_ISSUER_CHAIN_FILE=$EFFECTIVE_SRC_POLICY_ISSUER_CHAIN_FILE") + fi else - ENV_VARS=("MIGTD_POLICY_FILE=$EFFECTIVE_DST_POLICY_FILE" "MIGTD_POLICY_ISSUER_CHAIN_FILE=$EFFECTIVE_DST_POLICY_ISSUER_CHAIN_FILE" "RUST_BACKTRACE=$RUST_BACKTRACE" "RUST_LOG=$RUST_LOG") + ENV_VARS=("MIGTD_POLICY_FILE=$EFFECTIVE_DST_POLICY_FILE" "RUST_BACKTRACE=$RUST_BACKTRACE" "RUST_LOG=$RUST_LOG") + if [[ -n "$EFFECTIVE_DST_SERVTD_SIGNER_ANCHOR_FILE" ]]; then + ENV_VARS+=("MIGTD_SERVTD_SIGNER_ANCHOR_FILE=$EFFECTIVE_DST_SERVTD_SIGNER_ANCHOR_FILE" "MIGTD_SERVTD_CORIM_FILE=$EFFECTIVE_DST_SERVTD_CORIM_FILE") + else + ENV_VARS+=("MIGTD_POLICY_ISSUER_CHAIN_FILE=$EFFECTIVE_DST_POLICY_ISSUER_CHAIN_FILE") + fi fi if [[ "$USE_POLICY_V2" != true ]]; then ENV_VARS+=("MIGTD_ROOT_CA_FILE=$ROOT_CA_FILE") diff --git a/sh_script/Azure/Dockerfile b/sh_script/Azure/Dockerfile new file mode 100644 index 000000000..f2e4bdcb8 --- /dev/null +++ b/sh_script/Azure/Dockerfile @@ -0,0 +1,58 @@ +# Reproducible build environment for the MigTD **Azure IGVM** image. +# +# This image only provides the toolchain; the source tree is supplied at run +# time by sh_script/Azure/docker_build_igvm.sh, which runs the Azure Makefile +# (`make build-igvm-all`) inside a container and extracts target/release/migtd.igvm. +# +# The base image is pinned by digest to the SAME ubuntu release used by +# container/Dockerfile. This is deliberate: the IGVM payload statically links +# the `ring` crate whose C sources are compiled by the image's clang/llvm, so +# the controlled compiler environment is required for a bit-for-bit +# reproducible IGVM. See sh_script/Azure/reproducible_build.md. +FROM ubuntu:26.04@sha256:53958ec7b67c2c9355df922dd08dbf0360611f8c3cdb656875e81873db9ffdba + +# Adding rust binaries to PATH. +ENV PATH="$PATH:/root/.cargo/bin" +ENV RUST_TOOLCHAIN=1.88.0 +WORKDIR /root + +# Install all build dependencies in one layer. +# - clang/llvm/nasm : compile and assemble the `ring` crypto crate +# - ocaml/ocamlbuild/automake/autoconf/libtool/cmake/perl/make/libssl-dev : +# build the SGX/DCAP attestation library (deps/linux-sgx) pulled in by the +# `igvm-attest` build (attestation/build.rs only skips it under feature "test") +# - git : required by sh_script/preparation.sh to (re)patch the `ring` submodule +# DEBIAN_FRONTEND is set for tzdata. Use HTTPS because GitHub-hosted runners +# may not allow package downloads over port 80, and retry transient failures. +# The minimal Ubuntu image has no CA bundle, so bootstrap ca-certificates with +# TLS peer verification disabled; APT still verifies the signed Ubuntu index +# and package before the remaining downloads use fully verified HTTPS. +RUN sed -i \ + -e 's|http://archive.ubuntu.com|https://archive.ubuntu.com|g' \ + -e 's|http://security.ubuntu.com|https://security.ubuntu.com|g' \ + /etc/apt/sources.list.d/ubuntu.sources && \ + apt-get -o Acquire::Retries=5 -o Acquire::https::Timeout=30 \ + -o Acquire::https::Verify-Peer=false update && \ + DEBIAN_FRONTEND="noninteractive" apt-get \ + -o Acquire::Retries=5 -o Acquire::https::Timeout=30 \ + -o Acquire::https::Verify-Peer=false \ + install --no-install-recommends -y ca-certificates && \ + apt-get -o Acquire::Retries=5 -o Acquire::https::Timeout=30 update && \ + DEBIAN_FRONTEND="noninteractive" apt-get \ + -o Acquire::Retries=5 -o Acquire::https::Timeout=30 \ + install --no-install-recommends -y \ + build-essential unzip curl gcc git libssl-dev pkg-config ssh \ + clang llvm nasm \ + ocaml ocamlbuild wget libtool autoconf autotools-dev automake cmake perl \ + python3 python3-pip python-is-python3 jq \ + && apt-get clean && rm -rf /var/lib/apt/lists/* + +# Install rustup and the pinned Rust toolchain, plus the bare-metal target and +# rust-src component used by `cargo image`. +RUN curl https://sh.rustup.rs -sSf | sh -s -- -y --default-toolchain "${RUST_TOOLCHAIN}" --profile minimal && \ + rustup component add rust-src && \ + rustup target add x86_64-unknown-none + +# The build script copies the MigTD source tree here at run time. +RUN mkdir -p /root/MigTD +WORKDIR /root/MigTD diff --git a/sh_script/Azure/Makefile b/sh_script/Azure/Makefile index 5644111c6..070123f83 100644 --- a/sh_script/Azure/Makefile +++ b/sh_script/Azure/Makefile @@ -1,22 +1,28 @@ # # Copyright (C) 2011-2021 Intel Corporation. All rights reserved. # +# all targets in this Makefile are for building IGVM images for testing only. +# +# For a pinned, reproducible build of these targets inside Docker (recommended +# for release artifacts), use the wrapper: +# ./docker_build_igvm.sh # build the local tree's IGVM +# ./docker_build_igvm.sh --help # options (target, --clone, output dir) IGVM_FILE ?= target/release/migtd.igvm LOG_LEVEL ?= trace # Common features for IGVM images IGVM_FEATURES_BASE ?= vmcall-raw,stack-guard,main,vmcall-interrupt,oneshot-apic,spdm_attestation -IGVM_FEATURES_GET_QUOTE ?= $(IGVM_FEATURES_BASE),igvm-attest -# test_disable_ra_and_accept_all feature disables remote attestation and skips policy verification, bypassing RATLS security -# test feature skips the compilation of attestation library when the remote attestation is not enabled or needed -IGVM_FEATURES_DISABLE_RA_AND_ACCEPT_ALL ?= $(IGVM_FEATURES_BASE),test_disable_ra_and_accept_all +IGVM_FEATURES_GET_QUOTE = $(IGVM_FEATURES_BASE),igvm-attest +IGVM_FEATURES_MOCK_QUOTE = $(IGVM_FEATURES_BASE),use-mock-quote +IGVM_FEATURES_GET_QUOTE_TEST = $(IGVM_FEATURES_GET_QUOTE),test-get-quote IGVM_MANIFEST ?= config/Azure/servtd_info.json -.PHONY: generate-hash-accept build-igvm-accept build-igvm-accept-all -.PHONY: pre-build build-igvm generate-hash build-igvm-all -.PHONY: build-igvm-reject build-igvm-reject-all -.PHONY: generate-hash-verbose generate-hash-accept-verbose -.PHONY: build-igvm-get-quote build-igvm-get-quote-all generate-hash-get-quote +.PHONY: pre-build generate-hash generate-hash-v2 generate-hash-v2-verbose generate-hash-verbose +.PHONY: generate-hash-accept generate-hash-get-quote +.PHONY: generate-policy-accept build-igvm-accept build-igvm-accept-all +.PHONY: generate-policy-reject build-igvm-reject build-igvm-reject-all test-reject +.PHONY: build-igvm build-igvm-all build-igvm-v2-mock +.PHONY: build-igvm-get-quote build-igvm-get-quote-all .PHONY: build-igvm-mock-quote generate-policy-mock-quote .PHONY: build-igvm-mock-quote-allow-all generate-policy-mock-quote-allow-all @@ -25,12 +31,13 @@ IGVM_MANIFEST ?= config/Azure/servtd_info.json help: @echo "Available targets:" @echo " build-igvm-all - Build IGVM" - @echo " build-igvm-accept-all - Build IGVM with disabled RA and accept all policy with TLS" - @echo " build-igvm-reject - Build IGVM with v1 policy which will be rejected because on empty quote generation." - @echo " build-igvm-reject-all - Build IGVM with v1 policy which will be rejected because on empty quote generation." - @echo " build-igvm-get-quote-all - Build IGVM with v2 policy which will call getquote durining initialization." + @echo " build-igvm-accept-all - Build IGVM with allow-all v2 policy using mock quote data" + @echo " build-igvm-reject-all - Build IGVM with bad-FMSPC v2 policy (migration will be rejected)" + @echo " build-igvm-get-quote-all - Build IGVM with v2 policy to test the getquote during initialization.(no successful migration expected)" @echo " build-igvm-mock-quote - Build IGVM with v2 policy using mock quote data for testing." @echo " build-igvm-mock-quote-allow-all - Build IGVM with allow-all v2 policy using mock quote data." + @echo "" + @echo "Reproducible Docker build (wraps the above): ./docker_build_igvm.sh --help" pre-build: @if ! command -v rustc >/dev/null 2>&1 || ! rustc --version | grep -q "1.88.0"; then \ @@ -50,49 +57,105 @@ pre-build: chmod +x ../../sh_script/preparation.sh cd ../../ && ./sh_script/preparation.sh -build-igvm-accept: - cd ../../ && cargo image --no-default-features --features $(IGVM_FEATURES_DISABLE_RA_AND_ACCEPT_ALL) \ - --log-level $(LOG_LEVEL) --image-format igvm --output $(IGVM_FILE) --debug +# --- Hash generation (shared) --- -generate-hash-accept: - cd ../../ && cargo run -p migtd-hash -- --image $(IGVM_FILE) --test-disable-ra-and-accept-all \ - --manifest $(IGVM_MANIFEST) +generate-hash: + cd ../../ && cargo run -p migtd-hash -- --image $(IGVM_FILE) --manifest $(IGVM_MANIFEST) --policy-v2 -generate-hash-accept-verbose: - cd ../../ && cargo run -p migtd-hash -- --image $(IGVM_FILE) --test-disable-ra-and-accept-all \ - --verbose +generate-hash-verbose: + cd ../../ && cargo run -p migtd-hash -- --image $(IGVM_FILE) --manifest $(IGVM_MANIFEST) --verbose --policy-v2 -build-igvm-accept-all: pre-build build-igvm-accept generate-hash-accept +generate-hash-v2: generate-hash -generate-hash: - cd ../../ && cargo run -p migtd-hash -- --image $(IGVM_FILE) --manifest $(IGVM_MANIFEST) +generate-hash-accept: generate-hash-v2 + +generate-hash-get-quote: generate-hash-v2 + +generate-hash-v2-verbose: generate-hash-verbose + +# --- Default (same as get-quote, kept for pipeline) --- build-igvm: cd ../../ && cargo image --no-default-features --features $(IGVM_FEATURES_GET_QUOTE) --log-level $(LOG_LEVEL) \ - --image-format igvm --output $(IGVM_FILE) --debug + --image-format igvm --output $(IGVM_FILE) --debug \ + --policy-v2 --policy config/templates/policy_v2_signed.json \ + --policy-issuer-chain config/templates/policy_issuer_chain.pem \ + --root-ca config/Intel_SGX_Provisioning_Certification_RootCA_preproduction.cer + +build-igvm-all: pre-build build-igvm generate-hash-v2 + +# --- Shared v2 mock-quote IGVM build (used by accept, reject, mock-quote targets) --- + +build-igvm-v2-mock: + cd ../../ && cargo image --policy-v2 --debug \ + --image-format igvm \ + --no-default-features \ + --features $(IGVM_FEATURES_MOCK_QUOTE) \ + --log-level $(LOG_LEVEL) \ + --policy-issuer-chain config/Azure/policy_issuer_chain.pem \ + --policy config/Azure/policy_v2_signed.json \ + --output $(IGVM_FILE) -build-igvm-all: pre-build build-igvm generate-hash +# --- Accept-all (allow-all v2 policy + mock quote) --- -build-igvm-reject: - cd ../../ && cargo image --no-default-features --features $(IGVM_FEATURES_BASE) --log-level $(LOG_LEVEL) \ - --image-format igvm --output $(IGVM_FILE) --debug +generate-policy-accept: + chmod +x ./build_azure_mock_test.sh + ./build_azure_mock_test.sh --allow-all + @if [ $$? -ne 0 ]; then \ + echo "Failed to generate allow-all policy with mock report"; \ + exit 1; \ + fi -build-igvm-reject-all: pre-build build-igvm-reject generate-hash +build-igvm-accept: pre-build generate-policy-accept build-igvm-v2-mock -generate-hash-verbose: - cd ../../ && cargo run -p migtd-hash -- --image $(IGVM_FILE) --verbose --manifest $(IGVM_MANIFEST) +build-igvm-accept-all: build-igvm-accept generate-hash-v2 -build-igvm-get-quote: - cd ../../ && cargo image --no-default-features --features $(IGVM_FEATURES_GET_QUOTE) --log-level $(LOG_LEVEL) \ +# --- Reject-all (bad-FMSPC v2 policy + mock quote) --- + +generate-policy-reject: + chmod +x ./build_azure_mock_test.sh + ./build_azure_mock_test.sh --reject --skip-test + @if [ $$? -ne 0 ]; then \ + echo "Failed to generate reject policy with mock report"; \ + exit 1; \ + fi + +build-igvm-reject: pre-build generate-policy-reject build-igvm-v2-mock + +build-igvm-reject-all: build-igvm-reject test-reject generate-hash-v2 + +test-reject: + @echo "Running reject test (expecting migration failure with code 8)..." + cd ../../ && ./migtdemu.sh --policy-v2 \ + --policy-file config/Azure/policy_v2_signed.json \ + --policy-issuer-chain-file config/Azure/policy_issuer_chain.pem \ + --mock-report --both --no-sudo --log-level info; \ + EXIT_CODE=$$?; \ + if [ $$EXIT_CODE -eq 0 ]; then \ + echo "ERROR: Migration succeeded but should have been rejected!"; \ + exit 1; \ + fi; \ + if grep -q "code.* 8\|code: 8" migtd_migration_source.log 2>/dev/null; then \ + echo "✓ Reject test passed: migration correctly rejected with code 8"; \ + else \ + echo "ERROR: Migration failed but not with expected code 8"; \ + grep -i "failed\|error" migtd_migration_source.log 2>/dev/null | tail -5; \ + exit 1; \ + fi + +# --- Get-quote (v2 policy with real quote) --- + +# For testing getquote during initialization, no successful migration is expected. +build-igvm-get-quote: pre-build + cd ../../ && cargo image --no-default-features --features $(IGVM_FEATURES_GET_QUOTE_TEST) --log-level $(LOG_LEVEL) \ --image-format igvm --output $(IGVM_FILE) --debug \ --policy-v2 --policy config/templates/policy_v2_signed.json \ --policy-issuer-chain config/templates/policy_issuer_chain.pem \ --root-ca config/Intel_SGX_Provisioning_Certification_RootCA_preproduction.cer -generate-hash-get-quote: - cd ../../ && cargo run -p migtd-hash -- --image $(IGVM_FILE) --manifest $(IGVM_MANIFEST) --policy-v2 +build-igvm-get-quote-all: build-igvm-get-quote generate-hash-v2 -build-igvm-get-quote-all: pre-build build-igvm-get-quote generate-hash-get-quote +# --- Mock-quote (v2 policy + mock quote for testing) --- generate-policy-mock-quote: chmod +x ./build_azure_mock_test.sh @@ -102,15 +165,9 @@ generate-policy-mock-quote: exit 1; \ fi -build-igvm-mock-quote: pre-build generate-policy-mock-quote - cd ../../ && cargo image --policy-v2 --debug \ - --image-format igvm \ - --no-default-features \ - --features $(IGVM_FEATURES_BASE),use-mock-quote \ - --log-level $(LOG_LEVEL) \ - --policy-issuer-chain config/Azure/policy_issuer_chain.pem \ - --policy config/Azure/policy_v2_signed.json \ - --output $(IGVM_FILE) +build-igvm-mock-quote: pre-build generate-policy-mock-quote build-igvm-v2-mock + +# --- Mock-quote allow-all --- generate-policy-mock-quote-allow-all: chmod +x ./build_azure_mock_test.sh @@ -120,13 +177,4 @@ generate-policy-mock-quote-allow-all: exit 1; \ fi -build-igvm-mock-quote-allow-all: pre-build generate-policy-mock-quote-allow-all - cd ../../ && cargo image --policy-v2 --debug \ - --image-format igvm \ - --no-default-features \ - --features $(IGVM_FEATURES_BASE),use-mock-quote \ - --log-level $(LOG_LEVEL) \ - --policy-issuer-chain config/Azure/policy_issuer_chain.pem \ - --policy config/Azure/policy_v2_signed.json \ - --output $(IGVM_FILE) - +build-igvm-mock-quote-allow-all: pre-build generate-policy-mock-quote-allow-all build-igvm-v2-mock diff --git a/sh_script/Azure/build_azure_mock_test.sh b/sh_script/Azure/build_azure_mock_test.sh index 5b1061c1d..90cb09529 100755 --- a/sh_script/Azure/build_azure_mock_test.sh +++ b/sh_script/Azure/build_azure_mock_test.sh @@ -85,6 +85,7 @@ TOOLS_DIR="$PROJECT_ROOT/target/release" # Input Files POLICY_DATA_RAW="$SOURCE_MATERIAL_DIR/policy_data_raw.json" POLICY_ALLOW_ALL_DATA_RAW="$SOURCE_MATERIAL_DIR/policy_allow_all_data_raw.json" +POLICY_REJECT_DATA_RAW="$SOURCE_MATERIAL_DIR/policy_reject_data_raw.json" TD_IDENTITY_TEMPLATE="$SOURCE_MATERIAL_DIR/td_identity.json" TCB_MAPPING_TEMPLATE="$SOURCE_MATERIAL_DIR/tcb_mapping.json" COLLATERALS_FILE="$SOURCE_MATERIAL_DIR/collateral_thim.json" @@ -141,6 +142,7 @@ generate_certificates() { local cert_validity_days="${3:-365}" local root_ca_subject="${4:-/CN=MigTD Root CA/O=Microsoft Corporation}" local leaf_subject="${5:-/CN=MigTD Policy Issuer/O=Microsoft Corporation}" + local signer_eku_oid="${MIGTD_SIGNER_EKU_OID:-1.3.6.1.4.1.32473.1.1}" # Validate key type first if [ "$key_type" != "P384" ]; then @@ -191,7 +193,7 @@ generate_certificates() { -days $cert_validity_days \ -$hash_algo \ -extensions v3_ca \ - -extfile <(echo -e "[v3_ca]\nkeyUsage = digitalSignature") + -extfile <(printf '[v3_ca]\nkeyUsage = digitalSignature\nextendedKeyUsage = %s\n' "$signer_eku_oid") # Create certificate chain (leaf + root) echo "7. Creating certificate chain..." @@ -201,12 +203,96 @@ generate_certificates() { rm -f "$output_dir/policy_signing.csr" } +validate_rotated_leaf_certificates() { + local source_dir="$1" + local rotated_dir="$2" + local source_subject rotated_subject + + if ! cmp -s "$source_dir/root_ca.pem" "$rotated_dir/root_ca.pem"; then + echo "Error: Rotated leaf does not use the original root CA." >&2 + exit 1 + fi + + source_subject=$(openssl x509 -in "$source_dir/policy_signing.pem" \ + -noout -subject -nameopt RFC2253) + rotated_subject=$(openssl x509 -in "$rotated_dir/policy_signing.pem" \ + -noout -subject -nameopt RFC2253) + if [ "$source_subject" != "$rotated_subject" ]; then + echo "Error: Rotated leaf Subject Name differs from the original." >&2 + exit 1 + fi + + if cmp -s \ + <(openssl pkey -in "$source_dir/policy_signing.key" -pubout 2>/dev/null) \ + <(openssl pkey -in "$rotated_dir/policy_signing.key" -pubout 2>/dev/null); then + echo "Error: Rotated leaf reused the original public key." >&2 + exit 1 + fi +} + +generate_rotated_leaf_certificates() { + local source_dir="$1" + local output_dir="$2" + local curve_name + local hash_algo + local leaf_subject="/CN=MigTD Policy Issuer/O=Microsoft Corporation" + + for file in root_ca.key root_ca.pem policy_signing.key policy_signing.pem; do + if [ ! -f "$source_dir/$file" ]; then + echo "Error: Cannot rotate leaf; missing $source_dir/$file" >&2 + exit 1 + fi + done + + mkdir -p "$output_dir" + cp "$source_dir/root_ca.key" "$output_dir/root_ca.key" + cp "$source_dir/root_ca.pem" "$output_dir/root_ca.pem" + + curve_name=$(get_curve_name "P384") + hash_algo=$(get_hash_algorithm "P384") + + echo "Generating rotated policy signing private key..." + openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:$curve_name \ + -out "$output_dir/policy_signing.key" + openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt \ + -in "$output_dir/policy_signing.key" \ + -out "$output_dir/policy_signing_pkcs8.key" + openssl req -new \ + -key "$output_dir/policy_signing.key" \ + -out "$output_dir/policy_signing.csr" \ + -subj "$leaf_subject" + openssl x509 -req \ + -in "$output_dir/policy_signing.csr" \ + -CA "$output_dir/root_ca.pem" \ + -CAkey "$output_dir/root_ca.key" \ + -CAcreateserial \ + -out "$output_dir/policy_signing.pem" \ + -days 365 \ + -$hash_algo \ + -extensions v3_ca \ + -extfile <(echo -e "[v3_ca]\nkeyUsage = digitalSignature") + cat "$output_dir/policy_signing.pem" "$output_dir/root_ca.pem" \ + > "$output_dir/policy_issuer_chain.pem" + rm -f "$output_dir/policy_signing.csr" + + validate_rotated_leaf_certificates "$source_dir" "$output_dir" +} + # Parse command line arguments USE_MOCK_REPORT=false MOCK_QUOTE_FILE="" FETCH_COLLATERALS=false AZURE_REGION="useast" ALLOW_ALL=false +REJECT=false +CERT_DIR_OVERRIDE="" +SERVTD_CERT_DIR_OVERRIDE="" +ROTATE_LEAF_FROM="" +MEASURED_IMAGE="" +MEASURED_MANIFEST="$PROJECT_ROOT/config/Azure/servtd_info.json" +POLICY_SVN_OVERRIDE="" +REVOKE_TDINFO_HASHES=() +TCB_MAPPING_INPUT="" while [[ $# -gt 0 ]]; do case $1 in @@ -224,6 +310,10 @@ while [[ $# -gt 0 ]]; do ALLOW_ALL=true shift ;; + --reject) + REJECT=true + shift + ;; --fetch-collaterals) FETCH_COLLATERALS=true shift @@ -232,16 +322,74 @@ while [[ $# -gt 0 ]]; do AZURE_REGION="$2" shift 2 ;; + --cert-dir) + CERT_DIR_OVERRIDE="$2" + shift 2 + ;; + --rotate-leaf-from) + ROTATE_LEAF_FROM="$2" + shift 2 + ;; + --servtd-cert-dir) + SERVTD_CERT_DIR_OVERRIDE="$2" + shift 2 + ;; + --measured-image) + MEASURED_IMAGE="$2" + shift 2 + ;; + --measured-manifest) + MEASURED_MANIFEST="$2" + shift 2 + ;; + --policy-svn) + POLICY_SVN_OVERRIDE="$2" + shift 2 + ;; + --tcb-mapping) + TCB_MAPPING_INPUT="$2" + shift 2 + ;; + --revoke-tdinfo-hash) + REVOKE_TDINFO_HASHES+=("$2") + shift 2 + ;; -h|--help) echo "Usage: $0 [OPTIONS]" echo echo "Options:" echo " --output-dir DIR Output directory for generated files (default: config/Azure)" echo " --allow-all Use allow-all policy rules (no TCB/platform/servtd checks)" + echo " --reject Use reject policy (bad FMSPC — migration will be rejected)" echo " --skip-test Skip running the MigTD test at the end" echo " --fetch-collaterals Fetch fresh collaterals from Azure THIM before generating policy" echo " --azure-region REGION Azure region for THIM (useast, westus, northeurope)" echo " (default: useast, applies with --fetch-collaterals)" + echo " --cert-dir DIR Reuse (or persist) the signing key + issuer chain in DIR" + echo " instead of a throwaway temp dir. If DIR already contains" + echo " a key + issuer chain, they are reused as-is (no new" + echo " certs generated, private key NOT deleted at the end)." + echo " Needed for a stable RTMR1 across multiple invocations," + echo " e.g. the two-phase measure-then-bind tcb_mapping flow." + echo " --rotate-leaf-from DIR Generate/reuse a new policy leaf key in --cert-dir," + echo " signed by DIR's root CA with the same leaf Subject Name." + echo " --servtd-cert-dir DIR Sign TD identity and TCB mapping collateral with DIR's" + echo " existing key/chain while the outer policy uses --cert-dir." + echo " This supports policy-leaf-only key rotation." + echo " --measured-image IGVM Add the REAL tdinfo_hash of an already-built MigTD IGVM" + echo " to the cumulative TCB mapping, instead of using" + echo " the mock report's synthetic values. Pairs with --cert-dir" + echo " in a two-phase build: (1) build a placeholder-policy image" + echo " with a persistent cert dir, (2) re-run with --measured-image" + echo " pointing at that image + the same --cert-dir to bind the real" + echo " measurements into the signed tcb_mapping/policy." + echo " --measured-manifest FILE Manifest used to measure --measured-image (default:" + echo " config/Azure/servtd_info.json)" + echo " --policy-svn SVN Override policySvn before signing (TiP/release staging)" + echo " --tcb-mapping FILE Previous authority-maintained mapping to extend" + echo " (default: existing output, then config/Azure)" + echo " --revoke-tdinfo-hash HASH Explicitly remove a historical tdinfo_hash" + echo " from the cumulative mapping (repeatable)" echo " -h, --help Show this help message" echo echo "Examples:" @@ -271,16 +419,31 @@ echo " Fetch collaterals: $FETCH_COLLATERALS" if [ "$FETCH_COLLATERALS" = true ]; then echo " Azure region: $AZURE_REGION" fi +if [ "${#REVOKE_TDINFO_HASHES[@]}" -gt 0 ]; then + echo " Explicit mapping revocations: ${REVOKE_TDINFO_HASHES[*]}" +fi +if [ -n "$POLICY_SVN_OVERRIDE" ]; then + echo " Policy SVN override: $POLICY_SVN_OVERRIDE" +fi echo # Ensure output directory exists mkdir -p "$OUTPUT_DIR" +if [ -n "$CERT_DIR_OVERRIDE" ]; then + CERT_DIR="$CERT_DIR_OVERRIDE" + PRIVATE_KEY="$CERT_DIR/policy_signing_pkcs8.key" +fi +SERVTD_CERT_DIR="${SERVTD_CERT_DIR_OVERRIDE:-$CERT_DIR}" +SERVTD_PRIVATE_KEY="$SERVTD_CERT_DIR/policy_signing_pkcs8.key" mkdir -p "$CERT_DIR" # Select which policy data file to use if [ "$ALLOW_ALL" = true ]; then ACTIVE_POLICY_DATA_RAW="$POLICY_ALLOW_ALL_DATA_RAW" echo -e "${YELLOW}Using allow-all policy rules (no TCB/platform/servtd checks)${NC}" +elif [ "$REJECT" = true ]; then + ACTIVE_POLICY_DATA_RAW="$POLICY_REJECT_DATA_RAW" + echo -e "${YELLOW}Using reject policy (bad FMSPC — migration will be rejected)${NC}" else ACTIVE_POLICY_DATA_RAW="$POLICY_DATA_RAW" fi @@ -293,12 +456,21 @@ if [ ! -f "$TD_IDENTITY_TEMPLATE" ]; then fi if [ ! -f "$TCB_MAPPING_TEMPLATE" ]; then echo -e "${YELLOW}Generating default tcb_mapping.json template${NC}" - printf '{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","mrSigner":"%s","isvProdId":1,"svnMappings":[{"tdMeasurements":{"mrtd":"%s","rtmr0":"%s","rtmr1":"%s"},"isvsvn":1}]}' \ - "$(printf '0%.0s' {1..96})" "$(printf '0%.0s' {1..96})" "$(printf '0%.0s' {1..96})" "$(printf '0%.0s' {1..96})" > "$TCB_MAPPING_TEMPLATE" + cp "$PROJECT_ROOT/config/templates/tcb_mapping_seed.json" "$TCB_MAPPING_TEMPLATE" +fi + +if [[ -n "$TCB_MAPPING_INPUT" && "$TCB_MAPPING_INPUT" != /* ]]; then + TCB_MAPPING_INPUT="$PROJECT_ROOT/$TCB_MAPPING_INPUT" +fi +TCB_MAPPING_SOURCE="$TCB_MAPPING_TEMPLATE" +if [ -n "$TCB_MAPPING_INPUT" ]; then + TCB_MAPPING_SOURCE="$TCB_MAPPING_INPUT" +elif [ -f "$OUTPUT_DIR/tcb_mapping.json" ]; then + TCB_MAPPING_SOURCE="$OUTPUT_DIR/tcb_mapping.json" fi # Verify input files exist -for file in "$ACTIVE_POLICY_DATA_RAW"; do +for file in "$ACTIVE_POLICY_DATA_RAW" "$TCB_MAPPING_SOURCE"; do if [ ! -f "$file" ]; then echo -e "${RED}Error: Required input file not found: $file${NC}" >&2 exit 1 @@ -374,6 +546,9 @@ cargo build --release -p servtd-collateral-generator 2>&1 | grep -E "(Compiling| echo "Building migtd-policy-generator..." cargo build --release -p migtd-policy-generator 2>&1 | grep -E "(Compiling|Finished|error)" || true +echo "Building migtd-hash..." +cargo build --release -p migtd-hash 2>&1 | grep -E "(Compiling|Finished|error)" || true + # Verify tools exist # Note: azcvm-extract-report is in a different location if [ ! -f "$PROJECT_ROOT/deps/td-shim-AzCVMEmu/azcvm-extract-report/target/release/azcvm-extract-report" ]; then @@ -381,7 +556,7 @@ if [ ! -f "$PROJECT_ROOT/deps/td-shim-AzCVMEmu/azcvm-extract-report/target/relea exit 1 fi -for tool in json-signer servtd-collateral-generator migtd-policy-generator; do +for tool in json-signer servtd-collateral-generator migtd-policy-generator migtd-hash; do if [ ! -f "$TOOLS_DIR/$tool" ]; then echo -e "${RED}Error: Tool '$tool' not found at $TOOLS_DIR/$tool${NC}" >&2 exit 1 @@ -428,6 +603,23 @@ MRSIGNER=$(jq -r '.mrsigner // "000000000000000000000000000000000000000000000000 ISV_PROD_ID=$(jq -r '.isvProdId // 0' "$REPORT_DATA_FILE") ISVSVN=$(jq -r '.isvsvn // 1' "$REPORT_DATA_FILE") +# Select the source for the current release's tdinfo_hash. TD identity fields +# continue to come from the report; only the TCB mapping uses the measured +# image when requested. +MAPPING_MEASUREMENT_ARGS=(--from-report "$REPORT_DATA_FILE") +if [ -n "$MEASURED_IMAGE" ]; then + # Resolve to absolute paths since we're running from $TEMP_DIR. + MEASURED_IMAGE_ABS="$MEASURED_IMAGE" + [[ "$MEASURED_IMAGE_ABS" = /* ]] || MEASURED_IMAGE_ABS="$PROJECT_ROOT/$MEASURED_IMAGE" + MEASURED_MANIFEST_ABS="$MEASURED_MANIFEST" + [[ "$MEASURED_MANIFEST_ABS" = /* ]] || MEASURED_MANIFEST_ABS="$PROJECT_ROOT/$MEASURED_MANIFEST" + MAPPING_MEASUREMENT_ARGS=( + --manifest "$MEASURED_MANIFEST_ABS" + --image "$MEASURED_IMAGE_ABS" + ) + echo -e "${YELLOW}Using real tdinfo_hash measured from: $MEASURED_IMAGE${NC}" +fi + echo "Extracted measurements:" echo " MRTD: ${MRTD:0:32}..." echo " RTMR0: ${RTMR0:0:32}..." @@ -441,30 +633,67 @@ echo # Make sure no ending newline is added (important for signing) # echo -e "${BLUE}=== Step 3: Updating TD Identity Template ===${NC}" -# Set tcbDate and issueDate to current time so they satisfy the policy's -# servtd tcbDate reference (which uses an absolute date). -CURRENT_UTC=$(date -u +"%Y-%m-%dT%H:%M:%SZ") +# Conditionally update tcbDate and issueDate only when they are behind the +# policy's servtd tcbDate reference (greater-or-equal check). +POLICY_TCB_REF=$(jq -r ' + [.policy[] | .servtd.migtdIdentity.tcbDate.reference // empty] | + map(select(. != "")) | max // empty +' "$ACTIVE_POLICY_DATA_RAW" 2>/dev/null) + +DATE_UPDATES="" +if [ -n "$POLICY_TCB_REF" ]; then + CURRENT_UTC=$(date -u +"%Y-%m-%dT%H:%M:%SZ") + TEMPLATE_TCB_DATE=$(jq -r '.tcbLevels[0].tcbDate' "$TD_IDENTITY_TEMPLATE") + TEMPLATE_ISSUE_DATE=$(jq -r '.issueDate' "$TD_IDENTITY_TEMPLATE") + if [[ "$TEMPLATE_TCB_DATE" < "$POLICY_TCB_REF" ]]; then + DATE_UPDATES="$DATE_UPDATES | .tcbLevels[0].tcbDate = \"$CURRENT_UTC\"" + echo -e " Updating tcbDate: $TEMPLATE_TCB_DATE -> $CURRENT_UTC (reference: $POLICY_TCB_REF)" + fi + if [[ "$TEMPLATE_ISSUE_DATE" < "$POLICY_TCB_REF" ]]; then + DATE_UPDATES="$DATE_UPDATES | .issueDate = \"$CURRENT_UTC\"" + echo -e " Updating issueDate: $TEMPLATE_ISSUE_DATE -> $CURRENT_UTC (reference: $POLICY_TCB_REF)" + fi +fi + jq -c ".xfam = \"$XFAM\" | .attributes = \"$ATTRIBUTES\" | .mrConfigId = \"$MR_CONFIG_ID\" | \ .mrOwner = \"$MR_OWNER\" | .mrOwnerConfig = \"$MR_OWNER_CONFIG\" | .mrsigner = \"$MRSIGNER\" | \ -.isvProdId = $ISV_PROD_ID | .tcbLevels[0].tcb.isvsvn = $ISVSVN | \ -.tcbLevels[0].tcbDate = \"$CURRENT_UTC\" | .issueDate = \"$CURRENT_UTC\"" \ +.isvProdId = $ISV_PROD_ID | .tcbLevels[0].tcb.isvsvn = $ISVSVN $DATE_UPDATES" \ "$TD_IDENTITY_TEMPLATE" | tr -d '\n' > "$TD_IDENTITY_UPDATED" echo -e "${GREEN}✓ TD Identity updated: $TD_IDENTITY_UPDATED${NC}" echo # -# Step 4: Update tcb_mapping.json with extracted measurements +# Step 4: Update the cumulative tcb_mapping.json with the v2 tdinfo_hash # Make sure no ending newline is added (important for signing) # -echo -e "${BLUE}=== Step 4: Updating TCB Mapping Template ===${NC}" -jq -c ".svnMappings[0].tdMeasurements.mrtd = \"$MRTD\" | \ -.svnMappings[0].tdMeasurements.rtmr0 = \"$RTMR0\" | \ -.svnMappings[0].tdMeasurements.rtmr1 = \"$RTMR1\" | \ -.svnMappings[0].isvsvn = $ISVSVN" \ -"$TCB_MAPPING_TEMPLATE" | tr -d '\n' > "$TCB_MAPPING_UPDATED" +# The Rust helper retains all supported historical hashes, replaces the +# current hash by key, rejects conflicting duplicates, applies only explicit +# revocations, and emits deterministic compact JSON for signing. It computes +# the hash through the same migtd-hash path used by the release pipeline. +# +echo -e "${BLUE}=== Step 4: Updating Cumulative TCB Mapping ===${NC}" + +TDINFO_HASH_FILE="$TEMP_DIR/tdinfo_hash.hex" +MAPPING_UPDATE_ARGS=( + --update-tcb-mapping "$TCB_MAPPING_SOURCE" + --output-tcb-mapping "$TCB_MAPPING_UPDATED" + --mapping-isvsvn "$ISVSVN" +) +for hash in "${REVOKE_TDINFO_HASHES[@]}"; do + MAPPING_UPDATE_ARGS+=(--revoke-tdinfo-hash "$hash") +done +"$TOOLS_DIR/migtd-hash" \ + --policy-v2 \ + "${MAPPING_MEASUREMENT_ARGS[@]}" \ + --output-tdinfo-hash "$TDINFO_HASH_FILE" \ + "${MAPPING_UPDATE_ARGS[@]}" +# Uppercase to match the convention used by signed policies. +TDINFO_HASH=$(tr 'a-z' 'A-Z' < "$TDINFO_HASH_FILE") echo -e "${GREEN}✓ TCB Mapping updated: $TCB_MAPPING_UPDATED${NC}" +echo -e " history source = $TCB_MAPPING_SOURCE" +echo -e " tdinfo_hash = $TDINFO_HASH" echo # @@ -481,9 +710,24 @@ echo # Step 5: Generate certificates and signing key # echo -e "${BLUE}=== Step 5: Generating Certificates ===${NC}" -generate_certificates "$CERT_DIR" "P384" 365 +if [ -n "$ROTATE_LEAF_FROM" ] && + [ -f "$PRIVATE_KEY" ] && + [ -f "$CERT_DIR/policy_issuer_chain.pem" ]; then + echo "Reusing rotated certificate chain + signing key in: $CERT_DIR" + validate_rotated_leaf_certificates "$ROTATE_LEAF_FROM" "$CERT_DIR" +elif [ -n "$ROTATE_LEAF_FROM" ]; then + generate_rotated_leaf_certificates "$ROTATE_LEAF_FROM" "$CERT_DIR" +elif [ -n "$CERT_DIR_OVERRIDE" ] && [ -f "$PRIVATE_KEY" ] && [ -f "$CERT_DIR/policy_issuer_chain.pem" ]; then + echo "Reusing existing certificate chain + signing key in: $CERT_DIR" +else + generate_certificates "$CERT_DIR" "P384" 365 +fi echo -e "${GREEN}✓ Certificates generated in: $CERT_DIR${NC}" +if [ ! -f "$SERVTD_PRIVATE_KEY" ] || [ ! -f "$SERVTD_CERT_DIR/policy_issuer_chain.pem" ]; then + echo "Error: ServTD signing key/chain not found in: $SERVTD_CERT_DIR" >&2 + exit 1 +fi echo # @@ -493,7 +737,7 @@ echo -e "${BLUE}=== Step 6: Signing TD Identity ===${NC}" "$TOOLS_DIR/json-signer" \ --sign \ --name "tdIdentity" \ - --private-key "$PRIVATE_KEY" \ + --private-key "$SERVTD_PRIVATE_KEY" \ --input "$TD_IDENTITY_UPDATED" \ --output "$TD_IDENTITY_SIGNED" @@ -507,7 +751,7 @@ echo -e "${BLUE}=== Step 7: Signing TCB Mapping ===${NC}" "$TOOLS_DIR/json-signer" \ --sign \ --name "tdTcbMapping" \ - --private-key "$PRIVATE_KEY" \ + --private-key "$SERVTD_PRIVATE_KEY" \ --input "$TCB_MAPPING_UPDATED" \ --output "$TCB_MAPPING_SIGNED" @@ -518,8 +762,8 @@ echo # Step 8: Generate servtd_collateral.json # echo -e "${BLUE}=== Step 8: Generating ServTD Collateral ===${NC}" -IDENTITY_CHAIN="$CERT_DIR/policy_issuer_chain.pem" -MAPPING_CHAIN="$CERT_DIR/policy_issuer_chain.pem" +IDENTITY_CHAIN="$SERVTD_CERT_DIR/policy_issuer_chain.pem" +MAPPING_CHAIN="$SERVTD_CERT_DIR/policy_issuer_chain.pem" "$TOOLS_DIR/servtd-collateral-generator" \ --identity "$TD_IDENTITY_SIGNED" \ @@ -541,6 +785,14 @@ echo -e "${BLUE}=== Step 9: Merging Policy Data ===${NC}" --servtd-collateral "$SERVTD_COLLATERAL" \ --output "$POLICY_DATA_MERGED" +if [ -n "$POLICY_SVN_OVERRIDE" ]; then + POLICY_DATA_WITH_SVN="$TEMP_DIR/policy_data_with_svn.json" + jq -c --argjson svn "$POLICY_SVN_OVERRIDE" \ + '.policySvn = $svn' \ + "$POLICY_DATA_MERGED" | tr -d '\n' > "$POLICY_DATA_WITH_SVN" + mv "$POLICY_DATA_WITH_SVN" "$POLICY_DATA_MERGED" +fi + echo -e "${GREEN}✓ Policy data merged: $POLICY_DATA_MERGED${NC}" echo @@ -571,7 +823,9 @@ echo # Step 12: Securely delete private key # echo -e "${BLUE}=== Step 12: Cleaning Up Private Key ===${NC}" -if [ -f "$PRIVATE_KEY" ]; then +if [ -n "$CERT_DIR_OVERRIDE" ]; then + echo -e "${YELLOW}Keeping private key (--cert-dir reuse requested): $PRIVATE_KEY${NC}" +elif [ -f "$PRIVATE_KEY" ]; then shred -u "$PRIVATE_KEY" 2>/dev/null || rm -f "$PRIVATE_KEY" echo -e "${GREEN}✓ Private key securely deleted${NC}" fi diff --git a/sh_script/Azure/docker_build_igvm.sh b/sh_script/Azure/docker_build_igvm.sh new file mode 100755 index 000000000..2dfaf30f7 --- /dev/null +++ b/sh_script/Azure/docker_build_igvm.sh @@ -0,0 +1,175 @@ +#!/usr/bin/env bash +# +# Build the MigTD **Azure IGVM** image inside a pinned, reproducible Docker +# container and extract the resulting `migtd.igvm` plus its measurements. +# +# It builds the toolchain image from sh_script/Azure/Dockerfile (same pinned +# ubuntu base as container/Dockerfile, so the clang/llvm that compiles `ring` +# is frozen and the IGVM is reproducible), then runs the Azure Makefile target +# inside a throw-away container. +# +# Two source modes: +# local (default) : your current working tree (minus target/ and .git) is +# copied in and built with `make build-igvm generate-hash-v2`. +# The tree must already be prepared (submodules initialised +# and sh_script/preparation.sh applied) -- it normally is if +# you have built MigTD before. If not, use --clone. +# --clone [REF] : a pristine `git clone --recursive` is done inside the +# container and built with `make build-igvm-all` (runs the +# full preparation). Most reproducible; ignores local edits. +# +# Usage: +# sh_script/Azure/docker_build_igvm.sh [options] +# +# Options: +# -t, --target <make-target> Makefile target(s) to run (overrides the mode +# default). e.g. build-igvm-mock-quote-allow-all +# -o, --output <dir> Output directory (default: sh_script/Azure/output) +# --image <name:tag> Builder image tag (default: migtd-igvm-build:latest) +# --clone [REF] Build a fresh recursive clone instead of the +# local tree (optionally checkout REF / commit). +# --repo <url> Repo URL for --clone (default: intel/MigTD). +# --rebuild-image Force rebuild of the builder image. +# --no-cache Pass --no-cache to `docker build`. +# -h, --help Show this help. +# +# Examples: +# # Build the IGVM from your current checkout +# sh_script/Azure/docker_build_igvm.sh +# +# # Reproducible build of a specific upstream commit +# sh_script/Azure/docker_build_igvm.sh --clone <commit-sha> +# +# # Build the allow-all mock-quote test IGVM +# sh_script/Azure/docker_build_igvm.sh -t build-igvm-mock-quote-allow-all +# +set -euo pipefail + +SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd) +REPO_ROOT=$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || (cd "$SCRIPT_DIR/../.." && pwd)) + +IMAGE="migtd-igvm-build:latest" +MODE="local" +REF="" +REPO_URL="https://github.com/intel/MigTD.git" +TARGET="" +OUTPUT="$SCRIPT_DIR/output" +REBUILD_IMAGE=0 +DOCKER_BUILD_ARGS=() + +err() { echo -e "\e[1;31mERROR:\e[0m $*" >&2; } +info() { echo -e "\e[1;34m[*]\e[0m $*"; } + +usage() { sed -n '2,/^set -euo/p' "${BASH_SOURCE[0]}" | sed '$d; s/^#\?//'; } + +while [ $# -gt 0 ]; do + case "$1" in + -t|--target) TARGET="$2"; shift 2;; + -o|--output) OUTPUT="$2"; shift 2;; + --image) IMAGE="$2"; shift 2;; + --clone) MODE="clone"; + if [ "${2-}" ] && [[ "$2" != -* ]]; then REF="$2"; shift; fi + shift;; + --repo) REPO_URL="$2"; shift 2;; + --rebuild-image) REBUILD_IMAGE=1; shift;; + --no-cache) DOCKER_BUILD_ARGS+=(--no-cache); shift;; + -h|--help) usage; exit 0;; + *) err "Unknown option: $1"; usage; exit 1;; + esac +done + +command -v docker >/dev/null 2>&1 || { err "docker is not installed or not on PATH."; exit 1; } + +# Default Makefile target depends on the source mode. +if [ -z "$TARGET" ]; then + if [ "$MODE" = "clone" ]; then TARGET="build-igvm-all"; else TARGET="build-igvm generate-hash-v2"; fi +fi + +# Sanity check for local mode: the tree must be prepared. +if [ "$MODE" = "local" ]; then + if [ ! -f "$REPO_ROOT/deps/td-shim/Cargo.toml" ] || [ ! -f "$REPO_ROOT/deps/spdm-rs/Cargo.toml" ]; then + err "Submodules are not initialised in $REPO_ROOT." + err "Run: git submodule update --init --recursive && ./sh_script/preparation.sh" + err "or build a pristine tree with: $0 --clone" + exit 1 + fi +fi + +mkdir -p "$OUTPUT" + +# 1) Build (or reuse) the pinned builder image. +if [ "$REBUILD_IMAGE" -eq 1 ] || ! docker image inspect "$IMAGE" >/dev/null 2>&1; then + info "Building builder image: $IMAGE" + docker build "${DOCKER_BUILD_ARGS[@]}" -t "$IMAGE" -f "$SCRIPT_DIR/Dockerfile" "$SCRIPT_DIR" +else + info "Reusing builder image: $IMAGE (use --rebuild-image to refresh)" +fi + +# 2) Generate the in-container build script for the chosen mode. +WORK="$(mktemp -d)" +cleanup() { + if [ -n "${CID-}" ]; then docker rm -f "$CID" >/dev/null 2>&1 || true; fi + rm -rf "$WORK" +} +trap cleanup EXIT + +if [ "$MODE" = "clone" ]; then + { + echo 'set -euxo pipefail' + echo 'rm -rf /root/MigTD && git clone --recursive '"$REPO_URL"' /root/MigTD' + echo 'cd /root/MigTD' + if [ -n "$REF" ]; then + echo 'git -c advice.detachedHead=false checkout '"$REF"' && git submodule update --init --recursive' + fi + echo 'cd sh_script/Azure && make '"$TARGET" + } > "$WORK/_build.sh" +else + { + echo 'set -euxo pipefail' + # The local tree is copied without .git, but ring/build.rs uses the + # presence of deps/td-shim/library/ring/.git to decide whether to + # generate prefix_symbols.h + perlasm/nasm from source (the path a real + # `git clone --recursive` takes). Recreate that marker so the local + # build matches the clone build. build.rs only tests existence, so the + # marker content is irrelevant. + echo 'echo gitlink > /root/MigTD/deps/td-shim/library/ring/.git' + # Mark this no-Git copy as an ephemeral source export so attestation + # pruning can run without weakening checkout safety checks. + echo 'export MIGTD_SOURCE_EXPORT=1' + echo 'cd /root/MigTD/sh_script/Azure && make '"$TARGET" + } > "$WORK/_build.sh" +fi + +# 3) Create the container, inject source (+ build script), run, extract. +CID=$(docker create -w /root/MigTD "$IMAGE" bash /root/_build.sh) +docker cp "$WORK/_build.sh" "$CID:/root/_build.sh" + +if [ "$MODE" = "local" ]; then + info "Copying local working tree into container (excluding target/ and .git)" + tar -C "$REPO_ROOT" \ + --exclude='./target' --exclude='*/target' \ + --exclude='.git' \ + --exclude='./sh_script/Azure/output' \ + -cf - . | docker cp - "$CID:/root/MigTD" +fi + +info "Building Azure IGVM (mode: $MODE, target: $TARGET)" +set +e +docker start -a "$CID" 2>&1 | tee "$OUTPUT/build.log" +rc=${PIPESTATUS[0]} +set -e +if [ "$rc" -ne 0 ]; then + err "Build failed (exit $rc). See $OUTPUT/build.log" + exit "$rc" +fi + +# 4) Extract artifacts. +info "Extracting artifacts to $OUTPUT" +docker cp "$CID:/root/MigTD/target/release/migtd.igvm" "$OUTPUT/migtd.igvm" +( cd "$OUTPUT" && sha256sum migtd.igvm | tee migtd.igvm.sha256 ) +# The MRTD/RTMR measurements are emitted by `generate-hash` into the build log. +grep -iE 'MR_TD|MRTD|RTMR|measurement|servtd|SHA384|hash' "$OUTPUT/build.log" \ + > "$OUTPUT/migtd.igvm.measurements.txt" 2>/dev/null || true + +info "Done. Artifacts in $OUTPUT:" +ls -l "$OUTPUT" diff --git a/sh_script/Azure/reproducible_build.md b/sh_script/Azure/reproducible_build.md new file mode 100644 index 000000000..10f573fa8 --- /dev/null +++ b/sh_script/Azure/reproducible_build.md @@ -0,0 +1,130 @@ +# Reproducible Azure IGVM Builds + +This document describes the supported reproducible build path for the Azure +`migtd.igvm` image. It does not define reproducibility guarantees for other +image formats or build environments. + +## Build interface + +`docker_build_igvm.sh` builds MigTD with the environment defined by the Azure +`Dockerfile`, runs a target from the Azure `Makefile`, and extracts the IGVM +image and build records from a fresh container. + +### Current working tree + +Prepare the checkout, then build it: + +```bash +git submodule update --init --recursive +bash sh_script/preparation.sh +sh_script/Azure/docker_build_igvm.sh \ + --rebuild-image \ + --output sh_script/Azure/output +``` + +This mode copies the current working tree into `/root/MigTD` in the container. +It includes local source changes but excludes `.git`, Cargo target directories, +and the Azure output directory. The default Make targets are `build-igvm` and +`generate-hash-v2`. + +### Clean repository revision + +Build a clean recursive clone at a full commit SHA: + +```bash +sh_script/Azure/docker_build_igvm.sh \ + --clone <commit-sha> \ + --repo https://github.com/microsoft/MigTD.git \ + --rebuild-image \ + --output sh_script/Azure/output +``` + +Clone mode checks out the requested revision and uses the `build-igvm-all` +target, which initializes the required build inputs before producing the +image. + +Use `--target` to select a different target from the Azure `Makefile`. The +target, its feature set, and all policy inputs are part of the image's +reproducibility inputs. + +## Builder environment + +The Azure `Dockerfile` provides: + +- an Ubuntu base image pinned by digest; +- Rust `1.88.0`, `rust-src`, and the `x86_64-unknown-none` target; +- Clang, LLVM, NASM, and the SGX/DCAP attestation build dependencies; and +- a fixed `/root/MigTD` source path inside the container. + +`--rebuild-image` rebuilds the builder image from the Dockerfile. Without that +option, the wrapper reuses the configured local image tag when it already +exists. + +Dependency tracking is limited. At the repository level, dependency versions +are tracked only for Cargo dependencies through `Cargo.lock`. The Dockerfile +specifies Ubuntu APT package names rather than exact package versions, and the +Rust installer and toolchain artifacts are not locked by `Cargo.lock`. + +Rebuilding the builder image later can therefore resolve different compiler or +system-package artifacts. For a release that must be reproduced later, retain +the built container image and record its image identifier instead of relying +only on rebuilding the Dockerfile. + +## Reproducibility inputs + +All output-affecting inputs must match: + +- the MigTD commit and recursive submodule commits; +- `Cargo.lock`, `rust-toolchain`, and preparation patches; +- the built Azure builder image; +- the selected Azure Make target and its build options; +- policy, certificate, trust-anchor, collateral, and manifest files; and +- any generated inputs embedded in the IGVM. + +Freshly generated keys, certificates, signatures, or fetched collateral may +change the final image. Preserve those inputs when an identical IGVM is +required. + +## Build outputs + +The output directory contains: + +| File | Contents | +|------|----------| +| `migtd.igvm` | Azure IGVM image | +| `migtd.igvm.sha256` | SHA-256 checksum of the image | +| `migtd.igvm.measurements.txt` | Measurement-related lines from the build log | +| `build.log` | Complete container build log | + +## CI verification + +`.github/workflows/reproducible-igvm.yml` verifies this build path by: + +1. checking out the requested revision with recursive submodules; +2. applying the repository preparation step; +3. building the Azure `build-igvm` target twice in separate containers that + reuse the same builder image; +4. comparing the two IGVM SHA-256 values; and +5. failing and uploading both images when the values differ. + +The workflow runs weekly, through manual dispatch, and for pull requests that +modify the Azure build environment or other listed build inputs. + +Matching IGVM bytes produce the same MRTD. The CI job verifies repeatability +within one built Azure builder image; it does not compare independently rebuilt +builder images. + +## Release records + +Retain the following with each published Azure IGVM: + +- the full MigTD commit and recursive submodule commits; +- the Azure builder image identifier; +- the exact wrapper command and Make target; +- all policy, trust, collateral, and manifest inputs; +- `migtd.igvm`, `migtd.igvm.sha256`, and + `migtd.igvm.measurements.txt`; and +- `build.log`. + +Reproducibility establishes output equality. Source, builder, policy, and +checksum provenance must be authenticated separately. diff --git a/sh_script/Azure/tip/Install-TipDependencies.ps1 b/sh_script/Azure/tip/Install-TipDependencies.ps1 new file mode 100644 index 000000000..c8089cb29 --- /dev/null +++ b/sh_script/Azure/tip/Install-TipDependencies.ps1 @@ -0,0 +1,277 @@ +#Requires -Version 7.0 +#Requires -RunAsAdministrator + +<# +.SYNOPSIS + Install the dependencies bundled with a MigTD TiP package. + +.DESCRIPTION + Installs PowerTest and HCSTest v2 for PowerShell 7, installs the package's + matching VmgsTool, and optionally installs test Secure Firmware. Host + migration settings can also be configured and validated. +#> +[CmdletBinding(SupportsShouldProcess)] +param( + [string]$PackageDir = $PSScriptRoot, + [string]$PowerTestInstallRoot = "$env:ProgramFiles\PowerShell\Modules", + [string]$HcsTestInstallRoot = "$env:ProgramFiles\PowerShell\Modules", + [string]$VmgsToolInstallPath = "$env:SystemRoot\System32\vmgstool.exe", + [switch]$SkipSecureFirmware, + [switch]$ConfigureHost, + [switch]$Force +) + +$ErrorActionPreference = 'Stop' +Set-StrictMode -Version Latest + +function New-StagedModuleDirectory { + param( + [Parameter(Mandatory)] [string]$Source, + [Parameter(Mandatory)] [string]$Destination, + [Parameter(Mandatory)] [string]$Manifest + ) + + $manifestPath = Join-Path $Source $Manifest + if (-not (Test-Path -LiteralPath $manifestPath -PathType Leaf)) { + throw "Bundled module manifest not found: $manifestPath" + } + $destinationParent = Split-Path $Destination -Parent + New-Item -ItemType Directory -Path $destinationParent -Force | Out-Null + $stagingPath = "$Destination.install-$([guid]::NewGuid())" + New-Item -ItemType Directory -Path $stagingPath -Force | Out-Null + Get-ChildItem -LiteralPath $Source -Force | ForEach-Object { + Copy-Item -LiteralPath $_.FullName -Destination $stagingPath -Recurse -Force + } + Test-ModuleManifest -Path (Join-Path $stagingPath $Manifest) -ErrorAction Stop | Out-Null + return $stagingPath +} + +function Install-StagedModuleDirectories { + param( + [Parameter(Mandatory)] + [object[]]$Modules + ) + + $installed = [System.Collections.Generic.List[object]]::new() + try { + foreach ($module in $Modules) { + if (-not $PSCmdlet.ShouldProcess($module.Destination, "Install module from $($module.Source)")) { + continue + } + $backup = "$($module.Destination).backup-$([guid]::NewGuid())" + $hadDestination = Test-Path -LiteralPath $module.Destination + if ($hadDestination) { + Move-Item -LiteralPath $module.Destination -Destination $backup + } + try { + Move-Item -LiteralPath $module.StagingPath -Destination $module.Destination + } + catch { + if ($hadDestination -and + (Test-Path -LiteralPath $backup) -and + -not (Test-Path -LiteralPath $module.Destination)) { + Move-Item -LiteralPath $backup -Destination $module.Destination + } + throw + } + $installed.Add([pscustomobject]@{ + Destination = $module.Destination + Backup = $backup + HadDestination = $hadDestination + }) + } + } + catch { + for ($index = $installed.Count - 1; $index -ge 0; $index--) { + $entry = $installed[$index] + if (Test-Path -LiteralPath $entry.Destination) { + Remove-Item -LiteralPath $entry.Destination -Recurse -Force + } + if ($entry.HadDestination -and (Test-Path -LiteralPath $entry.Backup)) { + Move-Item -LiteralPath $entry.Backup -Destination $entry.Destination + } + } + throw + } + + foreach ($entry in $installed) { + if ($entry.HadDestination -and (Test-Path -LiteralPath $entry.Backup)) { + Remove-Item -LiteralPath $entry.Backup -Recurse -Force + } + } +} + +function Install-BundledFile { + param( + [Parameter(Mandatory)] [string]$Source, + [Parameter(Mandatory)] [string]$Destination, + [Parameter(Mandatory)] [string]$Description + ) + + if (-not (Test-Path -LiteralPath $Source -PathType Leaf)) { + throw "Bundled $Description not found: $Source" + } + + $changed = -not (Test-Path -LiteralPath $Destination -PathType Leaf) + if (-not $changed) { + $sourceHash = (Get-FileHash -LiteralPath $Source -Algorithm SHA256).Hash + $destinationHash = (Get-FileHash -LiteralPath $Destination -Algorithm SHA256).Hash + $changed = $sourceHash -ne $destinationHash + } + if ($changed -and (Test-Path -LiteralPath $Destination) -and -not $Force) { + throw "$Description differs from the installed file: $Destination. Re-run with -Force to replace it." + } + + if ($changed -and $PSCmdlet.ShouldProcess($Destination, "Install $Description from $Source")) { + New-Item -ItemType Directory -Path (Split-Path $Destination -Parent) -Force | Out-Null + Copy-Item -LiteralPath $Source -Destination $Destination -Force + } + return $changed +} + +$dependencies = Join-Path $PackageDir 'dependencies' +$powerTestSource = Join-Path $dependencies 'PowerTest' +$hcsTestSource = Join-Path $dependencies 'HCSTest' +$vmgsToolSource = Join-Path $dependencies 'Tools\VmgsTool.exe' +$secFwSource = Join-Path $dependencies 'SecFw\secfw_test_GenuineIntel.dll' +$powerTestDestination = Join-Path $PowerTestInstallRoot 'PowerTest' +$hcsTestDestination = Join-Path $HcsTestInstallRoot 'HCSTest' + +if (Get-Module HCSTest) { + throw 'HCSTest is loaded. Close this process and run setup from a fresh elevated PowerShell 7 process.' +} + +$requiredPowerTestFiles = @( + 'PowerTest.psd1' + 'TdxLiveMigrationUtilities.psm1' + 'HCSUtilities.psm1' + 'LiveMigrationUtilities.psm1' + 'LiveMigrationTestUtilities.psm1' + 'VmgsUtilities.psm1' + 'WmiUtilities.psm1' + 'IVMUtilities.psm1' +) +foreach ($requiredPowerTestFile in $requiredPowerTestFiles) { + $requiredPath = Join-Path $powerTestSource $requiredPowerTestFile + if (-not (Test-Path -LiteralPath $requiredPath -PathType Leaf)) { + throw "Bundled PowerTest file not found: $requiredPath" + } +} +$hcsTestV2 = Join-Path $hcsTestSource 'coreclr\Microsoft.HostCompute.Test.PowerShell.v2.dll' +if (-not (Test-Path -LiteralPath $hcsTestV2 -PathType Leaf)) { + throw "Bundled HCSTest PowerShell 7 binary not found: $hcsTestV2. Run Publish-TipPackage.ps1 with the matching winbuild first." +} +if (-not (Test-Path -LiteralPath $vmgsToolSource -PathType Leaf)) { + throw "Bundled VmgsTool not found: $vmgsToolSource. Run Publish-TipPackage.ps1 with the matching winbuild first." +} + +foreach ($destination in @($powerTestDestination, $hcsTestDestination)) { + if ((Test-Path -LiteralPath $destination) -and -not $Force) { + throw "Destination already exists: $destination. Re-run with -Force to replace it." + } +} + +Import-Module (Join-Path $hcsTestSource 'HCSTest.psd1') ` + -ArgumentList @{ UseVersion2 = $true } -Global -Force +$loadedHcsTest = Get-Module HCSTest +$nestedName = ($loadedHcsTest.NestedModules | Select-Object -First 1).Name +if ($nestedName -notlike '*.v2') { + throw "HCSTest v2 validation failed; loaded nested module '$nestedName'." +} +foreach ($command in 'New-VMStateFile', 'New-HcsSystemDocument') { + if (-not (Get-Command $command -ErrorAction SilentlyContinue)) { + throw "Bundled HCSTest v2 did not export $command." + } +} + +$powerTestStaging = $null +$hcsTestStaging = $null +try { + $powerTestStaging = New-StagedModuleDirectory ` + -Source $powerTestSource ` + -Destination $powerTestDestination ` + -Manifest 'PowerTest.psd1' + $hcsTestStaging = New-StagedModuleDirectory ` + -Source $hcsTestSource ` + -Destination $hcsTestDestination ` + -Manifest 'HCSTest.psd1' + Install-StagedModuleDirectories -Modules @( + [pscustomobject]@{ + Source = $powerTestSource + StagingPath = $powerTestStaging + Destination = $powerTestDestination + } + [pscustomobject]@{ + Source = $hcsTestSource + StagingPath = $hcsTestStaging + Destination = $hcsTestDestination + } + ) +} +finally { + foreach ($stagingPath in @($powerTestStaging, $hcsTestStaging)) { + if ($stagingPath -and (Test-Path -LiteralPath $stagingPath)) { + Remove-Item -LiteralPath $stagingPath -Recurse -Force + } + } +} + +$null = Install-BundledFile -Source $vmgsToolSource -Destination $VmgsToolInstallPath -Description 'VmgsTool' + +$rebootRequired = $false +$secFwDestination = Join-Path "$env:SystemRoot\System32" 'secfw_test_GenuineIntel.dll' +if ($SkipSecureFirmware) { + Write-Warning 'Secure Firmware installation was skipped. The target host must already have the matching firmware configured.' +} +elseif (Test-Path -LiteralPath $secFwSource -PathType Leaf) { + $secFwChanged = Install-BundledFile ` + -Source $secFwSource ` + -Destination $secFwDestination ` + -Description 'test Secure Firmware' + if ($secFwChanged) { + $rebootRequired = $true + } + + $regPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\Hypervisor' + $currentSecFw = Get-ItemPropertyValue $regPath -Name SecFwFile -ErrorAction SilentlyContinue + if ($currentSecFw -ne 'secfw_test_GenuineIntel.dll') { + if ($PSCmdlet.ShouldProcess($regPath, 'Set SecFwFile=secfw_test_GenuineIntel.dll')) { + New-ItemProperty $regPath -Name SecFwFile -Value 'secfw_test_GenuineIntel.dll' ` + -PropertyType String -Force | Out-Null + $rebootRequired = $true + } + } +} +elseif (-not (Test-Path -LiteralPath $secFwDestination -PathType Leaf)) { + Write-Warning 'Test Secure Firmware is not bundled or installed. Republish with -SecFwFile before running TDX tests.' +} + +if ($ConfigureHost) { + $validator = Join-Path $PackageDir 'troubleshooting\Test-TdxLmLabBlade.ps1' + if (-not (Test-Path -LiteralPath $validator -PathType Leaf)) { + throw "Host validation script not found: $validator" + } + $secFwBeforeConfigure = Get-ItemPropertyValue ` + 'HKLM:\SYSTEM\CurrentControlSet\Control\Hypervisor' ` + -Name SecFwFile -ErrorAction SilentlyContinue + & $validator -PowerTestPath $powerTestDestination -Configure + $secFwAfterConfigure = Get-ItemPropertyValue ` + 'HKLM:\SYSTEM\CurrentControlSet\Control\Hypervisor' ` + -Name SecFwFile -ErrorAction SilentlyContinue + if ($secFwBeforeConfigure -ne $secFwAfterConfigure) { + $rebootRequired = $true + } +} + +[pscustomobject]@{ + PowerTestPath = $powerTestDestination + HcsTestPath = $hcsTestDestination + HcsTestBinary = $nestedName + VmgsToolPath = $VmgsToolInstallPath + SecFwBundled = Test-Path -LiteralPath $secFwSource -PathType Leaf + RebootRequired = $rebootRequired +} + +if ($rebootRequired) { + Write-Warning 'Reboot the host before running TiP tests so Hyper-V loads the selected test Secure Firmware.' +} diff --git a/sh_script/Azure/tip/Invoke-TdxLmLoopback.ps1 b/sh_script/Azure/tip/Invoke-TdxLmLoopback.ps1 new file mode 100644 index 000000000..5cfa04d0b --- /dev/null +++ b/sh_script/Azure/tip/Invoke-TdxLmLoopback.ps1 @@ -0,0 +1,385 @@ +#Requires -Version 7.0 + +<# +.SYNOPSIS + Run one TDX MigTD loopback live-migration on a labblade. + +.DESCRIPTION + Starts the given MigTD IGVM, registers its hash, creates a TDX guest, migrates + it to localhost (loopback), and asserts the outcome. Cleans up afterwards. + Mirrors the Azure OS PR gate (Invoke-TdxLmE2ETest). Requires PowerTest's + TdxLiveMigrationUtilities for New-TestHcsMigTd; pass -PowerTestPath to import it. + +.EXAMPLE + .\Invoke-TdxLmLoopback.ps1 -IgvmFilePath .\test-migtd-accept-all.igvm + .\Invoke-TdxLmLoopback.ps1 -IgvmFilePath .\test-migtd-reject-all.igvm -ExpectReject + .\Invoke-TdxLmLoopback.ps1 -IgvmFilePath .\test-migtd-accept-all.igvm -CaptureSerial +#> +[CmdletBinding()] +param( + [Parameter(Mandatory)] [string]$IgvmFilePath, + [string]$HashFilePath = "$IgvmFilePath.hash", + [string]$MigTdId = 'tipmigtd', + [string]$VmName = 'tiptd', + [switch]$ExpectReject, + [string]$PowerTestPath = "$env:ProgramFiles\PowerShell\Modules\PowerTest", + [ValidateRange(0, 300)] + [int]$StartupDelaySeconds = 0, + # Validate the target VM's 272-byte ServTdExt after prebind/start, then + # clean up without issuing Move-VM. + [switch]$ServTdExtOnly, + # Sets GuestStateIsolationMode=NoPersistentSecrets before startup. OpenHCL + # then suppresses target-VM host attestation. A _mock_quote MigTD image uses + # built-in quote data and does not call IGVMAgent for GetQuote. This changes + # the target VM security profile. + [switch]$NoPersistentSecrets, + [ValidateRange(0, 60)] + [int]$SerialDrainTimeoutSeconds = 30, + # Captures the MigTD's own serial console (built with --log-level info) to + # <MigTdId>.serial.log via New-TestHcsMigTd -EnableSerial's named pipe. + # Useful when migration fails with only a generic VMMS error and no detail + # on why the MigTD itself rejected/aborted. + [switch]$CaptureSerial +) +$ErrorActionPreference = 'Stop' + +function Test-ServTdExtLayout { + param( + [Parameter(Mandatory)] [string]$TargetVmName, + [Parameter(Mandatory)] [string]$ExpectedHash, + [Parameter(Mandatory)] [string]$ModuleRoot, + [ValidateRange(1, 120)] [int]$TimeoutSeconds = 15 + ) + + if (-not (Get-Command Get-VmServTdExt -ErrorAction SilentlyContinue)) { + $modulePath = Join-Path $ModuleRoot 'LiveMigrationTestUtilities.psm1' + if (-not (Test-Path $modulePath)) { + throw "PowerTest LiveMigrationTestUtilities.psm1 not found: $modulePath" + } + Import-Module $modulePath -Force + } + if (-not (Get-Command Get-VmServTdExt -ErrorAction SilentlyContinue)) { + throw 'Get-VmServTdExt is unavailable after importing LiveMigrationTestUtilities.psm1.' + } + + $expected = $ExpectedHash.Trim().ToLowerInvariant() + if ($expected -notmatch '^[0-9a-f]{96}$') { + throw 'Expected MigTD hash must be exactly 96 hexadecimal characters.' + } + + $deadline = (Get-Date).AddSeconds($TimeoutSeconds) + do { + $raw = [string](Get-VmServTdExt -VmName $TargetVmName) + $actual = ($raw -replace '[^0-9a-fA-F]', '').ToLowerInvariant() + if ($actual) { break } + Start-Sleep -Milliseconds 250 + } while ((Get-Date) -lt $deadline) + + if (-not $actual) { + throw "Get-VmServTdExt returned no data for '$TargetVmName' within $TimeoutSeconds seconds." + } + if ($actual -notmatch '^[0-9a-f]+$') { + throw "ServTdExt contains non-hexadecimal data: $raw" + } + if ($actual.Length -ne 544) { + throw "ServTdExt must be 272 bytes (544 hex characters); received $($actual.Length / 2) bytes." + } + + function Get-HexRange { + param([int]$Offset, [int]$Length) + return $actual.Substring($Offset * 2, $Length * 2) + } + function Assert-HexRange { + param([string]$Name, [int]$Offset, [int]$Length, [string]$Expected) + $value = Get-HexRange -Offset $Offset -Length $Length + if ($value -ne $Expected) { + throw "$Name mismatch at byte offset $Offset. Expected=$Expected Actual=$value" + } + } + function Assert-ZeroRange { + param([string]$Name, [int]$Offset, [int]$Length) + Assert-HexRange -Name $Name -Offset $Offset -Length $Length -Expected ('00' * $Length) + } + + # HV_TD_SERVICE_TD_EXT / MigTD ServtdExt is 272 bytes: + # 0x000 init hash (48), 0x030 init attr/reserved (16), + # 0x040 CPU/TCB/model metadata (44), 0x06c reserved (4), + # 0x070 current hash (48), 0x0a0 current attr/reserved (112). + Assert-HexRange -Name 'InitServTdInfoHash' -Offset 0 -Length 48 -Expected $expected + Assert-ZeroRange -Name 'InitServTdAttrAndReserved' -Offset 48 -Length 16 + Assert-ZeroRange -Name 'InitMetadataReserved' -Offset 108 -Length 4 + Assert-HexRange -Name 'CurrentServTdInfoHash' -Offset 112 -Length 48 -Expected $expected + Assert-ZeroRange -Name 'CurrentServTdAttrAndReserved' -Offset 160 -Length 112 + + [pscustomobject]@{ + VmName = $TargetVmName + LengthBytes = 272 + InitServTdInfoHash = Get-HexRange -Offset 0 -Length 48 + InitCpuSvn = Get-HexRange -Offset 64 -Length 16 + InitTeeTcbSvn = Get-HexRange -Offset 80 -Length 16 + InitTeeModel = Get-HexRange -Offset 96 -Length 12 + CurrentServTdInfoHash = Get-HexRange -Offset 112 -Length 48 + ReservedRangesZero = $true + RawServTdExt = $actual + } | Format-List +} + +function Wait-ForFinalQuoteRetry { + param( + [string]$LogPath, + [int]$TimeoutSeconds, + [bool]$HostOperationSucceeded = $false, + [bool]$UsesMockQuote = $false + ) + + if ($UsesMockQuote -or -not $LogPath -or -not (Test-Path $LogPath) -or + $TimeoutSeconds -eq 0) { + return + } + + $busyMarker = 'GetQuote returned Busy (attempt 5/6)' + $terminalPattern = 'Quote generated successfully|GetQuote failed after 6 attempts|get_quote_with_retry failed' + $text = [string](Get-Content $LogPath -Raw -ErrorAction SilentlyContinue) + $busyIndex = $text.LastIndexOf($busyMarker, [System.StringComparison]::Ordinal) + if ($busyIndex -lt 0 -or $text.Substring($busyIndex) -match $terminalPattern) { + return + } + + Write-Host "Waiting up to $TimeoutSeconds second(s) for the final GetQuote retry log." + $deadline = (Get-Date).AddSeconds($TimeoutSeconds) + do { + Start-Sleep -Milliseconds 250 + $text = [string](Get-Content $LogPath -Raw -ErrorAction SilentlyContinue) + $busyIndex = $text.LastIndexOf($busyMarker, [System.StringComparison]::Ordinal) + if ($busyIndex -lt 0 -or $text.Substring($busyIndex) -match $terminalPattern) { + return + } + } while ((Get-Date) -lt $deadline) + + if ($HostOperationSucceeded) { + Write-Host 'Host operation succeeded; no terminal GetQuote retry marker was observed before cleanup.' + } else { + Write-Warning 'Timed out waiting for the final GetQuote retry log; stopping MigTD.' + } +} + +if ($PowerTestPath) { + Import-Module (Join-Path $PowerTestPath 'TdxLiveMigrationUtilities.psm1') -Force + # New-TestHcsMigTd (and Start-HcsSystem/Stop-HcsSystem later in this script) + # need the real HCSTest binary module for New-HcsSystemDocument/New-HcsSystem/ + # Start-HcsSystem/Modify-HcsSystem. HCSUtilities.psm1 defines these as plain + # function calls but never imports HCSTest itself - only its own + # Import-HcsTestModule helper does that, and nothing calls it automatically. + $hcsUtilPath = Join-Path $PowerTestPath 'HCSUtilities.psm1' + if (Test-Path $hcsUtilPath) { Import-Module $hcsUtilPath -Force } + # Must load the V2 binary (Microsoft.HostCompute.Test.PowerShell.v2.dll): + # V1's New-VmStateFile P/Invokes vmcompute.dll!CreateEmptyGuestStateFile, which + # newer OS builds removed in favor of computestorage.dll (V2's HcsInterface). + # Matches onecore/vm/test/migration/tdx/Loopback/Tdx.LiveMigration.Loopback.Tests.ps1 + # (Import-Module HCSTest -ArgumentList @{ UseVersion2 = $true }). + $hcsTestModule = Get-Module HCSTest + if ($hcsTestModule -and $hcsTestModule.NestedModules[0].Name -notlike '*.v2') { + throw "HCSTest v1 is already loaded. Close this PowerShell process and retry; Remove-Module cannot unload its binary assembly." + } + if (-not $hcsTestModule) { + # Import directly first: if the package installer put HCSTest under + # Program Files\PowerShell\Modules, this succeeds with no network/BNS + # dependency. Only fall back to + # PowerTest's Import-HcsTestModule if that direct import can't find it - + # its $HcsTestModulePath parameter default unconditionally calls + # Get-TestItem -Chunk TEST_AUTOMATION_BINS (BNS/winbuilds lookup) even when + # unneeded, and our script's $ErrorActionPreference='Stop' turns that + # internal failure into a hard error. + Import-Module HCSTest -ArgumentList @{ UseVersion2 = $true } -Global -Force -ErrorAction SilentlyContinue + if (-not (Get-Module HCSTest)) { + if (Get-Command Import-HcsTestModule -ErrorAction SilentlyContinue) { + Import-HcsTestModule -UseVersion2 + } else { + throw "HCSTest module unavailable and Import-HcsTestModule not found (HCSUtilities.psm1 missing from -PowerTestPath?)." + } + } + } + if (-not (Get-Command New-HcsSystemDocument -ErrorAction SilentlyContinue)) { + throw "New-HcsSystemDocument still unavailable after loading HCSTest (v2)." + } + # Some PowerTest builds' TdxLiveMigrationUtilities.psm1 (New-TestHcsMigTd) call + # New-VmStateFile, which isn't defined anywhere in that module set (every other + # module - IVMUtilities.psm1, VmgsUtilities.psm1 - creates guest state files via + # New-GuestStateFile). Load VmgsUtilities.psm1 as a fallback and shim the gap + # here rather than patching the vendored module. + $vmgsUtilPath = Join-Path $PowerTestPath 'VmgsUtilities.psm1' + if (Test-Path $vmgsUtilPath) { Import-Module $vmgsUtilPath -Force } + if (-not (Get-Command New-VmStateFile -ErrorAction SilentlyContinue)) { + function global:New-VmStateFile { + param( + [Parameter(Mandatory)] [string]$GuestStateFilePath, + [int]$FileSize = 16MB + ) + # Prefer the OS-shipped vmgstool.exe (present on TDX-capable hosts) so + # this stays self-contained; fall back to PowerTest's New-GuestStateFile + # (needs Copy-TestItem / internal test-content access) if unavailable. + $tool = Get-Command vmgstool.exe -ErrorAction SilentlyContinue + if ($tool) { $tool = $tool.Source } + elseif (Test-Path (Join-Path $env:SystemRoot 'System32\vmgstool.exe')) { + $tool = Join-Path $env:SystemRoot 'System32\vmgstool.exe' + } + if ($tool) { + & $tool -Create -FilePath $GuestStateFilePath "-FileSize=$FileSize" | Out-Null + } elseif (Get-Command New-GuestStateFile -ErrorAction SilentlyContinue) { + New-GuestStateFile -FilePath $GuestStateFilePath -FileSize $FileSize | Out-Null + } else { + throw "Cannot create guest state file: vmgstool.exe not found (PATH or System32) and New-GuestStateFile (VmgsUtilities.psm1) is unavailable." + } + } + } + # The official aka.ms/tdxlm partner-facing loopback test + # (Tdx.LiveMigration.Partner.Tests.ps1) calls this before enabling migration: + # repoints Hyper-V's default VM/VHD storage paths to <SystemDrive>\HyperVData\... + # instead of C:\ProgramData\Microsoft\Windows\Hyper-V. Per that test's own + # comment, this (for undetermined reasons) is needed to make loopback + # migration succeed on some lab systems - same generic "failed at migration + # source" symptom this script can otherwise hit. + $liveMigUtilPath = Join-Path $PowerTestPath 'LiveMigrationUtilities.psm1' + if (Test-Path $liveMigUtilPath) { Import-Module $liveMigUtilPath -Force } + if (Get-Command Enable-LoopbackMigrationDirectoryWorkaround -ErrorAction SilentlyContinue) { + Enable-LoopbackMigrationDirectoryWorkaround + } +} +if (-not (Test-Path $IgvmFilePath)) { throw "IGVM not found: $IgvmFilePath" } +if (-not (Test-Path $HashFilePath)) { throw "Hash file not found: $HashFilePath" } + +$MigTdHash = (Get-Content $HashFilePath -Raw).Trim() +Write-Host "MigTD: $IgvmFilePath hash=$MigTdHash" +$usesMockQuote = [System.IO.Path]::GetFileName($IgvmFilePath) -match '_mock_quote' +if ($usesMockQuote) { + Write-Host 'MigTD attestation path: built-in mock quote; no IGVMAgent GetQuote call will be made.' +} else { + Write-Host 'MigTD attestation path: IGVMAgent-backed GetQuote.' +} + +$migTd = $null; $td = $null; $serialJob = $null; $serialLogPath = $null +$hostOperationSucceeded = $false +try { + $migTd = New-TestHcsMigTd -Id $MigTdId -IgvmFilePath (Resolve-Path $IgvmFilePath) -GuestStateDirectory . -EnableSerial:$CaptureSerial -Force + + if ($CaptureSerial) { + $serialLogPath = Join-Path (Get-Location) "$MigTdId.serial.log" + Remove-Item $serialLogPath -ErrorAction SilentlyContinue + # New-TestHcsMigTd -EnableSerial wires the MigTD's COM port to named pipe + # \\.\pipe\raw<Id>; connect a background reader so we can see the MigTD's + # own log output (built with --log-level info) when migration fails with + # only a generic VMMS error. + $serialJob = Start-Job -Name "$MigTdId-serial" -ScriptBlock { + param($PipeName, $LogPath) + try { + $pipe = [System.IO.Pipes.NamedPipeClientStream]::new('.', $PipeName, [System.IO.Pipes.PipeDirection]::In) + $pipe.Connect(15000) + $reader = [System.IO.StreamReader]::new($pipe) + while ($true) { + $line = $reader.ReadLine() + if ($null -eq $line) { break } + Add-Content -Path $LogPath -Value $line + } + } catch { + Add-Content -Path $LogPath -Value "[serial-capture] $_" + } + } -ArgumentList "raw$MigTdId", $serialLogPath + } + + $migTd | Start-HcsSystem + Add-VmHostMigrationTdMapping -MigTdHash $MigTdHash -VmId $migTd.Id + Set-VMHostMigrationPolicy DisabledByDefault $MigTdHash + + $td = New-VM -Name $VmName -GuestStateIsolation TDX -Generation 2 -NoVHD + if ($NoPersistentSecrets) { + if (-not (Get-Command Set-GuestStateIsolationMode -ErrorAction SilentlyContinue)) { + if (-not $PowerTestPath) { + throw 'Set-GuestStateIsolationMode is required for -NoPersistentSecrets; provide -PowerTestPath.' + } + $wmiUtilitiesPath = Join-Path $PowerTestPath 'WmiUtilities.psm1' + $ivmUtilitiesPath = Join-Path $PowerTestPath 'IVMUtilities.psm1' + if (-not (Test-Path $wmiUtilitiesPath)) { + throw "PowerTest WmiUtilities.psm1 not found: $wmiUtilitiesPath" + } + if (-not (Test-Path $ivmUtilitiesPath)) { + throw "PowerTest IVMUtilities.psm1 not found: $ivmUtilitiesPath" + } + Import-Module $wmiUtilitiesPath -Force + Import-Module $ivmUtilitiesPath -Force + } + $td | Set-GuestStateIsolationMode -IsolationMode NoPersistentSecrets + Write-Host 'Configured NoPersistentSecrets; target-VM OpenHCL attestation is suppressed.' + } + $td | Set-VmMigratablePolicy -MigratablePolicy EnabledIfHostPermits | Out-Null + $migratablePolicy = [string]($td | Get-VmMigratablePolicy) + if ($migratablePolicy -ne 'EnabledIfHostPermits') { + throw "Failed to opt the TD into host-permitted migration. Actual policy=$migratablePolicy" + } + Write-Host 'Configured VM migratable policy: EnabledIfHostPermits.' + $td | Update-VmMigrationPolicy + $td | Start-VM + + # The partner test migrates immediately. Keep timing configurable for + # controlled experiments; both zero and five seconds have produced the same + # generic VidTdxBind failure on the current blade. + if ($StartupDelaySeconds -gt 0) { + Write-Host "Waiting $StartupDelaySeconds second(s) before Move-VM" + Start-Sleep -Seconds $StartupDelaySeconds + } + $td = Get-VM -Name $VmName + if ($td.State -ne 'Running') { + throw "TD is not running after Start-VM (state=$($td.State)); cannot begin TDX live migration" + } + + if ($ServTdExtOnly) { + if (-not $PowerTestPath) { + throw '-PowerTestPath is required for -ServTdExtOnly.' + } + Test-ServTdExtLayout ` + -TargetVmName $VmName ` + -ExpectedHash $MigTdHash ` + -ModuleRoot $PowerTestPath + $hostOperationSucceeded = $true + Write-Host 'PASS: ServTdExt contains the prebound hash in both binding slots with expected zero padding.' + return + } + + $moveErr = $null + Move-VM -Name $VmName -DestinationHost localhost -ErrorVariable moveErr -ErrorAction SilentlyContinue + + if ($ExpectReject) { + if (-not $moveErr) { throw "FAIL: migration succeeded but rejection expected" } + $hostOperationSucceeded = $true + Write-Host "PASS: migration rejected as expected ($($moveErr[0]))" + } else { + if ($moveErr) { throw "FAIL: migration failed: $($moveErr[0])" } + $hostOperationSucceeded = $true + Write-Host "PASS: migration succeeded" + } +} +finally { + if ($td) { $td | Stop-VM -Force -ErrorAction SilentlyContinue; $td | Remove-VM -Force -ErrorAction SilentlyContinue } + if ($MigTdHash) { + Set-VMHostMigrationPolicy DisabledByDefault $MigTdHash -ErrorAction SilentlyContinue + } + if ($MigTdHash) { Remove-VmHostMigrationTdMapping -MigTdHash $MigTdHash -ErrorAction SilentlyContinue } + if ($serialJob) { + Wait-ForFinalQuoteRetry ` + -LogPath $serialLogPath ` + -TimeoutSeconds $SerialDrainTimeoutSeconds ` + -HostOperationSucceeded:$hostOperationSucceeded ` + -UsesMockQuote:$usesMockQuote + } + if ($migTd) { Stop-HcsSystem $migTd -ErrorAction SilentlyContinue; $migTd.Close() } + if ($serialJob) { + # Keep reading until MigTD is stopped and closes the named pipe. Stopping + # this job before Stop-HcsSystem truncated logs while an outstanding + # GetQuote retry was still running. + Wait-Job $serialJob -Timeout 5 -ErrorAction SilentlyContinue | Out-Null + if ($serialJob.State -notin @('Completed', 'Failed')) { + Stop-Job $serialJob -ErrorAction SilentlyContinue | Out-Null + } + Remove-Job $serialJob -Force -ErrorAction SilentlyContinue + if (Test-Path $serialLogPath) { Write-Host "MigTD serial log: $serialLogPath" } + } +} diff --git a/sh_script/Azure/tip/Publish-TipPackage.ps1 b/sh_script/Azure/tip/Publish-TipPackage.ps1 new file mode 100644 index 000000000..a91784736 --- /dev/null +++ b/sh_script/Azure/tip/Publish-TipPackage.ps1 @@ -0,0 +1,355 @@ +#Requires -Version 7.0 + +[CmdletBinding()] +param( + [Parameter(Mandatory)] + [string]$PackageDir, + + [Parameter(Mandatory)] + [string]$WinBuildRoot, + + [Parameter(Mandatory)] + [string]$Destination, + + [string]$ArchFlavor = "amd64fre", + + [string]$SecFwFile, + + [switch]$SkipSecFw, + + [switch]$Force +) + +$ErrorActionPreference = "Stop" +Set-StrictMode -Version Latest + +function Resolve-ExistingDirectory { + param( + [Parameter(Mandatory)] + [string]$Path, + + [Parameter(Mandatory)] + [string]$Description + ) + + if (-not (Test-Path -LiteralPath $Path -PathType Container)) { + throw "$Description not found: $Path" + } + return (Resolve-Path -LiteralPath $Path).Path +} + +function Resolve-TestAutomationBins { + param( + [Parameter(Mandatory)] + [string]$BuildRoot, + + [Parameter(Mandatory)] + [string]$Flavor + ) + + $candidates = @( + $BuildRoot + (Join-Path $BuildRoot "test_automation_bins") + (Join-Path $BuildRoot "$Flavor\test_automation_bins") + ) + + foreach ($candidate in $candidates) { + if ((Split-Path $candidate -Leaf) -ieq "test_automation_bins" -and + (Test-Path -LiteralPath (Join-Path $candidate "vm") -PathType Container)) { + return (Resolve-Path -LiteralPath $candidate).Path + } + } + + throw "test_automation_bins was not found under '$BuildRoot' for architecture flavor '$Flavor'." +} + +function Resolve-FirstFile { + param( + [Parameter(Mandatory)] + [string[]]$Candidates, + + [Parameter(Mandatory)] + [string]$Description + ) + + foreach ($candidate in $Candidates) { + if (Test-Path -LiteralPath $candidate -PathType Leaf) { + return (Resolve-Path -LiteralPath $candidate).Path + } + } + + throw "$Description was not found. Checked:`n $($Candidates -join "`n ")" +} + +function Resolve-SecureFirmware { + param( + [Parameter(Mandatory)] + [string]$AutomationBins, + + [Parameter(Mandatory)] + [string]$BuildRoot, + + [Parameter(Mandatory)] + [string]$Flavor + ) + + $candidates = @( + (Join-Path $AutomationBins "vm\test\migration\tdx\secfw_test_GenuineIntel.dll") + (Join-Path $AutomationBins "vm\test\securefirmware\secfw_test_GenuineIntel.dll") + (Join-Path $BuildRoot "$Flavor\secfw_test_GenuineIntel.dll") + ) + foreach ($candidate in $candidates) { + if (Test-Path -LiteralPath $candidate -PathType Leaf) { + return (Resolve-Path -LiteralPath $candidate).Path + } + } + + $matches = @( + Get-ChildItem -LiteralPath $AutomationBins ` + -Filter "secfw_test_GenuineIntel.dll" ` + -File ` + -Recurse ` + -ErrorAction SilentlyContinue | + Select-Object -First 2 + ) + if ($matches.Count -eq 1) { + return $matches[0].FullName + } + if ($matches.Count -gt 1) { + throw "Multiple Secure Firmware DLLs were found under $AutomationBins. Pass -SecFwFile with the intended file." + } + + throw "Secure Firmware test DLL was not found under the selected winbuild. Pass -SecFwFile with the matching file or -SkipSecFw when it is already installed." +} + +function Copy-DirectoryContent { + param( + [Parameter(Mandatory)] + [string]$Source, + + [Parameter(Mandatory)] + [string]$DestinationPath + ) + + New-Item -ItemType Directory -Path $DestinationPath -Force | Out-Null + Get-ChildItem -LiteralPath $Source -Force | ForEach-Object { + Copy-Item -LiteralPath $_.FullName -Destination $DestinationPath -Recurse -Force + } +} + +function Get-NormalizedPath { + param( + [Parameter(Mandatory)] + [string]$Path + ) + + $fullPath = [System.IO.Path]::GetFullPath($Path) + $root = [System.IO.Path]::GetPathRoot($fullPath) + if ($fullPath.Length -gt $root.Length) { + return $fullPath.TrimEnd( + [System.IO.Path]::DirectorySeparatorChar, + [System.IO.Path]::AltDirectorySeparatorChar) + } + return $fullPath +} + +function Get-CanonicalPath { + param( + [Parameter(Mandatory)] + [string]$Path + ) + + $normalizedPath = Get-NormalizedPath $Path + $root = [System.IO.Path]::GetPathRoot($normalizedPath) + $relativePath = $normalizedPath.Substring($root.Length) + $segments = $relativePath -split '[\\/]' + $currentPath = $root + + foreach ($segment in $segments) { + if (-not $segment) { + continue + } + $candidate = Join-Path $currentPath $segment + if (Test-Path -LiteralPath $candidate) { + $item = Get-Item -LiteralPath $candidate -Force + if (($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { + $target = $item.ResolveLinkTarget($true) + if ($target) { + $currentPath = $target.FullName + continue + } + } + $currentPath = $item.FullName + } + else { + $currentPath = $candidate + } + } + + return Get-NormalizedPath $currentPath +} + +function Test-PathWithin { + param( + [Parameter(Mandatory)] + [string]$Path, + + [Parameter(Mandatory)] + [string]$Parent + ) + + if ([string]::Equals($Path, $Parent, [System.StringComparison]::OrdinalIgnoreCase)) { + return $true + } + $parentPrefix = $Parent + if (-not $parentPrefix.EndsWith([System.IO.Path]::DirectorySeparatorChar)) { + $parentPrefix += [System.IO.Path]::DirectorySeparatorChar + } + return $Path.StartsWith($parentPrefix, [System.StringComparison]::OrdinalIgnoreCase) +} + +$resolvedPackageDir = Resolve-ExistingDirectory -Path $PackageDir -Description "TiP package" +$resolvedBuildRoot = Resolve-ExistingDirectory -Path $WinBuildRoot -Description "Winbuild build directory" +$testAutomationBins = Resolve-TestAutomationBins -BuildRoot $resolvedBuildRoot -Flavor $ArchFlavor + +$hcsTestSource = Join-Path $testAutomationBins "vm\test\compute\HCSTest" +if (-not (Test-Path -LiteralPath $hcsTestSource -PathType Container)) { + throw "Prebuilt HCSTest was not found: $hcsTestSource" +} +$hcsTestCoreClr = Join-Path $hcsTestSource "coreclr\Microsoft.HostCompute.Test.PowerShell.v2.dll" +if (-not (Test-Path -LiteralPath $hcsTestCoreClr -PathType Leaf)) { + throw "HCSTest v2 coreclr binary was not found: $hcsTestCoreClr" +} + +$vmgsToolSource = Resolve-FirstFile -Description "VmgsTool.exe" -Candidates @( + (Join-Path $testAutomationBins "vm\tools\VmgsTool.exe") + (Join-Path $testAutomationBins "vm\underhill\vmgstool.exe") +) + +$resolvedSecFw = $null +if (-not $SkipSecFw) { + if ($SecFwFile) { + $resolvedSecFw = Resolve-FirstFile -Description "Secure Firmware test DLL" -Candidates @($SecFwFile) + } + else { + $resolvedSecFw = Resolve-SecureFirmware ` + -AutomationBins $testAutomationBins ` + -BuildRoot $resolvedBuildRoot ` + -Flavor $ArchFlavor + } +} + +$normalizedPackageDir = Get-CanonicalPath $resolvedPackageDir +$normalizedBuildRoot = Get-CanonicalPath $resolvedBuildRoot +$resolvedDestination = Get-CanonicalPath $Destination +$inputPaths = @($normalizedPackageDir, $normalizedBuildRoot) +if ($resolvedSecFw) { + $inputPaths += Get-CanonicalPath $resolvedSecFw +} +foreach ($inputPath in $inputPaths) { + if ((Test-PathWithin -Path $resolvedDestination -Parent $inputPath) -or + (Test-PathWithin -Path $inputPath -Parent $resolvedDestination)) { + throw "Destination must not be the same as, contain, or be contained by an input path: $inputPath" + } +} +if (Test-Path -LiteralPath $resolvedDestination) { + if (-not $Force) { + throw "Destination already exists: $resolvedDestination. Pass -Force to replace it." + } +} + +$destinationParent = Split-Path $resolvedDestination -Parent +if (-not $destinationParent) { + throw "Destination must include a parent directory: $Destination" +} +New-Item -ItemType Directory -Path $destinationParent -Force | Out-Null + +$stagingRoot = Join-Path ([System.IO.Path]::GetTempPath()) "MigTdTipPublish-$([guid]::NewGuid())" +$publishTemp = "$resolvedDestination.publish-$([guid]::NewGuid())" +$destinationBackup = "$resolvedDestination.backup-$([guid]::NewGuid())" +try { + Copy-DirectoryContent -Source $resolvedPackageDir -DestinationPath $stagingRoot + + $dependenciesDir = Join-Path $stagingRoot "dependencies" + $hcsTestDestination = Join-Path $dependenciesDir "HCSTest" + if (Test-Path -LiteralPath $hcsTestDestination) { + Remove-Item -LiteralPath $hcsTestDestination -Recurse -Force + } + Copy-DirectoryContent -Source $hcsTestSource -DestinationPath $hcsTestDestination + + $toolsDir = Join-Path $dependenciesDir "Tools" + New-Item -ItemType Directory -Path $toolsDir -Force | Out-Null + Copy-Item -LiteralPath $vmgsToolSource -Destination (Join-Path $toolsDir "VmgsTool.exe") -Force + + $secFwDir = Join-Path $dependenciesDir "SecFw" + if ($SkipSecFw -and (Test-Path -LiteralPath $secFwDir)) { + Remove-Item -LiteralPath $secFwDir -Recurse -Force + } + elseif ($resolvedSecFw) { + New-Item -ItemType Directory -Path $secFwDir -Force | Out-Null + Copy-Item -LiteralPath $resolvedSecFw -Destination (Join-Path $secFwDir "secfw_test_GenuineIntel.dll") -Force + } + + $requiredFiles = @( + (Join-Path $stagingRoot "Install-TipDependencies.ps1") + (Join-Path $dependenciesDir "PowerTest\PowerTest.psd1") + (Join-Path $dependenciesDir "PowerTest\TdxLiveMigrationUtilities.psm1") + (Join-Path $dependenciesDir "PowerTest\HCSUtilities.psm1") + (Join-Path $dependenciesDir "PowerTest\LiveMigrationUtilities.psm1") + (Join-Path $dependenciesDir "PowerTest\LiveMigrationTestUtilities.psm1") + (Join-Path $dependenciesDir "PowerTest\VmgsUtilities.psm1") + (Join-Path $dependenciesDir "PowerTest\WmiUtilities.psm1") + (Join-Path $dependenciesDir "PowerTest\IVMUtilities.psm1") + (Join-Path $hcsTestDestination "HCSTest.psd1") + (Join-Path $hcsTestDestination "coreclr\Microsoft.HostCompute.Test.PowerShell.v2.dll") + (Join-Path $toolsDir "VmgsTool.exe") + ) + if (-not $SkipSecFw) { + $requiredFiles += Join-Path $dependenciesDir "SecFw\secfw_test_GenuineIntel.dll" + } + foreach ($requiredFile in $requiredFiles) { + if (-not (Test-Path -LiteralPath $requiredFile -PathType Leaf)) { + throw "Published package dependency is missing: $requiredFile" + } + } + + Copy-Item -LiteralPath $stagingRoot -Destination $publishTemp -Recurse + + $hadDestination = Test-Path -LiteralPath $resolvedDestination + if ($hadDestination) { + Move-Item -LiteralPath $resolvedDestination -Destination $destinationBackup + } + try { + Move-Item -LiteralPath $publishTemp -Destination $resolvedDestination + } + catch { + if ($hadDestination -and + (Test-Path -LiteralPath $destinationBackup) -and + -not (Test-Path -LiteralPath $resolvedDestination)) { + Move-Item -LiteralPath $destinationBackup -Destination $resolvedDestination + } + throw + } + if ($hadDestination -and (Test-Path -LiteralPath $destinationBackup)) { + Remove-Item -LiteralPath $destinationBackup -Recurse -Force + } +} +finally { + if (Test-Path -LiteralPath $stagingRoot) { + Remove-Item -LiteralPath $stagingRoot -Recurse -Force + } + if (Test-Path -LiteralPath $publishTemp) { + Remove-Item -LiteralPath $publishTemp -Recurse -Force + } +} + +Write-Host "Published TiP package: $resolvedDestination" -ForegroundColor Green +Write-Host "Winbuild content: $testAutomationBins" +Write-Host "HCSTest: $hcsTestSource" +Write-Host "VmgsTool: $vmgsToolSource" +if ($resolvedSecFw) { + Write-Host "Secure Firmware: $resolvedSecFw" +} +else { + Write-Warning "Secure Firmware was intentionally omitted; the target host must already have the correct firmware configured." +} diff --git a/sh_script/Azure/tip/README.md b/sh_script/Azure/tip/README.md new file mode 100644 index 000000000..95c20dd19 --- /dev/null +++ b/sh_script/Azure/tip/README.md @@ -0,0 +1,476 @@ +# MigTD TiP Loopback Test Package + +Self-contained TDX live-migration test for a labblade. Build on Linux, copy the +package to the TDX host, run loopback migrations manually. + +## 1. Build (Linux) + +### 1.0 One-time build-environment setup (fresh host) + +On a clean Debian/Ubuntu box, install the full toolchain (system packages via a +single `sudo apt-get install`, plus Rust + the `x86_64-unknown-none` target) with: + +```bash +./sh_script/setup_build_env.sh # sudo apt install + rustup/toolchain +# or just print the one-line apt command: ./sh_script/setup_build_env.sh --print-apt +``` + +Then initialize submodules and apply patches (first time only): + +```bash +source "$HOME/.cargo/env" +git submodule update --init --recursive deps/td-shim deps/spdm-rs deps/linux-sgx +./sh_script/preparation.sh +``` + +Set the C toolchain the MigTD/td-shim build expects: + +```bash +export CC=clang AR=llvm-ar +``` + +On GCC >= 14 the vendored linux-sgx DCAP C code would otherwise fail to +compile; `src/attestation/build.rs` detects this and demotes those errors back +to warnings automatically, so no manual `CFLAGS` override is needed. + +### 1.1 Build the package + +```bash +./sh_script/Azure/tip/build_tip_package.sh \ + --out out/tip-package \ + --fetch-collaterals \ + --tcb-mapping /path/to/previous-release/tcb_mapping.json \ + --os-root /path/to/os.2020 \ + --hcstest-dir /path/to/prebuilt/HCSTest \ + --secfw-file /path/to/secfw_test_GenuineIntel.dll +``` + +This creates a source-complete package without requiring Linux access to +`\\winbuilds`. `--os-root` bundles PowerTest, HCSTest PowerShell v2 source, and +the OS TDX live-migration test sources. If matching prebuilts are mounted on +Linux, `--hcstest-dir`, `--vmgstool-file`, and `--secfw-file` can still create a +fully enriched package in one step. + +Use `--skip-dependencies` for an image-and-test-script-only package when +PowerTest and HCSTest v2 are already installed on the TiP host. +Omit `--tcb-mapping` only for a first release; later releases must provide the +authority-maintained mapping whose historical real hashes remain supported. + +Produces in `out/tip-package/`: + +| File | Role | +|------|------| +| `test-migtd-accept-all.igvm` + `.hash` | allow-all policy → migration succeeds | +| `test-migtd-reject-all.igvm` + `.hash` | bad-FMSPC policy → migration rejected | +| `test-migtd.igvm` + `.hash` | `config/Azure/policy_data_raw.json` → succeeds if node FMSPC/TCB match | +| `test-migtd_rebind.igvm` + `.hash` | same real policy and signer with `policySvn` incremented by one | +| `test-migtd_key_rotation.igvm` + `.hash` | same real policy SVN/root/leaf Subject Name, signed by a new policy leaf key | +| `test-migtd-getquote-all.igvm` + `.hash` | GetQuote init image | +| `test-migtd-accept-all_mock_quote.igvm` + `.hash` | allow-all policy with built-in mock quote | +| `test-migtd-reject-all_mock_quote.igvm` + `.hash` | reject policy with built-in mock quote | +| `test-migtd_mock_quote.igvm` + `.hash` | policy generated from mock measurements with built-in mock quote | +| `test-migtd_mock_quote_rebind.igvm` + `.hash` | same mock-quote real policy and signer with `policySvn` incremented by one | +| `test-migtd_mock_quote_key_rotation.igvm` + `.hash` | mock-quote counterpart signed by the rotated policy leaf key | +| `test-migtd{,_rebind,_key_rotation,_mock_quote,_mock_quote_rebind,_mock_quote_key_rotation}.policy.json` | signed policy snapshot embedded in the corresponding image | +| `Invoke-TdxLmLoopback.ps1`, `Run-TipTests.ps1` | migration test scripts | +| `Test-TdxMigTdStartupRequests.ps1` | validate startup `EnableLogArea` plus an external post-start `GetTDReport` health-check query; optionally validate GetQuote | +| `Test-TdxServTdExtPrebind.ps1` | start a prebound TD and validate both ServTdExt hash slots and zero padding | +| `Test-TdxLmRebind.ps1` | rebind a running TD between two same- or different-image MigTD instances | +| `Publish-TipPackage.ps1` | enrich the source package with matching winbuild prebuilts and copy it to a destination | +| `Install-TipDependencies.ps1` | install bundled PowerTest, HCSTest v2, VmgsTool, and optional test SecFw | +| `troubleshooting/Export-MigTdMigrationTimeline.ps1` | normalize VMMS/Worker/VID/GHCI events from one ETL | +| `troubleshooting/Compare-MigTdNodeTraces.ps1` | align source and destination timelines around one migration request | +| `troubleshooting/Get-MigTdDeploymentProvenance.ps1` | capture host build, repository, image, hash, mapping, and HCS provenance | +| `troubleshooting/Test-CrossNodeMigTdBinding.ps1` | validate destination hash mapping and running MigTD before cross-node migration | +| `dependencies/Source` | OS-source snapshots of PowerTest, HCSTest v2, and TDX live-migration tests | +| `dependencies/PowerTest`, `dependencies/HCSTest` | installable host modules; HCSTest becomes complete after publishing | +| `dependencies/Tools/VmgsTool.exe` | build-matched VMGS creation tool added by the publisher | +| `dependencies/SecFw` | optional build-matched test Secure Firmware | + +`.hash` is the direct `SERVTD_INFO_HASH` the host passes to +`TDH.SERVTD.PREBIND` as `MigTdHash`. Built with MigTD-native tooling only +(`cargo image`, `migtd-hash`, `build_azure_mock_test.sh`). + +The `_mock_quote` variants use the `use-mock-quote` feature and do not use the +host IGVMAgent GetQuote path. Their sibling `.hash` files are still direct +`SERVTD_INFO_HASH` values calculated from each final emitted IGVM. + +Each real-policy variant is emitted as an original/rebind pair. The rebind +policy increments `policySvn` with the same policy key, measures the resulting +image, then adds that image's hash to the same cumulative TCB mapping before +the final signing pass. The authenticated rebind-source policy therefore maps +both the original init hash and its current hash. +The real-quote pair uses a two-phase measure-then-bind build so its ServTD TCB +mapping contains the final image's real `tdinfo_hash`. The mock-quote pair +follows the same authority-history reset and adds the actual original/rebind +image hashes needed for ServTdExt lookup. Phase-1 synthetic mappings are never +promoted into the final signed mapping. +The builder calculates each image's final runtime TD Info Hash independently. +If a pair produces equal hashes, one shared mapping entry is sufficient. + +The key-rotation variants keep `policySvn` unchanged so rebind is authorized +in both directions. Their outer policy certificate uses a new key, but chains +to the same root CA and carries the same leaf Subject Name. TD identity and TCB +mapping collateral remain signed by the original leaf, isolating the test to +rotation of the policy-signing leaf. Each image carries a signed TCB mapping for +its own measurements; after the peer mapping chain passes the same-root and +same-Subject-Name checks, the peer mapping supplies its MigTD SVN and identity. +The destination does not require the source/init measurements in its local TCB +mapping, so an older image does not need to predict a future rotation image. + +For regular attestation, ServTdExt binds the supplied init TDINFO and the +authenticated source MROWNER/MROWNERCONFIG check enforces that the source policy +signer matches the init signer and that source policy SVN is greater than or +equal to init policy SVN. The local TCB-mapping lookup does not contribute to +that ordering and is intentionally omitted, allowing migration and rebinding +back and forth during a key-rotation rollout. The current `REVERT_ME` test mode +logs some MROWNER/MROWNERCONFIG failures instead of aborting; production must +restore those checks as hard failures. + +## 2. Enrich and deploy to a TiP node (PowerShell 7 + FCShell) + +The builder emits `out/migtd_package.zip` beside `out/tip-package`. Copy +`migtd_package.zip` to the SAW, then expand it directly under the SAW user's +home directory: + +```powershell +$packageRoot = Join-Path $HOME 'migtd_package' +if (Test-Path -LiteralPath $packageRoot) { + Remove-Item -LiteralPath $packageRoot -Recurse -Force +} +Expand-Archive C:\staging\migtd_package.zip -DestinationPath $HOME -Force +``` + +This creates: + +```text +$HOME\migtd_package\Upload-TipPackage.ps1 +$HOME\migtd_package\tip_package\... +``` + +First use PowerShell 7 on the SAW to add matching winbuild prebuilts: + +```powershell +& "$HOME\migtd_package\tip_package\Publish-TipPackage.ps1" ` + -PackageDir "$HOME\migtd_package\tip_package" ` + -WinBuildRoot \\winbuilds\release\<branch>\<build> ` + -ArchFlavor amd64fre ` + -SecFwFile \\winbuilds\...\secfw_test_GenuineIntel.dll ` + -Destination "$HOME\migtd_package\tip_package_ready" ` + -Force +``` + +The publisher resolves +`<WinBuildRoot>\<ArchFlavor>\test_automation_bins`, replaces the source-only +HCSTest runtime directory with the matching prebuilt module, adds +`VmgsTool.exe` and Secure Firmware, validates the completed package, and leaves +the source package unchanged. Use `-SkipSecFw` only when the target host +already has the matching test Secure Firmware configured. + +Then, from an FCShell session started via DCM Explorer, upload the enriched +package: + +```powershell +& "$HOME\migtd_package\Upload-TipPackage.ps1" ` + -ClusterName CVL05PrdApp02 ` + -SessionId 11111111-2222-3333-4444-555555555555 ` + -PackagePath "$HOME\migtd_package\tip_package_ready" +``` + +The uploader requires the `acc_tip` and `TipNodeServiceAME` modules and an +already-created TiP session (allocate one with `tdx_lm_node_setup.ps1` or +`New-TipNodeSession`). It zips the package, publishes it to the fabric image +store as a `NodeExecutePackage`, and distributes it to every node in the +session. The fabric extracts it to `C:\NodeExecute\<PackageName>\` (default +`migtd-tip-package`) on each node, so the IGVMs and test scripts land at +`C:\NodeExecute\migtd-tip-package\`. Pass `-PackageName` to control the on-node +directory. Then run the tests on the node as in section 3. + +## 3. Run (TDX labblade, elevated PowerShell 7) + +Open a fresh elevated PowerShell 7 process in the published package, then: + +```powershell +# One-time dependency install and host prep. Reboot if requested, then rerun +# without -InstallDependencies. +.\Run-TipTests.ps1 -InstallDependencies -ConfigureHost + +# Default suite: startup request coverage, mock-quote migration, ServTdExt, +# and mock-quote rebind/key-rotation validation. +.\Run-TipTests.ps1 + +# Also run GetQuote initialization and regular IGVMAgent-dependent policy cases. +.\Run-TipTests.ps1 -IncludeAgentCases +``` + +The suite prints a `wait_for_requests coverage` matrix for all operations MigTD +accepts: + +| Operation | Real-host trigger / coverage | +|------|------| +| `1 StartMigration` | `Move-VM` loopback | +| `2 StartRebinding` | `Update-VmMigrationPolicy` rebind | +| `3 GetTDReport` | explicit post-start HCS query matching IGVMAgent health checks; validates the nonce, TDREPORT hashes, image TD Info Hash, and external GHCI events | +| `4 EnableLogArea` | automatic first startup request; validated through GHCI VDev ETW | +| `5 GetMigtdData` | unavailable on the current Host OS GHCI VDev, whose `GhciRequestOperation` exposes only operations 1–4 | + +The request test follows the Host OS GHCI test pattern and requires PowerShell +7 plus elevated WPR access. Startup's internal `GetTDReport` is verified only +as TDINFO-cache setup. Operation 3 coverage comes from a separate post-start +`Get-HcsSystemProperties` `MigTdReport` query using a random REPORTDATA nonce, +the same HCS path used by IGVMAgent health checks. With `-IncludeAgentCases`, +the test also starts `test-migtd-getquote-all.igvm` and requires Worker +Analytic event 18670, matching `Tdx.Ghci.GetQuote.TestMD.Tests.ps1`. + +Each case: start MigTD → register hash with host policy `DisabledByDefault` → +create a TDX VM → set its migratable policy to `EnabledIfHostPermits` → assign +its MigTD hash → `Move-VM -DestinationHost localhost` → assert → cleanup while +leaving the host `DisabledByDefault`. This applies to migration, expected +rejection, ServTdExt prebind, and rebind tests. Requires PowerTest +`TdxLiveMigrationUtilities` for `New-TestHcsMigTd`. Rebinding uses +`Test-TdxLmRebind.ps1` with two same- or different-image inputs. + +Some PowerTest builds' `New-TestHcsMigTd` call `New-VmStateFile`, which is not +defined in that module set. The publisher bundles the matching `VmgsTool.exe`, +and the installer places it in System32, so the compatibility shim does not +need PowerTest's internal `Copy-TestItem`/test-content path. + +Similarly, `New-HcsSystemDocument`/`New-HcsSystem`/`Start-HcsSystem` come from +the real `HCSTest` binary module, which `HCSUtilities.psm1` only loads via its +own `Import-HcsTestModule` helper — nothing calls that automatically. `Invoke- +TdxLmLoopback.ps1` imports `HCSUtilities.psm1` and calls `Import-Module HCSTest +-ArgumentList @{ UseVersion2 = $true }` itself when `-PowerTestPath` is passed +(only falling back to PowerTest's `Import-HcsTestModule` if `HCSTest` isn't +already installed under `Program Files\PowerShell\Modules`). `UseVersion2` +matters: the V1 binary's `New-VmStateFile` P/Invokes +`vmcompute.dll!CreateEmptyGuestStateFile`, removed on newer OS builds in favor +of `computestorage.dll` (used by V2). This matches +`onecore/vm/test/migration/tdx/Loopback/Tdx.LiveMigration.Loopback.Tests.ps1`. + +`Publish-TipPackage.ps1` takes HCSTest from the matching winbuilds share build +(see `bin\<archflavor>\test_automation_bins\buildname.txt` in the OS enlistment +for the exact build): +``` +\\winbuilds\release\<branch>\<build>.<qfe>.<date-time>\<archflavor>\test_automation_bins\vm\test\compute\HCSTest +``` +The package installer copies it to +`$env:ProgramFiles\PowerShell\Modules\HCSTest` and validates +`coreclr\Microsoft.HostCompute.Test.PowerShell.v2.dll`, +`New-VMStateFile`, and `New-HcsSystemDocument`. Run installation from a fresh +PowerShell 7 process because loaded HCSTest assemblies remain locked. + +If migration fails with only a generic VMMS error (e.g. "migration operation +failed at migration source" with no further detail), pass `-CaptureSerial` to +`Invoke-TdxLmLoopback.ps1` to capture the MigTD's own log output (it's built +with `--log-level info`) to `<MigTdId>.serial.log` via `New-TestHcsMigTd +-EnableSerial`'s named pipe. If cleanup begins during GetQuote retry backoff, +the script waits up to 30 seconds for the sixth-attempt terminal log before +stopping MigTD; override this with `-SerialDrainTimeoutSeconds`. + +`Invoke-TdxLmLoopback.ps1` also calls `Enable-LoopbackMigrationDirectoryWorkaround` +(from `LiveMigrationUtilities.psm1`) before attempting migration, matching the +official aka.ms/tdxlm partner-facing reference test +(`Tdx.LiveMigration.Partner.Tests.ps1`). It repoints Hyper-V's default VM/VHD +storage paths to `<SystemDrive>\HyperVData\...` — for undetermined reasons this +is needed on some lab systems to avoid the same generic "failed at migration +source" error with a bare `-NoVHD` loopback TD. + +The script migrates the bare `-NoVHD` TD immediately after `Start-VM`, matching +the partner test. `-StartupDelaySeconds` permits controlled timing experiments; +do not infer a timing root cause from `0xC0350071`, which is the generic +`ERROR_HV_OPERATION_FAILED`. On the investigated blade, both zero and five +seconds reached the same `VidTdxBind` failure. + +There are two attestation paths: + +- Regular images use `igvm-attest`, so MigTD migration approval requires a + compatible IGVMAgent for GHCI GetQuote. +- `-NoPersistentSecrets` suppresses only the target VM's OpenHCL attestation + call. It changes TPM/VMGS persistence semantics. + +For a fully IGVMAgent-independent smoke test, combine both bypasses: + +```powershell +.\Invoke-TdxLmLoopback.ps1 ` + -IgvmFilePath .\test-migtd-accept-all_mock_quote.igvm ` + -PowerTestPath C:\path\to\PowerTest ` + -NoPersistentSecrets ` + -CaptureSerial +``` + +To validate prebind state without starting migration: + +```powershell +.\Test-TdxServTdExtPrebind.ps1 ` + -IgvmFilePath .\test-migtd-accept-all_mock_quote.igvm ` + -PowerTestPath C:\path\to\PowerTest ` + -NoPersistentSecrets +``` + +The test reads `Get-VmServTdExt -VmName tiptd` after VM startup and validates +the 272-byte layout: the prebound hash at byte offsets 0 and 112, zero +SERVTD_ATTR/reserved ranges, and the variable CPU SVN/TEE TCB/model metadata +between the two hashes. + +To rebind a running TD between two MigTD instances, provide any two packaged +IGVMs. They may be different files or the same file: + +```powershell +.\Test-TdxLmRebind.ps1 ` + -OldIgvmFilePath .\test-migtd_mock_quote.igvm ` + -NewIgvmFilePath .\test-migtd_mock_quote_rebind.igvm +``` + +To exercise policy leaf-key rotation in both directions: + +```powershell +.\Test-TdxLmRebind.ps1 ` + -OldIgvmFilePath .\test-migtd_mock_quote.igvm ` + -NewIgvmFilePath .\test-migtd_mock_quote_key_rotation.igvm +.\Test-TdxLmRebind.ps1 ` + -OldIgvmFilePath .\test-migtd_mock_quote_key_rotation.igvm ` + -NewIgvmFilePath .\test-migtd_mock_quote.igvm +``` + +`Run-TipTests.ps1` runs these two mock-quote rotation cases by default. With +`-IncludeAgentCases`, it also runs both directions between `test-migtd.igvm` +and `test-migtd_key_rotation.igvm`. + +Runtime `TD Info Hash` values parsed from the two serial logs are authoritative, +so sibling `.hash` files may be stale or absent. Existing `.hash` files are +used only as cross-checks and as fallbacks when serial capture is disabled. +When the two runtime hashes are equal, the second host mapping uses a synthetic +key exactly as the host OS rebind test does; `Get-VmMigrationPolicy` must still +report the real IGVM hash. The target VM defaults to `NoPersistentSecrets`; pass +`-UsePersistentSecrets` only when target-VM attestation is intentionally part +of the test. Both MigTD serial logs are captured by default as +`tipmigtd-rebind-{old,new}.serial.log`; disable this with +`-CaptureSerial:$false`. The script warns when a sibling hash disagrees with +the runtime value and waits up to 30 seconds for +`ReportStatus for rebinding completed` before stopping either MigTD. If neither +side receives operation 2 within five seconds, it reports a pre-delivery host +failure instead. Override the timeout with `-SerialDrainTimeoutSeconds`. +Before `UpgradeMigrationPolicy`, the script queries both HCS systems and +requires each to be in `Running` state with a nonempty `RuntimeId`; the host +rebind implementation needs both MigTD worker processes and GHCI devices alive +at the same time. Host policy remains `DisabledByDefault`: the target TD is +explicitly marked `EnabledIfHostPermits` with `Set-VmMigratablePolicy`, and the +script verifies that setting before startup. Cleanup leaves the host +`DisabledByDefault` with the real final MigTD hash rather than enabling +migration for VMs that did not opt in. + +During rebind, `0x800721CE` is the GHCI translation of +`MIGPOLICY_UNSATISFIED_ERROR`, despite Windows formatting it as “The account is +controlled by external policy.” It means the old and new MigTD policies or +enrolled identities do not mutually authorize the pair; inspect both serial +logs for the specific failed policy check. + +Capture VMMS, Worker, VID, GHCI VDev, analytic-channel, and serial evidence +around one rebind attempt with: + +```powershell +.\troubleshooting\Invoke-TdxLmDiagnosticCapture.ps1 ` + -OutputDir .\diag-rebind ` + -EnableAnalytic ` + -CaptureEtw ` + -SerialLogPath @( + '.\tipmigtd-rebind-old.serial.log', + '.\tipmigtd-rebind-new.serial.log' + ) ` + -ReproCommand { + .\Test-TdxLmRebind.ps1 ` + -OldIgvmFilePath .\old.igvm ` + -NewIgvmFilePath .\new.igvm + } +``` + +In `tdxlm.etl`, inspect GHCI events +`CreateTdxPrepareRebindingRequest`, `SubmitRequest_Sent`, and +`RebindRequest_Failed`. The latter records `IsSource`, `PrimaryStatus`, +`DetailedError`, and `ResultHR`, distinguishing an old/source rejection from a +new/destination rejection. VMMS/Worker events show whether failure occurred +before request submission, in the data pump, or during `VidTdxRebind`. + +For a smaller trace containing only provider +`Microsoft.Windows.HyperV.GhciVDev` +(`AEFC8638-19A2-553A-06CB-C3984FFC7EE8`), run: + +```powershell +.\troubleshooting\Invoke-GhciVDevDiagnosticCapture.ps1 ` + -OutputDir .\diag-ghci ` + -ReproCommand { + .\Test-TdxLmRebind.ps1 ` + -OldIgvmFilePath .\old.igvm ` + -NewIgvmFilePath .\new.igvm + } +``` + +This writes `ghcivdev.etl`, raw `tracerpt` CSV/XML, provider metadata, and +provider-filtered text/CLIXML when `Get-WinEvent` can decode the ETL. To export +an existing trace separately: + +```powershell +.\troubleshooting\Export-GhciVDevEvents.ps1 -EtlPath .\tdxlm.etl +``` + +For a cross-node SPDM transport failure, capture deployment provenance and +validate destination mapping before the repro: + +```powershell +.\troubleshooting\Get-MigTdDeploymentProvenance.ps1 ` + -IgvmFilePath .\test-migtd-accept-all.igvm ` + -HashFilePath .\test-migtd-accept-all.igvm.hash ` + -SerialLogPath .\tipmigtd.serial.log ` + -MigTdHcsId <MIGTD_HCS_ID> ` + -PowerTestPath <POWERTEST_PATH> ` + -OutputDir .\provenance + +.\troubleshooting\Test-CrossNodeMigTdBinding.ps1 ` + -SourceHashFilePath .\source-migtd.igvm.hash ` + -DestinationSerialLogPath .\destination-migtd.serial.log ` + -DestinationMigTdHcsId <DESTINATION_MIGTD_HCS_ID> ` + -PowerTestPath <POWERTEST_PATH> ` + -RequireRuntimeHash +``` + +Normalize the ETLs on a Windows machine, then align request events: + +```powershell +.\troubleshooting\Export-MigTdMigrationTimeline.ps1 ` + -EtlPath .\td_source.etl -Node Source -OutputDir .\source-timeline +.\troubleshooting\Export-MigTdMigrationTimeline.ps1 ` + -EtlPath .\td_dest.etl -Node Destination -OutputDir .\destination-timeline + +.\troubleshooting\Compare-MigTdNodeTraces.ps1 ` + -SourceTimelinePath .\source-timeline\migtd-migration-timeline.csv ` + -DestinationTimelinePath .\destination-timeline\migtd-migration-timeline.csv ` + -RequestId <REQUEST_ID> ` + -OutputDir .\cross-node-comparison +``` + +The comparison marks the first destination failure candidate and calculates +its delay to source cancellation. Confirm any file/line event against the +Windows OS source branch matching the tested host build. + +An unresponsive agent can consume two 30-second target-VM attestation RPC +timeouts and exhaust the worker's 60-second `StartVtl0` budget. During regular +image migration, `0x80072F78` from GetQuote instead means the agent response +failed V2 header/size validation; use an agent binary matching the host build. + +`RequireIgvmAgent` under +`HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization` only +controls whether VM startup requires an available endpoint. It is unnecessary +for the mock-quote/no-secrets path. + +Design: `MigTD/doc/integration_test_azure_tip.md`. + +Reusable host validation, hash verification, and ETW capture helpers are copied +into each built package: + +```text +troubleshooting/ +``` + +Their source and full agent playbook live in +`.agents/skills/migtd-tip-troubleshoot/` and +`.agents/skills/migtd-spdm-transport-debug/`. diff --git a/sh_script/Azure/tip/Run-TipTests.ps1 b/sh_script/Azure/tip/Run-TipTests.ps1 new file mode 100644 index 000000000..9c29d8430 --- /dev/null +++ b/sh_script/Azure/tip/Run-TipTests.ps1 @@ -0,0 +1,287 @@ +#Requires -Version 7.0 + +<# +.SYNOPSIS + Run the TiP loopback test suite over a built package directory. + +.DESCRIPTION + Runs MigTD startup and post-start WaitForRequest coverage, + agent-independent mock-quote migration, ServTdExt prebind, and bidirectional + policy leaf-key rotation rebind checks. + Optionally installs bundled dependencies, configures the host, and runs the + regular IGVMAgent-dependent policy cases. + +.EXAMPLE + .\Run-TipTests.ps1 -InstallDependencies -ConfigureHost +#> +[CmdletBinding()] +param( + [string]$PackageDir = $PSScriptRoot, + [string]$PowerTestPath = "$env:ProgramFiles\PowerShell\Modules\PowerTest", + [switch]$InstallDependencies, + [switch]$ConfigureHost, + [switch]$IncludeAgentCases, + [switch]$CaptureSerial +) +$ErrorActionPreference = 'Stop' + +if ($InstallDependencies) { + $installer = Join-Path $PackageDir 'Install-TipDependencies.ps1' + if (-not (Test-Path $installer)) { + throw "Dependency installer not found: $installer" + } + $setupOutput = @(& $installer -PackageDir $PackageDir ` + -ConfigureHost:$ConfigureHost -Force) + $setupResult = $setupOutput | + Where-Object { $_.PSObject.Properties.Name -contains 'RebootRequired' } | + Select-Object -Last 1 + if (-not $setupResult) { + throw 'Dependency installer did not return setup status.' + } + $setupOutput | Where-Object { $_ -ne $setupResult } | Out-Host + $setupResult | Format-List | Out-Host + $PowerTestPath = $setupResult.PowerTestPath + if ($setupResult.RebootRequired) { + throw 'Dependency installation changed Secure Firmware. Reboot the host, then rerun Run-TipTests.ps1 without -InstallDependencies.' + } +} elseif ($ConfigureHost) { + $validator = Join-Path $PackageDir 'troubleshooting\Test-TdxLmLabBlade.ps1' + & $validator -PowerTestPath $PowerTestPath -Configure +} + +$results = @() +$requestCoverage = @() +$startupRequestScript = Join-Path $PackageDir 'Test-TdxMigTdStartupRequests.ps1' +if (-not (Test-Path $startupRequestScript)) { + throw "Startup request test script not found: $startupRequestScript" +} + +$startupRequestIgvm = Join-Path $PackageDir 'test-migtd-accept-all_mock_quote.igvm' +if (Test-Path $startupRequestIgvm) { + Write-Host "`n=== wait_for_requests startup and post-start operations ===" + try { + & $startupRequestScript ` + -IgvmFilePath $startupRequestIgvm ` + -PowerTestPath $PowerTestPath ` + -OutputDir (Join-Path $PackageDir 'request-coverage\startup') + $results += [pscustomobject]@{ + Case = 'wait_for_requests startup and GetTDReport' + Result = 'PASS' + } + $requestCoverage += @( + [pscustomobject]@{ + Operation = '4 EnableLogArea' + Trigger = 'MigTD startup' + Result = 'PASS' + Notes = 'GHCI EnableLogAreaRequest_Success' + }, + [pscustomobject]@{ + Operation = '3 GetTDReport' + Trigger = 'Post-start HCS query' + Result = 'PASS' + Notes = 'External request; nonce, report hashes, and image hash validated' + } + ) + } catch { + $results += [pscustomobject]@{ + Case = 'wait_for_requests startup and GetTDReport' + Result = "FAIL: $_" + } + $requestCoverage += @( + [pscustomobject]@{ + Operation = '4 EnableLogArea' + Trigger = 'MigTD startup' + Result = 'FAIL' + Notes = [string]$_ + }, + [pscustomobject]@{ + Operation = '3 GetTDReport' + Trigger = 'Post-start HCS query' + Result = 'FAIL' + Notes = [string]$_ + } + ) + } +} else { + Write-Warning "skip wait_for_requests startup: $startupRequestIgvm not found" + $requestCoverage += @( + [pscustomobject]@{ + Operation = '4 EnableLogArea' + Trigger = 'MigTD startup' + Result = 'SKIP' + Notes = 'mock-quote image missing' + }, + [pscustomobject]@{ + Operation = '3 GetTDReport' + Trigger = 'Post-start HCS query' + Result = 'SKIP' + Notes = 'mock-quote image missing' + } + ) +} + +if ($IncludeAgentCases) { + $getQuoteIgvm = Join-Path $PackageDir 'test-migtd-getquote-all.igvm' + if (Test-Path $getQuoteIgvm) { + Write-Host "`n=== GetQuote initialization ===" + try { + & $startupRequestScript ` + -IgvmFilePath $getQuoteIgvm ` + -PowerTestPath $PowerTestPath ` + -ExpectedGetQuoteResult Success ` + -OutputDir (Join-Path $PackageDir 'request-coverage\getquote') + $results += [pscustomobject]@{ + Case = 'GetQuote initialization' + Result = 'PASS' + } + } catch { + $results += [pscustomobject]@{ + Case = 'GetQuote initialization' + Result = "FAIL: $_" + } + } + } else { + Write-Warning "skip GetQuote initialization: $getQuoteIgvm not found" + } +} + +$cases = @( + @{ Name = 'accept-all_mock_quote'; File = 'test-migtd-accept-all_mock_quote.igvm'; Reject = $false; NoSecrets = $true } +) +if ($IncludeAgentCases) { + $cases += @( + @{ Name = 'accept-all'; File = 'test-migtd-accept-all.igvm'; Reject = $false; NoSecrets = $false }, + @{ Name = 'policy'; File = 'test-migtd.igvm'; Reject = $false; NoSecrets = $false }, + @{ Name = 'reject-all'; File = 'test-migtd-reject-all.igvm'; Reject = $true; NoSecrets = $false } + ) +} + +$loopback = Join-Path $PSScriptRoot 'Invoke-TdxLmLoopback.ps1' +if (-not (Test-Path $loopback)) { + throw "Loopback driver not found: $loopback" +} +foreach ($c in $cases) { + $igvm = Join-Path $PackageDir $c.File + if (-not (Test-Path $igvm)) { Write-Warning "skip $($c.Name): $igvm not found"; continue } + Write-Host "`n=== $($c.Name) ===" + try { + & $loopback -IgvmFilePath $igvm -ExpectReject:$c.Reject ` + -PowerTestPath $PowerTestPath -NoPersistentSecrets:$c.NoSecrets ` + -CaptureSerial:$CaptureSerial + $results += [pscustomobject]@{ Case = $c.Name; Result = 'PASS' } + } catch { + $results += [pscustomobject]@{ Case = $c.Name; Result = "FAIL: $_" } + } +} + +$migrationResults = @( + $results | Where-Object { $_.Case -in $cases.Name } +) +$migrationCoverage = if ($migrationResults.Result -match '^FAIL') { + 'FAIL' +} elseif ($migrationResults.Result -contains 'PASS') { + 'PASS' +} else { + 'SKIP' +} +$requestCoverage += [pscustomobject]@{ + Operation = '1 StartMigration' + Trigger = 'Move-VM loopback' + Result = $migrationCoverage + Notes = 'Invoke-TdxLmLoopback.ps1' +} + +$prebindIgvm = Join-Path $PackageDir 'test-migtd-accept-all_mock_quote.igvm' +if (Test-Path $prebindIgvm) { + Write-Host "`n=== ServTdExt prebind ===" + try { + $prebindScript = Join-Path $PackageDir 'Test-TdxServTdExtPrebind.ps1' + if (-not (Test-Path $prebindScript)) { + throw "ServTdExt test script not found: $prebindScript" + } + & $prebindScript ` + -IgvmFilePath $prebindIgvm -PowerTestPath $PowerTestPath ` + -NoPersistentSecrets -CaptureSerial:$CaptureSerial + $results += [pscustomobject]@{ Case = 'ServTdExt prebind'; Result = 'PASS' } + } catch { + $results += [pscustomobject]@{ Case = 'ServTdExt prebind'; Result = "FAIL: $_" } + } +} + +$rebindScript = Join-Path $PackageDir 'Test-TdxLmRebind.ps1' +if (-not (Test-Path $rebindScript)) { + throw "Rebind test script not found: $rebindScript" +} +$rotationCases = @( + @{ + Name = 'mock-quote key rotation forward' + Old = 'test-migtd_mock_quote.igvm' + New = 'test-migtd_mock_quote_key_rotation.igvm' + }, + @{ + Name = 'mock-quote key rotation backward' + Old = 'test-migtd_mock_quote_key_rotation.igvm' + New = 'test-migtd_mock_quote.igvm' + } +) +if ($IncludeAgentCases) { + $rotationCases += @( + @{ + Name = 'key rotation forward' + Old = 'test-migtd.igvm' + New = 'test-migtd_key_rotation.igvm' + }, + @{ + Name = 'key rotation backward' + Old = 'test-migtd_key_rotation.igvm' + New = 'test-migtd.igvm' + } + ) +} + +foreach ($c in $rotationCases) { + $oldIgvm = Join-Path $PackageDir $c.Old + $newIgvm = Join-Path $PackageDir $c.New + if (-not (Test-Path $oldIgvm) -or -not (Test-Path $newIgvm)) { + Write-Warning "skip $($c.Name): required image missing" + continue + } + Write-Host "`n=== $($c.Name) ===" + try { + & $rebindScript -OldIgvmFilePath $oldIgvm -NewIgvmFilePath $newIgvm ` + -PowerTestPath $PowerTestPath -CaptureSerial:$CaptureSerial + $results += [pscustomobject]@{ Case = $c.Name; Result = 'PASS' } + } catch { + $results += [pscustomobject]@{ Case = $c.Name; Result = "FAIL: $_" } + } +} + +$rebindResults = @( + $results | Where-Object { $_.Case -in $rotationCases.Name } +) +$rebindCoverage = if ($rebindResults.Result -match '^FAIL') { + 'FAIL' +} elseif ($rebindResults.Result -contains 'PASS') { + 'PASS' +} else { + 'SKIP' +} +$requestCoverage += [pscustomobject]@{ + Operation = '2 StartRebinding' + Trigger = 'Update-VmMigrationPolicy' + Result = $rebindCoverage + Notes = 'Test-TdxLmRebind.ps1' +} +$requestCoverage += [pscustomobject]@{ + Operation = '5 GetMigtdData' + Trigger = 'None on current Host OS' + Result = 'UNAVAILABLE' + Notes = 'Host GHCI VDev GhciRequestOperation exposes operations 1-4 only' +} + +$results | Format-Table -AutoSize +Write-Host "`n=== wait_for_requests coverage ===" +$requestCoverage | + Sort-Object { [int]($_.Operation.Split(' ')[0]) } | + Format-Table -AutoSize -Wrap +if ($results.Result -match 'FAIL') { exit 1 } diff --git a/sh_script/Azure/tip/Test-TdxLmRebind.ps1 b/sh_script/Azure/tip/Test-TdxLmRebind.ps1 new file mode 100644 index 000000000..2b894367f --- /dev/null +++ b/sh_script/Azure/tip/Test-TdxLmRebind.ps1 @@ -0,0 +1,557 @@ +#Requires -Version 7.0 +#Requires -RunAsAdministrator + +<# +.SYNOPSIS + Rebind a running TDX VM from one MigTD instance to another. + +.DESCRIPTION + Starts two MigTD instances from the supplied IGVM files, binds a TDX VM to + the first, then invokes UpgradeMigrationPolicy to rebind it to the second. + Runtime TD Info Hash values from the MigTD serial logs are authoritative. + Sibling .hash files are optional cross-checks and fallbacks when serial + capture is disabled. If both images have the same hash, the second mapping + uses a synthetic lookup hash, matching the host OS rebind test; the VM's + reported policy remains the real IGVM hash. + + The target VM uses NoPersistentSecrets by default so the test does not need + target-VM IGVMAgent attestation. + +.EXAMPLE + .\Test-TdxLmRebind.ps1 ` + -OldIgvmFilePath .\test-migtd-accept-all_mock_quote.igvm ` + -NewIgvmFilePath .\test-migtd_mock_quote.igvm + +.EXAMPLE + .\Test-TdxLmRebind.ps1 ` + -OldIgvmFilePath .\test-migtd-accept-all_mock_quote.igvm ` + -NewIgvmFilePath .\test-migtd-accept-all_mock_quote.igvm + +.EXAMPLE + .\Test-TdxLmRebind.ps1 ` + -OldIgvmFilePath .\test-migtd_mock_quote.igvm ` + -NewIgvmFilePath .\test-migtd_mock_quote_key_rotation.igvm +#> +[CmdletBinding()] +param( + [Parameter(Mandatory)] [string]$OldIgvmFilePath, + [Parameter(Mandatory)] [string]$NewIgvmFilePath, + [string]$OldHashFilePath = "$OldIgvmFilePath.hash", + [string]$NewHashFilePath = "$NewIgvmFilePath.hash", + [string]$OldMigTdId = 'tipmigtd-rebind-old', + [string]$NewMigTdId = 'tipmigtd-rebind-new', + [string]$VmName = 'tiptd-rebind', + [string]$PowerTestPath = "$env:ProgramFiles\PowerShell\Modules\PowerTest", + [switch]$UsePersistentSecrets, + [switch]$CaptureSerial = $true, + [ValidateRange(1, 120)] [int]$PolicyTimeoutSeconds = 15, + [ValidateRange(0, 60)] [int]$SerialDrainTimeoutSeconds = 30 +) + +$ErrorActionPreference = 'Stop' +$script:serialCaptures = @{} +$script:runtimeHashes = @{} + +function Import-PowerTestFile { + param([Parameter(Mandatory)] [string]$Name) + + $path = Join-Path $PowerTestPath $Name + if (-not (Test-Path $path)) { + throw "PowerTest module file not found: $path" + } + Import-Module $path -Global -Force -DisableNameChecking +} + +function Read-MigTdHash { + param( + [Parameter(Mandatory)] [string]$Path, + [switch]$Required + ) + + if (-not (Test-Path $Path)) { + if ($Required) { + throw "MigTD hash file not found: $Path" + } + return $null + } + $hash = (Get-Content $Path -Raw).Trim().ToLowerInvariant() + if ($hash -notmatch '^[0-9a-f]{96}$') { + throw "MigTD hash must be exactly 96 hexadecimal characters: $Path" + } + return $hash +} + +function New-SyntheticHash { + param([Parameter(Mandatory)] [string]$Hash) + + return -join ($Hash.ToCharArray() | ForEach-Object { + '{0:x}' -f (([Convert]::ToInt32("$_", 16) + 1) % 16) + }) +} + +function Start-MigTdInstance { + param( + [Parameter(Mandatory)] [string]$InstanceId, + [Parameter(Mandatory)] [string]$IgvmPath, + [string]$ExpectedHash + ) + + Write-Host "Starting MigTD '$InstanceId' from $IgvmPath" + $instance = New-TestHcsMigTd ` + -Id $InstanceId ` + -IgvmFilePath (Resolve-Path $IgvmPath) ` + -GuestStateDirectory (Get-Location) ` + -EnableSerial:$CaptureSerial ` + -Force + + if ($CaptureSerial) { + $logPath = Join-Path (Get-Location) "$InstanceId.serial.log" + Remove-Item $logPath -ErrorAction SilentlyContinue + $job = Start-Job -Name "$InstanceId-serial" -ScriptBlock { + param($PipeName, $LogPath) + try { + $pipe = [System.IO.Pipes.NamedPipeClientStream]::new( + '.', + $PipeName, + [System.IO.Pipes.PipeDirection]::In) + $pipe.Connect(15000) + $reader = [System.IO.StreamReader]::new($pipe) + while ($true) { + $line = $reader.ReadLine() + if ($null -eq $line) { + break + } + Add-Content -Path $LogPath -Value $line + } + } catch { + Add-Content -Path $LogPath -Value "[serial-capture] $_" + } + } -ArgumentList "raw$InstanceId", $logPath + $script:serialCaptures[$InstanceId] = [pscustomobject]@{ + Job = $job + LogPath = $logPath + } + } + + try { + $instance | Start-HcsSystem + if ($CaptureSerial) { + $script:runtimeHashes[$InstanceId] = Wait-MigTdRuntimeHash ` + -InstanceId $InstanceId ` + -ImagePath $IgvmPath ` + -ExpectedHash $ExpectedHash ` + -TimeoutSeconds $PolicyTimeoutSeconds + } + return $instance + } catch { + Stop-MigTdInstance $instance + throw + } +} + +function Wait-MigTdRuntimeHash { + param( + [Parameter(Mandatory)] [string]$InstanceId, + [Parameter(Mandatory)] [string]$ImagePath, + [string]$ExpectedHash, + [Parameter(Mandatory)] [int]$TimeoutSeconds + ) + + $capture = $script:serialCaptures[$InstanceId] + if (-not $capture) { + return + } + + $deadline = (Get-Date).AddSeconds($TimeoutSeconds) + do { + if (Test-Path $capture.LogPath) { + $text = Get-Content $capture.LogPath -Raw -ErrorAction SilentlyContinue + $match = [regex]::Match( + $text, + 'TD Info Hash:\s*([0-9a-fA-F]{96})', + [System.Text.RegularExpressions.RegexOptions]::RightToLeft) + if ($match.Success) { + $actualHash = $match.Groups[1].Value.ToLowerInvariant() + if ($ExpectedHash -and $actualHash -ne $ExpectedHash) { + Write-Warning "Ignoring stale hash file for '$InstanceId'. HashFile=$ExpectedHash Runtime=$actualHash Image=$ImagePath" + } + Write-Host "Runtime TD Info Hash verified for '$InstanceId': $actualHash" + return $actualHash + } + } + Start-Sleep -Milliseconds 250 + } while ((Get-Date) -lt $deadline) + + if ($ExpectedHash) { + Write-Warning "MigTD runtime TD Info Hash was not found in $($capture.LogPath); using hash file value $ExpectedHash." + return $ExpectedHash + } + throw "MigTD runtime TD Info Hash was not found in $($capture.LogPath) within $TimeoutSeconds seconds and no hash file fallback is available." +} + +function Stop-MigTdInstance { + param([object]$Instance) + + $instanceId = if ($Instance) { $Instance.Id } else { $null } + try { + if ($Instance -and -not $Instance.IsClosed) { + Stop-HcsSystem $Instance -ErrorAction SilentlyContinue + $Instance.Close() + } + } catch { + Write-Warning "Failed to close MigTD instance: $_" + } finally { + $capture = if ($instanceId) { $script:serialCaptures[$instanceId] } else { $null } + if ($capture) { + Wait-Job $capture.Job -Timeout 5 -ErrorAction SilentlyContinue | Out-Null + if ($capture.Job.State -notin @('Completed', 'Failed')) { + Stop-Job $capture.Job -ErrorAction SilentlyContinue | Out-Null + } + Remove-Job $capture.Job -Force -ErrorAction SilentlyContinue + Write-Host "MigTD serial log: $($capture.LogPath)" + $script:serialCaptures.Remove($instanceId) + } + } +} + +function Assert-MigTdRunning { + param( + [Parameter(Mandatory)] [object]$Instance, + [Parameter(Mandatory)] [string]$Role + ) + + if ($Instance.IsClosed) { + throw "$Role MigTD HCS handle is closed." + } + + $rawProperties = Get-HcsSystemProperties -System $Instance -RawJson + $properties = $rawProperties | ConvertFrom-Json + if ([string]$properties.State -ne 'Running') { + throw "$Role MigTD is not running (HCS state=$($properties.State))." + } + if (-not $properties.RuntimeId) { + throw "$Role MigTD has no HCS RuntimeId; its worker process is not ready." + } + + Write-Host "$Role MigTD is alive: Id=$($Instance.Id) RuntimeId=$($properties.RuntimeId)" +} + +function Wait-ForFinalRebindLogs { + param( + [string[]]$InstanceIds, + [int]$TimeoutSeconds, + [int]$RequestGraceSeconds = 5, + [bool]$HostOperationSucceeded = $false + ) + + if ($TimeoutSeconds -eq 0) { + return + } + + $captures = @($InstanceIds | ForEach-Object { + $capture = $script:serialCaptures[$_] + if ($capture) { + [pscustomobject]@{ + InstanceId = $_ + LogPath = $capture.LogPath + } + } + }) + if ($captures.Count -eq 0) { + return + } + + Write-Host "Waiting up to $TimeoutSeconds second(s) for final rebind log entries." + $start = Get-Date + $deadline = $start.AddSeconds($TimeoutSeconds) + $started = @() + $completed = @() + $settledSince = $null + $settledState = '' + do { + $started = @() + $completed = @() + foreach ($capture in $captures) { + $text = if (Test-Path $capture.LogPath) { + Get-Content $capture.LogPath -Raw -ErrorAction SilentlyContinue + } else { + '' + } + if ($text -match ('Processing StartRebinding request|' + + 'Pre-Session-Message Version|' + + 'finalize_spdm_session: body error|' + + 'Failure during rebinding status code')) { + $started += $capture.InstanceId + if ($text -match ('ReportStatus for rebinding completed|' + + 'Failed to report status for StartRebinding|' + + 'Failure during rebinding status code')) { + $completed += $capture.InstanceId + } + } + } + + if ($started.Count -gt 0 -and $completed.Count -eq $started.Count) { + $currentState = "$($started -join ',')|$($completed -join ',')" + if ($currentState -ne $settledState) { + $settledState = $currentState + $settledSince = Get-Date + } elseif ((Get-Date) -ge $settledSince.AddSeconds(2)) { + Write-Host "Final rebind status captured for: $($completed -join ', ')" + return + } + } else { + $settledSince = $null + $settledState = '' + } + if ($started.Count -eq 0 -and (Get-Date) -ge $start.AddSeconds($RequestGraceSeconds)) { + if ($HostOperationSucceeded) { + Write-Host 'Host rebind succeeded; no rebinding marker was observed in the captured serial logs.' + } else { + Write-Warning 'No MigTD rebinding activity was observed before the host rebind operation failed.' + } + return + } + + Start-Sleep -Milliseconds 250 + } while ((Get-Date) -lt $deadline) + + if ($started.Count -gt 0) { + $missing = @($started | Where-Object { $_ -notin $completed }) + if ($HostOperationSucceeded) { + Write-Host "Host rebind succeeded; terminal serial markers were not observed from: $($missing -join ', ')" + } else { + Write-Warning "Timed out waiting for terminal rebind logs from: $($missing -join ', ')" + } + } else { + if ($HostOperationSucceeded) { + Write-Host 'Host rebind succeeded; no StartRebinding marker was observed in the captured serial logs.' + } else { + Write-Warning 'Timed out without observing a MigTD StartRebinding request.' + } + } +} + +function Wait-VmMigrationPolicy { + param( + [Parameter(Mandatory)] [string]$TargetVmName, + [Parameter(Mandatory)] [string]$ExpectedHash, + [Parameter(Mandatory)] [int]$TimeoutSeconds + ) + + $deadline = (Get-Date).AddSeconds($TimeoutSeconds) + do { + $vm = Get-VM -Name $TargetVmName + $actual = ([string](Get-VmMigrationPolicy -Vm $vm)).Trim().ToLowerInvariant() + if ($actual -eq $ExpectedHash) { + return + } + Start-Sleep -Milliseconds 250 + } while ((Get-Date) -lt $deadline) + + throw "VM migration policy did not become $ExpectedHash within $TimeoutSeconds seconds. Actual=$actual" +} + +if ($PSVersionTable.PSVersion.Major -lt 7) { + throw 'This test requires PowerShell 7 because the host migration mapping helpers use ConvertFrom-Json -AsHashtable.' +} +if ($OldMigTdId -eq $NewMigTdId) { + throw 'OldMigTdId and NewMigTdId must be different.' +} +foreach ($path in @($OldIgvmFilePath, $NewIgvmFilePath)) { + if (-not (Test-Path $path)) { + throw "IGVM file not found: $path" + } +} + +Import-Module Hyper-V -Force +Import-PowerTestFile 'TdxLiveMigrationUtilities.psm1' +Import-PowerTestFile 'HCSUtilities.psm1' +Import-PowerTestFile 'LiveMigrationUtilities.psm1' +Import-PowerTestFile 'VmgsUtilities.psm1' +Import-PowerTestFile 'WmiUtilities.psm1' +Import-PowerTestFile 'IVMUtilities.psm1' + +$hcsTest = Get-Module HCSTest +if ($hcsTest -and $hcsTest.NestedModules[0].Name -notlike '*.v2') { + throw 'HCSTest v1 is already loaded. Close this PowerShell process and retry.' +} +if (-not $hcsTest) { + Import-Module HCSTest -ArgumentList @{ UseVersion2 = $true } ` + -Global -Force -ErrorAction SilentlyContinue + if (-not (Get-Module HCSTest)) { + if (Get-Command Import-HcsTestModule -ErrorAction SilentlyContinue) { + Import-HcsTestModule -UseVersion2 + } else { + throw 'HCSTest is unavailable and HCSUtilities did not provide Import-HcsTestModule.' + } + } +} +if (-not (Get-Command New-HcsSystemDocument -ErrorAction SilentlyContinue)) { + throw 'HCSTest v2 did not provide New-HcsSystemDocument.' +} + +if (-not (Get-Command New-VmStateFile -ErrorAction SilentlyContinue)) { + function global:New-VmStateFile { + param( + [Parameter(Mandatory)] [string]$GuestStateFilePath, + [int]$FileSize = 16MB + ) + + $tool = Get-Command vmgstool.exe -ErrorAction SilentlyContinue + if ($tool) { + $tool = $tool.Source + } elseif (Test-Path (Join-Path $env:SystemRoot 'System32\vmgstool.exe')) { + $tool = Join-Path $env:SystemRoot 'System32\vmgstool.exe' + } + + if ($tool) { + & $tool -Create -FilePath $GuestStateFilePath "-FileSize=$FileSize" | Out-Null + } elseif (Get-Command New-GuestStateFile -ErrorAction SilentlyContinue) { + New-GuestStateFile -FilePath $GuestStateFilePath -FileSize $FileSize | Out-Null + } else { + throw 'Cannot create the MigTD guest state file: vmgstool.exe and New-GuestStateFile are unavailable.' + } + } +} + +$oldHashFileValue = Read-MigTdHash $OldHashFilePath -Required:(-not $CaptureSerial) +$newHashFileValue = Read-MigTdHash $NewHashFilePath -Required:(-not $CaptureSerial) +$oldHash = $oldHashFileValue +$newHash = $newHashFileValue +$newMappingHash = $null +$oldUsesMockQuote = [System.IO.Path]::GetFileName($OldIgvmFilePath) -match '_mock_quote' +$newUsesMockQuote = [System.IO.Path]::GetFileName($NewIgvmFilePath) -match '_mock_quote' + +if ($oldUsesMockQuote) { + Write-Host 'Old MigTD uses built-in mock quote; no IGVMAgent GetQuote call will be made.' +} else { + Write-Host 'Old MigTD uses IGVMAgent-backed GetQuote.' +} +if ($newUsesMockQuote) { + Write-Host 'New MigTD uses built-in mock quote; no IGVMAgent GetQuote call will be made.' +} else { + Write-Host 'New MigTD uses IGVMAgent-backed GetQuote.' +} + +$oldMigTd = $null +$newMigTd = $null +$vm = $null +$rebindAttempted = $false +$rebindSucceeded = $false +try { + if ($oldHashFileValue) { + Remove-VmHostMigrationTdMapping -MigTdHash $oldHashFileValue -ErrorAction SilentlyContinue + } + if ($newHashFileValue) { + Remove-VmHostMigrationTdMapping -MigTdHash $newHashFileValue -ErrorAction SilentlyContinue + } + + $oldMigTd = Start-MigTdInstance ` + -InstanceId $OldMigTdId ` + -IgvmPath $OldIgvmFilePath ` + -ExpectedHash $oldHashFileValue + if ($CaptureSerial) { + $oldHash = $script:runtimeHashes[$OldMigTdId] + } + Assert-MigTdRunning -Instance $oldMigTd -Role 'Old' + Write-Host "Old MigTD hash used for binding: $oldHash" + Remove-VmHostMigrationTdMapping -MigTdHash $oldHash -ErrorAction SilentlyContinue + Add-VmHostMigrationTdMapping -MigTdHash $oldHash -VmId $oldMigTd.Id + Set-VMHostMigrationPolicy DisabledByDefault $oldHash + + $vm = New-VM -Name $VmName -GuestStateIsolation TDX -Generation 2 -NoVHD + if (-not $UsePersistentSecrets) { + $vm | Set-GuestStateIsolationMode -IsolationMode NoPersistentSecrets + Write-Host 'Configured target VM with NoPersistentSecrets.' + } + $vm | Set-VmMigratablePolicy -MigratablePolicy EnabledIfHostPermits | Out-Null + $migratablePolicy = [string]($vm | Get-VmMigratablePolicy) + if ($migratablePolicy -ne 'EnabledIfHostPermits') { + throw "Failed to opt the TD into host-permitted migration. Actual policy=$migratablePolicy" + } + Write-Host 'Configured VM migratable policy: EnabledIfHostPermits.' + $vm | Update-VmMigrationPolicy + $vm | Start-VM + + $vm = Get-VM -Name $VmName + if ($vm.State -ne 'Running') { + throw "TD is not running after initial binding (state=$($vm.State))." + } + Wait-VmMigrationPolicy ` + -TargetVmName $VmName ` + -ExpectedHash $oldHash ` + -TimeoutSeconds $PolicyTimeoutSeconds + Write-Host "Initial binding verified: $oldHash" + + $newMigTd = Start-MigTdInstance ` + -InstanceId $NewMigTdId ` + -IgvmPath $NewIgvmFilePath ` + -ExpectedHash $newHashFileValue + if ($CaptureSerial) { + $newHash = $script:runtimeHashes[$NewMigTdId] + } + Assert-MigTdRunning -Instance $newMigTd -Role 'New' + Write-Host "New MigTD hash used for binding: $newHash" + + $newMappingHash = $newHash + if ($oldHash -eq $newHash) { + $newMappingHash = New-SyntheticHash $newHash + Write-Host "Both MigTD images have hash $newHash" + Write-Host "Using synthetic second mapping key $newMappingHash" + } + Remove-VmHostMigrationTdMapping -MigTdHash $newMappingHash -ErrorAction SilentlyContinue + Add-VmHostMigrationTdMapping -MigTdHash $newMappingHash -VmId $newMigTd.Id + Set-VMHostMigrationPolicy DisabledByDefault $newMappingHash + + Assert-MigTdRunning -Instance $oldMigTd -Role 'Old' + Assert-MigTdRunning -Instance $newMigTd -Role 'New' + Write-Host 'Triggering UpgradeMigrationPolicy rebind.' + $rebindAttempted = $true + try { + $vm | Update-VmMigrationPolicy + } catch { + $errorText = ($_ | Format-List * -Force | Out-String).Trim() + if ($errorText -match '0x800721CE|external policy') { + throw "Rebind rejected with MIGPOLICY_UNSATISFIED_ERROR (0x800721CE). The old and new MigTD policies or enrolled identities do not mutually authorize this rebind. Inspect $OldMigTdId.serial.log and $NewMigTdId.serial.log for the failed policy check." + } + throw "UpgradeMigrationPolicy rebind failed.`n$errorText`nInspect $OldMigTdId.serial.log and $NewMigTdId.serial.log." + } + Wait-VmMigrationPolicy ` + -TargetVmName $VmName ` + -ExpectedHash $newHash ` + -TimeoutSeconds $PolicyTimeoutSeconds + + $vm = Get-VM -Name $VmName + if ($vm.State -ne 'Running') { + throw "TD stopped during rebind (state=$($vm.State))." + } + $rebindSucceeded = $true + Write-Host "PASS: '$VmName' rebound to the new MigTD and remained running." + Write-Host "Current migration policy: $newHash" +} +finally { + if ($CaptureSerial -and $rebindAttempted) { + Wait-ForFinalRebindLogs ` + -InstanceIds @($OldMigTdId, $NewMigTdId) ` + -TimeoutSeconds $SerialDrainTimeoutSeconds ` + -HostOperationSucceeded:$rebindSucceeded + } + if ($vm) { + $vm | Stop-VM -Force -ErrorAction SilentlyContinue + $vm | Remove-VM -Force -ErrorAction SilentlyContinue + } + $finalPolicyHash = if ($newHash) { $newHash } else { $oldHash } + if ($finalPolicyHash) { + Set-VMHostMigrationPolicy DisabledByDefault $finalPolicyHash -ErrorAction SilentlyContinue + } + foreach ($hash in @( + $newMappingHash, + $oldHash, + $newHashFileValue, + $oldHashFileValue + ) | Where-Object { $_ } | Select-Object -Unique) { + Remove-VmHostMigrationTdMapping -MigTdHash $hash -ErrorAction SilentlyContinue + } + Stop-MigTdInstance $newMigTd + Stop-MigTdInstance $oldMigTd +} diff --git a/sh_script/Azure/tip/Test-TdxMigTdStartupRequests.ps1 b/sh_script/Azure/tip/Test-TdxMigTdStartupRequests.ps1 new file mode 100644 index 000000000..f77bd6112 --- /dev/null +++ b/sh_script/Azure/tip/Test-TdxMigTdStartupRequests.ps1 @@ -0,0 +1,422 @@ +#Requires -Version 7.0 + +<# +.SYNOPSIS + Validate MigTD startup and post-start WaitForRequest operations. + +.DESCRIPTION + Starts one MigTD HCS system under a focused Microsoft.Windows.HyperV.GhciVDev + trace and verifies that the host successfully completes: + + * EnableLogArea (the first WaitForRequest) + * The internal startup GetTDReport used to cache TDINFO + * A separate post-start GetTDReport HCS query matching IGVMAgent health checks + + The external GetTDReport test sends a fresh 64-byte REPORTDATA nonce, validates + the returned nonce and TDREPORT hashes, and compares TEE_INFO_HASH with the + image's .hash file. + + With -ExpectedGetQuoteResult, also follows the Host OS + Tdx.Ghci.GetQuote.TestMD.Tests.ps1 pattern and validates the Worker Analytic + event for a test-get-quote image. + +.EXAMPLE + .\Test-TdxMigTdStartupRequests.ps1 ` + -IgvmFilePath .\test-migtd-accept-all_mock_quote.igvm + +.EXAMPLE + .\Test-TdxMigTdStartupRequests.ps1 ` + -IgvmFilePath .\test-migtd-getquote-all.igvm ` + -ExpectedGetQuoteResult Success +#> +[CmdletBinding()] +param( + [Parameter(Mandatory)] [string]$IgvmFilePath, + [string]$HashFilePath, + [string]$MigTdId = 'tipmigtd-startup', + [string]$PowerTestPath = "$env:ProgramFiles\PowerShell\Modules\PowerTest", + [string]$OutputDir = (Join-Path (Get-Location) 'tipmigtd-startup-requests'), + [ValidateSet('None', 'Success', 'Failure')] + [string]$ExpectedGetQuoteResult = 'None', + [ValidateRange(1, 600)] + [int]$TimeoutSeconds = 300, + [ValidateRange(0, 30)] + [int]$StartupSettleSeconds = 2 +) + +$ErrorActionPreference = 'Stop' + +function Import-PowerTestFile { + param([Parameter(Mandatory)] [string]$Name) + + $path = Join-Path $PowerTestPath $Name + if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { + throw "PowerTest file not found: $path" + } + Import-Module $path -Force +} + +function Initialize-TipHostModules { + Import-PowerTestFile 'TdxLiveMigrationUtilities.psm1' + Import-PowerTestFile 'HCSUtilities.psm1' + Import-PowerTestFile 'VmgsUtilities.psm1' + + $hcsTest = Get-Module HCSTest + if ($hcsTest -and $hcsTest.NestedModules[0].Name -notlike '*.v2') { + throw 'HCSTest v1 is already loaded. Close this PowerShell process and retry.' + } + if (-not $hcsTest) { + Import-Module HCSTest -ArgumentList @{ UseVersion2 = $true } ` + -Global -Force -ErrorAction SilentlyContinue + if (-not (Get-Module HCSTest)) { + if (Get-Command Import-HcsTestModule -ErrorAction SilentlyContinue) { + Import-HcsTestModule -UseVersion2 + } else { + throw 'HCSTest is unavailable and HCSUtilities did not provide Import-HcsTestModule.' + } + } + } + if (-not (Get-Command New-HcsSystemDocument -ErrorAction SilentlyContinue)) { + throw 'HCSTest v2 did not provide New-HcsSystemDocument.' + } + + if (-not (Get-Command New-VmStateFile -ErrorAction SilentlyContinue)) { + function global:New-VmStateFile { + param( + [Parameter(Mandatory)] [string]$GuestStateFilePath, + [int]$FileSize = 16MB + ) + + $tool = Get-Command vmgstool.exe -ErrorAction SilentlyContinue + if ($tool) { + $tool = $tool.Source + } elseif (Test-Path (Join-Path $env:SystemRoot 'System32\vmgstool.exe')) { + $tool = Join-Path $env:SystemRoot 'System32\vmgstool.exe' + } + + if ($tool) { + & $tool -Create -FilePath $GuestStateFilePath "-FileSize=$FileSize" | Out-Null + } elseif (Get-Command New-GuestStateFile -ErrorAction SilentlyContinue) { + New-GuestStateFile -FilePath $GuestStateFilePath -FileSize $FileSize | Out-Null + } else { + throw 'Cannot create the MigTD guest state file: vmgstool.exe and New-GuestStateFile are unavailable.' + } + } + } +} + +function Test-TraceMarker { + param( + [Parameter(Mandatory)] [string]$TraceOutputDir, + [Parameter(Mandatory)] [string[]]$Marker, + [Parameter(Mandatory)] [string]$Operation + ) + + $traceFiles = @( + Join-Path $TraceOutputDir 'ghcivdev-tracerpt.csv' + Join-Path $TraceOutputDir 'ghcivdev-tracerpt.xml' + Join-Path $TraceOutputDir 'ghcivdev-events.txt' + ) | Where-Object { Test-Path -LiteralPath $_ -PathType Leaf } + + foreach ($candidate in $Marker) { + if ($traceFiles -and + (Select-String -LiteralPath $traceFiles -Pattern $candidate -SimpleMatch -Quiet)) { + Write-Host "PASS: $Operation observed as GHCI event '$candidate'." + return + } + } + + throw "$Operation was not observed in the GHCI trace. Expected one of: $($Marker -join ', ')" +} + +function Get-QuoteEvent { + param( + [Parameter(Mandatory)] [int]$EventId, + [Parameter(Mandatory)] [datetime]$StartTime, + [Parameter(Mandatory)] [string]$VmName + ) + + Get-WinEvent -FilterHashtable @{ + LogName = 'Microsoft-Windows-Hyper-V-Worker-Analytic' + Id = $EventId + StartTime = $StartTime + } -Oldest -ErrorAction SilentlyContinue | + Where-Object { ([string]$_.Message).Contains($VmName) } | + Select-Object -First 1 +} + +function ConvertTo-HexString { + param([Parameter(Mandatory)] [byte[]]$Bytes) + + return -join ($Bytes | ForEach-Object { $_.ToString('x2') }) +} + +function Test-ByteArrayEqual { + param( + [Parameter(Mandatory)] [byte[]]$Left, + [Parameter(Mandatory)] [byte[]]$Right + ) + + if ($Left.Length -ne $Right.Length) { + return $false + } + for ($i = 0; $i -lt $Left.Length; $i++) { + if ($Left[$i] -ne $Right[$i]) { + return $false + } + } + return $true +} + +function Get-Sha384 { + param([Parameter(Mandatory)] [byte[]]$Bytes) + + $sha384 = [System.Security.Cryptography.SHA384]::Create() + try { + return [byte[]]$sha384.ComputeHash($Bytes) + } + finally { + $sha384.Dispose() + } +} + +function Invoke-MigTdGetReportHealthCheck { + param( + [Parameter(Mandatory)] $MigTd, + [Parameter(Mandatory)] [string]$ExpectedTdInfoHash + ) + + [byte[]]$nonce = New-Object byte[] 64 + [System.Security.Cryptography.RandomNumberGenerator]::Fill($nonce) + $query = @{ + Queries = @{ + MigTdReport = @{ + ReportData = [Convert]::ToBase64String($nonce) + } + } + } | ConvertTo-Json -Depth 4 -Compress + + $response = (Get-HcsSystemProperties ` + -System $MigTd ` + -Query $query ` + -RawJson ` + -ErrorAction Stop) | ConvertFrom-Json + $property = $response.PropertyResponses.MigTdReport + if (-not $property) { + throw 'GetTDReport response did not contain PropertyResponses.MigTdReport.' + } + if ($property.Error) { + throw "GetTDReport property failed: $($property.Error | ConvertTo-Json -Depth 8 -Compress)" + } + + $reportResponse = $property.Response + if (-not $reportResponse) { + throw 'GetTDReport response did not contain MigTdReport.Response.' + } + $completionStatus = $reportResponse.CompletionStatus + $completionText = ([string]$completionStatus).Trim() + if ($completionStatus -ne 0 -and $completionText -notmatch '^0x0+$') { + throw "GetTDReport completed with failure status $completionText." + } + if (-not $reportResponse.ReportData) { + throw 'GetTDReport returned empty ReportData.' + } + + try { + [byte[]]$report = [Convert]::FromBase64String([string]$reportResponse.ReportData) + } + catch { + throw "GetTDReport returned invalid base64 ReportData: $_" + } + if ($report.Length -lt 4 -or $report[0] -ne 0x81) { + throw 'GetTDReport did not return a TDX TDREPORT.' + } + + $tdInfoSize = if ($report[2] -le 1) { + 512 + } elseif ($report[2] -eq 2) { + 768 + } else { + throw "Unsupported TDREPORT version $($report[2])." + } + $expectedReportSize = 512 + $tdInfoSize + if ($report.Length -ne $expectedReportSize) { + throw "TDREPORT length $($report.Length) does not match version $($report[2]) length $expectedReportSize." + } + + [byte[]]$returnedNonce = $report[128..191] + if (-not (Test-ByteArrayEqual -Left $returnedNonce -Right $nonce)) { + throw 'TDREPORT REPORTDATA did not echo the health-check nonce.' + } + + [byte[]]$teeInfoHash = $report[80..127] + [byte[]]$tdInfo = $report[512..(511 + $tdInfoSize)] + [byte[]]$computedTdInfoHash = Get-Sha384 -Bytes $tdInfo + if (-not (Test-ByteArrayEqual -Left $teeInfoHash -Right $computedTdInfoHash)) { + throw 'TDREPORT TEE_INFO_HASH does not match SHA384(TDINFO).' + } + + [byte[]]$teeTcbInfoHash = $report[32..79] + if (($teeTcbInfoHash | Where-Object { $_ -ne 0 }).Count -gt 0) { + [byte[]]$teeTcbInfo = $report[256..494] + [byte[]]$computedTcbInfoHash = Get-Sha384 -Bytes $teeTcbInfo + if (-not (Test-ByteArrayEqual -Left $teeTcbInfoHash -Right $computedTcbInfoHash)) { + throw 'TDREPORT TEE_TCB_INFO_HASH does not match SHA384(TEE_TCB_INFO[239]).' + } + } + + $actualTdInfoHash = ConvertTo-HexString -Bytes $teeInfoHash + if ($actualTdInfoHash -ne $ExpectedTdInfoHash) { + throw "TDREPORT TEE_INFO_HASH $actualTdInfoHash does not match image hash $ExpectedTdInfoHash." + } + + Write-Host "PASS: Post-start GetTDReport returned a valid report for TD Info Hash $actualTdInfoHash." +} + +if ($PSVersionTable.PSVersion.Major -lt 7) { + throw 'This test requires PowerShell 7.' +} +if (-not (Test-Path -LiteralPath $IgvmFilePath -PathType Leaf)) { + throw "IGVM file not found: $IgvmFilePath" +} +$IgvmFilePath = (Resolve-Path -LiteralPath $IgvmFilePath).Path +if (-not $HashFilePath) { + $HashFilePath = "$IgvmFilePath.hash" +} +if (-not (Test-Path -LiteralPath $HashFilePath -PathType Leaf)) { + throw "IGVM hash file not found: $HashFilePath" +} +$HashFilePath = (Resolve-Path -LiteralPath $HashFilePath).Path +$expectedTdInfoHash = (Get-Content -LiteralPath $HashFilePath -Raw).Trim().ToLowerInvariant() +if ($expectedTdInfoHash -notmatch '^[0-9a-f]{96}$') { + throw "IGVM hash file must contain exactly 48 bytes of hexadecimal data: $HashFilePath" +} + +$troubleshootingDir = Join-Path $PSScriptRoot 'troubleshooting' +$captureScript = Join-Path $troubleshootingDir 'Invoke-GhciVDevDiagnosticCapture.ps1' +if (-not (Test-Path -LiteralPath $captureScript -PathType Leaf)) { + throw "GHCI diagnostic capture script not found: $captureScript" +} + +Initialize-TipHostModules + +$workerAnalytic = 'Microsoft-Windows-Hyper-V-Worker-Analytic' +$workerChannelChanged = $false +if ($ExpectedGetQuoteResult -ne 'None') { + $log = Get-WinEvent -ListLog $workerAnalytic -ErrorAction Stop + if (-not $log.IsEnabled) { + & wevtutil.exe sl $workerAnalytic /e:true + if ($LASTEXITCODE -ne 0) { + throw "Failed to enable event channel: $workerAnalytic" + } + $workerChannelChanged = $true + } +} + +$igvmPathForClosure = $IgvmFilePath +$migTdIdForClosure = $MigTdId +$expectedQuoteForClosure = $ExpectedGetQuoteResult +$timeoutForClosure = $TimeoutSeconds +$settleForClosure = $StartupSettleSeconds +$expectedTdInfoHashForClosure = $expectedTdInfoHash +$quoteStartTime = Get-Date + +$reproCommand = { + $migTd = $null + try { + # The bundled Host OS helper configures GhciDevice.LogLevel=Trace, + # causing the host to issue EnableLogArea on the first WaitForRequest. + $migTd = New-TestHcsMigTd ` + -Id $migTdIdForClosure ` + -IgvmFilePath $igvmPathForClosure ` + -GuestStateDirectory . ` + -Force + $migTd | Start-HcsSystem -ErrorAction Stop + + $properties = (Get-HcsSystemProperties -System $migTd -RawJson) | + ConvertFrom-Json + if ([string]$properties.State -ne 'Running' -or -not $properties.RuntimeId) { + throw "MigTD did not reach a running HCS state. State=$($properties.State) RuntimeId=$($properties.RuntimeId)" + } + + if ($settleForClosure -gt 0) { + Start-Sleep -Seconds $settleForClosure + } + Invoke-MigTdGetReportHealthCheck ` + -MigTd $migTd ` + -ExpectedTdInfoHash $expectedTdInfoHashForClosure + + if ($expectedQuoteForClosure -ne 'None') { + $expectedEventId = if ($expectedQuoteForClosure -eq 'Success') { 18670 } else { 18672 } + $unexpectedEventId = if ($expectedQuoteForClosure -eq 'Success') { 18672 } else { 18670 } + $deadline = (Get-Date).AddSeconds($timeoutForClosure) + do { + $unexpected = Get-QuoteEvent ` + -EventId $unexpectedEventId ` + -StartTime $quoteStartTime ` + -VmName $migTdIdForClosure + if ($unexpected) { + throw "GetQuote produced unexpected Worker event $unexpectedEventId`: $($unexpected.Message)" + } + $expected = Get-QuoteEvent ` + -EventId $expectedEventId ` + -StartTime $quoteStartTime ` + -VmName $migTdIdForClosure + if ($expected) { + Write-Host "PASS: GetQuote $expectedQuoteForClosure observed as Worker event $expectedEventId." + break + } + Start-Sleep -Seconds 2 + } while ((Get-Date) -lt $deadline) + + if (-not $expected) { + throw "GetQuote $expectedQuoteForClosure event $expectedEventId was not observed within $timeoutForClosure seconds." + } + } + + } + finally { + if ($migTd) { + Stop-HcsSystem $migTd -ErrorAction SilentlyContinue + $migTd.Close() + } + } +}.GetNewClosure() + +try { + & $captureScript ` + -OutputDir $OutputDir ` + -ReproCommand $reproCommand +} +finally { + if ($workerChannelChanged) { + & wevtutil.exe sl $workerAnalytic /e:false + } +} + +$eventOutputDir = Join-Path $OutputDir 'events' +Test-TraceMarker ` + -TraceOutputDir $eventOutputDir ` + -Marker @('EnableLogAreaRequest_Success') ` + -Operation 'wait_for_requests operation 4 (EnableLogArea)' +Test-TraceMarker ` + -TraceOutputDir $eventOutputDir ` + -Marker @('InternalGetReport_TdInfoCached') ` + -Operation 'startup internal TDINFO cache' +Test-TraceMarker ` + -TraceOutputDir $eventOutputDir ` + -Marker @('CreateMigTdGetReportRequest') ` + -Operation 'post-start external GetTDReport creation' +Test-TraceMarker ` + -TraceOutputDir $eventOutputDir ` + -Marker @('GetTdReportRequest_Success') ` + -Operation 'wait_for_requests operation 3 (external GetTDReport)' + +[pscustomobject]@{ + MigTdId = $MigTdId + EnableLogArea = 'PASS' + InternalTDInfoCache = 'PASS' + ExternalGetTDReport = 'PASS' + GetQuote = $ExpectedGetQuoteResult + DiagnosticBundle = (Resolve-Path -LiteralPath $OutputDir).Path +} | Format-List diff --git a/sh_script/Azure/tip/Test-TdxServTdExtPrebind.ps1 b/sh_script/Azure/tip/Test-TdxServTdExtPrebind.ps1 new file mode 100644 index 000000000..500ce8bff --- /dev/null +++ b/sh_script/Azure/tip/Test-TdxServTdExtPrebind.ps1 @@ -0,0 +1,48 @@ +#Requires -Version 7.0 + +<# +.SYNOPSIS + Start a prebound TDX VM and validate its runtime ServTdExt layout. + +.DESCRIPTION + Uses Invoke-TdxLmLoopback.ps1 to start MigTD, register the prebind hash, + create and start the target TD, then validate Get-VmServTdExt without + initiating migration. All created state is cleaned up afterwards. + +.EXAMPLE + .\Test-TdxServTdExtPrebind.ps1 ` + -IgvmFilePath .\test-migtd-accept-all_mock_quote.igvm ` + -PowerTestPath 'C:\Program Files\PowerShell\Modules\PowerTest' ` + -NoPersistentSecrets +#> +[CmdletBinding()] +param( + [Parameter(Mandatory)] [string]$IgvmFilePath, + [string]$HashFilePath = "$IgvmFilePath.hash", + [string]$MigTdId = 'tipmigtd', + [string]$VmName = 'tiptd', + [string]$PowerTestPath = "$env:ProgramFiles\PowerShell\Modules\PowerTest", + [switch]$NoPersistentSecrets, + [switch]$CaptureSerial, + [ValidateRange(0, 60)] [int]$SerialDrainTimeoutSeconds = 30 +) + +$ErrorActionPreference = 'Stop' +$driver = Join-Path $PSScriptRoot 'Invoke-TdxLmLoopback.ps1' +if (-not (Test-Path $driver)) { + throw "Loopback driver not found: $driver" +} + +$parameters = @{ + IgvmFilePath = $IgvmFilePath + HashFilePath = $HashFilePath + MigTdId = $MigTdId + VmName = $VmName + PowerTestPath = $PowerTestPath + ServTdExtOnly = $true + NoPersistentSecrets = $NoPersistentSecrets + CaptureSerial = $CaptureSerial + SerialDrainTimeoutSeconds = $SerialDrainTimeoutSeconds +} + +& $driver @parameters diff --git a/sh_script/Azure/tip/Upload-TipPackage.ps1 b/sh_script/Azure/tip/Upload-TipPackage.ps1 new file mode 100644 index 000000000..77ab014bd --- /dev/null +++ b/sh_script/Azure/tip/Upload-TipPackage.ps1 @@ -0,0 +1,212 @@ +<# +.SYNOPSIS + Upload a built MigTD TiP test package to the nodes of an existing TiP session. + +.DESCRIPTION + Run this from an FCShell session (started via DCM Explorer) on a SAW machine. + The standard `migtd_package.zip` bundle places this script beside a + `tip_package` directory, which is used by default. Pass `-PackagePath` only + when the node package is staged elsewhere. The script publishes the package + directory to the fabric image store as a NodeExecutePackage and distributes + it to every node in the given TiP session. The fabric extracts the archive + to `C:\NodeExecute\<PackageName>\` on each node, so after this script the + IGVMs and test scripts are available at: + + C:\NodeExecute\<PackageName>\test-migtd-*.igvm + C:\NodeExecute\<PackageName>\Run-TipTests.ps1 + ... + + This mirrors the upload path used by `tdx_lm_node_setup.ps1` + (Add-Image -Type NodeExecutePackage + Add-NodeFile), so it relies on the same + `acc_tip` and `TipNodeServiceAME` modules and an already-created TiP session. + +.PARAMETER ClusterName + Target cluster name, e.g. "CVL05PrdApp02". Used to connect to the fabric at + "<ClusterName>.fc.core.windows.net". + +.PARAMETER SessionId + Existing TiP session id whose nodes receive the package. This script does not + create sessions; allocate one with `tdx_lm_node_setup.ps1` (or + `New-TipNodeSession`) first. + +.PARAMETER PackagePath + Local path on the SAW machine to the built TiP package directory. Defaults + to the `tip_package` directory beside this script in `migtd_package.zip`. + +.PARAMETER PackageName + Logical name for the uploaded package. Determines the on-node directory + `C:\NodeExecute\<PackageName>`. Defaults to "migtd-tip-package". + +.PARAMETER KeepImage + Leave the uploaded fabric image in place after distribution. By default the + image is removed once every node has received it (the files stay on the nodes). + +.EXAMPLE + & "$HOME\migtd_package\Upload-TipPackage.ps1" -ClusterName CVL05PrdApp02 ` + -SessionId 11111111-2222-3333-4444-555555555555 + +.EXAMPLE + # Upload a package staged at a specific path under a custom name. + & "$HOME\migtd_package\Upload-TipPackage.ps1" -ClusterName CVL05PrdApp02 ` + -SessionId 11111111-2222-3333-4444-555555555555 ` + -PackagePath C:\builds\tip-package -PackageName migtd-pr1234 +#> +[CmdletBinding()] +param ( + [Parameter(Mandatory)][string]$ClusterName, + [Parameter(Mandatory)][string]$SessionId, + [string]$PackagePath = (Join-Path $PSScriptRoot 'tip_package'), + [string]$PackageName = "migtd-tip-package", + [switch]$KeepImage +) + +$ErrorActionPreference = 'Stop' + +# Trimmed copy of the Get-TipCommandOutput helper from tdx_lm_node_setup.ps1: +# fetches the NodeExecute result archive and returns its stdout/stderr. +function Get-TipCommandOutput { + param([Parameter(Mandatory)]$Result) + + $requestId = $Result.RequestIdentifier + $tempDir = Join-Path $env:TEMP "tip_$requestId" + $zipFile = Join-Path $tempDir "tip.zip" + $extractDir = Join-Path $tempDir "tip" + + try { + New-Item -ItemType Directory -Path $tempDir -Force | Out-Null + Invoke-WebRequest $Result.SASUri -OutFile $zipFile + Expand-Archive $zipFile -DestinationPath $extractDir -Force + + $outFile = Join-Path $extractDir "Logs\NodeExecuteLogs\$requestId.out" + $errFile = Join-Path $extractDir "Logs\NodeExecuteLogs\$requestId.err" + + $output = if (Test-Path $outFile) { Get-Content $outFile -Raw } else { $null } + $errorOutput = if (Test-Path $errFile) { Get-Content $errFile -Raw } else { $null } + return @{ StdOut = $output; StdErr = $errorOutput } + } + finally { + Remove-Item -Path $tempDir -Recurse -Force -ErrorAction SilentlyContinue + } +} + +function Main { + $requiredModules = @('acc_tip', 'TipNodeServiceAME') + foreach ($module in $requiredModules) { + if (-not (Get-Module -ListAvailable -Name $module) -and -not (Get-Module -Name $module)) { + Write-Error "Required module '$module' is not available. Import it before running (see tip_scripts README)." + return 1 + } + } + + if (-not (Test-Path -LiteralPath $PackagePath -PathType Container)) { + Write-Error "PackagePath not found or not a directory: $PackagePath" + return 1 + } + $resolvedPackage = (Resolve-Path -LiteralPath $PackagePath).Path + Write-Host "Package directory: $resolvedPackage" + + $igvms = @(Get-ChildItem -LiteralPath $resolvedPackage -Filter 'test-migtd*.igvm' -File -ErrorAction SilentlyContinue) + if ($igvms.Count -eq 0) { + Write-Error "No test-migtd*.igvm files found in $resolvedPackage. Build the package first with build_tip_package.sh." + return 1 + } + Write-Host "Found $($igvms.Count) IGVM image(s) to upload:" + $igvms | ForEach-Object { Write-Host " $($_.Name)" } + + Write-Host "Connecting to fabric for cluster '$ClusterName'..." + $fabric = Get-Fabric -Address "$ClusterName.fc.core.windows.net" + if (-not $fabric.TM.buildversion) { + Write-Error "Failed to connect to fabric for cluster '$ClusterName'." + return 1 + } + + $tipSession = $fabric | Get-TipNodeSession $SessionId + if (-not $tipSession) { + Write-Error "Failed to retrieve TiP session '$SessionId'." + return 1 + } + + $nodes = @() + foreach ($node in $tipSession.NodeList) { + $nodes += $fabric | Get-Node $node.Guid + } + if ($nodes.Count -eq 0) { + Write-Error "TiP session '$SessionId' has no nodes." + return 1 + } + Write-Host "Session '$SessionId' has $($nodes.Count) node(s)." + + # Package the whole tip-package directory into <PackageName>.zip. The fabric + # extracts a NodeExecutePackage named <PackageName>.zip into + # C:\NodeExecute\<PackageName>\ on each node. + $tempDir = Join-Path $env:TEMP "migtd_tip_upload_$(Get-Date -Format 'yyyyMMddHHmmss')" + $zipFile = Join-Path $tempDir "$PackageName.zip" + $onNodeDir = "C:\NodeExecute\$PackageName" + $uploadedImage = $null + + try { + New-Item -ItemType Directory -Path $tempDir -Force | Out-Null + Write-Host "Compressing package to $zipFile ..." + # Archive the directory contents (not the parent folder) so files land + # directly under C:\NodeExecute\<PackageName>\. + Compress-Archive -Path (Join-Path $resolvedPackage '*') -DestinationPath $zipFile -Force + Write-Host "Created archive: $zipFile ($([math]::Round((Get-Item $zipFile).Length / 1MB, 1)) MB)" + + Write-Host "Publishing package to the fabric image store..." + $fabric | Add-Image $zipFile -Type NodeExecutePackage | Out-Null + $uploadedImage = $fabric | Get-Image -ImageName "$PackageName.zip" -Type NodeExecutePackage + if (-not $uploadedImage) { + Write-Error "Package image '$PackageName.zip' not found after Add-Image." + return 1 + } + Write-Host "Uploaded image: $($uploadedImage.Name)" + + $allOk = $true + foreach ($node in $nodes) { + Write-Host "Distributing to node $($node.Id)..." + $node | Add-NodeFile $uploadedImage | Out-Null + Start-Sleep -Seconds 20 # allow the fabric to place and extract the file + + # Verify extraction on the node. + $verifyCmd = "cmd /c if exist $onNodeDir (echo PRESENT) else (echo MISSING)" + $result = Invoke-TipNodeCommand -TipSessionId $SessionId -NodeId $node -Command $verifyCmd + $out = Get-TipCommandOutput -Result $result + if ($out.StdOut -match 'PRESENT') { + Write-Host "Node $($node.Id): package available at $onNodeDir" + } else { + Write-Warning "Node $($node.Id): $onNodeDir not found after distribution." + if ($out.StdErr) { Write-Warning $out.StdErr } + $allOk = $false + } + } + + if (-not $allOk) { + Write-Error "One or more nodes did not receive the package." + return 1 + } + + Write-Host "`n=== Upload complete ===" + Write-Host "On each node, the package is at: $onNodeDir" + Write-Host "Run tests from an elevated PowerShell on the node, e.g.:" + Write-Host " cd $onNodeDir" + Write-Host " .\Run-TipTests.ps1" + return 0 + } + finally { + if ($uploadedImage -and -not $KeepImage) { + Write-Host "Cleaning up fabric image '$($uploadedImage.Name)'..." + $uploadedImage | Remove-Image -RemoveDeleted -ErrorAction SilentlyContinue | Out-Null + } + Remove-Item -Path $tempDir -Recurse -Force -ErrorAction SilentlyContinue + } +} + +try { + $exitCode = Main +} +catch { + Write-Error $_ -ErrorAction Continue + $exitCode = 1 +} + +exit $exitCode diff --git a/sh_script/Azure/tip/build_tip_package.sh b/sh_script/Azure/tip/build_tip_package.sh new file mode 100755 index 000000000..55901318c --- /dev/null +++ b/sh_script/Azure/tip/build_tip_package.sh @@ -0,0 +1,581 @@ +#!/bin/bash +# ============================================================================== +# Build a self-contained TDX live-migration TiP test package. +# +# Produces vpack-named MigTD IGVM images + sibling .hash files (read by the host +# as MigTdHash) plus the loopback test scripts, so the package can be copied to a +# labblade and run manually. MigTD-native tooling only (no parent repo, no ESRP). +# +# Variants built: +# test-migtd-accept-all.igvm allow-all policy -> migration succeeds +# test-migtd-reject-all.igvm bad-FMSPC policy -> migration rejected +# test-migtd.igvm config/Azure policy -> succeeds if node matches +# test-migtd_rebind.igvm same policy/signing key with policySvn + 1 +# Built in two phases: a placeholder policy is +# built and measured first (MRTD/RTMR0/RTMR1 do +# not depend on policy content), then those real +# measurements are bound into tcb_mapping.json, +# the real policy is (re-)signed, and re-enrolled +# into the already-built image's CFV in place. +# test-migtd_key_rotation.igvm same policy SVN/root/subject with a new leaf key +# test-migtd-getquote-all.igvm GetQuote init test image +# test-migtd-accept-all_mock_quote.igvm allow-all policy + built-in mock quote +# test-migtd-reject-all_mock_quote.igvm reject policy + built-in mock quote +# test-migtd_mock_quote.igvm policy from mock measurements + mock quote +# test-migtd_mock_quote_rebind.igvm same mock-quote policy with policySvn + 1 +# test-migtd_mock_quote_key_rotation.igvm same mock policy with a new leaf key +# +# Usage: +# ./sh_script/Azure/tip/build_tip_package.sh [--out DIR] [--fetch-collaterals] +# [--azure-region R] [--variants LIST] +# [--os-root DIR] +# [--powertest-dir DIR] +# [--hcstest-dir DIR] +# [--vmgstool-file FILE] +# [--secfw-file FILE] +# [--tcb-mapping FILE] +# [--skip-dependencies] +# ============================================================================== +set -euo pipefail + +# Repo root = MigTD/ (this script lives in MigTD/sh_script/Azure/tip) +PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)" +cd "$PROJECT_ROOT" + +OUT_DIR="$PROJECT_ROOT/out/tip-package" +VARIANTS="accept-all,reject-all,real,real_key_rotation,getquote-all,accept-all_mock_quote,reject-all_mock_quote,real_mock_quote,real_mock_quote_key_rotation" +FETCH_ARGS=() +FEATURES_BASE="vmcall-raw,stack-guard,main,vmcall-interrupt,oneshot-apic,spdm_attestation" +FEATURES_REAL_QUOTE="$FEATURES_BASE,igvm-attest" +FEATURES_MOCK_QUOTE="$FEATURES_BASE,use-mock-quote" +LOG_LEVEL="info" +OS_ROOT="" +POWERTEST_DIR="" +HCSTEST_SOURCE_DIR="" +HCSTEST_DIR="" +TDX_TEST_SOURCE_DIR="" +VMGSTOOL_FILE="" +SECFW_FILE="" +AUTHORITY_TCB_MAPPING="$PROJECT_ROOT/config/templates/tcb_mapping_seed.json" +INCLUDE_DEPENDENCIES=true + +while [[ $# -gt 0 ]]; do + case "$1" in + --out) OUT_DIR="$2"; shift 2;; + --variants) VARIANTS="$2"; shift 2;; + --fetch-collaterals) FETCH_ARGS=(--fetch-collaterals); shift;; + --azure-region) FETCH_ARGS+=(--azure-region "$2"); shift 2;; + --os-root) OS_ROOT="$2"; shift 2;; + --powertest-dir) POWERTEST_DIR="$2"; shift 2;; + --hcstest-dir) HCSTEST_DIR="$2"; shift 2;; + --vmgstool-file) VMGSTOOL_FILE="$2"; shift 2;; + --secfw-file) SECFW_FILE="$2"; shift 2;; + --tcb-mapping) AUTHORITY_TCB_MAPPING="$2"; shift 2;; + --skip-dependencies) INCLUDE_DEPENDENCIES=false; shift;; + -h|--help) sed -n '2,35p' "$0"; exit 0;; + *) echo "Unknown arg: $1" >&2; exit 2;; + esac +done + +if [[ -n "$OS_ROOT" ]]; then + POWERTEST_DIR="${POWERTEST_DIR:-$OS_ROOT/src/onecore/vm/test/common/powershell/PowerTest}" + HCSTEST_SOURCE_DIR="$OS_ROOT/src/onecore/vm/compute/test/hcstest/powershellV2" + TDX_TEST_SOURCE_DIR="$OS_ROOT/src/onecore/vm/test/migration/tdx" +fi +[[ "$AUTHORITY_TCB_MAPPING" = /* ]] || AUTHORITY_TCB_MAPPING="$PROJECT_ROOT/$AUTHORITY_TCB_MAPPING" +if [[ ! -f "$AUTHORITY_TCB_MAPPING" ]]; then + echo "Authority TCB mapping not found: $AUTHORITY_TCB_MAPPING" >&2 + exit 1 +fi + +MOCK="sh_script/Azure/build_azure_mock_test.sh" +MANIFEST="config/Azure/servtd_info.json" +IMG="target/debug/migtd.igvm" +TOOLS_DIR="target/release" +BUILD_TMP_DIR="$(mktemp -d)" +POLICY_DIR="$BUILD_TMP_DIR/policy" +POLICY="$POLICY_DIR/policy_v2_signed.json" +CHAIN="$POLICY_DIR/policy_issuer_chain.pem" +MAPPING_HISTORY="$BUILD_TMP_DIR/tcb-mapping-history.json" +FINAL_OUT_DIR="$(realpath -m "$OUT_DIR")" +MIGTD_PACKAGE_DIR="$(dirname "$FINAL_OUT_DIR")/migtd_package" +MIGTD_PACKAGE_ZIP="$MIGTD_PACKAGE_DIR.zip" +if [[ -z "$FINAL_OUT_DIR" || "$FINAL_OUT_DIR" == "/" || \ + "$(dirname "$FINAL_OUT_DIR")" == "/" || \ + "$PROJECT_ROOT" == "$FINAL_OUT_DIR" || \ + "$PROJECT_ROOT" == "$FINAL_OUT_DIR/"* || \ + "$HOME" == "$FINAL_OUT_DIR" || \ + "$HOME" == "$FINAL_OUT_DIR/"* || \ + "$FINAL_OUT_DIR" == "$MIGTD_PACKAGE_DIR" || \ + "$FINAL_OUT_DIR" == "$MIGTD_PACKAGE_ZIP" ]]; then + echo "Refusing unsafe TiP package output directory: $FINAL_OUT_DIR" >&2 + exit 1 +fi +OUT_DIR="$BUILD_TMP_DIR/tip-package" +OUTPUT_PUBLISH_TMP="" +cleanup() { + rm -rf "$BUILD_TMP_DIR" + if [[ -n "$OUTPUT_PUBLISH_TMP" && -e "$OUTPUT_PUBLISH_TMP" ]]; then + rm -rf "$OUTPUT_PUBLISH_TMP" + fi +} +trap cleanup EXIT +# Reuse one temporary signing key for every real-policy pair. This keeps the +# signer identity stable between the original and bumped-SVN images without +# placing a private key in the generated package. +CERT_DIR="$BUILD_TMP_DIR/policy-certs" +ROTATED_CERT_DIR="$BUILD_TMP_DIR/policy-certs-rotated" +POLICY_FFS_GUID="0BE92DC3-6221-4C98-87C1-8EEFFD70DE5A" +POLICY_ISSUER_CHAIN_FFS_GUID="3F2FB27A-9596-431C-A68D-D3EAB39F8AEB" +TROUBLESHOOT_DIR=".agents/skills/migtd-tip-troubleshoot/scripts" +SPDM_DEBUG_DIR=".agents/skills/migtd-spdm-transport-debug/scripts" +RESOLVED_POWERTEST_DIR="" +RESOLVED_HCSTEST_SOURCE_DIR="" + +gen_policy() { + chmod +x "$MOCK" + "./$MOCK" --skip-test --output-dir "$POLICY_DIR" \ + --tcb-mapping "$MAPPING_HISTORY" "${FETCH_ARGS[@]}" "$@" +} +reset_mapping_history() { cp "$AUTHORITY_TCB_MAPPING" "$MAPPING_HISTORY"; } +promote_mapping() { cp "$POLICY_DIR/tcb_mapping.json" "$MAPPING_HISTORY"; } +build_image() { cargo image --policy-v2 --debug --image-format igvm --no-default-features \ + --features "$2" --log-level "$LOG_LEVEL" \ + --policy-issuer-chain "$CHAIN" --policy "$POLICY" --output "$IMG"; } +build_make_image() { + local target="$1" + make -C sh_script/Azure "$target" \ + IGVM_FILE="$PROJECT_ROOT/$IMG" \ + LOG_LEVEL="$LOG_LEVEL" +} +artifact_stem() { + case "$1" in + default) printf 'test-migtd\n';; + default_rebind) printf 'test-migtd_rebind\n';; + mock_quote) printf 'test-migtd_mock_quote\n';; + mock_quote_rebind) printf 'test-migtd_mock_quote_rebind\n';; + key_rotation) printf 'test-migtd_key_rotation\n';; + mock_quote_key_rotation) printf 'test-migtd_mock_quote_key_rotation\n';; + *) printf 'test-migtd-%s\n' "$1";; + esac +} +# Re-enroll a (re-)signed policy + issuer chain into an already-built IGVM's +# CFV in place, without rebuilding MigTD/td-shim (MRTD is unaffected: only the +# CFV content changes, RTMR0/RTMR1 are also unaffected since they don't cover +# policy content, only the firmware separator + issuer chain hash). +enroll_policy() { + ( cd "$PROJECT_ROOT/deps/td-shim" && CC=clang AR=llvm-ar \ + cargo run -p td-shim-tools --bin td-shim-enroll --features=enroller -- \ + "$PROJECT_ROOT/$IMG" \ + -f "$POLICY_FFS_GUID" "$PROJECT_ROOT/$POLICY" \ + "$POLICY_ISSUER_CHAIN_FFS_GUID" "$PROJECT_ROOT/$CHAIN" \ + -o "$PROJECT_ROOT/$IMG" ) +} +emit() { # name + local name="$1" stem base + stem="$(artifact_stem "$name")" + base="$OUT_DIR/$stem.igvm" + cp "$IMG" "$base" + # Hyper-V passes MigTdHash directly to TDH.SERVTD.PREBIND as SERVTD_INFO_HASH. + # Do not use --calc-servtd-hash here: that produces the outer TDREPORT + # SERVTD_HASH and TDH.SERVTD.BIND rejects it with TDX_SERVTD_INFO_HASH_MISMATCH. + "$HASH_BIN" --manifest "$MANIFEST" --image "$base" --policy-v2 | tail -n1 | tr -d '[:space:]' > "$base.hash" + echo " built $stem hash=$(cat "$base.hash")" +} + +emit_real_policy_pair() { # name + local name="$1" + local original_stem rebind_stem + local original_policy="$BUILD_TMP_DIR/$name-policy-original.json" + local rebind_policy_data="$BUILD_TMP_DIR/$name-policy-rebind-data.json" + local original_svn rebind_svn actual_rebind_svn + + cp "$POLICY" "$original_policy" + original_svn="$(jq -er '.policyData.policySvn | numbers' "$original_policy")" + rebind_svn=$((original_svn + 1)) + original_stem="$(artifact_stem "$name")" + rebind_stem="$(artifact_stem "${name}_rebind")" + + emit "$name" + cp "$original_policy" "$OUT_DIR/$original_stem.policy.json" + + # Preserve the complete merged policyData object and change only policySvn, + # then sign it with the same key as the original image. + jq -c --argjson svn "$rebind_svn" \ + '.policyData | .policySvn = $svn' \ + "$original_policy" | tr -d '\n' > "$rebind_policy_data" + "$TOOLS_DIR/json-signer" \ + --sign \ + --name policyData \ + --private-key "$CERT_DIR/policy_signing_pkcs8.key" \ + --input "$rebind_policy_data" \ + --output "$POLICY" + + if ! diff -u \ + <(jq -S '.policyData | del(.policySvn)' "$original_policy") \ + <(jq -S '.policyData | del(.policySvn)' "$POLICY"); then + echo "Bumped policy for $name differs from the original beyond policySvn." >&2 + return 1 + fi + actual_rebind_svn="$(jq -er '.policyData.policySvn | numbers' "$POLICY")" + if [[ "$actual_rebind_svn" -ne "$rebind_svn" ]]; then + echo "Bumped policy for $name has policySvn=$actual_rebind_svn, expected $rebind_svn." >&2 + return 1 + fi + + # Enroll once to materialize the rebind image's new RTMR2/tdinfo_hash. The + # TCB mapping itself is excluded from RTMR2, so adding that hash and + # re-signing the policy does not change the resulting image hash. + enroll_policy + gen_policy \ + --cert-dir "$CERT_DIR" \ + --measured-image "$IMG" \ + --measured-manifest "$MANIFEST" \ + --policy-svn "$rebind_svn" + promote_mapping + actual_rebind_svn="$(jq -er '.policyData.policySvn | numbers' "$POLICY")" + if [[ "$actual_rebind_svn" -ne "$rebind_svn" ]]; then + echo "Regenerated policy for $name has policySvn=$actual_rebind_svn, expected $rebind_svn." >&2 + return 1 + fi + enroll_policy + emit "${name}_rebind" + cp "$POLICY" "$OUT_DIR/$rebind_stem.policy.json" + echo " policy pair $original_stem: policySvn $original_svn -> $rebind_svn (same signer)" +} + +emit_policy_image() { # name + local name="$1" + local stem + stem="$(artifact_stem "$name")" + emit "$name" + cp "$POLICY" "$OUT_DIR/$stem.policy.json" +} + +verify_key_rotation_policy() { + local baseline_policy="$1" + local rotated_policy="$2" + local baseline_svn rotated_svn + + baseline_svn="$(jq -er '.policyData.policySvn | numbers' "$baseline_policy")" + rotated_svn="$(jq -er '.policyData.policySvn | numbers' "$rotated_policy")" + if [[ "$baseline_svn" -ne "$rotated_svn" ]]; then + echo "Key rotation changed policySvn: $baseline_svn -> $rotated_svn" >&2 + return 1 + fi + diff -u \ + <(jq -S '.policyData | del(.servtdCollateral)' "$baseline_policy") \ + <(jq -S '.policyData | del(.servtdCollateral)' "$rotated_policy") + for chain in servtdIdentityIssuerChain servtdTcbMappingIssuerChain; do + if [[ "$(jq -r ".policyData.servtdCollateral.$chain" "$baseline_policy")" != \ + "$(jq -r ".policyData.servtdCollateral.$chain" "$rotated_policy")" ]]; then + echo "Key rotation unexpectedly changed embedded $chain." >&2 + return 1 + fi + done + echo " verified policy leaf rotation at unchanged policySvn $baseline_svn" +} + +resolve_powertest_dir() { + local source="$1" + if [[ -f "$source/PowerTest.psd1" ]]; then + printf '%s\n' "$source" + elif [[ -f "$source/Modules/PowerTest.psd1" ]]; then + printf '%s\n' "$source/Modules" + else + echo "PowerTest.psd1 not found under: $source" >&2 + return 1 + fi +} + +resolve_hcstest_source_dir() { + local source="$1" + if [[ -f "$source/HCSTest.psd1" && -f "$source/HCSTest.psm1" ]]; then + printf '%s\n' "$source" + else + echo "HCSTest PowerShell v2 source not found under: $source" >&2 + return 1 + fi +} + +validate_hcstest_prebuilt() { + local source="$1" + if [[ ! -f "$source/HCSTest.psd1" ]]; then + echo "HCSTest.psd1 not found under: $source" >&2 + return 1 + fi + if [[ ! -f "$source/coreclr/Microsoft.HostCompute.Test.PowerShell.v2.dll" ]]; then + echo "HCSTest v2 coreclr binary not found under: $source" >&2 + echo "Use the matching test_automation_bins/vm/test/compute/HCSTest directory." >&2 + return 1 + fi +} + +validate_dependencies() { + if [[ -z "$POWERTEST_DIR" ]]; then + echo "PowerTest source is required; pass --os-root or --powertest-dir." >&2 + return 1 + fi + RESOLVED_POWERTEST_DIR="$(resolve_powertest_dir "$POWERTEST_DIR")" + for module_file in \ + PowerTest.psd1 \ + TdxLiveMigrationUtilities.psm1 \ + HCSUtilities.psm1 \ + LiveMigrationUtilities.psm1 \ + LiveMigrationTestUtilities.psm1 \ + VmgsUtilities.psm1 \ + WmiUtilities.psm1 \ + IVMUtilities.psm1; do + if [[ ! -f "$RESOLVED_POWERTEST_DIR/$module_file" ]]; then + echo "Required PowerTest module file not found: $RESOLVED_POWERTEST_DIR/$module_file" >&2 + return 1 + fi + done + + if [[ -n "$HCSTEST_SOURCE_DIR" ]]; then + RESOLVED_HCSTEST_SOURCE_DIR="$(resolve_hcstest_source_dir "$HCSTEST_SOURCE_DIR")" + elif [[ -z "$HCSTEST_DIR" ]]; then + echo "HCSTest source or prebuilt content is required; pass --os-root or --hcstest-dir." >&2 + return 1 + fi + + if [[ -n "$HCSTEST_DIR" ]]; then + validate_hcstest_prebuilt "$HCSTEST_DIR" + else + echo "HCSTest source will be bundled without binaries; Publish-TipPackage.ps1 must add the matching winbuild prebuilt module." + fi + + if [[ -n "$TDX_TEST_SOURCE_DIR" ]]; then + for source_file in \ + "$TDX_TEST_SOURCE_DIR/Loopback/Tdx.LiveMigration.Loopback.Tests.ps1" \ + "$TDX_TEST_SOURCE_DIR/Loopback/Tdx.LiveMigration.Partner.Tests.ps1"; do + if [[ ! -f "$source_file" ]]; then + echo "TDX live-migration source not found: $source_file" >&2 + return 1 + fi + done + fi + + if [[ -n "$VMGSTOOL_FILE" && ! -f "$VMGSTOOL_FILE" ]]; then + echo "VmgsTool file not found: $VMGSTOOL_FILE" >&2 + return 1 + fi + if [[ -n "$SECFW_FILE" && ! -f "$SECFW_FILE" ]]; then + echo "SecFw file not found: $SECFW_FILE" >&2 + return 1 + fi +} + +copy_dependencies() { + local dependencies_dir="$OUT_DIR/dependencies" + + rm -rf "$dependencies_dir" + mkdir -p \ + "$dependencies_dir/PowerTest" \ + "$dependencies_dir/HCSTest" \ + "$dependencies_dir/Source/PowerTest" + cp -a "$RESOLVED_POWERTEST_DIR/." "$dependencies_dir/PowerTest/" + cp -a "$RESOLVED_POWERTEST_DIR/." "$dependencies_dir/Source/PowerTest/" + + if [[ -n "$RESOLVED_HCSTEST_SOURCE_DIR" ]]; then + mkdir -p "$dependencies_dir/Source/HCSTest" + cp -a "$RESOLVED_HCSTEST_SOURCE_DIR/." "$dependencies_dir/Source/HCSTest/" + cp -a "$RESOLVED_HCSTEST_SOURCE_DIR/." "$dependencies_dir/HCSTest/" + fi + if [[ -n "$HCSTEST_DIR" ]]; then + rm -rf "$dependencies_dir/HCSTest" + mkdir -p "$dependencies_dir/HCSTest" + cp -a "$HCSTEST_DIR/." "$dependencies_dir/HCSTest/" + fi + + if [[ -n "$TDX_TEST_SOURCE_DIR" ]]; then + mkdir -p "$dependencies_dir/Source/TdxLiveMigration" + cp -a "$TDX_TEST_SOURCE_DIR/." "$dependencies_dir/Source/TdxLiveMigration/" + fi + + if [[ -n "$VMGSTOOL_FILE" ]]; then + mkdir -p "$dependencies_dir/Tools" + cp "$VMGSTOOL_FILE" "$dependencies_dir/Tools/VmgsTool.exe" + fi + + if [[ -n "$SECFW_FILE" ]]; then + mkdir -p "$dependencies_dir/SecFw" + cp "$SECFW_FILE" "$dependencies_dir/SecFw/secfw_test_GenuineIntel.dll" + fi +} + +publish_output_dir() { + local output_parent backup + output_parent="$(dirname "$FINAL_OUT_DIR")" + backup="$FINAL_OUT_DIR.backup.$$" + OUTPUT_PUBLISH_TMP="$FINAL_OUT_DIR.new.$$" + + mkdir -p "$output_parent" + if [[ -e "$OUTPUT_PUBLISH_TMP" || -e "$backup" ]]; then + echo "Temporary package output already exists; refusing to overwrite it." >&2 + return 1 + fi + cp -a "$OUT_DIR" "$OUTPUT_PUBLISH_TMP" + + if [[ -e "$FINAL_OUT_DIR" ]]; then + mv "$FINAL_OUT_DIR" "$backup" + fi + if ! mv "$OUTPUT_PUBLISH_TMP" "$FINAL_OUT_DIR"; then + if [[ -e "$backup" && ! -e "$FINAL_OUT_DIR" ]]; then + mv "$backup" "$FINAL_OUT_DIR" + fi + return 1 + fi + OUTPUT_PUBLISH_TMP="" + if [[ -e "$backup" ]]; then + rm -rf "$backup" + fi + OUT_DIR="$FINAL_OUT_DIR" +} + +echo "=== TiP package build ===" +echo "Output: $FINAL_OUT_DIR" +if [[ ! -d "$TROUBLESHOOT_DIR" ]]; then + echo "Missing troubleshooting helpers: $TROUBLESHOOT_DIR" >&2 + exit 1 +fi +if [[ ! -d "$SPDM_DEBUG_DIR" ]]; then + echo "Missing SPDM debugging helpers: $SPDM_DEBUG_DIR" >&2 + exit 1 +fi +if [[ "$INCLUDE_DEPENDENCIES" == true ]]; then + validate_dependencies +else + echo "Host dependency bundling disabled (--skip-dependencies)." +fi +mkdir -p "$OUT_DIR" +find "$OUT_DIR" -maxdepth 1 -type f \ + \( -name 'test-migtd*.igvm' -o \ + -name 'test-migtd*.igvm.hash' -o \ + -name 'test-migtd*.policy.json' \) \ + -delete +mkdir -p "$POLICY_DIR" +reset_mapping_history +./sh_script/preparation.sh +cargo build -p migtd-hash --release +HASH_BIN="target/release/migtd-hash" + +IFS=',' read -ra LIST <<< "$VARIANTS" +for v in "${LIST[@]}"; do + echo "--- $v ---" + # Variants are independent release lineages. Two-phase builds promote only + # their final real-hash mapping; phase-1 mock mappings remain transient. + reset_mapping_history + case "$v" in + accept-all) gen_policy --allow-all; build_image "$v" "$FEATURES_REAL_QUOTE"; emit accept-all;; + reject-all) gen_policy --reject; build_image "$v" "$FEATURES_REAL_QUOTE"; emit reject-all;; + real) + # Two-phase measure-then-bind build (see doc/ port notes): MRTD/RTMR0/RTMR1 + # don't depend on policy content, so phase 1 can use a placeholder/mock- + # measurement policy just to produce a real, built image to measure from. + mkdir -p "$CERT_DIR" + # Phase 1: dummy policy (mock measurements), real cert chain (persisted). + gen_policy --cert-dir "$CERT_DIR" + build_image "$v" "$FEATURES_REAL_QUOTE" + # Phase 2: measure the real tdinfo_hash of the just-built image and add it + # to the cumulative tcb_mapping.json (instead of the mock-report hash), + # then re-sign the policy against it, reusing the SAME cert dir so the + # issuer chain (and RTMR1) stays identical to what was just measured. + gen_policy --cert-dir "$CERT_DIR" --measured-image "$IMG" --measured-manifest "$MANIFEST" + promote_mapping + # Re-enroll the newly-signed policy + issuer chain into the already- + # built image's CFV in place (no rebuild needed). + enroll_policy + emit_real_policy_pair default + ;; + real_key_rotation) + mkdir -p "$CERT_DIR" "$ROTATED_CERT_DIR" + # Ensure the baseline root exists, then create a distinct leaf key with + # the same Subject Name under that exact root CA. + gen_policy --cert-dir "$CERT_DIR" + baseline_policy="$BUILD_TMP_DIR/key-rotation-baseline.json" + cp "$POLICY" "$baseline_policy" + gen_policy --cert-dir "$ROTATED_CERT_DIR" --rotate-leaf-from "$CERT_DIR" \ + --servtd-cert-dir "$CERT_DIR" + build_image "$v" "$FEATURES_REAL_QUOTE" + gen_policy --cert-dir "$ROTATED_CERT_DIR" --rotate-leaf-from "$CERT_DIR" \ + --servtd-cert-dir "$CERT_DIR" \ + --measured-image "$IMG" \ + --measured-manifest "$MANIFEST" + verify_key_rotation_policy "$baseline_policy" "$POLICY" + enroll_policy + emit_policy_image key_rotation + ;; + getquote-all) gen_policy --allow-all; build_image "$v" "$FEATURES_REAL_QUOTE,test-get-quote"; emit getquote-all;; + accept-all_mock_quote) + build_make_image build-igvm-mock-quote-allow-all + emit accept-all_mock_quote + ;; + reject-all_mock_quote) + build_make_image build-igvm-reject + emit reject-all_mock_quote + ;; + real_mock_quote) + mkdir -p "$CERT_DIR" + gen_policy --cert-dir "$CERT_DIR" + build_image "$v" "$FEATURES_MOCK_QUOTE" + gen_policy --cert-dir "$CERT_DIR" \ + --measured-image "$IMG" \ + --measured-manifest "$MANIFEST" + promote_mapping + enroll_policy + emit_real_policy_pair mock_quote + ;; + real_mock_quote_key_rotation) + mkdir -p "$CERT_DIR" "$ROTATED_CERT_DIR" + gen_policy --cert-dir "$CERT_DIR" + baseline_policy="$BUILD_TMP_DIR/mock-key-rotation-baseline.json" + cp "$POLICY" "$baseline_policy" + gen_policy --cert-dir "$ROTATED_CERT_DIR" --rotate-leaf-from "$CERT_DIR" \ + --servtd-cert-dir "$CERT_DIR" + verify_key_rotation_policy "$baseline_policy" "$POLICY" + build_image "$v" "$FEATURES_MOCK_QUOTE" + emit_policy_image mock_quote_key_rotation + ;; + *) echo "skip unknown variant: $v" >&2;; + esac +done + +# Upload-TipPackage.ps1 runs from the SAW user's home before the package reaches +# a TiP node, so do not bundle it with the node-side test payload. +rm -f "$OUT_DIR/Upload-TipPackage.ps1" +for script in sh_script/Azure/tip/*.ps1; do + if [[ "$(basename "$script")" != "Upload-TipPackage.ps1" ]]; then + cp "$script" "$OUT_DIR/" + fi +done +cp sh_script/Azure/tip/README.md "$OUT_DIR/" +mkdir -p "$OUT_DIR/troubleshooting" +cp "$TROUBLESHOOT_DIR"/*.ps1 "$OUT_DIR/troubleshooting/" +cp "$TROUBLESHOOT_DIR"/*.wprp "$OUT_DIR/troubleshooting/" +cp "$SPDM_DEBUG_DIR"/*.ps1 "$OUT_DIR/troubleshooting/" +if [[ "$INCLUDE_DEPENDENCIES" == true ]]; then + copy_dependencies +else + rm -rf "$OUT_DIR/dependencies" +fi + +publish_output_dir + +# Build a SAW-side archive that can be expanded directly under $HOME. The +# uploader defaults to the sibling tip_package directory, while the node +# payload itself remains free of SAW-only tooling. +rm -rf "$MIGTD_PACKAGE_DIR" +rm -f "$MIGTD_PACKAGE_ZIP" +mkdir -p "$MIGTD_PACKAGE_DIR/tip_package" +cp sh_script/Azure/tip/Upload-TipPackage.ps1 "$MIGTD_PACKAGE_DIR/" +cp -a "$OUT_DIR/." "$MIGTD_PACKAGE_DIR/tip_package/" +( + cd "$(dirname "$MIGTD_PACKAGE_DIR")" + python3 -m zipfile -c "$(basename "$MIGTD_PACKAGE_ZIP")" \ + "$(basename "$MIGTD_PACKAGE_DIR")" +) + +echo "=== done ===" +ls -lh "$OUT_DIR" +ls -lh "$MIGTD_PACKAGE_ZIP" diff --git a/sh_script/build_AzCVMEmu_policy_and_test.sh b/sh_script/build_AzCVMEmu_policy_and_test.sh index 20136887b..21d3881db 100755 --- a/sh_script/build_AzCVMEmu_policy_and_test.sh +++ b/sh_script/build_AzCVMEmu_policy_and_test.sh @@ -37,6 +37,9 @@ # # Skip the integration test at the end # ./sh_script/build_AzCVMEmu_policy_and_test.sh --skip-test # +# # Also emit CoRIM-only artifacts for the canonical mock report +# ./sh_script/build_AzCVMEmu_policy_and_test.sh --mock-report --corim-only +# # # Custom output directory # ./sh_script/build_AzCVMEmu_policy_and_test.sh --output-dir /path/to/output # @@ -192,6 +195,10 @@ POLICY_DATA_RAW="$SOURCE_MATERIAL_DIR/policy_v2_raw.json" TD_IDENTITY_TEMPLATE="$SOURCE_MATERIAL_DIR/td_identity.json" TCB_MAPPING_TEMPLATE="$SOURCE_MATERIAL_DIR/tcb_mapping.json" COLLATERALS_FILE="$SOURCE_MATERIAL_DIR/collateral_azure_thim.json" +CORIM_FIXTURE_DIR="$SOURCE_MATERIAL_DIR/corim" +CORIM_FIXTURE="$CORIM_FIXTURE_DIR/tcb_mapping.cose" +CORIM_SIGNER_ANCHOR_FIXTURE="$CORIM_FIXTURE_DIR/signer_anchor.bin" +CORIM_MOCK_TDINFO_HASH="1ADC25055B5188A615FF0A2B4781C0E1F38D4369CA688C775EE321E142FBE4534C14EDE61D9C570967996F6C8E8F5F76" # Intermediate files REPORT_DATA_FILE="$TEMP_DIR/report_data.json" @@ -210,9 +217,15 @@ OUTPUT_POLICY_B="$OUTPUT_DIR/policy_v2_signed_b.json" OUTPUT_POLICY_PM_B="$OUTPUT_DIR/policy_v2_signed_pm_b.json" # Variant B with policy + tcb_mapping + td_identity leaf certs all rotated OUTPUT_POLICY_PMI_B="$OUTPUT_DIR/policy_v2_signed_pmi_b.json" +# Variant "a" whose collaterals carry a signer CRL that REVOKES the tcb-mapping +# signer leaf — used by the revocation e2e test (verify() must fail closed). +OUTPUT_POLICY_REVOKED="$OUTPUT_DIR/policy_v2_signed_revoked.json" OUTPUT_CERT_CHAIN="$OUTPUT_DIR/policy_issuer_chain.pem" OUTPUT_CERT_CHAIN_A="$OUTPUT_DIR/policy_issuer_chain_a.pem" OUTPUT_CERT_CHAIN_B="$OUTPUT_DIR/policy_issuer_chain_b.pem" +OUTPUT_CORIM_POLICY="$OUTPUT_DIR/policy_v2_corim.json" +OUTPUT_CORIM="$OUTPUT_DIR/tcb_mapping_corim.cose" +OUTPUT_CORIM_SIGNER_ANCHOR="$OUTPUT_DIR/servtd_signer_anchor.bin" CERT_DIR="$TEMP_DIR/certs" PRIVATE_KEY="$CERT_DIR/policy_signing_pkcs8.key" PRIVATE_KEY_A="$CERT_DIR/policy_signing_a_pkcs8.key" @@ -262,6 +275,7 @@ generate_certificates() { local cert_validity_days="${3:-365}" local root_ca_subject="${4:-/CN=MigTD Root CA/O=Intel Corporation}" local leaf_subject="${5:-/CN=MigTD Policy Issuer/O=Intel Corporation}" + local signer_eku_oid="${MIGTD_SIGNER_EKU_OID:-1.3.6.1.4.1.32473.1.1}" # Validate key type first if [ "$key_type" != "P384" ]; then @@ -295,10 +309,22 @@ generate_certificates() { # - identity_signing_{a,b} : signs td_identity (embedded in servtd_collateral) # Variant "a" uses the same logical leaf for all three; variant "b" rotates # one or more of them depending on the test mode. + # + # All signer leaves carry the same single dedicated EKU. The default uses + # the RFC 5612 documentation PEN; production issuers must override + # MIGTD_SIGNER_EKU_OID with their allocated signer-purpose OID. + # + # `RawPolicyData::verify` binds both the + # embedded servtdTcbMappingIssuerChain and the (optional) servtdIdentityIssuerChain + # to the same RTMR1 signer anchor as the CFV mapping-signer chain; + # since the anchor is SHA384(root fingerprint + leaf EKU), all signers MUST + # share root + leaf EKU or verification fails closed + # with PolicyError::SignerAnchorMismatch. Rotating the identity key (variant + # "b") keeps the same EKU, so the anchor stays stable. for family_subject in \ "policy_signing:/CN=MigTD Policy Issuer/O=Intel Corporation" \ "mapping_signing:/CN=MigTD TCB Mapping Issuer/O=Intel Corporation" \ - "identity_signing:/CN=MigTD TD Identity Issuer/O=Intel Corporation"; do + "identity_signing:/CN=MigTD TCB Mapping Issuer/O=Intel Corporation"; do local family="${family_subject%%:*}" local subject="${family_subject#*:}" # Default to the script's leaf_subject for the policy family to preserve @@ -336,7 +362,7 @@ generate_certificates() { -days $cert_validity_days \ -$hash_algo \ -extensions v3_ca \ - -extfile <(echo -e "[v3_ca]\nkeyUsage = digitalSignature") + -extfile <(printf '[v3_ca]\nkeyUsage = digitalSignature\nextendedKeyUsage = %s\n' "$signer_eku_oid") cat "$output_dir/${family}_${suffix}.pem" "$output_dir/root_ca.pem" \ > "$output_dir/${family_chain_prefix}_${suffix}.pem" @@ -350,12 +376,52 @@ generate_certificates() { cp "$output_dir/policy_issuer_chain_a.pem" "$output_dir/policy_issuer_chain.pem" } +# Generate two servtd signer CRLs, both signed by the shared root CA: +# servtd_crl_empty.pem : revokes nothing (crlNumber 0x1000) +# servtd_crl_revoked.pem : revokes the mapping_signing_a leaf (crlNumber 0x1001) +# The CRL issuer (root CA subject) matches the root cert present in every +# mapping/identity signer chain, so crypto::verify_signer_chain_not_revoked can +# authenticate it and check the leaf serials. +generate_servtd_crls() { + local cert_dir="$1" + local hash_algo="sha384" + local cadir="$cert_dir/crl_ca" + + mkdir -p "$cadir" + : > "$cadir/index.txt" + echo 1000 > "$cadir/crlnumber" + cat > "$cadir/ca.cnf" <<EOF +[ca] +default_ca = CA_default +[CA_default] +database = $cadir/index.txt +crlnumber = $cadir/crlnumber +default_md = $hash_algo +default_crl_days = 3650 +EOF + + # Empty CRL (crlNumber 0x1000). + openssl ca -config "$cadir/ca.cnf" -gencrl \ + -keyfile "$cert_dir/root_ca.key" -cert "$cert_dir/root_ca.pem" \ + -out "$cert_dir/servtd_crl_empty.pem" 2>/dev/null + + # Revoke the mapping_signing_a leaf, then regenerate (crlNumber 0x1001). + openssl ca -config "$cadir/ca.cnf" -revoke "$cert_dir/mapping_signing_a.pem" \ + -keyfile "$cert_dir/root_ca.key" -cert "$cert_dir/root_ca.pem" 2>/dev/null + openssl ca -config "$cadir/ca.cnf" -gencrl \ + -keyfile "$cert_dir/root_ca.key" -cert "$cert_dir/root_ca.pem" \ + -out "$cert_dir/servtd_crl_revoked.pem" 2>/dev/null +} + # Parse command line arguments USE_MOCK_REPORT=false MOCK_QUOTE_FILE="" FETCH_COLLATERALS=false AZURE_REGION="useast" EXTRA_FEATURES="" +REVOKE_TDINFO_HASHES=() +TCB_MAPPING_INPUT="" +GENERATE_CORIM_ONLY=false while [[ $# -gt 0 ]]; do case $1 in @@ -369,6 +435,9 @@ while [[ $# -gt 0 ]]; do OUTPUT_CERT_CHAIN="$OUTPUT_DIR/policy_issuer_chain.pem" OUTPUT_CERT_CHAIN_A="$OUTPUT_DIR/policy_issuer_chain_a.pem" OUTPUT_CERT_CHAIN_B="$OUTPUT_DIR/policy_issuer_chain_b.pem" + OUTPUT_CORIM_POLICY="$OUTPUT_DIR/policy_v2_corim.json" + OUTPUT_CORIM="$OUTPUT_DIR/tcb_mapping_corim.cose" + OUTPUT_CORIM_SIGNER_ANCHOR="$OUTPUT_DIR/servtd_signer_anchor.bin" shift 2 ;; --skip-test) @@ -379,6 +448,10 @@ while [[ $# -gt 0 ]]; do USE_MOCK_REPORT=true shift ;; + --corim-only) + GENERATE_CORIM_ONLY=true + shift + ;; --mock-quote-file) MOCK_QUOTE_FILE="$2" shift 2 @@ -395,6 +468,14 @@ while [[ $# -gt 0 ]]; do EXTRA_FEATURES="$2" shift 2 ;; + --tcb-mapping) + TCB_MAPPING_INPUT="$2" + shift 2 + ;; + --revoke-tdinfo-hash) + REVOKE_TDINFO_HASHES+=("$2") + shift 2 + ;; -h|--help) echo "Usage: $0 [OPTIONS]" echo @@ -402,11 +483,16 @@ while [[ $# -gt 0 ]]; do echo " --output-dir DIR Output directory for generated files (default: config/AzCVMEmu)" echo " --skip-test Skip running the MigTD test at the end" echo " --mock-report Use mock report data with test_mock_report feature" + echo " --corim-only Also generate CoRIM-only policy/runtime inputs" echo " --mock-quote-file FILE Path to mock quote file (--mock-report will be turned on)" echo " --fetch-collaterals Fetch fresh collaterals from Azure THIM before generating policy" echo " --azure-region REGION Azure region for THIM (useast, westus, northeurope)" echo " (default: useast, applies with --fetch-collaterals)" echo " --extra-features FEATURES Extra cargo features to add (e.g., 'igvm-attest')" + echo " --tcb-mapping FILE Previous authority-maintained mapping to extend" + echo " (default: existing output, then config/AzCVMEmu)" + echo " --revoke-tdinfo-hash HASH Explicitly remove a historical tdinfo_hash" + echo " from the cumulative mapping (repeatable)" echo " -h, --help Show this help message" echo echo "Examples:" @@ -416,6 +502,9 @@ while [[ $# -gt 0 ]]; do echo " # Mock report mode (uses test_mock_report feature):" echo " $0 --mock-report" echo + echo " # Mock report mode with CoRIM-only release inputs:" + echo " $0 --mock-report --corim-only" + echo echo " # Mock report mode with custom quote file:" echo " $0 --mock-quote-file ./config/AzCVMEmu/az_migtd_quote.blob" echo @@ -448,6 +537,7 @@ echo " Source material: $SOURCE_MATERIAL_DIR" echo " Output directory: $OUTPUT_DIR" echo " Temp directory: $TEMP_DIR" echo " Mock report mode: $USE_MOCK_REPORT" +echo " Generate CoRIM-only artifacts: $GENERATE_CORIM_ONLY" if [[ -n "$MOCK_QUOTE_FILE" ]]; then echo " Mock quote file: $MOCK_QUOTE_FILE" fi @@ -455,19 +545,40 @@ echo " Fetch collaterals: $FETCH_COLLATERALS" if [ "$FETCH_COLLATERALS" = true ]; then echo " Azure region: $AZURE_REGION" fi +if [ "${#REVOKE_TDINFO_HASHES[@]}" -gt 0 ]; then + echo " Explicit mapping revocations: ${REVOKE_TDINFO_HASHES[*]}" +fi echo # Ensure output directory exists mkdir -p "$OUTPUT_DIR" mkdir -p "$CERT_DIR" +if [[ -n "$TCB_MAPPING_INPUT" && "$TCB_MAPPING_INPUT" != /* ]]; then + TCB_MAPPING_INPUT="$PROJECT_ROOT/$TCB_MAPPING_INPUT" +fi +TCB_MAPPING_SOURCE="$TCB_MAPPING_TEMPLATE" +if [ -n "$TCB_MAPPING_INPUT" ]; then + TCB_MAPPING_SOURCE="$TCB_MAPPING_INPUT" +elif [ -f "$OUTPUT_DIR/tcb_mapping.json" ]; then + TCB_MAPPING_SOURCE="$OUTPUT_DIR/tcb_mapping.json" +fi + # Verify input files exist -for file in "$POLICY_DATA_RAW" "$TD_IDENTITY_TEMPLATE" "$TCB_MAPPING_TEMPLATE"; do +for file in "$POLICY_DATA_RAW" "$TD_IDENTITY_TEMPLATE" "$TCB_MAPPING_SOURCE"; do if [ ! -f "$file" ]; then echo -e "${RED}Error: Required input file not found: $file${NC}" >&2 exit 1 fi done +if [ "$GENERATE_CORIM_ONLY" = true ]; then + for file in "$CORIM_FIXTURE" "$CORIM_SIGNER_ANCHOR_FIXTURE"; do + if [ ! -f "$file" ]; then + echo -e "${RED}Error: Required CoRIM fixture not found: $file${NC}" >&2 + exit 1 + fi + done +fi # # Step 0: Fetch fresh collaterals from Azure THIM (optional) @@ -550,6 +661,12 @@ if ! cargo build --release -p migtd-policy-generator; then exit 1 fi +echo "Building migtd-hash..." +if ! cargo build --release -p migtd-hash; then + echo -e "${RED}Error: Failed to build migtd-hash${NC}" >&2 + exit 1 +fi + # Verify tools exist # azcvm-extract-report may be emitted either to the local crate target/ or the # workspace target/ when CARGO_TARGET_DIR is set. @@ -564,7 +681,7 @@ else exit 1 fi -for tool in json-signer servtd-collateral-generator migtd-policy-generator; do +for tool in json-signer servtd-collateral-generator migtd-policy-generator migtd-hash; do if [ ! -f "$TOOLS_DIR/$tool" ]; then echo -e "${RED}Error: Tool '$tool' not found at $TOOLS_DIR/$tool${NC}" >&2 exit 1 @@ -650,28 +767,101 @@ echo # Make sure no ending newline is added (important for signing) # echo -e "${BLUE}=== Step 3: Updating TD Identity Template ===${NC}" +# Conditionally update tcbDate and issueDate only when they are behind the +# policy's servtd tcbDate reference (greater-or-equal check). +POLICY_TCB_REF=$(jq -r ' + [.policy[] | .servtd.migtdIdentity.tcbDate.reference // empty] | + map(select(. != "")) | max // empty +' "$POLICY_DATA_RAW" 2>/dev/null) + +DATE_UPDATES="" +if [ -n "$POLICY_TCB_REF" ]; then + CURRENT_UTC=$(date -u +"%Y-%m-%dT%H:%M:%SZ") + TEMPLATE_TCB_DATE=$(jq -r '.tcbLevels[0].tcbDate' "$TD_IDENTITY_TEMPLATE") + TEMPLATE_ISSUE_DATE=$(jq -r '.issueDate' "$TD_IDENTITY_TEMPLATE") + if [[ "$TEMPLATE_TCB_DATE" < "$POLICY_TCB_REF" ]]; then + DATE_UPDATES="$DATE_UPDATES | .tcbLevels[0].tcbDate = \"$CURRENT_UTC\"" + echo -e " Updating tcbDate: $TEMPLATE_TCB_DATE -> $CURRENT_UTC (reference: $POLICY_TCB_REF)" + fi + if [[ "$TEMPLATE_ISSUE_DATE" < "$POLICY_TCB_REF" ]]; then + DATE_UPDATES="$DATE_UPDATES | .issueDate = \"$CURRENT_UTC\"" + echo -e " Updating issueDate: $TEMPLATE_ISSUE_DATE -> $CURRENT_UTC (reference: $POLICY_TCB_REF)" + fi +fi + jq -c ".xfam = \"$XFAM\" | .attributes = \"$ATTRIBUTES\" | .mrConfigId = \"$MR_CONFIG_ID\" | \ .mrOwner = \"$MR_OWNER\" | .mrOwnerConfig = \"$MR_OWNER_CONFIG\" | .mrsigner = \"$MRSIGNER\" | \ -.isvProdId = $ISV_PROD_ID | .tcbLevels[0].tcb.isvsvn = $ISVSVN" \ +.isvProdId = $ISV_PROD_ID | .tcbLevels[0].tcb.isvsvn = $ISVSVN $DATE_UPDATES" \ "$TD_IDENTITY_TEMPLATE" | tr -d '\n' > "$TD_IDENTITY_UPDATED" echo -e "${GREEN}✓ TD Identity updated: $TD_IDENTITY_UPDATED${NC}" echo # -# Step 4: Update tcb_mapping.json with extracted measurements +# Step 4: Update the cumulative tcb_mapping.json with the v2 tdinfo_hash # Make sure no ending newline is added (important for signing) # -echo -e "${BLUE}=== Step 4: Updating TCB Mapping Template ===${NC}" -jq -c ".svnMappings[0].tdMeasurements.mrtd = \"$MRTD\" | \ -.svnMappings[0].tdMeasurements.rtmr0 = \"$RTMR0\" | \ -.svnMappings[0].tdMeasurements.rtmr1 = \"$RTMR1\" | \ -.svnMappings[0].isvsvn = $ISVSVN" \ -"$TCB_MAPPING_TEMPLATE" | tr -d '\n' > "$TCB_MAPPING_UPDATED" +# The Rust helper retains all supported historical hashes, replaces the +# current hash by key, rejects conflicting duplicates, applies only explicit +# revocations, and emits deterministic compact JSON for signing. The +# --from-report path remains byte-identical to the release pipeline. +# +echo -e "${BLUE}=== Step 4: Updating Cumulative TCB Mapping ===${NC}" + +TDINFO_HASH_FILE="$TEMP_DIR/tdinfo_hash.hex" +MAPPING_UPDATE_ARGS=( + --update-tcb-mapping "$TCB_MAPPING_SOURCE" + --output-tcb-mapping "$TCB_MAPPING_UPDATED" + --mapping-isvsvn "$ISVSVN" +) +for hash in "${REVOKE_TDINFO_HASHES[@]}"; do + MAPPING_UPDATE_ARGS+=(--revoke-tdinfo-hash "$hash") +done +"$TOOLS_DIR/migtd-hash" \ + --policy-v2 \ + --from-report "$REPORT_DATA_FILE" \ + --output-tdinfo-hash "$TDINFO_HASH_FILE" \ + "${MAPPING_UPDATE_ARGS[@]}" +# Uppercase to match the convention used by signed policies. +TDINFO_HASH=$(tr 'a-z' 'A-Z' < "$TDINFO_HASH_FILE") echo -e "${GREEN}✓ TCB Mapping updated: $TCB_MAPPING_UPDATED${NC}" +echo -e " history source = $TCB_MAPPING_SOURCE" +echo -e " tdinfo_hash = $TDINFO_HASH" echo +# +# Step 4b: Generate CoRIM-only runtime inputs for the canonical mock report +# +if [ "$GENERATE_CORIM_ONLY" = true ]; then + echo -e "${BLUE}=== Step 4b: Generating CoRIM-only Runtime Inputs ===${NC}" + if [ "$TDINFO_HASH" != "$CORIM_MOCK_TDINFO_HASH" ]; then + echo -e "${RED}Error: CoRIM fixture is for canonical mock tdinfo_hash $CORIM_MOCK_TDINFO_HASH, got $TDINFO_HASH${NC}" >&2 + exit 1 + fi + + CORIM_POLICY_DATA_RAW="$TEMP_DIR/policy_v2_corim_raw.json" + CORIM_POLICY_DATA_MERGED="$TEMP_DIR/policy_v2_corim_merged.json" + jq -c '.policy += [{"servtd":{"migtdIdentity":{"isvsvn":{"operation":"greater-or-equal","reference":"self"}}}}]' \ + "$POLICY_DATA_RAW" > "$CORIM_POLICY_DATA_RAW" + "$TOOLS_DIR/migtd-policy-generator" v2 \ + --policy-data "$CORIM_POLICY_DATA_RAW" \ + --collaterals "$COLLATERALS_FILE" \ + --output "$CORIM_POLICY_DATA_MERGED" + jq -c '{policyData:.}' "$CORIM_POLICY_DATA_MERGED" > "$OUTPUT_CORIM_POLICY" + + if jq -e '.policyData | has("servtdCollateral")' "$OUTPUT_CORIM_POLICY" >/dev/null; then + echo -e "${RED}Error: Generated CoRIM-only policy unexpectedly contains servtdCollateral${NC}" >&2 + exit 1 + fi + cp "$CORIM_FIXTURE" "$OUTPUT_CORIM" + cp "$CORIM_SIGNER_ANCHOR_FIXTURE" "$OUTPUT_CORIM_SIGNER_ANCHOR" + echo -e "${GREEN}✓ CoRIM-only policy: $OUTPUT_CORIM_POLICY${NC}" + echo -e "${GREEN}✓ Signed TCB-mapping CoRIM: $OUTPUT_CORIM${NC}" + echo -e "${GREEN}✓ ServTD signer anchor: $OUTPUT_CORIM_SIGNER_ANCHOR${NC}" + echo +fi + # # Step 5: Generate certificates and signing key # @@ -681,6 +871,15 @@ generate_certificates "$CERT_DIR" "P384" 365 echo -e "${GREEN}✓ Certificates generated in: $CERT_DIR${NC}" echo +# +# Step 5b: Generate servtd signer CRLs (embedded per-variant into servtdCollateral) +# +echo -e "${BLUE}=== Step 5b: Generating Signer CRLs ===${NC}" +generate_servtd_crls "$CERT_DIR" + +echo -e "${GREEN}✓ Signer CRLs generated (empty + mapping-leaf-revoked)${NC}" +echo + # # Steps 6-10: Sign all policy variants # @@ -706,6 +905,7 @@ build_signed_policy_variant() { local mapping_suffix="$3" # a or b local policy_suffix="$4" # a or b local output_policy="$5" + local servtd_crl_file="${6:-}" # optional PEM CRL to embed in servtdCollateral local identity_key="$CERT_DIR/identity_signing_${identity_suffix}_pkcs8.key" local mapping_key="$CERT_DIR/mapping_signing_${mapping_suffix}_pkcs8.key" @@ -734,11 +934,16 @@ build_signed_policy_variant() { --input "$TCB_MAPPING_UPDATED" \ --output "$tcb_mapping_signed" + local servtd_crl_arg=() + if [ -n "$servtd_crl_file" ]; then + servtd_crl_arg=(--servtd-crl "$servtd_crl_file") + fi "$TOOLS_DIR/servtd-collateral-generator" \ --identity "$td_identity_signed" \ --identity-chain "$identity_chain" \ --mapping "$tcb_mapping_signed" \ --mapping-chain "$mapping_chain" \ + "${servtd_crl_arg[@]}" \ --output "$servtd_collateral" "$TOOLS_DIR/migtd-policy-generator" v2 \ @@ -758,10 +963,14 @@ build_signed_policy_variant() { } echo -e "${BLUE}=== Step 6-10: Building Signed Policy Variants ===${NC}" -build_signed_policy_variant "a" a a a "$OUTPUT_POLICY_A" -build_signed_policy_variant "b" a a b "$OUTPUT_POLICY_B" -build_signed_policy_variant "pm_b" a b b "$OUTPUT_POLICY_PM_B" -build_signed_policy_variant "pmi_b" b b b "$OUTPUT_POLICY_PMI_B" +build_signed_policy_variant "a" a a a "$OUTPUT_POLICY_A" "$CERT_DIR/servtd_crl_empty.pem" +build_signed_policy_variant "b" a a b "$OUTPUT_POLICY_B" "$CERT_DIR/servtd_crl_empty.pem" +build_signed_policy_variant "pm_b" a b b "$OUTPUT_POLICY_PM_B" "$CERT_DIR/servtd_crl_empty.pem" +build_signed_policy_variant "pmi_b" b b b "$OUTPUT_POLICY_PMI_B" "$CERT_DIR/servtd_crl_empty.pem" +# Revocation variant: same signers as "a", but its servtdCollateral carries a +# servtdCrl that revokes the tcb-mapping signer leaf, so RawPolicyData::verify() +# fails closed (PolicyError::SignerRevoked). +build_signed_policy_variant "revoked" a a a "$OUTPUT_POLICY_REVOKED" "$CERT_DIR/servtd_crl_revoked.pem" # Also keep a default signed policy (variant a) for backward compat cp "$OUTPUT_POLICY_A" "$OUTPUT_POLICY" @@ -773,8 +982,15 @@ echo # Step 11: Copying Certificate Chains to output directory # echo -e "${BLUE}=== Step 11: Copying Certificate Chains ===${NC}" -cp "$CERT_DIR/policy_issuer_chain_a.pem" "$OUTPUT_CERT_CHAIN_A" -cp "$CERT_DIR/policy_issuer_chain_b.pem" "$OUTPUT_CERT_CHAIN_B" +# The CFV MIGTD_POLICY_ISSUER_CHAIN slot now carries the **TCB-mapping** issuer +# chain (per doc/tcb_mapping_design_proposal.md: "RTMR1 = TCBMapping issuer cert +# chain"). RTMR1 measures its signer anchor and RawPolicyData::verify() binds +# the embedded servtdTcbMappingIssuerChain to that same anchor, so the CFV chain +# and the embedded mapping chain MUST share root + leaf signer EKU. The old +# policy_signing family only signed the (now-removed) outer policy signature and +# is no longer the RTMR1 anchor. +cp "$CERT_DIR/mapping_issuer_chain_a.pem" "$OUTPUT_CERT_CHAIN_A" +cp "$CERT_DIR/mapping_issuer_chain_b.pem" "$OUTPUT_CERT_CHAIN_B" cp "$OUTPUT_CERT_CHAIN_A" "$OUTPUT_CERT_CHAIN" echo -e "${GREEN}✓ Certificate chain A: $OUTPUT_CERT_CHAIN_A${NC}" @@ -811,6 +1027,11 @@ echo " 📄 Policy (default): $OUTPUT_POLICY" echo " 📄 Cert chain (a): $OUTPUT_CERT_CHAIN_A" echo " 📄 Cert chain (b): $OUTPUT_CERT_CHAIN_B" echo " 📄 Cert chain (default): $OUTPUT_CERT_CHAIN" +if [ "$GENERATE_CORIM_ONLY" = true ]; then + echo " 📄 CoRIM-only policy: $OUTPUT_CORIM_POLICY" + echo " 📄 Signed TCB CoRIM: $OUTPUT_CORIM" + echo " 📄 ServTD signer anchor: $OUTPUT_CORIM_SIGNER_ANCHOR" +fi echo if [ "$USE_MOCK_REPORT" = true ]; then @@ -828,7 +1049,7 @@ fi echo # -# Step 13: Test the policy (optional) +# Step 13: Test the policy - migration flow (optional) # # Pass --skip-policy-generation: this script already generated the policy # files, so migtdemu.sh must not re-run the generator (which would clobber @@ -849,7 +1070,7 @@ if [[ -n "$EXTRA_FEATURES" ]]; then fi if [ -z "$SKIP_TEST" ]; then - echo -e "${BLUE}=== Step 13: Testing Policy ===${NC}" + echo -e "${BLUE}=== Step 13: Testing Policy (migration) ===${NC}" if [ "$USE_MOCK_REPORT" = true ]; then echo "Running with mock report mode: $TEST_CMD" echo -e "${YELLOW}Note: Using test_mock_report feature for mock TD reports/quotes${NC}" @@ -861,19 +1082,65 @@ if [ -z "$SKIP_TEST" ]; then cd "$PROJECT_ROOT" if $TEST_CMD; then echo - echo -e "${GREEN}✓✓✓ SUCCESS: Policy validation and key exchange completed! ✓✓✓${NC}" + echo -e "${GREEN}✓✓✓ SUCCESS: Migration policy validation and key exchange completed! ✓✓✓${NC}" else echo - echo -e "${YELLOW}⚠ Test failed. Check the output above for errors.${NC}" + echo -e "${YELLOW}⚠ Migration test failed. Check the output above for errors.${NC}" echo "You can manually test with:" echo " $TEST_CMD" exit 1 fi else - echo -e "${YELLOW}Test skipped. To test manually, run:${NC}" + echo -e "${YELLOW}Migration test skipped. To test manually, run:${NC}" echo " $TEST_CMD" fi +# +# Step 14: Test the policy - prepare-rebind flow (optional) +# +# Runs the rebind-prepare operation which performs the rebinding handshake +# (TLS, token exchange, and approval) using the same policy variants. +REBIND_TEST_CMD="./migtdemu.sh --operation rebind-prepare --src-policy-file $OUTPUT_POLICY_A --src-policy-issuer-chain-file $OUTPUT_CERT_CHAIN_A --dst-policy-file $OUTPUT_POLICY_B --dst-policy-issuer-chain-file $OUTPUT_CERT_CHAIN_B --skip-policy-generation --debug --both" +if [ "$USE_MOCK_REPORT" = true ]; then + REBIND_TEST_CMD="$REBIND_TEST_CMD --mock-report" + + # Add mock quote file if specified + if [[ -n "$MOCK_QUOTE_FILE" ]]; then + REBIND_TEST_CMD="$REBIND_TEST_CMD --mock-quote-file $MOCK_QUOTE_FILE" + fi +fi + +# Add extra features if specified +if [[ -n "$EXTRA_FEATURES" ]]; then + REBIND_TEST_CMD="$REBIND_TEST_CMD --features $EXTRA_FEATURES" +fi + +if [ -z "$SKIP_TEST" ]; then + echo + echo -e "${BLUE}=== Step 14: Testing Policy (prepare-rebind) ===${NC}" + if [ "$USE_MOCK_REPORT" = true ]; then + echo "Running with mock report mode: $REBIND_TEST_CMD" + echo -e "${YELLOW}Note: Using test_mock_report feature for mock TD reports/quotes${NC}" + else + echo "Running with real remote attestation: $REBIND_TEST_CMD" + fi + echo + + cd "$PROJECT_ROOT" + if $REBIND_TEST_CMD; then + echo + echo -e "${GREEN}✓✓✓ SUCCESS: Prepare-rebind policy validation and token exchange completed! ✓✓✓${NC}" + else + echo + echo -e "${YELLOW}⚠ Prepare-rebind test failed. Check the output above for errors.${NC}" + echo "You can manually test with:" + echo " $REBIND_TEST_CMD" + exit 1 + fi +else + echo -e "${YELLOW}Prepare-rebind test skipped. To test manually, run:${NC}" + echo " $REBIND_TEST_CMD" +fi + echo echo -e "${GREEN}=== All Done! ===${NC}" - diff --git a/sh_script/build_policy_v2.sh b/sh_script/build_policy_v2.sh index 665dab586..bb699c5d4 100644 --- a/sh_script/build_policy_v2.sh +++ b/sh_script/build_policy_v2.sh @@ -5,6 +5,7 @@ config_temp_dir="./config/templates" key_dir="./key" environment="${1:-pre-production}" +tcb_mapping_file="${2:-}" case "$environment" in pre-production|preprod) collateral_file="collateral_pre_production_fmspc.json" @@ -13,12 +14,22 @@ case "$environment" in collateral_file="collateral_production_fmspc.json" ;; *) - echo "Usage: $0 <pre-production|production>" + echo "Usage: $0 <pre-production|production> <cumulative-tcb-mapping.json>" exit 1 ;; esac echo "Selected collateral environment '$environment' using $collateral_file" +if [[ -z "$tcb_mapping_file" ]]; then + echo "Usage: $0 <pre-production|production> <cumulative-tcb-mapping.json>" >&2 + exit 1 +fi +if ! jq -e '.svnMappings | type == "array" and length > 0' "$tcb_mapping_file" >/dev/null; then + echo "TCB mapping must contain at least one reviewed release: $tcb_mapping_file" >&2 + echo "Generate it cumulatively with migtd-hash before signing." >&2 + exit 1 +fi +echo "Signing cumulative TCB mapping: $tcb_mapping_file" # Build migtd-collateral-generator and generate collateral_pre_production_fmspc.json # cargo build -p migtd-collateral-generator @@ -38,7 +49,7 @@ cargo build -p json-signer ./target/debug/json-signer --sign \ --name tdTcbMapping \ --private-key $key_dir/issuer_pkcs8.key \ - --input $config_temp_dir/tcb_mapping.json \ + --input "$tcb_mapping_file" \ --output $config_temp_dir/tcb_mapping_signed.json # Build servtd-collateral-generator and generate servtd_collateral.json diff --git a/sh_script/key_gen.sh b/sh_script/key_gen.sh index c2025072e..6dc863311 100755 --- a/sh_script/key_gen.sh +++ b/sh_script/key_gen.sh @@ -3,6 +3,7 @@ set -e # Set output directory OUTPUT_DIR="key" +MIGTD_SIGNER_EKU_OID="${MIGTD_SIGNER_EKU_OID:-1.3.6.1.4.1.32473.1.1}" mkdir -p "$OUTPUT_DIR" # 1. Create the Root CA Key and Certificate @@ -37,8 +38,10 @@ openssl req -new -nodes -key "$OUTPUT_DIR/issuer.key" -sha384 -out "$OUTPUT_DIR/ # Add an explicit Key Usage so the cert is encoded as X.509 v3 (openssl # omits the [0] version field and produces a v1 certificate when no v3 # extensions are present, which the in-tree x509 parser rejects). The -# leaf MUST NOT be a CA — no BasicConstraints, no keyCertSign. -openssl x509 -req -in "$OUTPUT_DIR/issuer.csr" -CA "$OUTPUT_DIR/intermediate_ca.crt" -CAkey "$OUTPUT_DIR/intermediate_ca.key" -CAcreateserial -sha384 -days 365 -extfile <(printf 'keyUsage=critical,digitalSignature\n') -out "$OUTPUT_DIR/issuer.crt" +# leaf MUST NOT be a CA — no BasicConstraints, no keyCertSign. The default EKU +# uses the RFC 5612 documentation PEN; production issuers must override +# MIGTD_SIGNER_EKU_OID with their allocated dedicated signer-purpose OID. +openssl x509 -req -in "$OUTPUT_DIR/issuer.csr" -CA "$OUTPUT_DIR/intermediate_ca.crt" -CAkey "$OUTPUT_DIR/intermediate_ca.key" -CAcreateserial -sha384 -days 365 -extfile <(printf 'keyUsage=critical,digitalSignature\nextendedKeyUsage=%s\n' "$MIGTD_SIGNER_EKU_OID") -out "$OUTPUT_DIR/issuer.crt" # 4. Concat them into cert chain cat "$OUTPUT_DIR/issuer.crt" "$OUTPUT_DIR/intermediate_ca.crt" "$OUTPUT_DIR/root_ca.crt" > "$OUTPUT_DIR/migtd_issuer_chain.pem" diff --git a/sh_script/setup_build_env.sh b/sh_script/setup_build_env.sh new file mode 100755 index 000000000..a454d7a4a --- /dev/null +++ b/sh_script/setup_build_env.sh @@ -0,0 +1,145 @@ +#!/bin/bash +# ============================================================================== +# One-shot MigTD build-environment setup for a fresh Debian/Ubuntu host. +# +# Installs everything needed to build MigTD IGVM images (including the Azure TiP +# package built by sh_script/Azure/tip/build_tip_package.sh): +# +# * System build toolchain + libraries via a SINGLE `sudo apt-get install` +# (C/C++ compilers, LLVM/clang, nasm, autotools, OCaml for the vendored +# linux-sgx DCAP attestation lib, TPM2 TSS headers, jq, unzip, ...). +# * Rust (rustup) pinned to the repo's rust-toolchain channel, plus the +# `rust-src`/`llvm-tools` components and the `x86_64-unknown-none` +# bare-metal target the no_std MigTD/td-shim build needs. +# +# The apt step is the only part that needs root; the Rust step never uses sudo. +# +# Usage: +# ./sh_script/setup_build_env.sh # apt install + Rust setup +# ./sh_script/setup_build_env.sh --apt-only # only the sudo apt install +# ./sh_script/setup_build_env.sh --rust-only # only rustup/toolchain/target +# ./sh_script/setup_build_env.sh --print-apt # print the apt one-liner only +# ./sh_script/setup_build_env.sh -h | --help +# +# After running this once, a typical build is just: +# source "$HOME/.cargo/env" +# export CC=clang AR=llvm-ar +# ./sh_script/Azure/tip/build_tip_package.sh --os-root ... --hcstest-dir ... +# (On GCC >= 14, src/attestation/build.rs auto-demotes the legacy linux-sgx DCAP +# errors, so no manual CFLAGS override is needed.) +# ============================================================================== +set -euo pipefail + +PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" + +# ------------------------------------------------------------------------------ +# apt packages required to build MigTD + the vendored linux-sgx DCAP attestation +# library (deps/td-shim-AzCVMEmu/azcvm-extract-report and src/attestation). Keep +# this list flat so it installs in one `sudo apt-get install` invocation. +# ------------------------------------------------------------------------------ +APT_PACKAGES=( + # fetchers / VCS used by rustup, submodules, and the sgxssl download step + curl wget git ca-certificates + # C/C++ toolchain + linkers + build-essential clang llvm lld + # assembler for td-shim reset vector / ring + nasm + # generic build drivers + make pkg-config + # JSON tooling used by build_azure_mock_test.sh policy generation + jq + # unzip for the linux-sgx sgxssl prepare step + unzip + # autotools + texinfo for the linux-sgx cpprt/libunwind build + autoconf automake libtool-bin texinfo m4 + # OCaml for the linux-sgx edger8r tool + ocaml ocamlbuild + # TPM2 TSS dev headers for tss-esapi-sys (azcvm-extract-report) + libtss2-dev +) + +RUST_COMPONENTS=(rust-src llvm-tools rustfmt clippy) +RUST_TARGET="x86_64-unknown-none" + +apt_oneliner() { + printf 'sudo apt-get update && sudo apt-get install -y %s\n' "${APT_PACKAGES[*]}" +} + +install_apt() { + if ! command -v apt-get >/dev/null 2>&1; then + echo "apt-get not found: this script targets Debian/Ubuntu hosts." >&2 + echo "Install these packages with your package manager instead:" >&2 + printf ' %s\n' "${APT_PACKAGES[*]}" >&2 + return 1 + fi + echo "=== Installing system build dependencies (sudo) ===" + sudo apt-get update + sudo apt-get install -y "${APT_PACKAGES[@]}" + echo "=== System dependencies installed ===" +} + +resolve_rust_channel() { + # Prefer the channel pinned by the repo's rust-toolchain[.toml]. + local f + for f in "$PROJECT_ROOT/rust-toolchain.toml" "$PROJECT_ROOT/rust-toolchain"; do + if [[ -f "$f" ]]; then + local ch + ch="$(grep -E '^[[:space:]]*channel' "$f" | head -n1 | sed -E 's/.*=[[:space:]]*"?([^"]+)"?.*/\1/')" + if [[ -n "$ch" ]]; then printf '%s\n' "$ch"; return 0; fi + fi + done + printf 'stable\n' +} + +install_rust() { + local channel + channel="$(resolve_rust_channel)" + echo "=== Setting up Rust toolchain ($channel) ===" + + if [[ -f "$HOME/.cargo/env" ]]; then + # shellcheck disable=SC1091 + source "$HOME/.cargo/env" + fi + + if ! command -v rustup >/dev/null 2>&1; then + echo "Installing rustup..." + curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \ + | sh -s -- -y --default-toolchain "$channel" --profile minimal + # shellcheck disable=SC1091 + source "$HOME/.cargo/env" + fi + + rustup toolchain install "$channel" --profile minimal + rustup component add "${RUST_COMPONENTS[@]}" + rustup target add "$RUST_TARGET" + echo "=== Rust toolchain ready ===" + rustup show active-toolchain || true +} + +DO_APT=1 +DO_RUST=1 + +while [[ $# -gt 0 ]]; do + case "$1" in + --apt-only) DO_RUST=0; shift;; + --rust-only) DO_APT=0; shift;; + --print-apt) apt_oneliner; exit 0;; + -h|--help) sed -n '2,45p' "$0"; exit 0;; + *) echo "Unknown arg: $1" >&2; exit 2;; + esac +done + +[[ "$DO_APT" == 1 ]] && install_apt +[[ "$DO_RUST" == 1 ]] && install_rust + +cat <<'EOF' + +=== Done. To build, in a fresh shell run: === + source "$HOME/.cargo/env" + export CC=clang AR=llvm-ar + # Initialize submodules + apply patches (first time only): + git submodule update --init --recursive deps/td-shim deps/spdm-rs deps/linux-sgx + ./sh_script/preparation.sh + # Then, e.g., the TiP package: + ./sh_script/Azure/tip/build_tip_package.sh --os-root <OS_ROOT> --hcstest-dir <HCSTEST_DIR> --fetch-collaterals +EOF diff --git a/src/attestation/build.rs b/src/attestation/build.rs index cc1ac5b09..7081f49bb 100644 --- a/src/attestation/build.rs +++ b/src/attestation/build.rs @@ -3,8 +3,119 @@ // SPDX-License-Identifier: BSD-2-Clause-Patent use std::env; +use std::path::Path; use std::process::Command; +const PRUNE_ENV: &str = "MIGTD_PRUNE_UNUSED_LINUX_SGX"; +const SOURCE_EXPORT_ENV: &str = "MIGTD_SOURCE_EXPORT"; + +/// Detect the major version of the system `cc` when it is GCC. +/// +/// Returns `None` for clang or when detection fails. +fn system_gcc_major() -> Option<u32> { + let version = Command::new("cc").arg("--version").output().ok()?; + let banner = String::from_utf8_lossy(&version.stdout).to_lowercase(); + if banner.contains("clang") { + return None; + } + let dumped = Command::new("cc").arg("-dumpversion").output().ok()?; + String::from_utf8_lossy(&dumped.stdout) + .trim() + .split('.') + .next()? + .parse::<u32>() + .ok() +} + +/// CFLAGS to pass to the vendored linux-sgx DCAP `make`. +/// +/// GCC >= 14 promotes `-Wincompatible-pointer-types`, `-Wimplicit-function-declaration`, +/// and `-Wint-conversion` to hard errors by default, which breaks the older DCAP C code +/// (e.g. tdx_verify.c). Demote them back to warnings so the attestation lib builds on +/// modern toolchains. Any user-supplied CFLAGS are preserved and take precedence. +fn attestation_make_cflags() -> Option<String> { + let mut cflags = env::var("CFLAGS").unwrap_or_default(); + if system_gcc_major().is_some_and(|major| major >= 14) { + for flag in [ + "-Wno-error=incompatible-pointer-types", + "-Wno-error=implicit-function-declaration", + "-Wno-error=int-conversion", + ] { + if !cflags.contains(flag) { + cflags.push(' '); + cflags.push_str(flag); + } + } + } + let cflags = cflags.trim().to_string(); + (!cflags.is_empty()).then_some(cflags) +} + +fn run_preparation_script(lib_path: &Path, script: &str, args: &[&str]) { + let status = Command::new("bash") + .arg(script) + .args(args) + .current_dir(lib_path) + .status() + .unwrap_or_else(|error| panic!("failed to run {script}: {error}")); + assert!(status.success(), "{script} failed: {status}"); +} + +fn prepare_attestation_sources(lib_path: &Path, make_cflags: Option<&str>) { + if lib_path.join(".git").exists() { + let mut prep = Command::new("make"); + prep.arg("-C") + .arg(lib_path) + .arg("servtd_attest_preparation"); + if let Some(cflags) = make_cflags { + prep.env("CFLAGS", cflags); + } + let status = prep + .status() + .expect("failed to run make servtd_attest_preparation for attestation library!"); + assert!( + status.success(), + "failed to build servtd_attest_preparation: {status}" + ); + return; + } + + // Source archives and docker-copied trees have populated submodules but no + // Git metadata. Run the non-Git parts of servtd_attest_preparation directly. + run_preparation_script(lib_path, "external/sgx-emm/create_symlink.sh", &[]); + run_preparation_script( + lib_path, + "external/dcap_source/QuoteVerification/prepare_sgxssl.sh", + &["nobuild"], + ); +} + +fn env_flag(name: &str) -> bool { + match env::var(name) { + Ok(value) if value == "1" || value.eq_ignore_ascii_case("true") => true, + Ok(value) if value == "0" || value.eq_ignore_ascii_case("false") => false, + Ok(value) => panic!("{name} must be 0, 1, true, or false; got {value:?}"), + Err(env::VarError::NotPresent) => false, + Err(error) => panic!("failed to read {name}: {error}"), + } +} + +fn prune_mode(lib_path: &Path) -> Option<&'static str> { + if env_flag(SOURCE_EXPORT_ENV) { + assert!( + !lib_path.join(".git").exists(), + "{SOURCE_EXPORT_ENV}=1 is only valid for a source export without Git metadata" + ); + return Some("--source-export"); + } + + if env_flag(PRUNE_ENV) || env_flag("TF_BUILD") { + return Some("--git-checkout"); + } + + None +} + fn main() { // Skip the compilation of attestation library when the remote attestation is not enabled or // running unit test. @@ -23,31 +134,57 @@ fn main() { let _ = env::var("AR").ok().map(|_| env::remove_var("AR")); let crate_path = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR")); - let lib_path = crate_path - .join("../../deps/linux-sgx") - .display() - .to_string(); - - // make servtd_attest_preparation - let status = Command::new("make") - .args(["-C", &lib_path, "servtd_attest_preparation"]) - .status() - .expect("failed to run make servtd_attest_preparation for attestation library!"); - assert!( - status.success(), - "failed to build servtd_attest_preparation: {status}" - ); + let lib_path = crate_path.join("../../deps/linux-sgx"); + let prune_script = crate_path.join("prune-unused-linux-sgx.sh"); + let fixup_script = crate_path.join("fixup-libservtd-attest-lib.sh"); + + println!("cargo:rerun-if-env-changed={PRUNE_ENV}"); + println!("cargo:rerun-if-env-changed={SOURCE_EXPORT_ENV}"); + println!("cargo:rerun-if-env-changed=TF_BUILD"); + println!("cargo:rerun-if-changed={}", lib_path.display()); + println!("cargo:rerun-if-changed={}", prune_script.display()); + println!("cargo:rerun-if-changed={}", fixup_script.display()); + + // GCC >= 14 turns several legacy DCAP warnings into hard errors; demote them so + // the vendored linux-sgx attestation lib still builds. Preserves user CFLAGS. + let make_cflags = attestation_make_cflags(); + + prepare_attestation_sources(&lib_path, make_cflags.as_deref()); + + // Component Governance builds and ephemeral source exports remove upstream + // trees that ServTD attestation does not use. Developer builds are + // non-destructive unless pruning is explicitly requested. + if let Some(mode) = prune_mode(&lib_path) { + let status = match Command::new("bash") + .arg(&prune_script) + .arg(mode) + .arg(&lib_path) + .current_dir(&crate_path) + .status() + { + Ok(status) => status, + Err(error) => panic!("failed to run {}: {error}", prune_script.display()), + }; + assert!( + status.success(), + "failed to prune unused linux-sgx sources: {status}" + ); + } // make servtd_attest - let status = Command::new("make") - .args(["-C", &lib_path, "servtd_attest"]) + let mut build = Command::new("make"); + build.arg("-C").arg(&lib_path).arg("servtd_attest"); + if let Some(cflags) = &make_cflags { + build.env("CFLAGS", cflags); + } + let status = build .status() .expect("failed to run make servtd_attest for attestation library!"); assert!(status.success(), "failed to build servtd_attest: {status}"); let search_dir = format!( "{}/external/dcap_source/QuoteGeneration/quote_wrapper/servtd_attest/linux", - &lib_path + lib_path.display() ); println!("cargo:rustc-link-search=native={search_dir}"); @@ -56,9 +193,8 @@ fn main() { #[cfg(feature = "AzCVMEmu")] { // Run the fixup script to create the modified library for AzCVMEmu - let script_path = crate_path.join("fixup-libservtd-attest-lib.sh"); let status = Command::new("bash") - .arg(&script_path) + .arg(&fixup_script) .current_dir(&crate_path) .status() .expect("failed to run fixup-libservtd-attest-lib.sh script!"); diff --git a/src/attestation/prune-unused-linux-sgx.sh b/src/attestation/prune-unused-linux-sgx.sh new file mode 100644 index 000000000..e84d883a1 --- /dev/null +++ b/src/attestation/prune-unused-linux-sgx.sh @@ -0,0 +1,124 @@ +#!/usr/bin/env bash +set -euo pipefail + +if [[ $# -ne 2 ]]; then + echo "usage: $0 (--git-checkout|--source-export) LINUX_SGX_ROOT" >&2 + exit 2 +fi + +mode="$1" +linux_sgx_root="$(cd "$2" && pwd -P)" +servtd_makefile="$linux_sgx_root/external/dcap_source/QuoteGeneration/quote_wrapper/servtd_attest/linux/Makefile" + +if [[ ! -f "$linux_sgx_root/Makefile" || ! -f "$servtd_makefile" ]]; then + echo "error: refusing to prune unexpected directory: $linux_sgx_root" >&2 + exit 1 +fi + +case "$mode" in + --git-checkout) + if ! command -v git >/dev/null 2>&1; then + echo "error: git is required to prune a checkout safely" >&2 + exit 1 + fi + + if ! repo_root=$(git -C "$linux_sgx_root" rev-parse --show-toplevel 2>/dev/null); then + echo "error: refusing to prune a checkout without usable Git metadata: $linux_sgx_root" >&2 + exit 1 + fi + repo_root="$(cd "$repo_root" && pwd -P)" + if [[ "$repo_root" != "$linux_sgx_root" ]]; then + echo "error: refusing to prune outside the linux-sgx repository root: $repo_root" >&2 + exit 1 + fi + ;; + --source-export) + if [[ -e "$linux_sgx_root/.git" || -L "$linux_sgx_root/.git" ]]; then + echo "error: --source-export requires a tree without Git metadata" >&2 + exit 1 + fi + ;; + *) + echo "error: unsupported prune mode: $mode" >&2 + exit 2 + ;; +esac + +# These trees are absent from the traced servtd_attest build inputs. Removing +# them before compilation turns every build into a regression test for that +# dependency boundary. +unused_paths=( + "external/cbor" + "external/dcap_source/QuoteGeneration/pccs" + "external/dcap_source/QuoteVerification/QuoteVerificationService" + "external/dcap_source/external/jwt-cpp" + "external/dcap_source/external/wasm-micro-runtime" + "external/dnnl" + "external/ippcp_internal" + "external/openmp" + "external/protobuf" + "SampleCode/SampleAttestedTLS" +) + +for relative_path in "${unused_paths[@]}"; do + target="$linux_sgx_root/$relative_path" + if [[ -L "$target" ]]; then + echo "error: refusing to prune unexpected symlink: $relative_path" >&2 + exit 1 + fi + if [[ -e "$target" && ! -d "$target" ]]; then + echo "error: refusing to prune unexpected non-directory: $relative_path" >&2 + exit 1 + fi +done + +if [[ "$mode" == "--git-checkout" ]]; then + # Validate every target before deleting any of them so a failed safety + # check cannot leave a partially pruned checkout. + for relative_path in "${unused_paths[@]}"; do + target="$linux_sgx_root/$relative_path" + if [[ ! -e "$target" && ! -L "$target" ]]; then + continue + fi + + target_repo="$linux_sgx_root" + candidate="$linux_sgx_root" + IFS="/" read -r -a path_parts <<< "$relative_path" + for path_part in "${path_parts[@]}"; do + candidate="$candidate/$path_part" + if [[ -e "$candidate/.git" || -L "$candidate/.git" ]]; then + target_repo="$candidate" + fi + done + + if [[ "$target_repo" == "$target" ]]; then + status=$(git -C "$target_repo" status --porcelain=v1 \ + --untracked-files=all --ignore-submodules=none) + else + repo_path=${target#"$target_repo/"} + status=$(git -C "$target_repo" status --porcelain=v1 \ + --untracked-files=all --ignore-submodules=none -- "$repo_path") + fi + if [[ -n "$status" ]]; then + echo "error: refusing to prune $relative_path because it contains local changes:" >&2 + echo "$status" >&2 + exit 1 + fi + done +fi + +for relative_path in "${unused_paths[@]}"; do + target="$linux_sgx_root/$relative_path" + if [[ -e "$target" || -L "$target" ]]; then + rm -rf -- "$target" + echo "Removed unused linux-sgx source: $relative_path" + fi +done + +for relative_path in "${unused_paths[@]}"; do + target="$linux_sgx_root/$relative_path" + if [[ -e "$target" || -L "$target" ]]; then + echo "error: unused linux-sgx source still exists: $relative_path" >&2 + exit 1 + fi +done diff --git a/src/attestation/test-prune-unused-linux-sgx.sh b/src/attestation/test-prune-unused-linux-sgx.sh new file mode 100755 index 000000000..749d31c67 --- /dev/null +++ b/src/attestation/test-prune-unused-linux-sgx.sh @@ -0,0 +1,141 @@ +#!/usr/bin/env bash +set -euo pipefail + +script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)" +repo_root="$(cd "$script_dir/../.." && pwd -P)" +prune_script="$script_dir/prune-unused-linux-sgx.sh" +test_root="$repo_root/target/prune-unused-linux-sgx-tests" + +unused_paths=( + "external/cbor" + "external/dcap_source/QuoteGeneration/pccs" + "external/dcap_source/QuoteVerification/QuoteVerificationService" + "external/dcap_source/external/jwt-cpp" + "external/dcap_source/external/wasm-micro-runtime" + "external/dnnl" + "external/ippcp_internal" + "external/openmp" + "external/protobuf" + "SampleCode/SampleAttestedTLS" +) + +cleanup() { + rm -rf -- "$test_root" +} +trap cleanup EXIT + +create_fixture() { + local fixture="$1" + rm -rf -- "$fixture" + mkdir -p "$fixture/external/dcap_source/QuoteGeneration/quote_wrapper/servtd_attest/linux" + : > "$fixture/Makefile" + : > "$fixture/external/dcap_source/QuoteGeneration/quote_wrapper/servtd_attest/linux/Makefile" + for relative_path in "${unused_paths[@]}"; do + mkdir -p "$fixture/$relative_path" + echo tracked > "$fixture/$relative_path/input.txt" + done +} + +create_git_fixture() { + local fixture="$1" + create_fixture "$fixture" + git -C "$fixture" init -q + git -C "$fixture" config user.name "MigTD pruning test" + git -C "$fixture" config user.email "migtd-pruning-test@example.invalid" + git -C "$fixture" add . + git -C "$fixture" commit -qm "test fixture" +} + +assert_targets_present() { + local fixture="$1" + for relative_path in "${unused_paths[@]}"; do + [[ -e "$fixture/$relative_path" ]] + done +} + +assert_targets_removed() { + local fixture="$1" + for relative_path in "${unused_paths[@]}"; do + [[ ! -e "$fixture/$relative_path" && ! -L "$fixture/$relative_path" ]] + done +} + +run_prune() { + bash "$prune_script" "$@" +} + +mkdir -p "$test_root" + +dirty_fixture="$test_root/dirty-checkout" +create_git_fixture "$dirty_fixture" +echo dirty >> "$dirty_fixture/external/cbor/input.txt" +if run_prune --git-checkout "$dirty_fixture" >"$test_root/dirty.log" 2>&1; then + echo "error: pruning accepted a dirty checkout" >&2 + exit 1 +fi +assert_targets_present "$dirty_fixture" +grep -q "contains local changes" "$test_root/dirty.log" || { + cat "$test_root/dirty.log" >&2 + exit 1 +} + +untracked_fixture="$test_root/untracked-checkout" +create_git_fixture "$untracked_fixture" +echo untracked > "$untracked_fixture/external/cbor/untracked.txt" +if run_prune --git-checkout "$untracked_fixture" >"$test_root/untracked.log" 2>&1; then + echo "error: pruning accepted an untracked file" >&2 + exit 1 +fi +assert_targets_present "$untracked_fixture" +grep -q "contains local changes" "$test_root/untracked.log" || { + cat "$test_root/untracked.log" >&2 + exit 1 +} + +nested_fixture="$test_root/nested-untracked-checkout" +create_fixture "$nested_fixture" +nested_target="$nested_fixture/external/dcap_source/QuoteVerification/QuoteVerificationService" +git -C "$nested_target" init -q +git -C "$nested_target" config user.name "MigTD pruning test" +git -C "$nested_target" config user.email "migtd-pruning-test@example.invalid" +git -C "$nested_target" add . +git -C "$nested_target" commit -qm "nested test fixture" +git -C "$nested_fixture" init -q +git -C "$nested_fixture" config user.name "MigTD pruning test" +git -C "$nested_fixture" config user.email "migtd-pruning-test@example.invalid" +git -C "$nested_fixture" add . 2>/dev/null +git -C "$nested_fixture" commit -qm "test fixture" +echo untracked > "$nested_target/untracked.txt" +if run_prune --git-checkout "$nested_fixture" >"$test_root/nested.log" 2>&1; then + echo "error: pruning accepted an untracked file in a nested repository" >&2 + exit 1 +fi +assert_targets_present "$nested_fixture" +grep -q "contains local changes" "$test_root/nested.log" || { + cat "$test_root/nested.log" >&2 + exit 1 +} + +clean_fixture="$test_root/clean-checkout" +create_git_fixture "$clean_fixture" +run_prune --git-checkout "$clean_fixture" +assert_targets_removed "$clean_fixture" + +export_fixture="$test_root/source-export" +create_fixture "$export_fixture" +run_prune --source-export "$export_fixture" +assert_targets_removed "$export_fixture" + +git_export_fixture="$test_root/git-source-export" +create_git_fixture "$git_export_fixture" +if run_prune --source-export "$git_export_fixture" >"$test_root/git-export.log" 2>&1; then + echo "error: source-export mode accepted a Git checkout" >&2 + exit 1 +fi +assert_targets_present "$git_export_fixture" +grep -q "requires a tree without Git metadata" "$test_root/git-export.log" || { + cat "$test_root/git-export.log" >&2 + exit 1 +} + +echo "linux-sgx pruning tests passed" diff --git a/src/crypto/src/crl.rs b/src/crypto/src/crl.rs index 612817f37..2decbb527 100644 --- a/src/crypto/src/crl.rs +++ b/src/crypto/src/crl.rs @@ -2,19 +2,24 @@ // // SPDX-License-Identifier: BSD-2-Clause-Patent -use crate::x509::{Extension, Time}; +use crate::x509::{AlgorithmIdentifier, Extension, Time}; use crate::Error; use alloc::vec::Vec; -use der::asn1::{AnyRef, BitStringRef, ObjectIdentifier}; +use der::asn1::{AnyRef, BitStringRef, ObjectIdentifier, UintRef}; use der::{Choice, Decode, Encode, ErrorKind, Header, Sequence, Tag, TagMode, TagNumber, Tagged}; use pki_types::{pem::PemObject, CertificateRevocationListDer}; const CRL_NUMBER_OID: ObjectIdentifier = ObjectIdentifier::new_unwrap("2.5.29.20"); +/// ECDSA-with-SHA384 signature algorithm OID (1.2.840.10045.4.3.3). The only +/// CRL signature algorithm supported in-guest, matching the rest of the crypto +/// crate. +const ECDSA_WITH_SHA384_OID: ObjectIdentifier = ObjectIdentifier::new_unwrap("1.2.840.10045.4.3.3"); + #[derive(Sequence)] pub struct Crl<'a> { tbs_cert_list: TbsCertList<'a>, - signature_algorithm: AnyRef<'a>, + signature_algorithm: AlgorithmIdentifier<'a>, signature_value: BitStringRef<'a>, } @@ -31,7 +36,7 @@ struct TbsCertList<'a> { #[derive(Sequence)] struct RevokedCertificate<'a> { - user_certificate: AnyRef<'a>, + user_certificate: UintRef<'a>, revocation_date: AnyRef<'a>, crl_entry_extensions: Option<AnyRef<'a>>, } @@ -120,6 +125,79 @@ pub fn get_crl_number(crl: &[u8]) -> Result<u32, Error> { Err(Error::CrlNumberNotFound) } +/// Parse a PEM CRL into its DER bytes. +fn crl_pem_to_der(crl: &[u8]) -> Result<Vec<u8>, Error> { + CertificateRevocationListDer::from_pem_slice(crl) + .map(|der| der.as_ref().to_vec()) + .map_err(|_| Error::DecodePemCert) +} + +/// Returns the DER encoding of the CRL's `issuer` Name. +/// +/// The caller matches this against a candidate CA certificate's `subject` DER +/// to find which certificate in a signer chain issued (and therefore should +/// have signed) this CRL. +pub fn get_crl_issuer_der(crl: &[u8]) -> Result<Vec<u8>, Error> { + let der = crl_pem_to_der(crl)?; + let crl = Crl::from_der(&der).map_err(|_| Error::ParseCertificate)?; + crl.tbs_cert_list + .issuer + .to_der() + .map_err(|_| Error::ParseCertificate) +} + +/// Verify the CRL's ECDSA-P384/SHA-384 signature using the issuing CA's raw +/// public-key bytes (`SubjectPublicKey`, e.g. from +/// `extract_public_key_from_cert`). +/// +/// Fails (`UnsupportedAlgorithm`) if the CRL is not signed with +/// ECDSA-with-SHA384, and (`EcdsaVerify`) if the signature does not verify. +/// This authenticates the CRL before any of its `revokedCertificates` entries +/// are trusted. +pub fn verify_crl_signature(crl: &[u8], issuer_public_key: &[u8]) -> Result<(), Error> { + let der = crl_pem_to_der(crl)?; + let crl = Crl::from_der(&der).map_err(|_| Error::ParseCertificate)?; + + if crl.signature_algorithm.algorithm != ECDSA_WITH_SHA384_OID { + return Err(Error::UnsupportedAlgorithm); + } + + let tbs = crl + .tbs_cert_list + .to_der() + .map_err(|_| Error::ParseCertificate)?; + let signature = crl + .signature_value + .as_bytes() + .ok_or(Error::ParseCertificate)?; + + crate::ecdsa::ecdsa_verify_with_algorithm( + issuer_public_key, + &tbs, + signature, + &crate::ecdsa::ECDSA_P384_SHA384_ASN1, + ) + .map_err(|_| Error::EcdsaVerify) +} + +/// Returns `true` if `serial` (big-endian magnitude bytes, as returned by +/// `der`'s `UintRef::as_bytes` / the crypto crate's certificate +/// `serial_number.as_bytes()`) is listed in the CRL's `revokedCertificates`. +/// +/// This performs **no** signature check — callers MUST authenticate the CRL +/// with [`verify_crl_signature`] first (see `verify_signer_chain_not_revoked`). +pub fn is_serial_revoked(crl: &[u8], serial: &[u8]) -> Result<bool, Error> { + let der = crl_pem_to_der(crl)?; + let crl = Crl::from_der(&der).map_err(|_| Error::ParseCertificate)?; + + Ok(crl + .tbs_cert_list + .revoked_certificates + .iter() + .flatten() + .any(|entry| entry.user_certificate.as_bytes() == serial)) +} + #[cfg(test)] mod test { use super::*; @@ -149,4 +227,35 @@ IrrRoE+AsML37e56hg== assert_eq!(get_crl_number(CRL1).unwrap(), 1); assert_eq!(get_crl_number(CRL2).unwrap(), 1); } + + // Fixtures generated by sh_script (P-384): a root CA that revokes a leaf + // signer. See src/crypto/test/crl/. + const CRL_EMPTY: &[u8] = include_bytes!("../test/crl/crl_empty.pem"); + const CRL_REVOKED: &[u8] = include_bytes!("../test/crl/crl_revoked.pem"); + // Big-endian serial magnitude of the revoked leaf (first byte 0x30 has its + // high bit clear, so there is no DER sign-padding zero to strip). + const LEAF_SERIAL: &[u8] = &[ + 0x30, 0x2A, 0x09, 0xF6, 0x12, 0x40, 0x99, 0x78, 0xFF, 0xE6, 0x63, 0xAD, 0x71, 0xE4, 0x06, + 0xFF, 0x35, 0xE2, 0xC5, 0x3A, + ]; + + #[test] + fn get_crl_number_parses_generated_crls() { + // openssl `ca -gencrl` seeded crlnumber at 0x1000; revocation bumps it. + assert_eq!(get_crl_number(CRL_EMPTY).unwrap(), 0x1000); + assert_eq!(get_crl_number(CRL_REVOKED).unwrap(), 0x1001); + } + + #[test] + fn is_serial_revoked_detects_revoked_leaf() { + assert!(is_serial_revoked(CRL_REVOKED, LEAF_SERIAL).unwrap()); + } + + #[test] + fn is_serial_revoked_false_for_unrevoked_or_empty() { + // A serial not on the list. + assert!(!is_serial_revoked(CRL_REVOKED, &[0x01, 0x02, 0x03]).unwrap()); + // The same leaf against a CRL that revokes nothing. + assert!(!is_serial_revoked(CRL_EMPTY, LEAF_SERIAL).unwrap()); + } } diff --git a/src/crypto/src/lib.rs b/src/crypto/src/lib.rs index 32ebaad4b..a204a0dbe 100644 --- a/src/crypto/src/lib.rs +++ b/src/crypto/src/lib.rs @@ -119,6 +119,112 @@ pub fn get_policy_signer_key_hash(cert_chain_pem: &[u8]) -> Result<[u8; SHA384_D Ok(hash) } +/// Split a PEM certificate chain into (leaf_der, root_der). +/// +/// Convention (matches other helpers in this crate): the PEM chain is leaf-first, +/// i.e. `chain[0]` is the leaf and `chain.last()` is the trust anchor (root). +/// A single-cert chain returns the same bytes for leaf and root. +pub fn split_chain_pem_to_leaf_and_root_der(cert_chain_pem: &[u8]) -> Result<(Vec<u8>, Vec<u8>)> { + let chain = extract_cert_chain_from_pem(cert_chain_pem)?; + let leaf = chain[0].as_ref().to_vec(); + let root = chain.last().unwrap().as_ref().to_vec(); + Ok((leaf, root)) +} + +/// X.509 Extended Key Usage extension OID (RFC 5280 §4.2.1.12). +const EXTENDED_KEY_USAGE_OID: x509::ObjectIdentifier = + x509::ObjectIdentifier::new_unwrap("2.5.29.37"); + +/// `anyExtendedKeyUsage` is not a dedicated signer-purpose identifier and +/// therefore cannot be used in the RTMR1 signer fingerprint. +const ANY_EXTENDED_KEY_USAGE_OID: x509::ObjectIdentifier = + x509::ObjectIdentifier::new_unwrap("2.5.29.37.0"); + +/// Extract the DER-encoded, dedicated signer-purpose EKU OID from a leaf cert. +/// +/// The leaf must contain exactly one EKU extension asserting exactly one +/// purpose OID that is not `anyExtendedKeyUsage`. This is used on the legacy +/// single-EKU enrollment/exchange paths where a specific OID has to be selected +/// deterministically (there is no target anchor to match against). Multi-EKU +/// signer leaves are handled anchor-first via [`extract_leaf_eku_oids_der`]. +fn extract_single_leaf_eku_oid_der(cert: &x509::Certificate<'_>) -> Result<Vec<u8>> { + let extensions = cert + .tbs_certificate + .extensions + .as_ref() + .ok_or(Error::ParseCertificate)?; + let mut signer_eku = None; + + for ext in extensions.get() { + if ext.extn_id != EXTENDED_KEY_USAGE_OID { + continue; + } + if signer_eku.is_some() { + return Err(Error::ParseCertificate); + } + + let value = ext.extn_value.as_ref().ok_or(Error::ParseCertificate)?; + let purposes = Vec::<x509::ObjectIdentifier>::from_der(value.as_bytes()) + .map_err(|_| Error::ParseCertificate)?; + if purposes.len() != 1 || purposes[0] == ANY_EXTENDED_KEY_USAGE_OID { + return Err(Error::ParseCertificate); + } + signer_eku = Some(purposes[0].to_der().map_err(|_| Error::ParseCertificate)?); + } + + signer_eku.ok_or(Error::ParseCertificate) +} + +/// Extract **all** DER-encoded EKU purpose OIDs asserted by a leaf cert. +/// +/// The leaf must carry exactly one ExtendedKeyUsage extension; every purpose it +/// asserts is returned (leaf-order), each as its own DER-encoded OID. This is +/// the anchor-first path: the caller does not need to know which purpose is the +/// MigTD signer OID — it recomputes the signer anchor for each returned OID and +/// keeps the one that reproduces the enrolled/measured anchor. A signer cert may +/// therefore carry the MigTD purpose alongside unrelated purposes (e.g. a +/// code-signing EKU) without the firmware hard-coding any specific OID. +pub fn extract_leaf_eku_oids_der(cert: &x509::Certificate<'_>) -> Result<Vec<Vec<u8>>> { + let extensions = cert + .tbs_certificate + .extensions + .as_ref() + .ok_or(Error::ParseCertificate)?; + let mut oids: Option<Vec<Vec<u8>>> = None; + + for ext in extensions.get() { + if ext.extn_id != EXTENDED_KEY_USAGE_OID { + continue; + } + if oids.is_some() { + // More than one EKU extension is malformed (RFC 5280 §4.2.1.12). + return Err(Error::ParseCertificate); + } + + let value = ext.extn_value.as_ref().ok_or(Error::ParseCertificate)?; + let purposes = Vec::<x509::ObjectIdentifier>::from_der(value.as_bytes()) + .map_err(|_| Error::ParseCertificate)?; + if purposes.is_empty() { + return Err(Error::ParseCertificate); + } + let mut ders = Vec::with_capacity(purposes.len()); + for oid in purposes { + ders.push(oid.to_der().map_err(|_| Error::ParseCertificate)?); + } + oids = Some(ders); + } + + oids.ok_or(Error::ParseCertificate) +} + +/// Return the DER-encoded signer-purpose EKU OID from a PEM chain's leaf. +pub fn extract_leaf_eku_oid_der_from_chain_pem(cert_chain_pem: &[u8]) -> Result<Vec<u8>> { + let chain = extract_cert_chain_from_pem(cert_chain_pem)?; + let leaf_der = chain[0].as_ref(); + let cert = x509::Certificate::from_der(leaf_der).map_err(|_| Error::ParseCertificate)?; + extract_single_leaf_eku_oid_der(&cert) +} + /// Verifies a certificate chain and then verifies a message signature pub fn verify_cert_chain_and_signature( cert_chain_pem: &[u8], @@ -136,6 +242,141 @@ pub fn verify_cert_chain_and_signature( Ok(()) } +/// Verify a leaf-first signer certificate chain (PEM or DER) against a CRL and +/// fail **closed** if any certificate in the chain has been revoked. +/// +/// Steps: +/// 1. Locate the CA certificate in `signer_chain` whose `subject` matches the +/// CRL's `issuer`, and verify the CRL's ECDSA-P384/SHA-384 signature with +/// that CA's public key. An unauthenticated CRL (issuer not in the chain, or +/// bad signature) is rejected — it can neither add nor drop revocations. +/// 2. Reject if the serial number of **any** certificate in the chain appears +/// in the CRL's `revokedCertificates`. +/// +/// This is the in-guest revocation control for the servtd signer chain, called +/// in addition to the RTMR1 signer-anchor binding (which measures the chain but +/// cannot, by design, distinguish a still-valid certificate from a revoked one +/// under the same root + signer EKU). Freshness/anti-rollback (monotonic CRL +/// number) is enforced by the policy layer, not here. +pub enum SignerChain<'a> { + /// Leaf-first PEM certificate chain. + Pem(&'a [u8]), + /// Leaf-first DER certificate chain, as carried by a COSE `x5chain`. + Der(&'a [&'a [u8]]), +} + +pub fn verify_signer_chain_not_revoked( + signer_chain: SignerChain<'_>, + crl_pem: &[u8], +) -> Result<()> { + let chain_der = match signer_chain { + SignerChain::Pem(chain_pem) => extract_cert_chain_from_pem(chain_pem)?, + SignerChain::Der(chain_der) => { + if chain_der.is_empty() { + return Err(Error::CertChainVerification( + "No certificates found in chain".into(), + )); + } + chain_der + .iter() + .map(|der| CertificateDer::from(der.to_vec())) + .collect() + } + }; + let chain = chain_der + .iter() + .map(|der| x509::Certificate::from_der(der.as_ref()).map_err(|_| Error::ParseCertificate)) + .collect::<Result<Vec<_>>>()?; + + // 1. Authenticate the CRL against its issuing CA in the chain: the CA's + // subject must equal the CRL issuer, and it MUST be a CA (RFC 5280). + // Requiring cA=TRUE stops a non-CA leaf — whose key a peer may hold — + // from issuing its own CRL. + let crl_issuer_der = crl::get_crl_issuer_der(crl_pem)?; + let mut issuer_key = None; + for cert in &chain { + let subject_der = cert + .tbs_certificate + .subject + .to_der() + .map_err(|_| Error::ParseCertificate)?; + if subject_der == crl_issuer_der && is_ca_certificate(cert)? { + issuer_key = Some(extract_public_key_from_cert(cert)?); + break; + } + } + let issuer_key = issuer_key.ok_or_else(|| { + Error::CertChainVerification("CRL issuer does not match any CA in the signer chain".into()) + })?; + crl::verify_crl_signature(crl_pem, &issuer_key)?; + + // 2. Fail closed if any certificate in the chain is revoked. + for cert in &chain { + if crl::is_serial_revoked(crl_pem, cert.tbs_certificate.serial_number.as_bytes())? { + return Err(Error::CertChainVerification( + "a certificate in the signer chain is revoked".into(), + )); + } + } + + Ok(()) +} + +/// Verify a `COSE_Sign1` ECDSA-P384/SHA-384 (ES384/ESP384) signature against +/// an embedded RFC 9360 `x5chain`. +/// +/// * `x5chain_der` — the certificate chain (DER, **end-entity first**) taken +/// from the COSE protected header. +/// * `tbs` — the COSE `Sig_structure1` to-be-signed bytes. +/// * `signature` — the raw `r || s` ECDSA-P384 value. COSE uses the +/// fixed-width encoding (96 bytes), **not** ASN.1 DER. +/// +/// Steps performed: +/// 1. Verify the chain's internal integrity (each cert signed by the next). +/// 2. Verify the COSE signature with the leaf certificate's public key. +/// +/// Trust is **not** established here: this only proves the chain is internally +/// consistent and the signature is valid. The caller must bind the returned +/// `(root_der, leaf_eku_oid_der)` to a measured trust anchor (see +/// `policy::compute_signer_anchor`, which folds them into the RTMR1 signer +/// anchor) before trusting the payload. +pub fn verify_cose_sign1_es384_x5chain( + x5chain_der: &[&[u8]], + tbs: &[u8], + signature: &[u8], +) -> Result<(Vec<u8>, Vec<Vec<u8>>)> { + if x5chain_der.is_empty() { + return Err(Error::CertChainVerification("empty x5chain".into())); + } + + // 1. Chain integrity (leaf -> ... -> root). + let chain: Vec<CertificateDer> = x5chain_der + .iter() + .map(|der| CertificateDer::from(der.to_vec())) + .collect(); + verify_certificate_chain(&chain)?; + + // 2. COSE signature over `tbs` by the leaf key (raw r||s, fixed-width). + let leaf = x509::Certificate::from_der(x5chain_der[0]).map_err(|_| Error::ParseCertificate)?; + let leaf_pubkey = extract_public_key_from_cert(&leaf)?; + ecdsa::ecdsa_verify_with_algorithm( + &leaf_pubkey, + tbs, + signature, + &ecdsa::ECDSA_P384_SHA384_FIXED, + ) + .map_err(|_| Error::SignatureVerification)?; + + // 3. Anchor material for the caller: the trust-anchor cert DER plus every + // EKU purpose OID the leaf asserts. The caller recomputes the signer + // anchor for each OID and keeps whichever reproduces the enrolled + // anchor, so a multi-purpose signer leaf needs no hard-coded OID here. + let root_der = x5chain_der[x5chain_der.len() - 1].to_vec(); + let leaf_eku_oids_der = extract_leaf_eku_oids_der(&leaf)?; + + Ok((root_der, leaf_eku_oids_der)) +} + fn extract_cert_chain_from_pem(cert_chain_pem: &[u8]) -> Result<Vec<CertificateDer>> { let mut cert_chain = Vec::new(); @@ -268,25 +509,21 @@ fn verify_signature_with_algorithm( /// Performs the following checks: /// 1. Verifies the peer chain's internal signature integrity /// 2. Root CA must match between local and peer chains -/// 3. Leaf certificate Subject Name must match -/// 4. Every issuer certificate in the peer chain MUST carry the X.509 +/// 3. Every issuer certificate in the peer chain MUST carry the X.509 /// `BasicConstraints` extension with `cA=TRUE` (RFC 5280 §4.2.1.9). This /// prevents a peer from presenting `[fake_leaf, legit_leaf, …]` where the /// legit leaf's private key was stolen and used to sign a synthetic /// sub-leaf — the legit leaf is not a CA, so it is not a valid issuer. +/// 4. The local and peer leaves must assert the same single, dedicated EKU OID. /// /// Intentionally not checked: /// - **Intermediate cert identity** — intermediate cert contents are not /// compared against the local chain's intermediates. This lets either /// side rotate its intermediate CA(s) independently, as long as the -/// shared root and the leaf Subject Name remain stable and every issuer +/// shared root and the leaf signer-purpose EKU remain stable and every issuer /// in the peer chain is itself a CA (check 4). Intermediate certs are /// still validated structurally (signature integrity in check 1 and /// CA-attribute in check 4). -/// -/// Assumption: the leaf cert's Subject Name uniquely identifies the -/// intended usage for the product/model — distinct usages must use -/// distinct Subject Names in their leaf certs. pub fn validate_peer_cert_chain(local_chain_pem: &[u8], peer_chain_pem: &[u8]) -> Result<()> { let local_chain = extract_cert_chain_from_pem(local_chain_pem)?; let peer_chain = extract_cert_chain_from_pem(peer_chain_pem)?; @@ -297,20 +534,7 @@ pub fn validate_peer_cert_chain(local_chain_pem: &[u8], peer_chain_pem: &[u8]) - // 2. Root CA must match (DER byte comparison) check_root_ca_match(&local_chain, &peer_chain)?; - // Parse leaf certs for subject name check - let local_leaf = x509::Certificate::from_der(local_chain[0].as_ref()) - .map_err(|_| Error::ParseCertificate)?; - let peer_leaf = - x509::Certificate::from_der(peer_chain[0].as_ref()).map_err(|_| Error::ParseCertificate)?; - - // 3. Leaf certificate Subject Name must match - if local_leaf.tbs_certificate.subject != peer_leaf.tbs_certificate.subject { - return Err(Error::PeerCertChainValidation( - "Leaf certificate Subject Name mismatch between local and peer chains".into(), - )); - } - - // 4. Every issuer in the peer chain must be a CA. + // 3. Every issuer in the peer chain must be a CA. for cert_der in peer_chain.iter().skip(1) { let issuer = x509::Certificate::from_der(cert_der.as_ref()).map_err(|_| Error::ParseCertificate)?; @@ -323,6 +547,29 @@ pub fn validate_peer_cert_chain(local_chain_pem: &[u8], peer_chain_pem: &[u8]) - } } + // 4. Leaf signer-purpose EKUs must match. The local measured chain defines + // the required purpose; a missing, ambiguous, any-purpose, or different + // peer EKU fails closed. + let local_leaf = x509::Certificate::from_der(local_chain[0].as_ref()) + .map_err(|_| Error::ParseCertificate)?; + let peer_leaf = + x509::Certificate::from_der(peer_chain[0].as_ref()).map_err(|_| Error::ParseCertificate)?; + let local_eku = extract_single_leaf_eku_oid_der(&local_leaf).map_err(|_| { + Error::PeerCertChainValidation( + "Local leaf certificate has no single dedicated signer EKU".into(), + ) + })?; + let peer_eku = extract_single_leaf_eku_oid_der(&peer_leaf).map_err(|_| { + Error::PeerCertChainValidation( + "Peer leaf certificate has no single dedicated signer EKU".into(), + ) + })?; + if local_eku != peer_eku { + return Err(Error::PeerCertChainValidation( + "Leaf signer EKU mismatch between local and peer chains".into(), + )); + } + Ok(()) } @@ -487,10 +734,9 @@ kXYiyuG9OEI= // Adversarial chain demonstrating the stolen-leaf-key attack: // [fake_leaf, legit_leaf, intermediate, root] // The legit leaf has no BasicConstraints; the fake leaf was signed by - // the legit leaf's key while reusing the legit leaf's Subject Name, so - // the existing subject-name + root-match + signature-integrity checks - // all pass. Only the CA-attribute check on the legit leaf (as issuer) - // rejects this chain. + // the legit leaf's key. The chain's signature integrity and root match; + // the CA-attribute check on the legit leaf (as issuer) rejects it before + // signer-purpose EKU validation. fn attacker_chain() -> &'static [u8] { b"-----BEGIN CERTIFICATE----- MIICVzCCAd2gAwIBAgIUHTraNuO2R92W3rj+VUu757uTU/0wCgYIKoZIzj0EAwMw @@ -570,13 +816,13 @@ m07Y31+o+LpsZuEnlIETx/zemHA= #[test] fn test_validate_peer_cert_chain_same_chain() { - let chain = test_chain(); + let chain = include_bytes!("../test/eku/signer_a.pem"); assert!(validate_peer_cert_chain(chain, chain).is_ok()); } #[test] fn test_validate_peer_cert_chain_root_ca_mismatch() { - let chain = test_chain(); + let chain = include_bytes!("../test/eku/signer_a.pem"); let diff = different_root_chain(); let result = validate_peer_cert_chain(chain, diff); assert!(result.is_err()); @@ -589,19 +835,101 @@ m07Y31+o+LpsZuEnlIETx/zemHA= } #[test] - fn test_validate_peer_cert_chain_subject_name_mismatch() { - let chain = test_chain(); - let root = root_ca_only(); - let result = validate_peer_cert_chain(chain, root); + fn test_validate_peer_cert_chain_accepts_subject_change_with_same_eku() { + let local = include_bytes!("../test/eku/signer_a.pem"); + let peer = include_bytes!("../test/eku/signer_b.pem"); + assert!(validate_peer_cert_chain(local, peer).is_ok()); + } + + #[test] + fn test_validate_peer_cert_chain_eku_mismatch() { + let local = include_bytes!("../test/eku/signer_a.pem"); + let peer = include_bytes!("../test/eku/signer_other_eku.pem"); + let result = validate_peer_cert_chain(local, peer); assert!(result.is_err()); match result { Err(Error::PeerCertChainValidation(msg)) => { - assert!(msg.contains("Subject Name mismatch")); + assert!(msg.contains("EKU mismatch")); + } + _ => panic!("Expected PeerCertChainValidation error"), + } + } + + #[test] + fn test_validate_peer_cert_chain_missing_eku() { + let local = include_bytes!("../test/eku/signer_a.pem"); + let peer = include_bytes!("../test/eku/signer_no_eku.pem"); + let result = validate_peer_cert_chain(local, peer); + assert!(result.is_err()); + match result { + Err(Error::PeerCertChainValidation(msg)) => { + assert!(msg.contains("no single dedicated signer EKU")); + } + _ => panic!("Expected PeerCertChainValidation error"), + } + } + + #[test] + fn test_validate_peer_cert_chain_rejects_ambiguous_ekus() { + let local = include_bytes!("../test/eku/signer_a.pem"); + let peer = include_bytes!("../test/eku/signer_multiple_eku.pem"); + let result = validate_peer_cert_chain(local, peer); + match result { + Err(Error::PeerCertChainValidation(msg)) => { + assert!(msg.contains("no single dedicated signer EKU")); } _ => panic!("Expected PeerCertChainValidation error"), } } + #[test] + fn test_validate_peer_cert_chain_rejects_any_eku() { + let local = include_bytes!("../test/eku/signer_a.pem"); + let peer = include_bytes!("../test/eku/signer_any_eku.pem"); + let result = validate_peer_cert_chain(local, peer); + match result { + Err(Error::PeerCertChainValidation(msg)) => { + assert!(msg.contains("no single dedicated signer EKU")); + } + _ => panic!("Expected PeerCertChainValidation error"), + } + } + + #[test] + fn test_validate_peer_cert_chain_selects_designated_eku_among_many() { + // A leaf that co-asserts the dedicated MigTD signer OID alongside a + // code-signing EKU is multi-purpose; the single-OID extractor used by + // the legacy peer path rejects it (anchor-first matching via + // `extract_leaf_eku_oids_der` handles multi-purpose leaves instead). + let local = include_bytes!("../test/eku/signer_designated_multi.pem"); + let peer = include_bytes!("../test/eku/signer_designated_only.pem"); + assert!(validate_peer_cert_chain(local, peer).is_err()); + } + + #[test] + fn test_extract_leaf_eku_oids_lists_all_purposes() { + // The list extractor returns every purpose the leaf asserts, in order, + // each DER-encoded — so an anchor-first caller can match without knowing + // which OID is the MigTD signer purpose. + let chain = + extract_cert_chain_from_pem(include_bytes!("../test/eku/signer_designated_multi.pem")) + .unwrap(); + let leaf = x509::Certificate::from_der(chain[0].as_ref()).unwrap(); + let oids = extract_leaf_eku_oids_der(&leaf).unwrap(); + // signer_designated_multi asserts { id-kp-codeSigning, 1.3.6.1.4.1.311.76.59.1.43 }. + assert_eq!(oids.len(), 2); + let migtd_signer_oid_der = x509::ObjectIdentifier::new_unwrap("1.3.6.1.4.1.311.76.59.1.43") + .to_der() + .unwrap(); + assert!(oids.iter().any(|d| *d == migtd_signer_oid_der)); + + // A leaf with no EKU extension is rejected. + let no_eku = + extract_cert_chain_from_pem(include_bytes!("../test/eku/signer_no_eku.pem")).unwrap(); + let no_eku_leaf = x509::Certificate::from_der(no_eku[0].as_ref()).unwrap(); + assert!(extract_leaf_eku_oids_der(&no_eku_leaf).is_err()); + } + #[test] fn test_is_ca_certificate_leaf_is_not_ca() { // Extract the leaf cert (first cert in test_chain). @@ -660,4 +988,71 @@ mdG27TBGsOS6KzfZ7avUDurwwFx++58HjoLq68p8jvKQBQJjco9bcwUFAjEA7otq other => panic!("Expected PeerCertChainValidation, got: {other:?}"), } } + + // ---- signer-chain revocation (CRL) ------------------------------------ + // + // Fixtures (src/crypto/test/crl/): a P-384 root CA, a leaf signer it + // issued, an empty CRL, and a CRL that revokes the leaf. See crl.rs tests + // for the parsing-level coverage; these exercise the full orchestration in + // `verify_signer_chain_not_revoked`. + + fn crl_root_pubkey() -> Vec<u8> { + let root = pem_cert_to_der(include_bytes!("../test/crl/root.pem")).unwrap(); + let cert = x509::Certificate::from_der(root.as_ref()).unwrap(); + extract_public_key_from_cert(&cert).unwrap() + } + + #[test] + fn verify_crl_signature_accepts_correct_issuer_key() { + let crl = include_bytes!("../test/crl/crl_revoked.pem"); + assert!(crl::verify_crl_signature(crl, &crl_root_pubkey()).is_ok()); + } + + #[test] + fn verify_crl_signature_rejects_wrong_issuer_key() { + // The CRL is signed by the root; verifying against the LEAF key fails. + let leaf = pem_cert_to_der(include_bytes!("../test/crl/leaf.pem")).unwrap(); + let cert = x509::Certificate::from_der(leaf.as_ref()).unwrap(); + let leaf_pubkey = extract_public_key_from_cert(&cert).unwrap(); + let crl = include_bytes!("../test/crl/crl_revoked.pem"); + assert!(crl::verify_crl_signature(crl, &leaf_pubkey).is_err()); + } + + #[test] + fn signer_chain_not_revoked_passes_for_empty_crl() { + let chain = include_bytes!("../test/crl/signer_chain.pem"); + let crl = include_bytes!("../test/crl/crl_empty.pem"); + assert!(verify_signer_chain_not_revoked(SignerChain::Pem(chain), crl).is_ok()); + } + + #[test] + fn signer_chain_not_revoked_fails_closed_for_revoked_leaf() { + let chain = include_bytes!("../test/crl/signer_chain.pem"); + let crl = include_bytes!("../test/crl/crl_revoked.pem"); + match verify_signer_chain_not_revoked(SignerChain::Pem(chain), crl) { + Err(Error::CertChainVerification(msg)) => { + assert!(msg.contains("revoked"), "unexpected message: {msg}"); + } + other => panic!("expected revoked CertChainVerification, got {other:?}"), + } + } + + #[test] + fn signer_chain_not_revoked_rejects_non_ca_crl_issuer() { + // A CRL "issued" and signed by a non-CA end-entity leaf (whose private + // key a peer may legitimately hold) must NOT be accepted as an + // authenticated CRL — only a CA issues CRLs. Even though the leaf's key + // validly signs this CRL and the leaf is present in the chain, the + // cA=TRUE requirement rejects it (fail-closed), so a peer cannot present + // a self-crafted CRL to satisfy the freshness floor or launder a + // revocation. + let chain = include_bytes!("../test/crl/nonca_leaf_chain.pem"); + let crl = include_bytes!("../test/crl/crl_leaf_issued.pem"); + match verify_signer_chain_not_revoked(SignerChain::Pem(chain), crl) { + Err(Error::CertChainVerification(msg)) => { + assert!(msg.contains("CRL issuer"), "unexpected message: {msg}"); + } + other => panic!("expected CRL-issuer CertChainVerification error, got {other:?}"), + } + } } diff --git a/src/crypto/src/rustls_impl/tls.rs b/src/crypto/src/rustls_impl/tls.rs index 1346ed9b9..b0fafb388 100644 --- a/src/crypto/src/rustls_impl/tls.rs +++ b/src/crypto/src/rustls_impl/tls.rs @@ -530,6 +530,41 @@ pub(crate) mod connection { received_app_data: ChunkVecBuffer, } + // T22: zero-progress read/write helpers for the TLS unbuffered driver. + // The TLS state machine repeatedly calls `transport.read(..)` / `transport.write(..)` + // and then `input.consume(N)` / `output.reset()` regardless of the returned + // length. Without these helpers, a VMM-mediated transport that returns + // `Ok(0)` from `read` produces an internal handshake livelock, and a + // `transport.write` that does not fully send `output.used()` silently + // drops ciphertext (because `output.reset()` clears the buffer before the + // next attempt). See + // docs/threat_model/T22-policyv2-ratls-internal-zero-progress-livelock.md. + async fn transport_read_progress<T: AsyncRead + AsyncWrite + Unpin>( + transport: &mut T, + buf: &mut [u8], + ) -> Result<usize, TlsConnectionError> { + let n = transport.read(buf).await?; + if n == 0 { + return Err(TlsConnectionError::Transport); + } + Ok(n) + } + + async fn transport_write_all<T: AsyncRead + AsyncWrite + Unpin>( + transport: &mut T, + data: &[u8], + ) -> Result<(), TlsConnectionError> { + let mut sent = 0; + while sent < data.len() { + let n = transport.write(&data[sent..]).await?; + if n == 0 { + return Err(TlsConnectionError::Transport); + } + sent += n; + } + Ok(()) + } + impl<T: AsyncRead + AsyncWrite + Unpin> TlsServerConnection<T> { pub fn new(config: Arc<ServerConfig>, transport: T) -> Result<Self, TlsConnectionError> { Ok(Self { @@ -575,7 +610,9 @@ pub(crate) mod connection { return Ok(read); } ConnectionState::WriteTraffic(..) => { - let size = self.transport.read(self.input.unused_mut()).await?; + let size = + transport_read_progress(&mut self.transport, self.input.unused_mut()) + .await?; self.input.consume(size); } _ => return Err(TlsConnectionError::UnexpectedState), @@ -616,16 +653,7 @@ pub(crate) mod connection { |out_buffer| state.encrypt(data, out_buffer), map_err, )?; - // Write all output bytes to transport (handle short writes) - let total = self.output.used().len(); - let mut written = 0; - while written < total { - let n = self.transport.write(&self.output.used()[written..]).await?; - if n == 0 { - return Err(TlsConnectionError::UnexpectedState); - } - written += n; - } + transport_write_all(&mut self.transport, self.output.used()).await?; self.output.reset(); break; } @@ -656,12 +684,16 @@ pub(crate) mod connection { )?; } ConnectionState::TransmitTlsData(state) => { - self.transport.write(self.output.used()).await?; + transport_write_all(&mut self.transport, self.output.used()).await?; self.output.reset(); state.done(); } ConnectionState::BlockedHandshake { .. } => { - let size = self.transport.read(self.input.unused_mut()).await?; + let size = transport_read_progress( + &mut self.transport, + self.input.unused_mut(), + ) + .await?; self.input.consume(size); } ConnectionState::ReadTraffic(mut state) => { @@ -710,7 +742,7 @@ pub(crate) mod connection { }, )?; - self.transport.write(self.output.used()).await?; + transport_write_all(&mut self.transport, self.output.used()).await?; self.output.reset(); Ok(()) } @@ -863,7 +895,9 @@ pub(crate) mod connection { return Ok(read); } ConnectionState::WriteTraffic(..) => { - let size = self.transport.read(self.input.unused_mut()).await?; + let size = + transport_read_progress(&mut self.transport, self.input.unused_mut()) + .await?; self.input.consume(size); } _ => return Err(TlsConnectionError::UnexpectedState), @@ -904,16 +938,7 @@ pub(crate) mod connection { |out_buffer| state.encrypt(data, out_buffer), map_err, )?; - // Write all output bytes to transport (handle short writes) - let total = self.output.used().len(); - let mut written = 0; - while written < total { - let n = self.transport.write(&self.output.used()[written..]).await?; - if n == 0 { - return Err(TlsConnectionError::UnexpectedState); - } - written += n; - } + transport_write_all(&mut self.transport, self.output.used()).await?; self.output.reset(); break; } @@ -944,12 +969,16 @@ pub(crate) mod connection { )?; } ConnectionState::TransmitTlsData(state) => { - self.transport.write(self.output.used()).await?; + transport_write_all(&mut self.transport, self.output.used()).await?; self.output.reset(); state.done(); } ConnectionState::BlockedHandshake { .. } => { - let size = self.transport.read(self.input.unused_mut()).await?; + let size = transport_read_progress( + &mut self.transport, + self.input.unused_mut(), + ) + .await?; self.input.consume(size); } ConnectionState::ReadTraffic(mut state) => { @@ -997,7 +1026,7 @@ pub(crate) mod connection { } }, )?; - self.transport.write(self.output.used()).await?; + transport_write_all(&mut self.transport, self.output.used()).await?; self.output.reset(); Ok(()) } diff --git a/src/crypto/test/crl/crl_empty.pem b/src/crypto/test/crl/crl_empty.pem new file mode 100644 index 000000000..dbd4ac398 --- /dev/null +++ b/src/crypto/test/crl/crl_empty.pem @@ -0,0 +1,8 @@ +-----BEGIN X509 CRL----- +MIH3MH8CAQEwCgYIKoZIzj0EAwMwPzELMAkGA1UEBhMCVVMxEzARBgNVBAoMCk1p +Z1REIFRlc3QxGzAZBgNVBAMMEk1pZ1REIFRlc3QgUm9vdCBDQRcNMjYwNzAzMDMw +NTI0WhcNMzYwNjMwMDMwNTI0WqAPMA0wCwYDVR0UBAQCAhAAMAoGCCqGSM49BAMD +A2gAMGUCMA93cIB2+BchBq73sEdHNu5CI8D2kR2/uU037HBAfc4ol/FDdEhIyioz +TfznOGrjTwIxAOwAxGY0LBwoAonyDVekEcnrXcOOkKXDnQXUBWNbebzTk9qHodLB +xJmujiFwSkVTJw== +-----END X509 CRL----- diff --git a/src/crypto/test/crl/crl_leaf_issued.pem b/src/crypto/test/crl/crl_leaf_issued.pem new file mode 100644 index 000000000..dfaed0d0f --- /dev/null +++ b/src/crypto/test/crl/crl_leaf_issued.pem @@ -0,0 +1,7 @@ +-----BEGIN X509 CRL----- +MIHnMG8CAQEwCgYIKoZIzj0EAwMwLzETMBEGA1UECgwKTWlnVEQgVGVzdDEYMBYG +A1UEAwwPTm9uQ0EgVGVzdCBMZWFmFw0yNjA3MDMxMjA1MDFaFw0zNjA2MzAxMjA1 +MDFaoA8wDTALBgNVHRQEBAICIAAwCgYIKoZIzj0EAwMDaAAwZQIxAOwV8tSckuVQ +8tIxQ31a5+X6RfQM1IXcKhe3IfGmIHtBumXzsIxIqH8Fs2BGeZGN3gIwL8Yugune +yKam/+mUMAGx68EqdvrAKBVSani/3bjV9yU20dXpQ+C0kJ5or6/Md5XI +-----END X509 CRL----- diff --git a/src/crypto/test/crl/crl_revoked.pem b/src/crypto/test/crl/crl_revoked.pem new file mode 100644 index 000000000..1eb26f03d --- /dev/null +++ b/src/crypto/test/crl/crl_revoked.pem @@ -0,0 +1,9 @@ +-----BEGIN X509 CRL----- +MIIBIjCBqAIBATAKBggqhkjOPQQDAzA/MQswCQYDVQQGEwJVUzETMBEGA1UECgwK +TWlnVEQgVGVzdDEbMBkGA1UEAwwSTWlnVEQgVGVzdCBSb290IENBFw0yNjA3MDMw +MzA1MjRaFw0zNjA2MzAwMzA1MjRaMCcwJQIUMCoJ9hJAmXj/5mOtceQG/zXixToX +DTI2MDcwMzAzMDUyNFqgDzANMAsGA1UdFAQEAgIQATAKBggqhkjOPQQDAwNpADBm +AjEAy8lNSWC5I2y1TSCpKQE7cBgbocCsFYHwPA2V8ivcIbz9W/RNkvMLLCTw1V9r +7d/KAjEA04jzMu1yyb0iv1vxQtw81QTzp6tQv3KLFoonYL4SvBFXDyLeVLf5HMka +J2DR2O1Y +-----END X509 CRL----- diff --git a/src/crypto/test/crl/leaf.pem b/src/crypto/test/crl/leaf.pem new file mode 100644 index 000000000..79137fafe --- /dev/null +++ b/src/crypto/test/crl/leaf.pem @@ -0,0 +1,14 @@ +-----BEGIN CERTIFICATE----- +MIICDzCCAZSgAwIBAgIUMCoJ9hJAmXj/5mOtceQG/zXixTowCgYIKoZIzj0EAwMw +PzELMAkGA1UEBhMCVVMxEzARBgNVBAoMCk1pZ1REIFRlc3QxGzAZBgNVBAMMEk1p +Z1REIFRlc3QgUm9vdCBDQTAeFw0yNjA3MDMwMzA1MjRaFw0zNjA2MzAwMzA1MjRa +MD4xCzAJBgNVBAYTAlVTMRMwEQYDVQQKDApNaWdURCBUZXN0MRowGAYDVQQDDBFN +aWdURCBUZXN0IFNpZ25lcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABKXMf8U166cG +fYhmwHL9K7vp5RsjuJ7rGCQ8CIVvKzcsatFxgMCtYcwZa7y25KcCQXdOa0S65dXS +lSJJSYNWaqo6jNDqs08k/mnbrc+UaMcz6jo/l5bqDifo4jm44wJsJqNSMFAwDgYD +VR0PAQH/BAQDAgeAMB0GA1UdDgQWBBSotjTerlLc20l+EwvVP4dYPZeVkjAfBgNV +HSMEGDAWgBT2i1LPrW01jc/oWgDvr7boE7GHRDAKBggqhkjOPQQDAwNpADBmAjEA +imKWMhxAXv2NQ5Y/Nh1uFmHhgu29hV2GaoGSd48bzRf+Qwp5knQKpJmnMzHHbgYK +AjEA5YDn4/048VrEDsp2w9Zvxu/Qr5AvX5n6Hjw0T5zukCSl77LGQJDtiAyukfDF +YIcL +-----END CERTIFICATE----- diff --git a/src/crypto/test/crl/nonca_leaf_chain.pem b/src/crypto/test/crl/nonca_leaf_chain.pem new file mode 100644 index 000000000..34d97d0df --- /dev/null +++ b/src/crypto/test/crl/nonca_leaf_chain.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIB/TCCAYOgAwIBAgIUFBfcrHybdFTTJST3QFFZG2stTO0wCgYIKoZIzj0EAwMw +LzETMBEGA1UECgwKTWlnVEQgVGVzdDEYMBYGA1UEAwwPTm9uQ0EgVGVzdCBSb290 +MB4XDTI2MDcwMzEyMDUwMVoXDTM2MDYzMDEyMDUwMVowLzETMBEGA1UECgwKTWln +VEQgVGVzdDEYMBYGA1UEAwwPTm9uQ0EgVGVzdCBMZWFmMHYwEAYHKoZIzj0CAQYF +K4EEACIDYgAEXnQOQ5NaK+2Mn67HJCsNPXUOg0Mhf5QRE3iglyiB3n4LkErCcrcq +vTtuvK3SDi0hVyfhXl5AhsPPy5dR4x/mG8FFd//D05B1yl7R86idSbQe9hP1cldV +xE9ADrKitgo5o2AwXjAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIHgDAdBgNV +HQ4EFgQUcJ/B+4w/G5w5JbGRXxqasa7zUsMwHwYDVR0jBBgwFoAU+braYn6yYSDO +M5SUXp3vw4wARaowCgYIKoZIzj0EAwMDaAAwZQIwKPKcbMJAATHEhb4dTtLQWxjE +cyYmQHNCfNYXkIwtio59uj1reT74m7yr9NlOF2mkAjEAxLorTQXk72om1rLeZNAX +GU7Cu6VMax6nUsGOdyyUSi4biNdsUNDyy1aj23I/m7sf +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICATCCAYagAwIBAgIUXu8kP9SN7w7h2/GEY47LX/JvIPMwCgYIKoZIzj0EAwMw +LzETMBEGA1UECgwKTWlnVEQgVGVzdDEYMBYGA1UEAwwPTm9uQ0EgVGVzdCBSb290 +MB4XDTI2MDcwMzEyMDUwMVoXDTM2MDYzMDEyMDUwMVowLzETMBEGA1UECgwKTWln +VEQgVGVzdDEYMBYGA1UEAwwPTm9uQ0EgVGVzdCBSb290MHYwEAYHKoZIzj0CAQYF +K4EEACIDYgAEnLyAodkvdJD+91o0Y6x0kAF1Vkp/oud/GpmtXP/Exrz+1hylPbkd +HfH/KHVCwsMOruURR9nzayRYs24hx9ao22pAtowAFKD1fFon3spxORUgUI8iZWN8 +ZEQAVYe38PK+o2MwYTAdBgNVHQ4EFgQU+braYn6yYSDOM5SUXp3vw4wARaowHwYD +VR0jBBgwFoAU+braYn6yYSDOM5SUXp3vw4wARaowDwYDVR0TAQH/BAUwAwEB/zAO +BgNVHQ8BAf8EBAMCAQYwCgYIKoZIzj0EAwMDaQAwZgIxANEfQGN832WnHUC77wIQ +1KRMirHIn9Tx/2gkHkXZQxH+1j+7CPAn76vNZOFSA0ZpQgIxAICMgJmAj/ukqu2J +zgP/oAaCfUClAojgNCpGRCErEhiNEh3kTIBLsEz1bfbGNCHTuA== +-----END CERTIFICATE----- diff --git a/src/crypto/test/crl/root.pem b/src/crypto/test/crl/root.pem new file mode 100644 index 000000000..62539f51d --- /dev/null +++ b/src/crypto/test/crl/root.pem @@ -0,0 +1,14 @@ +-----BEGIN CERTIFICATE----- +MIICIDCCAaagAwIBAgIUczl/LLRr3gi5kOp2r1KXbkiszfQwCgYIKoZIzj0EAwMw +PzELMAkGA1UEBhMCVVMxEzARBgNVBAoMCk1pZ1REIFRlc3QxGzAZBgNVBAMMEk1p +Z1REIFRlc3QgUm9vdCBDQTAeFw0yNjA3MDMwMzA1MjRaFw0zNjA2MzAwMzA1MjRa +MD8xCzAJBgNVBAYTAlVTMRMwEQYDVQQKDApNaWdURCBUZXN0MRswGQYDVQQDDBJN +aWdURCBUZXN0IFJvb3QgQ0EwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAARsW/g2IGfQ +LTtFd5dxWCFmL5YdeNZjg7wSltqJNzVA2/JcuGJtffMpxOJ+sqZYHc4HtoMhc1Yp +yw/Sccy0agqvpScD9lfTCjFo+Fr9FrgL3Hgx3PcQK82G78pVy7i29YujYzBhMB0G +A1UdDgQWBBT2i1LPrW01jc/oWgDvr7boE7GHRDAfBgNVHSMEGDAWgBT2i1LPrW01 +jc/oWgDvr7boE7GHRDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAK +BggqhkjOPQQDAwNoADBlAjEAmcgb89AWs7ePYk8Z3vV4DoNW4s0ldrMQ/cxtrEAp +IpvYE5aTK7b//Rf16WIa9J0BAjATSxhi77XoyRqgiBJhFCdQAuNLTxod0/AOi2wM +BkQ3O4iMlMCJ5af9YwWrOqF6t6I= +-----END CERTIFICATE----- diff --git a/src/crypto/test/crl/signer_chain.pem b/src/crypto/test/crl/signer_chain.pem new file mode 100644 index 000000000..012754990 --- /dev/null +++ b/src/crypto/test/crl/signer_chain.pem @@ -0,0 +1,28 @@ +-----BEGIN CERTIFICATE----- +MIICDzCCAZSgAwIBAgIUMCoJ9hJAmXj/5mOtceQG/zXixTowCgYIKoZIzj0EAwMw +PzELMAkGA1UEBhMCVVMxEzARBgNVBAoMCk1pZ1REIFRlc3QxGzAZBgNVBAMMEk1p +Z1REIFRlc3QgUm9vdCBDQTAeFw0yNjA3MDMwMzA1MjRaFw0zNjA2MzAwMzA1MjRa +MD4xCzAJBgNVBAYTAlVTMRMwEQYDVQQKDApNaWdURCBUZXN0MRowGAYDVQQDDBFN +aWdURCBUZXN0IFNpZ25lcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABKXMf8U166cG +fYhmwHL9K7vp5RsjuJ7rGCQ8CIVvKzcsatFxgMCtYcwZa7y25KcCQXdOa0S65dXS +lSJJSYNWaqo6jNDqs08k/mnbrc+UaMcz6jo/l5bqDifo4jm44wJsJqNSMFAwDgYD +VR0PAQH/BAQDAgeAMB0GA1UdDgQWBBSotjTerlLc20l+EwvVP4dYPZeVkjAfBgNV +HSMEGDAWgBT2i1LPrW01jc/oWgDvr7boE7GHRDAKBggqhkjOPQQDAwNpADBmAjEA +imKWMhxAXv2NQ5Y/Nh1uFmHhgu29hV2GaoGSd48bzRf+Qwp5knQKpJmnMzHHbgYK +AjEA5YDn4/048VrEDsp2w9Zvxu/Qr5AvX5n6Hjw0T5zukCSl77LGQJDtiAyukfDF +YIcL +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICIDCCAaagAwIBAgIUczl/LLRr3gi5kOp2r1KXbkiszfQwCgYIKoZIzj0EAwMw +PzELMAkGA1UEBhMCVVMxEzARBgNVBAoMCk1pZ1REIFRlc3QxGzAZBgNVBAMMEk1p +Z1REIFRlc3QgUm9vdCBDQTAeFw0yNjA3MDMwMzA1MjRaFw0zNjA2MzAwMzA1MjRa +MD8xCzAJBgNVBAYTAlVTMRMwEQYDVQQKDApNaWdURCBUZXN0MRswGQYDVQQDDBJN +aWdURCBUZXN0IFJvb3QgQ0EwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAARsW/g2IGfQ +LTtFd5dxWCFmL5YdeNZjg7wSltqJNzVA2/JcuGJtffMpxOJ+sqZYHc4HtoMhc1Yp +yw/Sccy0agqvpScD9lfTCjFo+Fr9FrgL3Hgx3PcQK82G78pVy7i29YujYzBhMB0G +A1UdDgQWBBT2i1LPrW01jc/oWgDvr7boE7GHRDAfBgNVHSMEGDAWgBT2i1LPrW01 +jc/oWgDvr7boE7GHRDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAK +BggqhkjOPQQDAwNoADBlAjEAmcgb89AWs7ePYk8Z3vV4DoNW4s0ldrMQ/cxtrEAp +IpvYE5aTK7b//Rf16WIa9J0BAjATSxhi77XoyRqgiBJhFCdQAuNLTxod0/AOi2wM +BkQ3O4iMlMCJ5af9YwWrOqF6t6I= +-----END CERTIFICATE----- diff --git a/src/crypto/test/eku/generate_designated.sh b/src/crypto/test/eku/generate_designated.sh new file mode 100755 index 000000000..fa5d0d8b5 --- /dev/null +++ b/src/crypto/test/eku/generate_designated.sh @@ -0,0 +1,63 @@ +#!/usr/bin/env bash +# Generate the "designated MigTD signer purpose" EKU fixtures used to cover +# `crypto::extract_single_leaf_eku_oid_der` selecting the dedicated OID +# 1.3.6.1.4.1.311.76.59.1.43 +# from a leaf that may co-assert other purposes. +# +# Both leaves are ECDSA P-384 / SHA-384 signed by a single self-signed root +# (CA:TRUE), matching the algorithms accepted by the crypto crate. Each fixture +# is a leaf-first PEM chain (leaf + root). These are additive to the pre-existing +# signer_*.pem fixtures and share their own root. +set -euo pipefail +cd "$(dirname "$0")" + +SIGNER_OID="1.3.6.1.4.1.311.76.59.1.43" # dedicated MigTD policy-signer purpose +CODESIGN_OID="1.3.6.1.5.5.7.3.3" # id-kp-codeSigning (co-asserted purpose) +DAYS=36500 + +TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT + +openssl ecparam -name secp384r1 -genkey -noout -out "$TMP/root.key" +cat > "$TMP/root.cnf" <<'EOF' +[req] +distinguished_name = dn +x509_extensions = v3 +prompt = no +[dn] +O = MigTD Test +CN = MigTD Designated EKU Root +[v3] +basicConstraints = critical, CA:TRUE +keyUsage = critical, keyCertSign, cRLSign +EOF +openssl req -x509 -new -key "$TMP/root.key" -sha384 -days "$DAYS" \ + -config "$TMP/root.cnf" -out "$TMP/root.pem" + +gen_leaf() { + local out="$1" cn="$2" eku="$3" + openssl ecparam -name secp384r1 -genkey -noout -out "$TMP/leaf.key" + cat > "$TMP/leaf.cnf" <<EOF +[req] +distinguished_name = dn +prompt = no +[dn] +O = MigTD Test +CN = $cn +EOF + openssl req -new -key "$TMP/leaf.key" -sha384 -config "$TMP/leaf.cnf" -out "$TMP/leaf.csr" + printf 'basicConstraints = critical, CA:FALSE\nextendedKeyUsage = %s\n' "$eku" > "$TMP/leaf.ext" + openssl x509 -req -in "$TMP/leaf.csr" -CA "$TMP/root.pem" -CAkey "$TMP/root.key" \ + -CAcreateserial -sha384 -days "$DAYS" -extfile "$TMP/leaf.ext" -out "$TMP/leaf.pem" + cat "$TMP/leaf.pem" "$TMP/root.pem" > "$out" +} + +# Designated OID co-asserted with an unrelated code-signing purpose. +gen_leaf signer_designated_multi.pem "MigTD Designated Multi" "$CODESIGN_OID,$SIGNER_OID" +# Designated OID only (different subject, same root). +gen_leaf signer_designated_only.pem "MigTD Designated Only" "$SIGNER_OID" + +echo "Generated:" +for f in signer_designated_multi signer_designated_only; do + printf ' %-28s ' "$f.pem" + openssl x509 -in "$f.pem" -noout -ext extendedKeyUsage 2>/dev/null | tail -1 | sed 's/^ *//' +done diff --git a/src/crypto/test/eku/signer_a.pem b/src/crypto/test/eku/signer_a.pem new file mode 100644 index 000000000..d4259ac28 --- /dev/null +++ b/src/crypto/test/eku/signer_a.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIICCTCCAY+gAwIBAgIUGBaSh46F+ZxSt0xq75U6dkcj96gwCgYIKoZIzj0EAwMw +MzETMBEGA1UECgwKTWlnVEQgVGVzdDEcMBoGA1UEAwwTTWlnVEQgRUtVIFRlc3Qg +Um9vdDAeFw0yNjA3MjEwMjIxMjFaFw0yNzA3MjEwMjIxMjFaMC4xEzARBgNVBAoM +Ck1pZ1REIFRlc3QxFzAVBgNVBAMMDk1pZ1REIFNpZ25lciBBMHYwEAYHKoZIzj0C +AQYFK4EEACIDYgAEUYh1fwDBu61JnyyB571Yv5o4CYIvnOLE4aK6lj//u5tv6e1U +Qye7AbhxbXDaZRMrDG4IDJY1JYdBL+NkSCIQ3Ck02sZtgI+C6s/zywRUSYi7t9Ab +A/y+LTdwENTfHnpto2kwZzAOBgNVHQ8BAf8EBAMCB4AwFQYDVR0lBA4wDAYKKwYB +BAGB/VkBATAdBgNVHQ4EFgQUuMJtUQCraKkunTx22tAoqqYHUCowHwYDVR0jBBgw +FoAUFX/a9BjNsgwHmCShtLwJnlall2swCgYIKoZIzj0EAwMDaAAwZQIxAJ25v84U +/YvQb/kSbHLmIJIw34n5cIWWFlCkHstxkKisUi9ybsIpDUBfDZ4XuLakfwIwM0+K +BYGFzc3ix2P3WISJvYS1on1G/F4HJkjQssnGxpfa5SS3BjCUDCZhcs8wy+AP +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICCTCCAY6gAwIBAgIUOXk0571gxjFa4z9KRWAn5Nd9UYIwCgYIKoZIzj0EAwMw +MzETMBEGA1UECgwKTWlnVEQgVGVzdDEcMBoGA1UEAwwTTWlnVEQgRUtVIFRlc3Qg +Um9vdDAeFw0yNjA3MjEwMjIxMjFaFw0zNjA3MTgwMjIxMjFaMDMxEzARBgNVBAoM +Ck1pZ1REIFRlc3QxHDAaBgNVBAMME01pZ1REIEVLVSBUZXN0IFJvb3QwdjAQBgcq +hkjOPQIBBgUrgQQAIgNiAAQfOdFcbraNYlYjDzu73zwekqQ7s46LeoZKIGPoBEVu +y4r8KDrq8cfs5wxX/T7HNdqXl5g+zn3xWWOxcTuauerWan/XpwwzNesebPu1pisV +ZmaSOoxvG4Lx+kDw5WUacO+jYzBhMB0GA1UdDgQWBBQVf9r0GM2yDAeYJKG0vAme +VqWXazAfBgNVHSMEGDAWgBQVf9r0GM2yDAeYJKG0vAmeVqWXazAPBgNVHRMBAf8E +BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAwNpADBmAjEApN/sTVod +QDjYkiSAZvqO8Wr2o7jMaUAW0fRefChS+KWEPaJH1MOrJKfxmj+pqBcoAjEA70be +7AjLsHZrtccNS34OjK+nD61Quogqd3x44GP0r6edhtoGeyx2tTYLOE69Wvin +-----END CERTIFICATE----- diff --git a/src/crypto/test/eku/signer_any_eku.pem b/src/crypto/test/eku/signer_any_eku.pem new file mode 100644 index 000000000..673d9aa87 --- /dev/null +++ b/src/crypto/test/eku/signer_any_eku.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIICAjCCAYigAwIBAgIUGBaSh46F+ZxSt0xq75U6dkcj960wCgYIKoZIzj0EAwMw +MzETMBEGA1UECgwKTWlnVEQgVGVzdDEcMBoGA1UEAwwTTWlnVEQgRUtVIFRlc3Qg +Um9vdDAeFw0yNjA3MjEwMjI5NDVaFw0yNzA3MjEwMjI5NDVaMC0xEzARBgNVBAoM +Ck1pZ1REIFRlc3QxFjAUBgNVBAMMDU1pZ1REIEFueSBFS1UwdjAQBgcqhkjOPQIB +BgUrgQQAIgNiAAQjL4wUP6HH1xAsKZZXjB8aMCR3RopnxpA5/odbXiM+/8qye2jS +v1NXOOhe7nQhROhpId4xAwDyIefHV0xeS5pH5bOeBS/bpWnZn1+wX6w8fg2rRdrI +jYBl9GcTr2HqoCyjYzBhMA4GA1UdDwEB/wQEAwIHgDAPBgNVHSUECDAGBgRVHSUA +MB0GA1UdDgQWBBRoz/dZxS7GSxKJPB+0gD97gWqZFjAfBgNVHSMEGDAWgBQVf9r0 +GM2yDAeYJKG0vAmeVqWXazAKBggqhkjOPQQDAwNoADBlAjEAp0rgp0oZ17w/dK1h +gDjJbpH7bC28gY5uq1NN1zOIV0OCxZZStwCPLLT+VOufXkYdAjAX27HEnT55S7yA +wNz4LkUsR6GE757TIFNAOGX/+KQ7bTZbuHp5qdhKQ6vMbgF0c3E= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICCTCCAY6gAwIBAgIUOXk0571gxjFa4z9KRWAn5Nd9UYIwCgYIKoZIzj0EAwMw +MzETMBEGA1UECgwKTWlnVEQgVGVzdDEcMBoGA1UEAwwTTWlnVEQgRUtVIFRlc3Qg +Um9vdDAeFw0yNjA3MjEwMjIxMjFaFw0zNjA3MTgwMjIxMjFaMDMxEzARBgNVBAoM +Ck1pZ1REIFRlc3QxHDAaBgNVBAMME01pZ1REIEVLVSBUZXN0IFJvb3QwdjAQBgcq +hkjOPQIBBgUrgQQAIgNiAAQfOdFcbraNYlYjDzu73zwekqQ7s46LeoZKIGPoBEVu +y4r8KDrq8cfs5wxX/T7HNdqXl5g+zn3xWWOxcTuauerWan/XpwwzNesebPu1pisV +ZmaSOoxvG4Lx+kDw5WUacO+jYzBhMB0GA1UdDgQWBBQVf9r0GM2yDAeYJKG0vAme +VqWXazAfBgNVHSMEGDAWgBQVf9r0GM2yDAeYJKG0vAmeVqWXazAPBgNVHRMBAf8E +BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAwNpADBmAjEApN/sTVod +QDjYkiSAZvqO8Wr2o7jMaUAW0fRefChS+KWEPaJH1MOrJKfxmj+pqBcoAjEA70be +7AjLsHZrtccNS34OjK+nD61Quogqd3x44GP0r6edhtoGeyx2tTYLOE69Wvin +-----END CERTIFICATE----- diff --git a/src/crypto/test/eku/signer_b.pem b/src/crypto/test/eku/signer_b.pem new file mode 100644 index 000000000..cb3a2bb09 --- /dev/null +++ b/src/crypto/test/eku/signer_b.pem @@ -0,0 +1,27 @@ +-----BEGIN CERTIFICATE----- +MIICEjCCAZegAwIBAgIUGBaSh46F+ZxSt0xq75U6dkcj96kwCgYIKoZIzj0EAwMw +MzETMBEGA1UECgwKTWlnVEQgVGVzdDEcMBoGA1UEAwwTTWlnVEQgRUtVIFRlc3Qg +Um9vdDAeFw0yNjA3MjEwMjIxMjFaFw0yNzA3MjEwMjIxMjFaMDYxEzARBgNVBAoM +Ck1pZ1REIFRlc3QxHzAdBgNVBAMMFk1pZ1REIFJvdGF0ZWQgU2lnbmVyIEIwdjAQ +BgcqhkjOPQIBBgUrgQQAIgNiAATufPloGY6hxw6UkKp22MLrcrKnFrzZGuTOSMQ2 +Hf/aoXminjKVQSDJY0t8TQkwQhz06MBatgkslq1a7pNZGbs+4cmb6vVfQ0yYFf1E +ntnO10FyPwH3YL6EQM87MUBYqsyjaTBnMA4GA1UdDwEB/wQEAwIHgDAVBgNVHSUE +DjAMBgorBgEEAYH9WQEBMB0GA1UdDgQWBBR68APKKOMcp03Cp6xLPp33pqvRpjAf +BgNVHSMEGDAWgBQVf9r0GM2yDAeYJKG0vAmeVqWXazAKBggqhkjOPQQDAwNpADBm +AjEA380oBWcbpJFGGr86SxJ274TmmM1XIdB/mYgAuIrPfNTJbopLX5VmN37m+x53 +BSWNAjEAglxwIOW/EvvhQwYeDyJTbYOCBjmztEfoxMLbZqqVD843nJTlnMGZqRBb +1b1RhBGL +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICCTCCAY6gAwIBAgIUOXk0571gxjFa4z9KRWAn5Nd9UYIwCgYIKoZIzj0EAwMw +MzETMBEGA1UECgwKTWlnVEQgVGVzdDEcMBoGA1UEAwwTTWlnVEQgRUtVIFRlc3Qg +Um9vdDAeFw0yNjA3MjEwMjIxMjFaFw0zNjA3MTgwMjIxMjFaMDMxEzARBgNVBAoM +Ck1pZ1REIFRlc3QxHDAaBgNVBAMME01pZ1REIEVLVSBUZXN0IFJvb3QwdjAQBgcq +hkjOPQIBBgUrgQQAIgNiAAQfOdFcbraNYlYjDzu73zwekqQ7s46LeoZKIGPoBEVu +y4r8KDrq8cfs5wxX/T7HNdqXl5g+zn3xWWOxcTuauerWan/XpwwzNesebPu1pisV +ZmaSOoxvG4Lx+kDw5WUacO+jYzBhMB0GA1UdDgQWBBQVf9r0GM2yDAeYJKG0vAme +VqWXazAfBgNVHSMEGDAWgBQVf9r0GM2yDAeYJKG0vAmeVqWXazAPBgNVHRMBAf8E +BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAwNpADBmAjEApN/sTVod +QDjYkiSAZvqO8Wr2o7jMaUAW0fRefChS+KWEPaJH1MOrJKfxmj+pqBcoAjEA70be +7AjLsHZrtccNS34OjK+nD61Quogqd3x44GP0r6edhtoGeyx2tTYLOE69Wvin +-----END CERTIFICATE----- diff --git a/src/crypto/test/eku/signer_designated_multi.pem b/src/crypto/test/eku/signer_designated_multi.pem new file mode 100644 index 000000000..08d10c2b1 --- /dev/null +++ b/src/crypto/test/eku/signer_designated_multi.pem @@ -0,0 +1,27 @@ +-----BEGIN CERTIFICATE----- +MIICIjCCAaigAwIBAgIUDv4/fbyuSoXAn7kp4qp44d8nBHUwCgYIKoZIzj0EAwMw +OTETMBEGA1UECgwKTWlnVEQgVGVzdDEiMCAGA1UEAwwZTWlnVEQgRGVzaWduYXRl +ZCBFS1UgUm9vdDAgFw0yNjA3MjIyMTA0MDlaGA8yMTI2MDYyODIxMDQwOVowNjET +MBEGA1UECgwKTWlnVEQgVGVzdDEfMB0GA1UEAwwWTWlnVEQgRGVzaWduYXRlZCBN +dWx0aTB2MBAGByqGSM49AgEGBSuBBAAiA2IABHggeS6ZvU9muWLe4FCoX6np5TBW +DnEEGs43gKyQRnq/mcnTDjYRC+f7mTt6Nrw1SzJ0PEggToqr3ELCRVgkI7sYqAxB +/Jdi8tglu0sJdhFuGxn2HMJFAYr7T2GJhS2dV6NyMHAwDAYDVR0TAQH/BAIwADAg +BgNVHSUEGTAXBggrBgEFBQcDAwYLKwYBBAGCN0w7ASswHQYDVR0OBBYEFOHuRcow +41iz5Z0Ry1IXvDHtiDz8MB8GA1UdIwQYMBaAFIG8wRq1xxT0HRauEUUxNMK0agjW +MAoGCCqGSM49BAMDA2gAMGUCMQD39gFu5tFm8cjsS6LrkVtYNWiOPK/uLcFjMSfz +YdNXpO6GDKMyGpWAzfzoEYQX74UCMBdfPGso11c2uLTWxxopOWNuUyN1H/t/vqPo +pV1tJvp3wfmLiAYc7SYcN7a4d8+prQ== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIB9TCCAXugAwIBAgIUbA3SkgzzDfSaqilxghR2nIHAvJMwCgYIKoZIzj0EAwMw +OTETMBEGA1UECgwKTWlnVEQgVGVzdDEiMCAGA1UEAwwZTWlnVEQgRGVzaWduYXRl +ZCBFS1UgUm9vdDAgFw0yNjA3MjIyMTA0MDlaGA8yMTI2MDYyODIxMDQwOVowOTET +MBEGA1UECgwKTWlnVEQgVGVzdDEiMCAGA1UEAwwZTWlnVEQgRGVzaWduYXRlZCBF +S1UgUm9vdDB2MBAGByqGSM49AgEGBSuBBAAiA2IABKYzIu9CyteH6nobtVtNeKmi +aCKhHDFVVAfnZoUd74AZUgwjn9me7szAKzNxz3Z74bZtd+Xw4H9x5Y3Ef+ZgHHOm +xf+3ZQz8LIjJ6U883fvGXqtcqT1D/gPonb2xPUo3R6NCMEAwDwYDVR0TAQH/BAUw +AwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFIG8wRq1xxT0HRauEUUxNMK0 +agjWMAoGCCqGSM49BAMDA2gAMGUCMGmYjkwVLjznPaimwWvqUnwgw4RXliXQvbRh +aetsWrOwJkmb2RhNwEHOt3ekXxeNkgIxAPmvYlIimCrse8KmV7rVLBZ4FXg/jQhF +POzJPjcAZYaS4i/dIA38FcGL+YW/CNyBsw== +-----END CERTIFICATE----- diff --git a/src/crypto/test/eku/signer_designated_only.pem b/src/crypto/test/eku/signer_designated_only.pem new file mode 100644 index 000000000..81733b53c --- /dev/null +++ b/src/crypto/test/eku/signer_designated_only.pem @@ -0,0 +1,27 @@ +-----BEGIN CERTIFICATE----- +MIICGDCCAZ2gAwIBAgIUWIqUSNla4AtNLYnWX9XzTVbFTJEwCgYIKoZIzj0EAwMw +OTETMBEGA1UECgwKTWlnVEQgVGVzdDEiMCAGA1UEAwwZTWlnVEQgRGVzaWduYXRl +ZCBFS1UgUm9vdDAgFw0yNjA3MjIyMTA0MDlaGA8yMTI2MDYyODIxMDQwOVowNTET +MBEGA1UECgwKTWlnVEQgVGVzdDEeMBwGA1UEAwwVTWlnVEQgRGVzaWduYXRlZCBP +bmx5MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAElfPl3ALyIGWS+CzPnuTdLveGNtcA +WszLh5nleDmBSggBgB7Kgg1pa3ywKR4VfH4RU6CZ/Z1CduenRiLopATtt7SrDS71 +SwVTUSscOcQy3JDIucimFOG/03G4oEY36IL+o2gwZjAMBgNVHRMBAf8EAjAAMBYG +A1UdJQQPMA0GCysGAQQBgjdMOwErMB0GA1UdDgQWBBTvKaSw1tpOQY2EoXIKOnF9 +MvsyBTAfBgNVHSMEGDAWgBSBvMEatccU9B0WrhFFMTTCtGoI1jAKBggqhkjOPQQD +AwNpADBmAjEA2zZ5QcJOqhicvvNdBmMXTIE8sczxH+JPTgBTPV1EcGZHcI/LkCGj +zN+FElPQLLmhAjEAwy+uKXyngGKm3AYAu0d53h51he/p8cyphuGPqUhchsXSyJPF +TL7RaQKZEXqglwkJ +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIB9TCCAXugAwIBAgIUbA3SkgzzDfSaqilxghR2nIHAvJMwCgYIKoZIzj0EAwMw +OTETMBEGA1UECgwKTWlnVEQgVGVzdDEiMCAGA1UEAwwZTWlnVEQgRGVzaWduYXRl +ZCBFS1UgUm9vdDAgFw0yNjA3MjIyMTA0MDlaGA8yMTI2MDYyODIxMDQwOVowOTET +MBEGA1UECgwKTWlnVEQgVGVzdDEiMCAGA1UEAwwZTWlnVEQgRGVzaWduYXRlZCBF +S1UgUm9vdDB2MBAGByqGSM49AgEGBSuBBAAiA2IABKYzIu9CyteH6nobtVtNeKmi +aCKhHDFVVAfnZoUd74AZUgwjn9me7szAKzNxz3Z74bZtd+Xw4H9x5Y3Ef+ZgHHOm +xf+3ZQz8LIjJ6U883fvGXqtcqT1D/gPonb2xPUo3R6NCMEAwDwYDVR0TAQH/BAUw +AwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFIG8wRq1xxT0HRauEUUxNMK0 +agjWMAoGCCqGSM49BAMDA2gAMGUCMGmYjkwVLjznPaimwWvqUnwgw4RXliXQvbRh +aetsWrOwJkmb2RhNwEHOt3ekXxeNkgIxAPmvYlIimCrse8KmV7rVLBZ4FXg/jQhF +POzJPjcAZYaS4i/dIA38FcGL+YW/CNyBsw== +-----END CERTIFICATE----- diff --git a/src/crypto/test/eku/signer_multiple_eku.pem b/src/crypto/test/eku/signer_multiple_eku.pem new file mode 100644 index 000000000..e719a0721 --- /dev/null +++ b/src/crypto/test/eku/signer_multiple_eku.pem @@ -0,0 +1,27 @@ +-----BEGIN CERTIFICATE----- +MIICGzCCAaCgAwIBAgIUGBaSh46F+ZxSt0xq75U6dkcj96wwCgYIKoZIzj0EAwMw +MzETMBEGA1UECgwKTWlnVEQgVGVzdDEcMBoGA1UEAwwTTWlnVEQgRUtVIFRlc3Qg +Um9vdDAeFw0yNjA3MjEwMjI5NDVaFw0yNzA3MjEwMjI5NDVaMDMxEzARBgNVBAoM +Ck1pZ1REIFRlc3QxHDAaBgNVBAMME01pZ1REIEFtYmlndW91cyBFS1UwdjAQBgcq +hkjOPQIBBgUrgQQAIgNiAAR5mpQ0fxXT/g+2uUW71aiAAXC28XXH+TaPiZPQ4tgI +dC4zdkBuxSmEgAcW8Mb51RfAOd3PVnioSPDtPvWLYhAGsp407eUYLAofMQLKtmif +8ReZXzpUt64XtTqmBOVOmwOjdTBzMA4GA1UdDwEB/wQEAwIHgDAhBgNVHSUEGjAY +BgorBgEEAYH9WQEBBgorBgEEAYH9WQECMB0GA1UdDgQWBBRNvJxZsgtY2bmOvtH9 +XEzGtHWOnDAfBgNVHSMEGDAWgBQVf9r0GM2yDAeYJKG0vAmeVqWXazAKBggqhkjO +PQQDAwNpADBmAjEAgkmERvG9MfpTX4yO2j/C1lYOKjjKkkchhxxOFt3VWPMYPmaH +MVUZXyM/gsMbamg4AjEA9TmQLAN+KJ83u4K1qOSZZccOVPRg/j6iJPMS/t1ZF1/y +IF0TXP63goWatpRoaC4b +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICCTCCAY6gAwIBAgIUOXk0571gxjFa4z9KRWAn5Nd9UYIwCgYIKoZIzj0EAwMw +MzETMBEGA1UECgwKTWlnVEQgVGVzdDEcMBoGA1UEAwwTTWlnVEQgRUtVIFRlc3Qg +Um9vdDAeFw0yNjA3MjEwMjIxMjFaFw0zNjA3MTgwMjIxMjFaMDMxEzARBgNVBAoM +Ck1pZ1REIFRlc3QxHDAaBgNVBAMME01pZ1REIEVLVSBUZXN0IFJvb3QwdjAQBgcq +hkjOPQIBBgUrgQQAIgNiAAQfOdFcbraNYlYjDzu73zwekqQ7s46LeoZKIGPoBEVu +y4r8KDrq8cfs5wxX/T7HNdqXl5g+zn3xWWOxcTuauerWan/XpwwzNesebPu1pisV +ZmaSOoxvG4Lx+kDw5WUacO+jYzBhMB0GA1UdDgQWBBQVf9r0GM2yDAeYJKG0vAme +VqWXazAfBgNVHSMEGDAWgBQVf9r0GM2yDAeYJKG0vAmeVqWXazAPBgNVHRMBAf8E +BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAwNpADBmAjEApN/sTVod +QDjYkiSAZvqO8Wr2o7jMaUAW0fRefChS+KWEPaJH1MOrJKfxmj+pqBcoAjEA70be +7AjLsHZrtccNS34OjK+nD61Quogqd3x44GP0r6edhtoGeyx2tTYLOE69Wvin +-----END CERTIFICATE----- diff --git a/src/crypto/test/eku/signer_no_eku.pem b/src/crypto/test/eku/signer_no_eku.pem new file mode 100644 index 000000000..dc332debe --- /dev/null +++ b/src/crypto/test/eku/signer_no_eku.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIB9TCCAXugAwIBAgIUGBaSh46F+ZxSt0xq75U6dkcj96swCgYIKoZIzj0EAwMw +MzETMBEGA1UECgwKTWlnVEQgVGVzdDEcMBoGA1UEAwwTTWlnVEQgRUtVIFRlc3Qg +Um9vdDAeFw0yNjA3MjEwMjIxMjFaFw0yNzA3MjEwMjIxMjFaMDExEzARBgNVBAoM +Ck1pZ1REIFRlc3QxGjAYBgNVBAMMEU1pZ1REIE1pc3NpbmcgRUtVMHYwEAYHKoZI +zj0CAQYFK4EEACIDYgAEEvbIYhUuAz25HvOarGyXmaRbRAWQKqHrlMlJaKw1EQNY +qQU/O5lM7Shkq40AMgyrZW3aB0srI+9e+ai59OMTnimskohCbSwqAuhwCyqZpC/3 +OOEBP7xgK4rsJCX8Jetko1IwUDAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0OBBYEFKbt +uecw2MdkOBzCATD8ARX5eiyKMB8GA1UdIwQYMBaAFBV/2vQYzbIMB5gkobS8CZ5W +pZdrMAoGCCqGSM49BAMDA2gAMGUCMQC6BNqECvh12qP/C48vCOxaMbKu+bHyA3eJ +uAKhnGuxI+tJsXE9OCpy25u9iqVOtfACMADHN2ImL7kVDpIMf/R1rtkb3pdoGbTs +rUPOfsv2XoQ+Fw0LXq81k3k5o0nYibgLhA== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICCTCCAY6gAwIBAgIUOXk0571gxjFa4z9KRWAn5Nd9UYIwCgYIKoZIzj0EAwMw +MzETMBEGA1UECgwKTWlnVEQgVGVzdDEcMBoGA1UEAwwTTWlnVEQgRUtVIFRlc3Qg +Um9vdDAeFw0yNjA3MjEwMjIxMjFaFw0zNjA3MTgwMjIxMjFaMDMxEzARBgNVBAoM +Ck1pZ1REIFRlc3QxHDAaBgNVBAMME01pZ1REIEVLVSBUZXN0IFJvb3QwdjAQBgcq +hkjOPQIBBgUrgQQAIgNiAAQfOdFcbraNYlYjDzu73zwekqQ7s46LeoZKIGPoBEVu +y4r8KDrq8cfs5wxX/T7HNdqXl5g+zn3xWWOxcTuauerWan/XpwwzNesebPu1pisV +ZmaSOoxvG4Lx+kDw5WUacO+jYzBhMB0GA1UdDgQWBBQVf9r0GM2yDAeYJKG0vAme +VqWXazAfBgNVHSMEGDAWgBQVf9r0GM2yDAeYJKG0vAmeVqWXazAPBgNVHRMBAf8E +BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAwNpADBmAjEApN/sTVod +QDjYkiSAZvqO8Wr2o7jMaUAW0fRefChS+KWEPaJH1MOrJKfxmj+pqBcoAjEA70be +7AjLsHZrtccNS34OjK+nD61Quogqd3x44GP0r6edhtoGeyx2tTYLOE69Wvin +-----END CERTIFICATE----- diff --git a/src/crypto/test/eku/signer_other_eku.pem b/src/crypto/test/eku/signer_other_eku.pem new file mode 100644 index 000000000..d1f1e4e5c --- /dev/null +++ b/src/crypto/test/eku/signer_other_eku.pem @@ -0,0 +1,27 @@ +-----BEGIN CERTIFICATE----- +MIICDTCCAZSgAwIBAgIUGBaSh46F+ZxSt0xq75U6dkcj96owCgYIKoZIzj0EAwMw +MzETMBEGA1UECgwKTWlnVEQgVGVzdDEcMBoGA1UEAwwTTWlnVEQgRUtVIFRlc3Qg +Um9vdDAeFw0yNjA3MjEwMjIxMjFaFw0yNzA3MjEwMjIxMjFaMDMxEzARBgNVBAoM +Ck1pZ1REIFRlc3QxHDAaBgNVBAMME01pZ1REIE90aGVyIFB1cnBvc2UwdjAQBgcq +hkjOPQIBBgUrgQQAIgNiAAR/TabYZEPdTQV2dqbx2GuOIIhBS69fd46x8LOzrBEG +IUexnrOgQ7rgHIaRd3WXq54MZSbob9MjAwhTt0IT8MqPvDaB65GQXvt3lDRm7pHm +WqYGqZsq47MvdBzp3cqkOp2jaTBnMA4GA1UdDwEB/wQEAwIHgDAVBgNVHSUEDjAM +BgorBgEEAYH9WQECMB0GA1UdDgQWBBTyo+ipdya2xONvm+YeD9GP6n1CzjAfBgNV +HSMEGDAWgBQVf9r0GM2yDAeYJKG0vAmeVqWXazAKBggqhkjOPQQDAwNnADBkAjBZ +DeRdJoooBFzYSee1Uj4gZLxQXTq1mY9+vzRR/woUtXBuY2gUx81YJcrj2k0gDrsC +MAT0Gv05f3CYNjntDtzwNubHoH1pF5/qEvgIN6eGeALlmNIDfYolSeSzw7CFpQ01 +AQ== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICCTCCAY6gAwIBAgIUOXk0571gxjFa4z9KRWAn5Nd9UYIwCgYIKoZIzj0EAwMw +MzETMBEGA1UECgwKTWlnVEQgVGVzdDEcMBoGA1UEAwwTTWlnVEQgRUtVIFRlc3Qg +Um9vdDAeFw0yNjA3MjEwMjIxMjFaFw0zNjA3MTgwMjIxMjFaMDMxEzARBgNVBAoM +Ck1pZ1REIFRlc3QxHDAaBgNVBAMME01pZ1REIEVLVSBUZXN0IFJvb3QwdjAQBgcq +hkjOPQIBBgUrgQQAIgNiAAQfOdFcbraNYlYjDzu73zwekqQ7s46LeoZKIGPoBEVu +y4r8KDrq8cfs5wxX/T7HNdqXl5g+zn3xWWOxcTuauerWan/XpwwzNesebPu1pisV +ZmaSOoxvG4Lx+kDw5WUacO+jYzBhMB0GA1UdDgQWBBQVf9r0GM2yDAeYJKG0vAme +VqWXazAfBgNVHSMEGDAWgBQVf9r0GM2yDAeYJKG0vAmeVqWXazAPBgNVHRMBAf8E +BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAwNpADBmAjEApN/sTVod +QDjYkiSAZvqO8Wr2o7jMaUAW0fRefChS+KWEPaJH1MOrJKfxmj+pqBcoAjEA70be +7AjLsHZrtccNS34OjK+nD61Quogqd3x44GP0r6edhtoGeyx2tTYLOE69Wvin +-----END CERTIFICATE----- diff --git a/src/devices/vmcall_raw/src/stream.rs b/src/devices/vmcall_raw/src/stream.rs index 87739e77d..417cec84e 100644 --- a/src/devices/vmcall_raw/src/stream.rs +++ b/src/devices/vmcall_raw/src/stream.rs @@ -123,3 +123,97 @@ impl VmcallRaw { Ok(()) } } + +#[cfg(test)] +mod tests { + use super::*; + use core::future::Future; + use core::pin::pin; + use core::task::{Context, Poll, Waker}; + + /// Drive a future expected to resolve without ever yielding `Pending`. + /// `recv` satisfies this once `data_queue` is pre-populated, because it + /// then performs no VMCALL. Panics if the future would block. + fn run_ready<F: Future>(fut: F) -> F::Output { + let mut cx = Context::from_waker(Waker::noop()); + let mut fut = pin!(fut); + match fut.as_mut().poll(&mut cx) { + Poll::Ready(v) => v, + Poll::Pending => panic!("future unexpectedly pending (unexpected VMCALL?)"), + } + } + + fn stream_with(packets: &[&[u8]]) -> VmcallRaw { + let mut s = VmcallRaw::new().unwrap(); + for p in packets { + s.data_queue.push_back(p.to_vec()); + } + s + } + + #[test] + fn recv_drains_single_queued_packet() { + let mut s = stream_with(&[b"hello"]); + let mut buf = [0u8; 16]; + let n = run_ready(s.recv(&mut buf, 0)).unwrap(); + assert_eq!(n, 5); + assert_eq!(&buf[..n], b"hello"); + assert!(s.data_queue.is_empty()); + } + + #[test] + fn recv_concatenates_queued_packets_when_buf_is_large() { + let mut s = stream_with(&[b"abc", b"de", b"fghi"]); + let mut buf = [0u8; 16]; + let n = run_ready(s.recv(&mut buf, 0)).unwrap(); + assert_eq!(n, 9); + assert_eq!(&buf[..n], b"abcdefghi"); + assert!(s.data_queue.is_empty()); + } + + #[test] + fn recv_preserves_leftover_when_buf_smaller_than_packet() { + // A packet larger than the caller's buffer must not lose bytes: the + // remainder stays queued for the next recv. + let mut s = stream_with(&[b"abcdef"]); + let mut buf = [0u8; 4]; + + let n1 = run_ready(s.recv(&mut buf, 0)).unwrap(); + assert_eq!(n1, 4); + assert_eq!(&buf[..n1], b"abcd"); + + let n2 = run_ready(s.recv(&mut buf, 0)).unwrap(); + assert_eq!(n2, 2); + assert_eq!(&buf[..n2], b"ef"); + assert!(s.data_queue.is_empty()); + } + + #[test] + fn caller_loop_reassembles_multi_packet_message() { + // Models the receiver of a chunked send: a large logical message + // arrives as several MTU-sized packets. A caller that loops `recv` + // into a fixed (deliberately misaligned) buffer must recover the exact + // original bytes across packet boundaries -- the property the + // higher-level readers (pre_session / SPDM / rustls) depend on, given + // that `recv` returns at most one packet's worth per call. + const TOTAL: usize = 180 * 1024; + const PACKET: usize = 64 * 1024; // simulate a 64KB-MTU peer + let original: Vec<u8> = (0..TOTAL).map(|i| (i % 251) as u8).collect(); + + let mut s = VmcallRaw::new().unwrap(); + for chunk in original.chunks(PACKET) { + s.data_queue.push_back(chunk.to_vec()); + } + + let mut got: Vec<u8> = Vec::with_capacity(TOTAL); + let mut app = [0u8; 5000]; // not a divisor of PACKET -> crosses boundaries + while got.len() < TOTAL { + let n = run_ready(s.recv(&mut app, 0)).unwrap(); + assert!(n > 0, "recv must make forward progress"); + got.extend_from_slice(&app[..n]); + } + + assert_eq!(got, original); + assert!(s.data_queue.is_empty()); + } +} diff --git a/src/devices/vmcall_raw/src/transport/vmcall.rs b/src/devices/vmcall_raw/src/transport/vmcall.rs index 7081dcd79..e4aaa4a8f 100644 --- a/src/devices/vmcall_raw/src/transport/vmcall.rs +++ b/src/devices/vmcall_raw/src/transport/vmcall.rs @@ -18,14 +18,28 @@ use td_payload::arch::idt::InterruptStack; use td_payload::mm::shared::SharedMemory; use tdx_tdcall::tdx; -pub(crate) const MAX_VMCALL_RAW_STREAM_MTU: usize = 0x1000 * 16; +/// Migration data-channel buffer size (send and receive) used for a single +/// `Service.MigTD.Send` / `Service.MigTD.Receive` VMCALL. +/// +/// The GHCI spec only requires a compliant VMM to support *at least* a 64KB +/// buffer (`0x1000 * 16`), which is the portable floor used upstream. The +/// Azure host provisions a larger buffer — 1MB by default and never below +/// 512KB — so this Azure build raises the value to 512KB. That lets the +/// policy_v2 pre-session blob (signed policy + issuer chain, ~180KB) ride in +/// a single VMCALL instead of several 64KB round-trips. +/// +/// Constraints: this MUST NOT exceed the smallest send/receive buffer the +/// host guarantees (512KB on Azure), both migration peers must use the same +/// value, and one receive buffer of this size must fit in the shared-memory +/// pool (`migtd::SHARED_MEMORY_SIZE`, 1.75MB). +pub(crate) const MAX_VMCALL_RAW_STREAM_MTU: usize = 0x1000 * 128; /// GHCI 1.5 buffer header overhead (8-byte status + 4-byte length) prepended /// by `vmcall_raw_transport_enqueue` to each VMCALL payload. pub(crate) const VMCALL_RAW_GHCI_HEADER_LEN: usize = 12; -/// Largest payload that can ride in a single `Service.MigTD.Send` VMCALL. -/// The VMM-side buffer for the migration data channel matches the MTU the -/// receive side advertises; sending more than this in one VMCALL fails with -/// TDX_VMCALL_STATUS != SUCCESS. +/// Largest payload that can ride in a single `Service.MigTD.Send` VMCALL: the +/// buffer size minus the GHCI header. The send path chunks to this so a write +/// never exceeds the host buffer (exceeding it fails with +/// TDX_VMCALL_STATUS != SUCCESS). pub(crate) const VMCALL_RAW_SEND_PAYLOAD_MTU: usize = MAX_VMCALL_RAW_STREAM_MTU - VMCALL_RAW_GHCI_HEADER_LEN; const VMCALL_VECTOR: u8 = 0x52; @@ -204,3 +218,22 @@ fn vmcall_raw_intr_notification(_: &mut InterruptStack) { flag.store(true, Ordering::SeqCst); } } + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn send_chunk_plus_header_exactly_fills_receive_buffer() { + // A single send chunk plus the GHCI header must fit in exactly one + // peer receive buffer; otherwise a chunked send could overflow the + // receiver's fixed MTU-sized buffer (which would truncate the packet). + assert_eq!( + VMCALL_RAW_SEND_PAYLOAD_MTU + VMCALL_RAW_GHCI_HEADER_LEN, + MAX_VMCALL_RAW_STREAM_MTU + ); + // The receive buffer is allocated as a whole number of pages. + assert_eq!(MAX_VMCALL_RAW_STREAM_MTU % PAGE_SIZE, 0); + assert!(VMCALL_RAW_SEND_PAYLOAD_MTU > 0); + } +} diff --git a/src/migtd/Cargo.toml b/src/migtd/Cargo.toml index ba72cd4ad..adb0bb7ab 100644 --- a/src/migtd/Cargo.toml +++ b/src/migtd/Cargo.toml @@ -73,6 +73,9 @@ cet-shstk = ["td-payload/cet-shstk"] coverage = ["minicov"] main = ["attestation", "policy/log", "sha2"] policy_v2 = ["policy/policy_v2", "attestation/attest-lib-ext", "td-shim-interface-emu?/policy_v2"] +# Opt-in CoRIM-based hash endorsement for servtd collateral. Additive on top +# of policy_v2; without it the legacy JSON collateral path is used unchanged. +servtd_corim = ["policy_v2", "policy/servtd_corim"] stack-guard = ["td-payload/stack-guard"] virtio-vsock = ["vsock/virtio-vsock"] virtio-serial = ["virtio_serial"] @@ -85,6 +88,8 @@ test_stack_size = ["td-benchmark"] test_disable_ra_and_accept_all = ["attestation/test", "tdx-tdcall-emu?/test_mock_report"] # Dangerous: test-only RA bypass; blocked in release (see src/lib.rs) spdm_attestation = ["main"] test_mock_report = ["AzCVMEmu", "tdx-tdcall-emu/test_mock_report"] # Use mock TD report in AzCVMEmu mode +igvm-attest = ["attestation/igvm-attest"] +test-get-quote = [] use-mock-quote = ["attestation/use-mock-quote"] # Use mock quote and mock TD report for non-AzCVMEmu testing mock_quote_retry = ["AzCVMEmu", "tdx-tdcall-emu/mock_quote_retry"] AzCVMEmu = [ @@ -101,7 +106,6 @@ AzCVMEmu = [ "td-logger-emu", # Use console-based td-logger shim "tokio", ] -igvm-attest = ["attestation/igvm-attest"] [patch.crates-io] sys_time = { path = "src/std-support/sys_time" } diff --git a/src/migtd/src/bin/migtd/cvmemu.rs b/src/migtd/src/bin/migtd/cvmemu.rs index 2af259c92..5be31d5b1 100644 --- a/src/migtd/src/bin/migtd/cvmemu.rs +++ b/src/migtd/src/bin/migtd/cvmemu.rs @@ -80,34 +80,58 @@ fn initialize_emulation() { #[cfg(feature = "policy_v2")] let result = { - // policy_v2: root CA is embedded in policy collaterals, only need issuer chain - let policy_issuer_chain_file_path = env::var("MIGTD_POLICY_ISSUER_CHAIN_FILE") - .map_err(|_| { - log::error!("Policy v2 requires a policy issuer chain file but MIGTD_POLICY_ISSUER_CHAIN_FILE was not set\n"); - }) - .unwrap_or_else(|_| process::exit(1)); - - log::info!( - "MIGTD_POLICY_ISSUER_CHAIN_FILE set to: {}\n", - policy_issuer_chain_file_path - ); + let signer_anchor = env::var("MIGTD_SERVTD_SIGNER_ANCHOR_FILE").ok(); + let servtd_corim = env::var("MIGTD_SERVTD_CORIM_FILE").ok(); + + match (signer_anchor, servtd_corim) { + (Some(anchor_path), Some(corim_path)) => { + for (description, path) in [ + ("ServTD signer anchor", &anchor_path), + ("signed ServTD CoRIM", &corim_path), + ] { + if !std::path::Path::new(path).exists() { + println!("{} file not found: {}", description, path); + print_usage(); + process::exit(1); + } + } - // Verify chain file exists - if !std::path::Path::new(&policy_issuer_chain_file_path).exists() { - println!( - "Policy issuer chain file not found: {}", - policy_issuer_chain_file_path - ); - print_usage(); - process::exit(1); - } + log::info!("MIGTD_SERVTD_SIGNER_ANCHOR_FILE set to: {}\n", anchor_path); + log::info!("MIGTD_SERVTD_CORIM_FILE set to: {}\n", corim_path); + let anchor_path: &'static str = Box::leak(anchor_path.into_boxed_str()); + let corim_path: &'static str = Box::leak(corim_path.into_boxed_str()); + td_shim_interface_emu::init_file_based_emulation_with_corim( + policy_path, + anchor_path, + corim_path, + ) + } + (None, None) => { + // policy_v2: root CA is embedded in policy collaterals. + let chain_path = env::var("MIGTD_POLICY_ISSUER_CHAIN_FILE") + .unwrap_or_else(|_| { + log::error!("Policy v2 requires either MIGTD_POLICY_ISSUER_CHAIN_FILE or both CoRIM-only input variables\n"); + process::exit(1); + }); + + log::info!("MIGTD_POLICY_ISSUER_CHAIN_FILE set to: {}\n", chain_path); + if !std::path::Path::new(&chain_path).exists() { + println!("Policy issuer chain file not found: {}", chain_path); + print_usage(); + process::exit(1); + } - let chain_path_static: &'static str = - Box::leak(policy_issuer_chain_file_path.into_boxed_str()); - td_shim_interface_emu::init_file_based_emulation_with_policy_chain( - policy_path, - chain_path_static, - ) + let chain_path: &'static str = Box::leak(chain_path.into_boxed_str()); + td_shim_interface_emu::init_file_based_emulation_with_policy_chain( + policy_path, + chain_path, + ) + } + _ => { + log::error!("MIGTD_SERVTD_SIGNER_ANCHOR_FILE and MIGTD_SERVTD_CORIM_FILE must be set together\n"); + process::exit(1); + } + } }; #[cfg(not(feature = "policy_v2"))] @@ -141,7 +165,11 @@ fn initialize_emulation() { #[cfg(feature = "policy_v2")] { let chain_file = env::var("MIGTD_POLICY_ISSUER_CHAIN_FILE").ok(); + let anchor_file = env::var("MIGTD_SERVTD_SIGNER_ANCHOR_FILE").ok(); + let corim_file = env::var("MIGTD_SERVTD_CORIM_FILE").ok(); log::info!(" Policy Issuer Chain: {:?}\n", chain_file); + log::info!(" ServTD Signer Anchor: {:?}\n", anchor_file); + log::info!(" Signed ServTD CoRIM: {:?}\n", corim_file); } } else { log::error!("Failed to initialize file-based emulation\n"); diff --git a/src/migtd/src/bin/migtd/main.rs b/src/migtd/src/bin/migtd/main.rs index c4660aaa9..2ea485140 100644 --- a/src/migtd/src/bin/migtd/main.rs +++ b/src/migtd/src/bin/migtd/main.rs @@ -10,9 +10,9 @@ extern crate alloc; use core::future::poll_fn; use core::task::Poll; -#[cfg(feature = "policy_v2")] -use alloc::string::String; use alloc::vec::Vec; +#[cfg(feature = "policy_v2")] +use alloc::{format, string::String}; use log::info; #[cfg(feature = "vmcall-raw")] use log::{debug, Level}; @@ -74,7 +74,7 @@ fn dump_td_info_and_hash() { hasher.update(td_report.td_info.as_bytes()); let hash = hasher.finalize(); - debug!("TD Info Hash: {:x}\n", hash); + info!("TD Info Hash: {:x}\n", hash); } const MIGTD_VERSION: &str = env!("CARGO_PKG_VERSION"); @@ -140,7 +140,7 @@ pub fn runtime_main() { #[cfg(feature = "vmcall-raw")] { log::info!("log::max_level() = {}\n", log::max_level()); - if log::max_level() >= Level::Debug { + if log::log_enabled!(Level::Info) { dump_td_info_and_hash(); } } @@ -275,67 +275,117 @@ fn get_policy_and_measure(event_log: &mut [u8]) { let version = initialize_policy(); - // Per GHCI 1.5: Verify own TDINFO.MROWNER/MROWNERCONFIG matches policy key/SVN - // Skip in AzCVMEmu mode — emulator uses mock TD reports where VMM does not - // populate MROWNER/MROWNERCONFIG. - #[cfg(not(feature = "AzCVMEmu"))] + // Per GHCI 1.5: Verify own TDINFO.MROWNER/MROWNERCONFIG matches policy key/SVN. + // Skipped under AzCVMEmu because the mock TDREPORT has zero MROWNER/MROWNERCONFIG, + // which would otherwise fail the check and block all policy_v2 + mock-report tests. + // + // TEST MODE: failures are logged but do not abort startup, so MigTD can boot on + // hosts that have not yet been updated to provision MROWNER/MROWNERCONFIG. + #[cfg(all(feature = "vmcall-raw", not(feature = "AzCVMEmu")))] { use migtd::mig_policy; if let Err(e) = mig_policy::verify_own_tdinfo() { - log::error!("TDINFO policy binding verification failed: {:?}\n", e); - panic_with_guest_crash_reg_report( - MigrationResult::InvalidPolicyError as u64, - b"TDINFO MROWNER/MROWNERCONFIG mismatch with policy", + log::error!( + "TDINFO policy binding verification failed: {:?} \ + (ignored: TEST MODE, continuing startup)\n", + e ); } } let event_data = version.as_bytes(); - // Measure and extend the migration policy to RTMR + // Per doc/tcb_mapping_design_proposal.md: RTMR2 is extended ONCE with the + // canonical bytes of `policyData` with `servtdCollateral.servtdTcbMapping` + // removed. The redaction is what makes `servtdTcbMapping` updateable + // after the IGVM is published; every other `policyData` field — including + // `version`, `id`, `policySvn`, `policy`, `forwardPolicy`, + // `backwardPolicy`, `collaterals`, and the rest of `servtdCollateral` + // (with the signed `servtdIdentity` and both issuer chains) — is + // protected by virtue of being inside the canonical object bytes. The + // event-log entry's `tagged_event_data` payload stays small + // (`version.as_bytes()`) to keep CCEL bounded; the full canonical bytes + // are only fed into the digest. + // + // The buffer hashed here MUST be byte-identical to what + // `policy::v2::policy::check_policy_integrity` and `migtd-hash` (offline + // RTMR2 simulator) compute, otherwise valid peers fail event-log + // integrity verification. + let policy_data_bytes = match migtd::policy::extract_canonical_policy_data_bytes(policy) { + Ok(bytes) => bytes, + Err(e) => { + log::error!("Failed to extract canonical policyData bytes: {:?}\n", e); + panic_with_guest_crash_reg_report( + MigrationResult::InvalidPolicyError as u64, + b"Failed to extract canonical policyData bytes", + ); + } + }; let _ = event_log::write_tagged_event_log( event_log, MR_INDEX_POLICY, - policy, - TAGGED_EVENT_ID_POLICY, + &policy_data_bytes, + TAGGED_EVENT_ID_POLICY_DATA, event_data, ) .map_err(|e| { - log::error!("Failed to log migration policy: {:?}\n", e); + log::error!("Failed to log policyData: {:?}\n", e); panic_with_guest_crash_reg_report( MigrationResult::InitializationError as u64, - b"Failed to log migration policy", + b"Failed to log policyData", ); }); } #[cfg(feature = "policy_v2")] fn get_policy_issuer_chain_and_measure(event_log: &mut [u8]) { - // Read policy issuer chain from CFV - let policy_issuer_chain = match config::get_policy_issuer_chain() { - Some(policy_issuer_chain) => policy_issuer_chain, + // Signer-anchor source from CFV: the 48-byte anchor slot (CoRIM-only + // enrollment) when present, else the legacy policy issuer chain PEM. + let anchor_source = match config::get_signer_anchor_source() { + Some(anchor_source) => anchor_source, None => { - log::error!("Fail to get policy issuer chain from CFV\n"); + log::error!("Fail to get policy signer anchor / issuer chain from CFV\n"); panic_with_guest_crash_reg_report( MigrationResult::InvalidPolicyError as u64, - b"Fail to get policy issuer chain from CFV", + b"Fail to get policy signer anchor from CFV", ); } }; - // Measure and extend the policy issuer chain to RTMR + // Per doc/rtmr1_signer_anchor_proposal.md: RTMR1 is extended with the SHA384 of + // the *signer anchor* A, NOT the entire PEM blob. A is derived from the + // root CA fingerprint and the leaf certificate's dedicated signer EKU, with + // a domain-separation tag, so the value is stable across rotations of + // PEM whitespace/ordering and across reissuance of intermediates. When the + // 48-byte anchor is enrolled directly, `resolve_signer_anchor` returns it + // as-is, yielding the identical RTMR1 value as the PEM-derived form. + let signer_anchor = match migtd::policy::resolve_signer_anchor(anchor_source) { + Ok(a) => a, + Err(e) => { + log::error!("Failed to resolve signer anchor: {:?}\n", e); + panic_with_guest_crash_reg_report( + MigrationResult::InvalidPolicyError as u64, + b"Failed to resolve policy signer anchor", + ); + } + }; + + // `write_tagged_event_log` hashes the supplied bytes (signer_anchor) and + // extends RTMR1 with that digest. The recorded event still carries the + // anchor source (48-byte anchor or full PEM) as `tagged_event_data` so a + // verifier can re-derive A. let _ = event_log::write_tagged_event_log( event_log, MR_INDEX_POLICY_ISSUER_CHAIN, - policy_issuer_chain, + &signer_anchor, TAGGED_EVENT_ID_POLICY_ISSUER_CHAIN, - policy_issuer_chain, + anchor_source, ) .map_err(|e| { - log::error!("Failed to log policy issuer chain: {:?}\n", e); + log::error!("Failed to log policy signer anchor: {:?}\n", e); panic_with_guest_crash_reg_report( MigrationResult::InitializationError as u64, - b"Failed to log policy issuer chain", + b"Failed to log policy signer anchor", ); }); } @@ -395,26 +445,28 @@ fn initialize_policy() -> String { ); } }; - let policy_issuer_chain = match config::get_policy_issuer_chain() { + let policy_issuer_chain = match config::get_signer_anchor_source() { Some(chain) => chain, None => { - log::error!("Fail to get policy issuer chain from CFV\n"); + log::error!("Fail to get policy signer anchor / issuer chain from CFV\n"); panic_with_guest_crash_reg_report( MigrationResult::InvalidPolicyError as u64, - b"Fail to get policy issuer chain from CFV", + b"Fail to get policy signer anchor from CFV", ); } }; // Initialize and verify the migration policy - let version = mig_policy::init_policy(policy, policy_issuer_chain).map_err(|e| { - log::error!("Failed to initialize migration policy: {:?}\n", e); - panic_with_guest_crash_reg_report( - MigrationResult::InvalidPolicyError as u64, - b"Failed to initialize migration policy", - ); - }); - - version.expect("Failed to initialize migration policy") + match mig_policy::init_policy(policy, policy_issuer_chain) { + Ok(version) => version, + Err(e) => { + let message = format!("Failed to initialize migration policy: {:?}", e); + log::error!("{}\n", message); + panic_with_guest_crash_reg_report( + MigrationResult::InvalidPolicyError as u64, + message.as_bytes(), + ); + } + } } fn handle_pre_mig() { diff --git a/src/migtd/src/config.rs b/src/migtd/src/config.rs index 05386a787..265486972 100644 --- a/src/migtd/src/config.rs +++ b/src/migtd/src/config.rs @@ -36,6 +36,42 @@ pub const MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID: Guid = Guid::from_fields( &[0xD3, 0xEA, 0xB3, 0x9F, 0x8A, 0xEB], ); +// {2B9D5A84-6F3C-4E71-8A2D-0C7E1F4B6A93} +// +// FFS GUID of the 48-byte RTMR1 signer anchor +// `A = SHA384(tag ‖ H(rootDER) ‖ leafEkuOidDER)` (hash of the root cert plus the +// leaf's dedicated signer-purpose EKU OID DER). This is the CoRIM-only +// enrollment form: instead of enrolling the full policy issuer chain PEM (whose +// only runtime role was to derive this anchor), the pipeline enrolls the +// precomputed anchor directly. Measured into RTMR1 exactly like the PEM-derived +// anchor, so the two forms are measurement-equivalent. When present it takes +// precedence over `MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID`. +pub const MIGTD_SERVTD_SIGNER_ANCHOR_FFS_GUID: Guid = Guid::from_fields( + 0x2B9D5A84, + 0x6F3C, + 0x4E71, + 0x8A, + 0x2D, + &[0x0C, 0x7E, 0x1F, 0x4B, 0x6A, 0x93], +); + +// {7E5B9C11-2D4A-4F6E-9B3C-1A2B3C4D5E6F} +// +// FFS GUID of the signed ServTD TCB-mapping CoRIM (`COSE_Sign1`) enrolled in +// the CFV. This file is intentionally NOT measured: `do_measurements()` never +// reads this GUID, so enrolling it does not change MRTD/RTMR or the resulting +// `tdinfo_hash`. Trust comes from the CoRIM's COSE signature bound to the RTMR1 +// policy signer anchor (see `ServtdCorim::decode_signed`). +#[cfg(feature = "servtd_corim")] +pub const MIGTD_SERVTD_CORIM_FFS_GUID: Guid = Guid::from_fields( + 0x7E5B9C11, + 0x2D4A, + 0x4F6E, + 0x9B, + 0x3C, + &[0x1A, 0x2B, 0x3C, 0x4D, 0x5E, 0x6F], +); + pub fn get_config_volume() -> &'static [u8] { unsafe { core::slice::from_raw_parts(CONFIG_VOLUME_BASE as *const u8, CONFIG_VOLUME_SIZE) } } @@ -58,3 +94,34 @@ pub fn get_policy_issuer_chain() -> Option<&'static [u8]> { MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID, ) } + +/// Read the 48-byte RTMR1 signer anchor from the CFV, if enrolled (the +/// CoRIM-only enrollment form). Returns `None` when only the legacy policy +/// issuer chain PEM is enrolled; callers then fall back to +/// [`get_policy_issuer_chain`] and derive the anchor from the PEM. +pub fn get_signer_anchor() -> Option<&'static [u8]> { + let cfv = get_config_volume(); + fv::get_file_from_fv( + cfv, + pi::fv::FV_FILETYPE_RAW, + MIGTD_SERVTD_SIGNER_ANCHOR_FFS_GUID, + ) +} + +/// Resolve the signer-anchor *source* bytes from the CFV: the 48-byte anchor +/// slot when present, otherwise the policy issuer chain PEM. Both forms are +/// accepted by `policy::resolve_signer_anchor`. Returns `None` only when +/// neither slot is enrolled. +pub fn get_signer_anchor_source() -> Option<&'static [u8]> { + get_signer_anchor().or_else(get_policy_issuer_chain) +} + +/// Read the signed ServTD TCB-mapping CoRIM (`COSE_Sign1`) from the CFV, if +/// enrolled. Returns `None` when no CoRIM was enrolled (the policy then falls +/// back to the JSON `servtdCollateral` mapping). This file is deliberately not +/// measured; see [`MIGTD_SERVTD_CORIM_FFS_GUID`]. +#[cfg(feature = "servtd_corim")] +pub fn get_servtd_corim() -> Option<&'static [u8]> { + let cfv = get_config_volume(); + fv::get_file_from_fv(cfv, pi::fv::FV_FILETYPE_RAW, MIGTD_SERVTD_CORIM_FFS_GUID) +} diff --git a/src/migtd/src/event_log.rs b/src/migtd/src/event_log.rs index 0b2c0928c..6c97afb3c 100644 --- a/src/migtd/src/event_log.rs +++ b/src/migtd/src/event_log.rs @@ -28,6 +28,13 @@ pub const TEST_DISABLE_RA_AND_ACCEPT_ALL_EVENT: &[u8] = b"test_disable_ra_and_ac pub const TAGGED_EVENT_ID_POLICY: u32 = 0x1; pub const TAGGED_EVENT_ID_ROOT_CA: u32 = 0x2; pub const TAGGED_EVENT_ID_POLICY_ISSUER_CHAIN: u32 = 0x3; +/// Single RTMR2 extend for v2 policy: canonical bytes of `policyData` with +/// `servtdCollateral.servtdTcbMapping` removed +/// (see `doc/tcb_mapping_design_proposal.md`). Replaces the prior six per-field +/// extends (`TAGGED_EVENT_ID_POLICY_VERSION/_ID/_SVN/_COLLATERALS`, +/// `TAGGED_EVENT_ID_SERVTD_IDENTITY`, and the `policy[]`-only use of +/// `TAGGED_EVENT_ID_POLICY = 0x1`). +pub const TAGGED_EVENT_ID_POLICY_DATA: u32 = 0x9; pub const TAGGED_EVENT_ID_TEST: u32 = 0x32; // MR index the event will be measured into @@ -123,6 +130,15 @@ pub fn write_tagged_event_log( let mut log_size = event_log_size(event_log).ok_or_else(|| anyhow!("Parsing event log"))?; let event = TaggedEvent::new(tagged_event_id, tagged_event_data); + // T15: bounds-check the event-log buffer BEFORE extending the hardware + // RTMR. RTMR extends are permanent and observed by remote attestation; + // a too-small CCEL buffer must not leave the RTMR extended with bytes + // that have no corresponding event-log record. See + // docs/threat_model/T15-rtmr-extend-before-ccel-bounds-check.md. + if event_log.len() < log_size + size_of::<CcEventHeader>() + event.as_bytes().len() { + return Err(anyhow!("Event log out of memory")); + } + let digest = calculate_digest(hash_data)?; extend_rtmr(&digest, mr_index)?; @@ -139,10 +155,6 @@ pub fn write_tagged_event_log( event_size: event.as_bytes().len() as u32, }; - if event_log.len() < log_size + size_of::<CcEventHeader>() + event.as_bytes().len() { - return Err(anyhow!("Event log out of memory")); - } - event_log[log_size..log_size + size_of::<CcEventHeader>()] .copy_from_slice(event_header.as_bytes()); log_size += size_of::<CcEventHeader>(); @@ -216,6 +228,8 @@ pub(crate) fn parse_events(event_log: &[u8]) -> Option<BTreeMap<EventName, CcEve EventName::MigTdPolicySigner, CcEvent::new(event_header, None), ); + } else if tag_id == TAGGED_EVENT_ID_POLICY_DATA { + map.insert(EventName::MigTdPolicyData, CcEvent::new(event_header, None)); } } _ => {} diff --git a/src/migtd/src/lib.rs b/src/migtd/src/lib.rs index 0dc1a5f6a..44e3fe1d5 100644 --- a/src/migtd/src/lib.rs +++ b/src/migtd/src/lib.rs @@ -54,6 +54,10 @@ pub mod quote; pub mod ratls; pub mod spdm; +// Re-export the policy crate so external consumers (e.g. the migtd bin) can +// reach v2 measurement primitives without depending on `policy` directly. +pub use ::policy; + pub const STACK_SIZE: usize = 0x20_0000; pub const HEAP_SIZE: usize = 0x70_0000; diff --git a/src/migtd/src/mig_policy.rs b/src/migtd/src/mig_policy.rs index b6f6fbb4f..d0ebe91c2 100644 --- a/src/migtd/src/mig_policy.rs +++ b/src/migtd/src/mig_policy.rs @@ -70,22 +70,28 @@ mod v2 { use spin::Once; use tdx_tdcall::tdreport::{tdcall_verify_report, TdInfo, TdxReport}; - use crate::config::get_policy_issuer_chain; use crate::event_log::{parse_events, verify_event_log}; use crate::mig_policy::get_rtmrs_from_suppl_data; use crate::migration::pre_session_data::LogErr; use crate::migration::servtd_ext::ServtdExt; - const SERVTD_ATTR_IGNORE_ATTRIBUTES: u64 = 0x1_0000_0000; - const SERVTD_ATTR_IGNORE_XFAM: u64 = 0x2_0000_0000; - const SERVTD_ATTR_IGNORE_MRTD: u64 = 0x4_0000_0000; - const SERVTD_ATTR_IGNORE_MRCONFIGID: u64 = 0x8_0000_0000; - const SERVTD_ATTR_IGNORE_MROWNER: u64 = 0x10_0000_0000; - const SERVTD_ATTR_IGNORE_MROWNERCONFIG: u64 = 0x20_0000_0000; - const SERVTD_ATTR_IGNORE_RTMR0: u64 = 0x40_0000_0000; - const SERVTD_ATTR_IGNORE_RTMR1: u64 = 0x80_0000_0000; - const SERVTD_ATTR_IGNORE_RTMR2: u64 = 0x100_0000_0000; - const SERVTD_ATTR_IGNORE_RTMR3: u64 = 0x200_0000_0000; + /// Compute the outer `tdinfo_hash` (attr=0) for the TD described by a + /// `TdInfo` returned by `TDG.MR.REPORT`. This is the canonical lookup key + /// for `servtd_tcb_mapping` after the TCB-mapping redesign. + fn tdinfo_hash_from_td_info(td: &TdInfo) -> Result<[u8; SHA384_DIGEST_SIZE], PolicyError> { + policy::compute_tdinfo_hash_from_fields( + &td.attributes, + &td.xfam, + &td.mrtd, + &td.mrconfig_id, + &td.mrowner, + &td.mrownerconfig, + &td.rtmr0, + &td.rtmr1, + &td.rtmr2, + &td.rtmr3, + ) + } lazy_static! { pub static ref VERIFIED_POLICY: Once<VerifiedPolicy<'static>> = Once::new(); @@ -99,15 +105,45 @@ mod v2 { let raw = RawPolicyData::deserialize_from_json(policy_json)?; // Get the root CA from collaterals and set it for quote verification - let verified_policy = raw.verify(cert_chain)?; + #[cfg_attr(not(feature = "servtd_corim"), allow(unused_mut))] + let mut verified_policy = raw.verify(cert_chain)?; + + // Attach the optional CoRIM hash endorsement enrolled in the CFV. Its + // COSE signer chain is bound to the SAME RTMR1 signer anchor as the CFV + // policy issuer chain, so a CoRIM signed under a different root cert or + // leaf signer EKU fails closed. The CoRIM is NOT measured + // (`config::get_servtd_corim` is never read by `do_measurements`), so + // enrolling it does not change the ServTD/`tdinfo_hash`. + // MigTD has no trusted wall clock. `decode_signed` rejects CWT + // `nbf`/`exp`; zero is used only for inner CoRIM validity validation. + #[cfg(feature = "servtd_corim")] + if let Some(cose) = crate::config::get_servtd_corim() { + let anchor = resolve_signer_anchor(cert_chain)?; + let corim = ServtdCorim::decode_signed(cose, 0, &anchor)?; + verified_policy.set_servtd_corim(corim); + log::info!("Loaded signed ServTD CoRIM endorsement"); + if let Some(servtd_crl) = verified_policy.servtd_crl.as_deref() { + verified_policy.verify_signer_chains_not_revoked(servtd_crl.as_bytes())?; + } + } + let root_ca_der = pem_cert_to_der(verified_policy.get_collaterals().root_ca.as_bytes()) .map_err(|_| PolicyError::InvalidCollateral)?; attestation::root_ca::set_ca(root_ca_der.as_ref()) .map_err(|_| PolicyError::InvalidCollateral)?; - VERIFIED_POLICY + let version = VERIFIED_POLICY .try_call_once(|| Ok(verified_policy)) - .map(|p| p.get_version().to_string()) + .map(|p| p.get_version().to_string())?; + + #[cfg(feature = "test-get-quote")] + { + log::info!("test-get-quote: testing quote generation during init\n"); + let _info = get_local_tcb_evaluation_info()?; + log::info!("test-get-quote: quote generation and verification succeeded\n"); + } + + Ok(version) } /// Generate a fresh local TCB evaluation info on demand by creating a @@ -120,7 +156,7 @@ mod v2 { _ => PolicyError::QuoteGeneration, })?; let (fmspc, suppl_data) = verify_quote("e, policy.get_collaterals())?; - setup_evaluation_data(fmspc, &suppl_data, policy, policy.get_collaterals()) + setup_evaluation_data(fmspc, &suppl_data, policy, policy, policy.get_collaterals()) } /// Get reference to the global verified policy @@ -135,12 +171,26 @@ mod v2 { policy_peer: &[u8], event_log_peer: &[u8], ) -> Result<Vec<u8>, PolicyError> { + log::info!( + "BC> POL-AR-01 authenticate_remote is_src={} quote.len={} policy.len={} event_log.len={}\n", + is_src, + quote_peer.len(), + policy_peer.len(), + event_log_peer.len() + ); let (policy_peer, peer_issuer_chain) = crate::migration::pre_session_data::decode_peer_data(policy_peer) .ok_or(PolicyError::InvalidParameter)?; + log::info!( + "BC> POL-AR-02 decode_peer_data ok policy.len={} issuer_chain.len={}\n", + policy_peer.len(), + peer_issuer_chain.len() + ); if is_src { + log::info!("BC> POL-AR-03 -> authenticate_migration_dest\n"); authenticate_migration_dest(quote_peer, event_log_peer, policy_peer, peer_issuer_chain) } else { + log::info!("BC> POL-AR-03 -> authenticate_migration_source\n"); authenticate_migration_source( quote_peer, event_log_peer, @@ -156,13 +206,19 @@ mod v2 { mig_policy_dst: &[u8], policy_issuer_chain: &[u8], ) -> Result<Vec<u8>, PolicyError> { + log::info!("BC> POL-DST-01 authenticate_remote_common BEGIN\n"); let (evaluation_data_dst, verified_policy_dst, suppl_data) = authenticate_remote_common( quote_dst, event_log_dst, mig_policy_dst, policy_issuer_chain, )?; + log::info!( + "BC> POL-DST-02 authenticate_remote_common ok suppl_data.len={}\n", + suppl_data.len() + ); let relative_reference = get_local_tcb_evaluation_info()?; + log::info!("BC> POL-DST-03 get_local_tcb_evaluation_info ok\n"); let policy = get_verified_policy().ok_or(PolicyError::InvalidParameter)?; policy.policy_data.evaluate_policy_common( @@ -170,16 +226,19 @@ mod v2 { &relative_reference, false, )?; + log::info!("BC> POL-DST-04 evaluate_policy_common ok\n"); policy.policy_data.evaluate_policy_forward( &evaluation_data_dst, &relative_reference, false, )?; + log::info!("BC> POL-DST-05 evaluate_policy_forward ok\n"); // Verify the destination's policy against local policy verified_policy_dst .policy_data .evaluate_against_policy(&policy.policy_data)?; + log::info!("BC> POL-DST-06 evaluate_against_policy ok\n"); Ok(suppl_data) } @@ -190,13 +249,19 @@ mod v2 { mig_policy_src: &[u8], policy_issuer_chain: &[u8], ) -> Result<Vec<u8>, PolicyError> { + log::info!("BC> POL-SRC-01 authenticate_remote_common BEGIN\n"); let (evaluation_data_src, _verified_policy_src, suppl_data) = authenticate_remote_common( quote_src, event_log_src, mig_policy_src, policy_issuer_chain, )?; + log::info!( + "BC> POL-SRC-02 authenticate_remote_common ok suppl_data.len={}\n", + suppl_data.len() + ); let relative_reference = get_local_tcb_evaluation_info()?; + log::info!("BC> POL-SRC-03 get_local_tcb_evaluation_info ok\n"); let policy = get_verified_policy().ok_or(PolicyError::InvalidParameter)?; policy.policy_data.evaluate_policy_common( @@ -204,11 +269,13 @@ mod v2 { &relative_reference, false, )?; + log::info!("BC> POL-SRC-04 evaluate_policy_common ok\n"); policy.policy_data.evaluate_policy_backward( &evaluation_data_src, &relative_reference, false, )?; + log::info!("BC> POL-SRC-05 evaluate_policy_backward ok\n"); Ok(suppl_data) } @@ -251,51 +318,34 @@ mod v2 { } // Authenticate the migtd-old from migtd-new side - // Per GHCI 1.5: init_tdinfo is a TDINFO_STRUCT (not full TDREPORT), - // and there is no separate init_policy JSON blob. + // The legacy init-TDINFO argument remains in the wire/API shape but the + // one-hash flow derives init identity from SERVTD_EXT. pub fn authenticate_rebinding_old( tdreport_src: &[u8], event_log_src: &[u8], mig_policy_src: &[u8], - init_tdinfo: &[u8], + _init_tdinfo: &[u8], servtd_ext_src: &[u8], ) -> Result<Vec<u8>, PolicyError> { let (mig_policy_src, peer_issuer_chain) = crate::migration::pre_session_data::decode_peer_data(mig_policy_src) .ok_or(PolicyError::InvalidParameter)?; // Verify quote src / event log src / policy src - let (evaluation_data_src, _verified_policy_src, tdx_report) = - authenticate_rebinding_common( - tdreport_src, - event_log_src, - mig_policy_src, - peer_issuer_chain, - )?; - let policy = get_verified_policy().ok_or(PolicyError::InvalidParameter)?; - - // Per GHCI 1.5: cross-check the peer's wire-claimed init TDINFO against - // the peer's verified TDREPORT — init policy signer and init SVN must - // be consistent with the peer's current self-report. - verify_peer_init_tdinfo_against_owner( - init_tdinfo, - &tdx_report.td_info.mrowner, - &tdx_report.td_info.mrownerconfig, + let (evaluation_data_src, verified_policy_src, tdx_report) = authenticate_rebinding_common( + tdreport_src, + event_log_src, + mig_policy_src, + peer_issuer_chain, )?; + let policy = get_verified_policy().ok_or(PolicyError::InvalidParameter)?; - // Verify the init tdinfo against servtd_ext hash let servtd_ext_src_obj = ServtdExt::read_from_bytes(servtd_ext_src).ok_or(PolicyError::InvalidParameter)?; - let init_td_info = verify_init_tdinfo(init_tdinfo, &servtd_ext_src_obj)?; - let _engine_svn = policy - .servtd_tcb_mapping - .get_engine_svn_by_measurements(&Measurements::new_from_bytes( - &init_td_info.mrtd, - &init_td_info.rtmr0, - &init_td_info.rtmr1, - None, - None, - )) - .ok_or(PolicyError::SvnMismatch)?; + verify_init_servtd_svn_order( + &verified_policy_src, + &evaluation_data_src, + &servtd_ext_src_obj, + )?; // If backward policy exists, evaluate the migration src based on it. let relative_reference = get_local_tcb_evaluation_info()?; @@ -317,8 +367,16 @@ mod v2 { let policy = get_verified_policy().ok_or(PolicyError::InvalidParameter)?; // 1. Verify quote & get supplemental data + log::info!( + "BC> POL-CMN-01 verify_quote begin quote.len={}\n", + quote.len() + ); let (fmspc, suppl_data) = verify_quote(quote, policy.get_collaterals()) .map_err(|_| PolicyError::QuoteVerification)?; + log::info!( + "BC> POL-CMN-02 verify_quote ok suppl_data.len={}\n", + suppl_data.len() + ); // 2. Verify the signature of the provided policy and the integrity of the event log let verified_policy = verify_policy_and_event_log( @@ -327,14 +385,17 @@ mod v2 { policy_issuer_chain, &get_rtmrs_from_suppl_data(&suppl_data)?, )?; + log::info!("BC> POL-CMN-03 verify_policy_and_event_log ok\n"); // 3. Get TCB evaluation info from the collaterals let evaluation_data = setup_evaluation_data( fmspc, &suppl_data, &verified_policy, + policy, policy.get_collaterals(), )?; + log::info!("BC> POL-CMN-04 setup_evaluation_data ok\n"); Ok((evaluation_data, verified_policy, suppl_data)) } @@ -357,12 +418,42 @@ mod v2 { )?; // 3. Get TCB evaluation info from the collaterals - let evaluation_data = - setup_evaluation_data_with_tdreport(&tdreport_verified, &verified_policy)?; + let local_policy = get_verified_policy().ok_or(PolicyError::InvalidParameter)?; + let evaluation_data = setup_evaluation_data_with_tdreport( + &tdreport_verified, + &verified_policy, + local_policy, + )?; Ok((evaluation_data, verified_policy, tdreport_verified)) } + fn verify_svn_order( + init_svn: Option<u16>, + current_svn: Option<u16>, + ) -> Result<(), PolicyError> { + let init_svn = init_svn.ok_or(PolicyError::UnqualifiedMigTdInfo)?; + let current_svn = current_svn.ok_or(PolicyError::UnqualifiedMigTdInfo)?; + if init_svn > current_svn { + return Err(PolicyError::SvnMismatch); + } + Ok(()) + } + + /// Resolve both releases through the authenticated source's one-hash + /// mapping. The destination's local mapping is intentionally not used. + fn verify_init_servtd_svn_order( + source_policy: &VerifiedPolicy, + source_evaluation: &PolicyEvaluationInfo, + servtd_ext: &ServtdExt, + ) -> Result<(), PolicyError> { + let init_svn = source_policy + .servtd_lookup_by_tdinfo_hash(&servtd_ext.init_servtd_info_hash) + .map(|lookup| lookup.isvsvn); + + verify_svn_order(init_svn, source_evaluation.migtd_isvsvn) + } + fn get_rtmrs_from_tdreport( td_report: &TdxReport, ) -> Result<[[u8; SHA384_DIGEST_SIZE]; 4], PolicyError> { @@ -388,31 +479,65 @@ mod v2 { verify_event_log(event_log, rtmrs).map_err(|_| PolicyError::InvalidEventLog)?; // 2. Verify the peer policy using the peer's issuer chain - let verified_policy = unverified_policy.verify(policy_issuer_chain)?; - - // 3. Validate that peer's chains share the same root CA and leaf - // subject name as our local chains. let local_policy = get_verified_policy().ok_or(PolicyError::InvalidParameter)?; - let local_chain = get_policy_issuer_chain().ok_or(PolicyError::InvalidParameter)?; - crypto::validate_peer_cert_chain( - local_chain, - verified_policy.policy_issuer_chain.as_bytes(), - ) - .log_err("Peer policy cert chain validation") - .map_err(|_| PolicyError::PeerCertChainValidation)?; + let local_servtd_crl = local_policy.servtd_crl.as_deref().map(str::as_bytes); + let mut verified_policy = unverified_policy + .verify_with_authoritative_servtd_crl(policy_issuer_chain, local_servtd_crl)?; + + // 3. Validate that the peer's signer matches ours by comparing the + // RTMR1 signer anchor (root CA + leaf signer EKU) instead of the + // full policy issuer chain PEM. This supports the anchor-only (CoRIM) + // enrollment form, which carries no PEM. `verify()` has already + // bound the peer's embedded mapping chain to `signer_anchor`. + if local_policy.signer_anchor != verified_policy.signer_anchor { + return Err(PolicyError::PeerCertChainValidation); + } - crypto::validate_peer_cert_chain( - local_policy.servtd_identity_issuer_chain.as_bytes(), - verified_policy.servtd_identity_issuer_chain.as_bytes(), - ) - .log_err("Peer identity cert chain validation") - .map_err(|_| PolicyError::PeerCertChainValidation)?; - crypto::validate_peer_cert_chain( - local_policy.servtd_tcb_mapping_issuer_chain.as_bytes(), - verified_policy.servtd_tcb_mapping_issuer_chain.as_bytes(), - ) - .log_err("Peer tcb mapping cert chain validation") - .map_err(|_| PolicyError::PeerCertChainValidation)?; + // Cross-check the JSON mapping issuer chains when both sides ship one + // (defense-in-depth; the signer_anchor equality above already binds the + // signer). Absent on both sides (CoRIM-only) is fine; one-sided fails. + match ( + local_policy.servtd_tcb_mapping_issuer_chain.as_deref(), + verified_policy.servtd_tcb_mapping_issuer_chain.as_deref(), + ) { + (Some(local_mc), Some(peer_mc)) => { + crypto::validate_peer_cert_chain(local_mc.as_bytes(), peer_mc.as_bytes()) + .log_err("Peer tcb mapping cert chain validation") + .map_err(|_| PolicyError::PeerCertChainValidation)?; + } + (None, None) => {} + _ => return Err(PolicyError::PeerCertChainValidation), + } + + // Validate the peer's optional TD Identity issuer chain against ours + // when both sides ship one. If exactly one side has it, the chains do + // not match and it fails closed. + match ( + local_policy.servtd_identity_issuer_chain.as_deref(), + verified_policy.servtd_identity_issuer_chain.as_deref(), + ) { + (Some(local_identity_chain), Some(peer_identity_chain)) => { + crypto::validate_peer_cert_chain( + local_identity_chain.as_bytes(), + peer_identity_chain.as_bytes(), + ) + .log_err("Peer td identity cert chain validation") + .map_err(|_| PolicyError::PeerCertChainValidation)?; + } + (None, None) => {} + _ => return Err(PolicyError::PeerCertChainValidation), + } + + // CoRIM is a local endorsement authority, not peer-supplied policy + // data. Attach our verified CoRIM for peer TCB lookups, then apply our + // measured CRL to every retained peer/local-authority signer chain. + #[cfg(feature = "servtd_corim")] + verified_policy.set_servtd_corim_from(local_policy); + if let Some(servtd_crl) = local_servtd_crl { + verified_policy + .verify_signer_chains_not_revoked(servtd_crl) + .log_err("Peer servtd signer revocation check")?; + } // 4. Check the integrity of the policy with its event log let events = parse_events(event_log).ok_or(PolicyError::InvalidEventLog)?; @@ -459,105 +584,26 @@ mod v2 { Ok(tdx_report) } - /// Per GHCI 1.5: verifies TDINFO_STRUCT integrity against ServtdExt info hash. - /// - /// Parses the TDINFO bytes, applies IGNORE masks from `servtd_attr`, computes - /// `SHA384(masked_tdinfo)`, and compares to `init_servtd_info_hash`. - /// Returns the parsed TdInfo on success. - /// - /// This function is only called when SERVTD_EXT is supported (the sender - /// gates on TDCS.ATTRIBUTES bit 17 before sending init_tdinfo). - fn verify_servtd_info_hash( - tdinfo_bytes: &[u8], - servtd_attr: u64, - init_servtd_info_hash: &[u8], - ) -> Result<TdInfo, PolicyError> { - if tdinfo_bytes.len() < size_of::<TdInfo>() { - return Err(PolicyError::InvalidParameter); - } - - // Parse TdInfo directly from bytes - let mut td_info = { - let mut uninit = core::mem::MaybeUninit::<TdInfo>::uninit(); - unsafe { - core::ptr::copy_nonoverlapping( - tdinfo_bytes.as_ptr(), - uninit.as_mut_ptr() as *mut u8, - size_of::<TdInfo>(), - ); - uninit.assume_init() - } - }; - - if (servtd_attr & SERVTD_ATTR_IGNORE_ATTRIBUTES) != 0 { - td_info.attributes.fill(0); - } - if (servtd_attr & SERVTD_ATTR_IGNORE_XFAM) != 0 { - td_info.xfam.fill(0); - } - if (servtd_attr & SERVTD_ATTR_IGNORE_MRTD) != 0 { - td_info.mrtd.fill(0); - } - if (servtd_attr & SERVTD_ATTR_IGNORE_MRCONFIGID) != 0 { - td_info.mrconfig_id.fill(0); - } - if (servtd_attr & SERVTD_ATTR_IGNORE_MROWNER) != 0 { - td_info.mrowner.fill(0); - } - if (servtd_attr & SERVTD_ATTR_IGNORE_MROWNERCONFIG) != 0 { - td_info.mrownerconfig.fill(0); - } - if (servtd_attr & SERVTD_ATTR_IGNORE_RTMR0) != 0 { - td_info.rtmr0.fill(0); - } - if (servtd_attr & SERVTD_ATTR_IGNORE_RTMR1) != 0 { - td_info.rtmr1.fill(0); - } - if (servtd_attr & SERVTD_ATTR_IGNORE_RTMR2) != 0 { - td_info.rtmr2.fill(0); - } - if (servtd_attr & SERVTD_ATTR_IGNORE_RTMR3) != 0 { - td_info.rtmr3.fill(0); - } - - let info_hash = - digest_sha384(td_info.as_bytes()).map_err(|_| PolicyError::HashCalculation)?; - - if info_hash.as_slice() != init_servtd_info_hash { - log::error!("verify_servtd_info_hash: HASH MISMATCH\n"); - return Err(PolicyError::InvalidTdReport); - } - - Ok(td_info) - } - - /// Per GHCI 1.5: verifies TDINFO_STRUCT against servtd_ext info hash - fn verify_init_tdinfo( - init_tdinfo: &[u8], - servtd_ext: &ServtdExt, - ) -> Result<TdInfo, PolicyError> { - verify_servtd_info_hash( - init_tdinfo, - u64::from_le_bytes(servtd_ext.init_attr), - &servtd_ext.init_servtd_info_hash, - ) - } - - fn get_rtmrs_from_tdinfo( - td_info: &TdInfo, - ) -> Result<[[u8; SHA384_DIGEST_SIZE]; 4], PolicyError> { - let mut rtmrs = [[0u8; SHA384_DIGEST_SIZE]; 4]; - rtmrs[0].copy_from_slice(&td_info.rtmr0); - rtmrs[1].copy_from_slice(&td_info.rtmr1); - rtmrs[2].copy_from_slice(&td_info.rtmr2); - rtmrs[3].copy_from_slice(&td_info.rtmr3); - Ok(rtmrs) + /// Compute the servtd signer CRL number from the authoritative local + /// policy, if a signer CRL is present (`servtdCrl`, or its legacy nested + /// location). Peer evaluation uses this local number rather than trusting + /// the peer-delivered CRL. `None` when it is absent (backward + /// compatibility); `Some(n)` feeds the `servtd_crl_num` anti-rollback + /// floor. + fn servtd_crl_num_from_policy(policy: &VerifiedPolicy) -> Result<Option<u32>, PolicyError> { + policy + .servtd_crl + .as_deref() + .map(|crl| get_crl_number(crl.as_bytes())) + .transpose() + .map_err(|_| PolicyError::InvalidCollateral) } fn setup_evaluation_data( fmspc: [u8; 6], suppl_data: &[u8], policy: &VerifiedPolicy, + authoritative_crl_policy: &VerifiedPolicy, collaterals: &Collaterals, ) -> Result<PolicyEvaluationInfo, PolicyError> { let (tcb_date, tcb_status) = get_tcb_date_and_status_from_suppl_data(suppl_data)?; @@ -565,11 +611,7 @@ mod v2 { let tcb_evaluation_number = get_tcb_evaluation_number_from_collateral(&collateral)?; let report_value = Report::new(suppl_data)?; - let migtd_svn = policy - .servtd_tcb_mapping - .get_engine_svn_by_report(&report_value); - - let migtd_tcb = migtd_svn.and_then(|svn| policy.servtd_identity.get_tcb_level_by_svn(svn)); + let migtd = policy.servtd_lookup_by_report(&report_value); let pck_crl_num = get_crl_number(collaterals.pck_crl.as_bytes()) .map_err(|_| PolicyError::InvalidCollateral)?; let root_ca_crl_num = get_crl_number(collaterals.root_ca_crl.as_bytes()) @@ -581,29 +623,37 @@ mod v2 { tcb_status: Some(tcb_status.as_str().to_string()), tcb_evaluation_number: Some(tcb_evaluation_number), fmspc: Some(fmspc), - migtd_isvsvn: migtd_svn, - migtd_tcb_date: migtd_tcb.map(|tcb| tcb.tcb_date.clone()), - migtd_tcb_status: migtd_tcb.map(|tcb| tcb.tcb_status.clone()), + migtd_isvsvn: migtd.as_ref().map(|m| m.isvsvn), + migtd_tcb_status: migtd.as_ref().and_then(|m| m.tcb_status.clone()), + migtd_tcb_date: migtd.as_ref().and_then(|m| m.tcb_date.clone()), pck_crl_num: Some(pck_crl_num), root_ca_crl_num: Some(root_ca_crl_num), + servtd_crl_num: servtd_crl_num_from_policy(authoritative_crl_policy)?, }) } fn setup_evaluation_data_with_tdreport( tdreport: &TdxReport, policy: &VerifiedPolicy, + authoritative_crl_policy: &VerifiedPolicy, ) -> Result<PolicyEvaluationInfo, PolicyError> { - let migtd_svn = policy.servtd_tcb_mapping.get_engine_svn_by_measurements( - &Measurements::new_from_bytes( - &tdreport.td_info.mrtd, - &tdreport.td_info.rtmr0, - &tdreport.td_info.rtmr1, - None, - None, - ), - ); + #[cfg(feature = "use-mock-quote")] + let mock_tdreport = attestation::tdreport::tdcall_report( + &[0u8; attestation::tdreport::TD_REPORT_ADDITIONAL_DATA_SIZE], + ) + .map_err(|_| PolicyError::GetTdxReport)?; + #[cfg(feature = "use-mock-quote")] + let mapping_tdreport = { + log::warn!( + "use-mock-quote: deriving rebinding MigTD TCB metadata from the mock quote report\n" + ); + &mock_tdreport + }; + #[cfg(not(feature = "use-mock-quote"))] + let mapping_tdreport = tdreport; - let migtd_tcb = migtd_svn.and_then(|svn| policy.servtd_identity.get_tcb_level_by_svn(svn)); + let tdinfo_hash = tdinfo_hash_from_td_info(&mapping_tdreport.td_info)?; + let migtd = policy.servtd_lookup_by_tdinfo_hash(&tdinfo_hash); Ok(PolicyEvaluationInfo { tee_tcb_svn: Some(tdreport.tee_tcb_info.tee_tcb_svn), @@ -611,11 +661,12 @@ mod v2 { tcb_status: None, tcb_evaluation_number: None, fmspc: None, - migtd_isvsvn: migtd_svn, - migtd_tcb_date: migtd_tcb.map(|tcb| tcb.tcb_date.clone()), - migtd_tcb_status: migtd_tcb.map(|tcb| tcb.tcb_status.clone()), + migtd_isvsvn: migtd.as_ref().map(|m| m.isvsvn), + migtd_tcb_status: migtd.as_ref().and_then(|m| m.tcb_status.clone()), + migtd_tcb_date: migtd.as_ref().and_then(|m| m.tcb_date.clone()), pck_crl_num: None, root_ca_crl_num: None, + servtd_crl_num: servtd_crl_num_from_policy(authoritative_crl_policy)?, }) } @@ -672,12 +723,14 @@ mod v2 { }) } - /// Per GHCI 1.5: Verify that own TDINFO.MROWNER matches policy signing key hash - /// and TDINFO.MROWNERCONFIG matches policy SVN. + /// Per GHCI 1.5: Verify that own TDINFO.MROWNERCONFIG matches policy SVN. + /// + /// NOTE: the `MROWNER == SHA384(policy-signer public key)` binding has been + /// **deprecated** — the policy-signer trust root is now the RTMR1 signer + /// anchor, and the CoRIM-only enrollment carries no signer public key in + /// the image. Only the MROWNERCONFIG (policy SVN) binding is enforced. /// Must be called at MigTD startup to ensure VMM correctly provisioned the TD. pub fn verify_own_tdinfo() -> Result<(), PolicyError> { - use crate::config::get_policy_issuer_chain; - let policy = get_verified_policy().ok_or(PolicyError::InvalidParameter)?; let policy_svn = policy.policy_data.get_policy_svn(); @@ -694,147 +747,12 @@ mod v2 { return Err(PolicyError::SvnMismatch); } - // Verify MROWNER == SHA384(policy signing public key) - let policy_issuer_chain = get_policy_issuer_chain().ok_or(PolicyError::InvalidParameter)?; - let policy_key_hash = crypto::get_policy_signer_key_hash(policy_issuer_chain) - .map_err(|_| PolicyError::InvalidCollateral)?; - if td_info.mrowner != policy_key_hash { - return Err(PolicyError::PolicyHashMismatch); - } - - Ok(()) - } - - /// Per GHCI 1.5: Verify initMigtdData.MROWNER matches own policy signer key hash - /// and initMigtdData.MROWNERCONFIG <= own policy SVN. - pub fn verify_init_migtd_data_policy_binding( - init_td_info: &[u8; crate::migration::TD_INFO_SIZE], - ) -> Result<(), PolicyError> { - use crate::config::get_policy_issuer_chain; - use crate::migration::{td_info_mrowner, td_info_mrownerconfig}; - - let policy = get_verified_policy().ok_or(PolicyError::InvalidParameter)?; - let my_policy_svn = policy.policy_data.get_policy_svn(); - - // Check MROWNER == own policy signer key hash - let policy_issuer_chain = get_policy_issuer_chain().ok_or(PolicyError::InvalidParameter)?; - let policy_key_hash = crypto::get_policy_signer_key_hash(policy_issuer_chain) - .map_err(|_| PolicyError::InvalidCollateral)?; - if td_info_mrowner(init_td_info) != &policy_key_hash { - return Err(PolicyError::PolicyHashMismatch); - } - - // Check MROWNERCONFIG (init policy_svn) <= my policy_svn - let init_mrownerconfig = td_info_mrownerconfig(init_td_info); - let mut init_svn_bytes = [0u8; 4]; - init_svn_bytes.copy_from_slice(&init_mrownerconfig[..4]); - let init_policy_svn = u32::from_le_bytes(init_svn_bytes); - // Remaining 44 bytes should be zero - if init_mrownerconfig[4..] != [0u8; SHA384_DIGEST_SIZE - 4] { - return Err(PolicyError::InvalidParameter); - } - if init_policy_svn > my_policy_svn { - return Err(PolicyError::SvnMismatch); - } - Ok(()) } - /// Per GHCI 1.5: Cross-check a peer's wire-supplied init TDINFO_STRUCT against - /// the peer's authenticated TDREPORT (or equivalent verified report data). - /// - /// The peer's `init.MROWNER` must equal the peer's report MROWNER (policy - /// signer hash). The peer's `init.MROWNERCONFIG` first 4 bytes encode the - /// init policy SVN as little-endian u32 with the remaining 44 bytes zero; - /// that init SVN must be less than or equal to the SVN encoded the same way - /// in the peer's report MROWNERCONFIG. - /// - /// `peer_mrowner` and `peer_mrownerconfig` are the peer's authentic values, - /// taken from a verified TDREPORT (`TdInfo::mrowner` / `mrownerconfig`) or - /// from quote-verification supplemental data - /// (`Report::R_MIGTD_MROWNER` / `R_MIGTD_MROWNERCONFIG`). - pub fn verify_peer_init_tdinfo_against_owner( - peer_init_td_info: &[u8], - peer_mrowner: &[u8], - peer_mrownerconfig: &[u8], - ) -> Result<(), PolicyError> { - use crate::migration::{td_info_mrowner, td_info_mrownerconfig, TD_INFO_SIZE}; - - if peer_init_td_info.len() != TD_INFO_SIZE - || peer_mrowner.len() != SHA384_DIGEST_SIZE - || peer_mrownerconfig.len() != SHA384_DIGEST_SIZE - { - return Err(PolicyError::InvalidParameter); - } - - let init: &[u8; TD_INFO_SIZE] = peer_init_td_info - .try_into() - .map_err(|_| PolicyError::InvalidParameter)?; - let init_mrowner = td_info_mrowner(init); - let init_mrownerconfig = td_info_mrownerconfig(init); - - // 1. MROWNER (policy signer key hash) must match peer's current report - if init_mrowner.as_slice() != peer_mrowner { - return Err(PolicyError::PolicyHashMismatch); - } - - // 2. init MROWNERCONFIG must be well-formed: first 4 bytes encode SVN, - // remaining 44 bytes must be zero. - if init_mrownerconfig[4..] != [0u8; SHA384_DIGEST_SIZE - 4] { - return Err(PolicyError::InvalidParameter); - } - - // 3. Peer report MROWNERCONFIG must also be well-formed: a genuine - // MigTD enforces this at startup, but we verify it locally instead - // of relying on the peer's self-check. - if peer_mrownerconfig[4..] != [0u8; SHA384_DIGEST_SIZE - 4] { - return Err(PolicyError::InvalidParameter); - } - - // 4. init policy SVN must be ≤ peer report policy SVN. - let mut buf = [0u8; 4]; - buf.copy_from_slice(&init_mrownerconfig[..4]); - let init_svn = u32::from_le_bytes(buf); - buf.copy_from_slice(&peer_mrownerconfig[..4]); - let peer_svn = u32::from_le_bytes(buf); - if init_svn > peer_svn { - return Err(PolicyError::SvnMismatch); - } - - Ok(()) - } - - /// Cross-check a peer's wire-supplied init `TDINFO_STRUCT` against the - /// MROWNER/MROWNERCONFIG bytes carried in the peer's verified quote - /// supplemental data (see `Report::R_MIGTD_MROWNER` / - /// `Report::R_MIGTD_MROWNERCONFIG`). - /// - /// This is a pure function: it length-checks `verified_suppl_data` before - /// slicing so it cannot panic on a too-short buffer, and it does not - /// invoke quote verification. Callers that want the combined attestation - /// + cross-check should use `authenticate_migration_source_with_init_tdinfo`. - pub fn verify_peer_init_tdinfo_against_suppl_data( - peer_init_td_info: &[u8], - verified_suppl_data: &[u8], - ) -> Result<(), PolicyError> { - if verified_suppl_data.len() < REPORT_DATA_SIZE { - return Err(PolicyError::InvalidParameter); - } - verify_peer_init_tdinfo_against_owner( - peer_init_td_info, - &verified_suppl_data[Report::R_MIGTD_MROWNER], - &verified_suppl_data[Report::R_MIGTD_MROWNERCONFIG], - ) - } - - /// Destination-side migration helper: verify the source MigTD's - /// quote/event log, cross-check init TDINFO against the quote's - /// supplemental data, verify init TDINFO integrity against ServtdExt, - /// and allowlist-gate init measurements against servtd_tcb_mapping. - /// - /// This mirrors the checks that `authenticate_rebinding_old` performs - /// for the rebinding path, ensuring parity between migration and - /// rebinding attestation. + /// Destination-side migration helper: authenticate the source MigTD and + /// require its initial mapped SVN to be no newer than its current mapped + /// SVN. The legacy init-TDINFO argument is ignored for wire compatibility. /// /// Returns the verified supplemental data on success so the caller can /// reuse it for SPDM-level bindings (e.g., REPORTDATA / TH1). @@ -842,14 +760,14 @@ mod v2 { quote_src: &[u8], peer_data: &[u8], event_log_src: &[u8], - init_tdinfo: &[u8], + _init_tdinfo: &[u8], servtd_ext_src: &[u8], ) -> Result<Vec<u8>, PolicyError> { let (mig_policy_src, peer_issuer_chain) = crate::migration::pre_session_data::decode_peer_data(peer_data) .ok_or(PolicyError::InvalidParameter)?; - let (evaluation_data_src, _verified_policy_src, suppl_data) = authenticate_remote_common( + let (evaluation_data_src, verified_policy_src, suppl_data) = authenticate_remote_common( quote_src, event_log_src, mig_policy_src, @@ -871,329 +789,52 @@ mod v2 { false, )?; - // Cross-check init TDINFO against MROWNER/MROWNERCONFIG from - // verified quote supplemental data, verify init TDINFO integrity - // against ServtdExt hash, and allowlist-gate init measurements. - // - // Skipped when running with mock quotes/reports that carry static - // test data — the mock init TDINFO does not have measurements - // that match the policy servtd_tcb_mapping. - #[cfg(not(any( - feature = "AzCVMEmu", - feature = "test_mock_report", - feature = "use-mock-quote" - )))] - { - verify_peer_init_tdinfo_against_suppl_data(init_tdinfo, &suppl_data)?; - - // Verify init TDINFO integrity against ServtdExt hash - let servtd_ext_obj = - ServtdExt::read_from_bytes(servtd_ext_src).ok_or(PolicyError::InvalidParameter)?; - let init_td_info = verify_init_tdinfo(init_tdinfo, &servtd_ext_obj)?; - - // Allowlist gate: init MigTD measurements must be in servtd_tcb_mapping - let _engine_svn = policy - .servtd_tcb_mapping - .get_engine_svn_by_measurements(&Measurements::new_from_bytes( - &init_td_info.mrtd, - &init_td_info.rtmr0, - &init_td_info.rtmr1, - None, - None, - )) - .ok_or(PolicyError::SvnMismatch)?; - } + let servtd_ext = + ServtdExt::read_from_bytes(servtd_ext_src).ok_or(PolicyError::InvalidParameter)?; + verify_init_servtd_svn_order(&verified_policy_src, &evaluation_data_src, &servtd_ext)?; Ok(suppl_data) } #[test] - fn test_unix_to_iso8601() { - let timestamp = 1704067200; // Corresponds to 2024-01-01T00:00:00Z - let iso_date = unix_to_iso8601(timestamp).unwrap(); - assert_eq!(iso_date, "2024-01-01T00:00:00Z"); + fn test_verify_svn_order_init_lower() { + assert!(verify_svn_order(Some(3), Some(5)).is_ok()); } #[test] - fn test_verify_servtd_info_hash_valid() { - // Build a 512-byte TDINFO_STRUCT with known content - let mut tdinfo_bytes = [0u8; 512]; - tdinfo_bytes[0..8].copy_from_slice(&[0x01; 8]); // attributes - tdinfo_bytes[8..16].copy_from_slice(&[0x02; 8]); // xfam - - // Compute expected hash: SHA384(tdinfo) - let servtd_attr: u64 = 0; - let expected_hash = digest_sha384(&tdinfo_bytes).unwrap(); - - let result = verify_servtd_info_hash(&tdinfo_bytes, servtd_attr, &expected_hash); - assert!(result.is_ok()); - let td_info = result.unwrap(); - assert_eq!(td_info.attributes, [0x01; 8]); - assert_eq!(td_info.xfam, [0x02; 8]); + fn test_verify_svn_order_equal() { + assert!(verify_svn_order(Some(5), Some(5)).is_ok()); } #[test] - fn test_verify_servtd_info_hash_wrong_hash() { - let tdinfo_bytes = [0u8; 512]; - let wrong_hash = [0xFFu8; 48]; - let result = verify_servtd_info_hash(&tdinfo_bytes, 0, &wrong_hash); - assert!(result.is_err()); - } - - #[test] - fn test_verify_servtd_info_hash_short_input() { - let short = [0u8; 256]; // too small for TdInfo (512 bytes) - let result = verify_servtd_info_hash(&short, 0, &[0u8; 48]); - assert!(matches!(result, Err(PolicyError::InvalidParameter))); - } - - #[test] - fn test_verify_servtd_info_hash_with_ignore_attributes() { - // Build TdInfo with non-zero attributes - let mut tdinfo_bytes = [0u8; 512]; - tdinfo_bytes[0..8].copy_from_slice(&[0xFF; 8]); // attributes - - // Compute hash with attributes zeroed (IGNORE_ATTRIBUTES flag) - let servtd_attr = SERVTD_ATTR_IGNORE_ATTRIBUTES; - let mut zeroed = tdinfo_bytes; - zeroed[0..8].fill(0); // zero attributes for hash computation - let expected_hash = digest_sha384(&zeroed).unwrap(); - - let result = verify_servtd_info_hash(&tdinfo_bytes, servtd_attr, &expected_hash); - assert!(result.is_ok()); - } - - #[test] - fn test_verify_servtd_info_hash_with_ignore_mrowner() { - // Build TdInfo with non-zero mrowner at offset 112..160 - let mut tdinfo_bytes = [0u8; 512]; - tdinfo_bytes[112..160].copy_from_slice(&[0xAA; 48]); // mrowner - - // Compute hash with mrowner zeroed (IGNORE_MROWNER flag) - let servtd_attr = SERVTD_ATTR_IGNORE_MROWNER; - let mut zeroed = tdinfo_bytes; - zeroed[112..160].fill(0); - let expected_hash = digest_sha384(&zeroed).unwrap(); - - let result = verify_servtd_info_hash(&tdinfo_bytes, servtd_attr, &expected_hash); - assert!(result.is_ok()); - // mrowner should be zeroed in the returned TdInfo - assert_eq!(result.unwrap().mrowner, [0u8; 48]); - } - - #[test] - fn test_verify_servtd_info_hash_with_combined_ignore_flags() { - // Build TdInfo with non-zero content in multiple fields - let mut tdinfo_bytes = [0u8; 512]; - tdinfo_bytes[0..8].copy_from_slice(&[0xFF; 8]); // attributes (masked) - tdinfo_bytes[8..16].copy_from_slice(&[0xEE; 8]); // xfam (masked) - tdinfo_bytes[16..64].copy_from_slice(&[0xBB; 48]); // mrtd (not masked) - tdinfo_bytes[112..160].copy_from_slice(&[0xCC; 48]); // mrowner (not masked) - - // Compute hash with attributes and xfam zeroed, mrtd and mrowner intact - let servtd_attr = SERVTD_ATTR_IGNORE_ATTRIBUTES | SERVTD_ATTR_IGNORE_XFAM; - let mut zeroed = tdinfo_bytes; - zeroed[0..8].fill(0); - zeroed[8..16].fill(0); - let expected_hash = digest_sha384(&zeroed).unwrap(); - - let result = verify_servtd_info_hash(&tdinfo_bytes, servtd_attr, &expected_hash); - assert!(result.is_ok()); - let td_info = result.unwrap(); - assert_eq!(td_info.attributes, [0u8; 8]); - assert_eq!(td_info.xfam, [0u8; 8]); - assert_eq!(td_info.mrtd, [0xBB; 48]); - assert_eq!(td_info.mrowner, [0xCC; 48]); - } - - #[test] - fn test_get_rtmrs_from_tdinfo() { - use tdx_tdcall::tdreport::TdInfo; - let mut tdinfo_bytes = [0u8; 512]; - // RTMR offsets in TdInfo: rtmr0 at 208, rtmr1 at 256, rtmr2 at 304, rtmr3 at 352 - tdinfo_bytes[208..256].copy_from_slice(&[0x01; 48]); // rtmr0 - tdinfo_bytes[256..304].copy_from_slice(&[0x02; 48]); // rtmr1 - tdinfo_bytes[304..352].copy_from_slice(&[0x03; 48]); // rtmr2 - tdinfo_bytes[352..400].copy_from_slice(&[0x04; 48]); // rtmr3 - - let td_info = unsafe { - let mut uninit = core::mem::MaybeUninit::<TdInfo>::uninit(); - core::ptr::copy_nonoverlapping( - tdinfo_bytes.as_ptr(), - uninit.as_mut_ptr() as *mut u8, - size_of::<TdInfo>(), - ); - uninit.assume_init() - }; - - let rtmrs = get_rtmrs_from_tdinfo(&td_info).unwrap(); - assert_eq!(rtmrs[0], [0x01; 48]); - assert_eq!(rtmrs[1], [0x02; 48]); - assert_eq!(rtmrs[2], [0x03; 48]); - assert_eq!(rtmrs[3], [0x04; 48]); - } - - // Build a 512-byte TDINFO_STRUCT with the supplied MROWNER bytes and an - // MROWNERCONFIG whose first 4 LE bytes encode `svn` and trailing 44 are - // zero (the well-formed shape defined by GHCI 1.5). - fn make_init_tdinfo(mrowner: &[u8; 48], svn: u32) -> [u8; 512] { - let mut bytes = [0u8; 512]; - bytes[112..160].copy_from_slice(mrowner); // mrowner - let svn_le = svn.to_le_bytes(); - bytes[160..164].copy_from_slice(&svn_le); - // bytes[164..208] already zero (trailing of mrownerconfig) - bytes - } - - fn make_peer_mrownerconfig(svn: u32) -> [u8; 48] { - let mut buf = [0u8; 48]; - buf[..4].copy_from_slice(&svn.to_le_bytes()); - buf - } - - #[test] - fn test_verify_peer_init_tdinfo_match_equal_svn() { - let mrowner = [0xAAu8; 48]; - let init = make_init_tdinfo(&mrowner, 5); - let peer_mrownerconfig = make_peer_mrownerconfig(5); - - let result = verify_peer_init_tdinfo_against_owner(&init, &mrowner, &peer_mrownerconfig); - assert!(result.is_ok()); - } - - #[test] - fn test_verify_peer_init_tdinfo_init_svn_less_than_peer() { - let mrowner = [0xAAu8; 48]; - let init = make_init_tdinfo(&mrowner, 3); - let peer_mrownerconfig = make_peer_mrownerconfig(7); - - let result = verify_peer_init_tdinfo_against_owner(&init, &mrowner, &peer_mrownerconfig); - assert!(result.is_ok()); - } - - #[test] - fn test_verify_peer_init_tdinfo_init_svn_greater_rejected() { - let mrowner = [0xAAu8; 48]; - let init = make_init_tdinfo(&mrowner, 10); - let peer_mrownerconfig = make_peer_mrownerconfig(5); - - let result = verify_peer_init_tdinfo_against_owner(&init, &mrowner, &peer_mrownerconfig); - assert!(matches!(result, Err(PolicyError::SvnMismatch))); - } - - #[test] - fn test_verify_peer_init_tdinfo_mrowner_mismatch_rejected() { - let init_mrowner = [0xAAu8; 48]; - let peer_mrowner = [0xBBu8; 48]; - let init = make_init_tdinfo(&init_mrowner, 5); - let peer_mrownerconfig = make_peer_mrownerconfig(5); - - let result = - verify_peer_init_tdinfo_against_owner(&init, &peer_mrowner, &peer_mrownerconfig); - assert!(matches!(result, Err(PolicyError::PolicyHashMismatch))); - } - - #[test] - fn test_verify_peer_init_tdinfo_malformed_mrownerconfig_rejected() { - let mrowner = [0xAAu8; 48]; - let mut init = make_init_tdinfo(&mrowner, 5); - // Corrupt the trailing-zero portion of MROWNERCONFIG (bytes 164..208). - init[200] = 0x01; - let peer_mrownerconfig = make_peer_mrownerconfig(5); - - let result = verify_peer_init_tdinfo_against_owner(&init, &mrowner, &peer_mrownerconfig); - assert!(matches!(result, Err(PolicyError::InvalidParameter))); - } - - #[test] - fn test_verify_peer_init_tdinfo_malformed_peer_mrownerconfig_rejected() { - let mrowner = [0xAAu8; 48]; - let init = make_init_tdinfo(&mrowner, 5); - let mut peer_mrownerconfig = make_peer_mrownerconfig(5); - // Corrupt the trailing-zero portion of the peer's MROWNERCONFIG. - peer_mrownerconfig[20] = 0x01; - - let result = verify_peer_init_tdinfo_against_owner(&init, &mrowner, &peer_mrownerconfig); - assert!(matches!(result, Err(PolicyError::InvalidParameter))); - } - - #[test] - fn test_verify_peer_init_tdinfo_wrong_lengths_rejected() { - let mrowner = [0xAAu8; 48]; - let init = make_init_tdinfo(&mrowner, 5); - let peer_mrownerconfig = make_peer_mrownerconfig(5); - - // Short init buffer - let short_init = &init[..256]; - assert!(matches!( - verify_peer_init_tdinfo_against_owner(short_init, &mrowner, &peer_mrownerconfig), - Err(PolicyError::InvalidParameter) - )); - - // Wrong mrowner length - let short_mrowner = &mrowner[..32]; - assert!(matches!( - verify_peer_init_tdinfo_against_owner(&init, short_mrowner, &peer_mrownerconfig), - Err(PolicyError::InvalidParameter) - )); - - // Wrong mrownerconfig length - let short_mrownerconfig = &peer_mrownerconfig[..32]; + fn test_verify_svn_order_init_higher() { assert!(matches!( - verify_peer_init_tdinfo_against_owner(&init, &mrowner, short_mrownerconfig), - Err(PolicyError::InvalidParameter) + verify_svn_order(Some(6), Some(5)), + Err(PolicyError::SvnMismatch) )); } - fn make_suppl_data(mrowner: &[u8; 48], svn: u32) -> Vec<u8> { - let mut suppl = alloc::vec![0u8; REPORT_DATA_SIZE]; - suppl[Report::R_MIGTD_MROWNER].copy_from_slice(mrowner); - suppl[Report::R_MIGTD_MROWNERCONFIG][..4].copy_from_slice(&svn.to_le_bytes()); - suppl - } - #[test] - fn test_verify_peer_init_tdinfo_against_suppl_data_ok() { - let mrowner = [0xCDu8; 48]; - let init = make_init_tdinfo(&mrowner, 3); - let suppl = make_suppl_data(&mrowner, 5); - assert!(verify_peer_init_tdinfo_against_suppl_data(&init, &suppl).is_ok()); - } - - #[test] - fn test_verify_peer_init_tdinfo_against_suppl_data_short_buffer() { - let mrowner = [0xCDu8; 48]; - let init = make_init_tdinfo(&mrowner, 3); - let short = alloc::vec![0u8; REPORT_DATA_SIZE - 1]; - // Must return InvalidParameter, not panic, even though - // R_MIGTD_MROWNERCONFIG = 280..328 would otherwise slice OOB. + fn test_verify_svn_order_missing_init_mapping() { assert!(matches!( - verify_peer_init_tdinfo_against_suppl_data(&init, &short), - Err(PolicyError::InvalidParameter) + verify_svn_order(None, Some(5)), + Err(PolicyError::UnqualifiedMigTdInfo) )); } #[test] - fn test_verify_peer_init_tdinfo_against_suppl_data_mrowner_mismatch() { - let init_mrowner = [0xCDu8; 48]; - let peer_mrowner = [0xEEu8; 48]; - let init = make_init_tdinfo(&init_mrowner, 3); - let suppl = make_suppl_data(&peer_mrowner, 5); + fn test_verify_svn_order_missing_current_mapping() { assert!(matches!( - verify_peer_init_tdinfo_against_suppl_data(&init, &suppl), - Err(PolicyError::PolicyHashMismatch) + verify_svn_order(Some(5), None), + Err(PolicyError::UnqualifiedMigTdInfo) )); } #[test] - fn test_verify_peer_init_tdinfo_against_suppl_data_svn_greater_rejected() { - let mrowner = [0xCDu8; 48]; - let init = make_init_tdinfo(&mrowner, 7); - let suppl = make_suppl_data(&mrowner, 5); - assert!(matches!( - verify_peer_init_tdinfo_against_suppl_data(&init, &suppl), - Err(PolicyError::SvnMismatch) - )); + fn test_unix_to_iso8601() { + let timestamp = 1704067200; // Corresponds to 2024-01-01T00:00:00Z + let iso_date = unix_to_iso8601(timestamp).unwrap(); + assert_eq!(iso_date, "2024-01-01T00:00:00Z"); } } diff --git a/src/migtd/src/migration/logging.rs b/src/migtd/src/migration/logging.rs index be45b8322..a3bd6c810 100644 --- a/src/migtd/src/migration/logging.rs +++ b/src/migtd/src/migration/logging.rs @@ -587,6 +587,64 @@ impl VisitSource<'_> for RequestIdVisitor { /// Custom logger that routes log messages to structured logging pub struct VmmLoggerBackend; +/// Maximum log message size in bytes before truncation is applied. +/// Messages longer than this are replaced with a summary showing the first +/// `LOG_TRUNCATE_HEAD` bytes, the last `LOG_TRUNCATE_TAIL` bytes, and the +/// number of bytes that were dropped. +/// +/// REVERT_ME (debug): doubled from 128/64/16 to 256/128/32 so temporary +/// migration diagnostics retain complete 48-byte hashes on one line. +const LOG_TRUNCATE_THRESHOLD: usize = 256; +const LOG_TRUNCATE_HEAD: usize = 128; +const LOG_TRUNCATE_TAIL: usize = 32; + +/// Truncate `msg` if it exceeds `LOG_TRUNCATE_THRESHOLD`. +/// Returns the original message unchanged when it fits, or a replacement of +/// the form: `[first ~128 bytes]... [last ~32 bytes], log truncated number of bytes: N` +/// +/// Head and tail boundaries are adjusted to the nearest UTF-8 character +/// boundary so that multi-byte characters are never split. +fn maybe_truncate(msg: Vec<u8>) -> Vec<u8> { + if msg.len() <= LOG_TRUNCATE_THRESHOLD { + return msg; + } + // Strip all trailing newlines so they don't appear between tail and the notice. + let mut data_end = msg.len(); + while data_end > 0 && msg[data_end - 1] == b'\n' { + data_end -= 1; + } + let data = &msg[..data_end]; + let total = data.len(); + + // Find UTF-8-safe cut points. Input originates from format!() so it is + // valid UTF-8, but fall back to raw byte offsets if it somehow isn't. + let (head_end, tail_start) = if let Ok(s) = core::str::from_utf8(data) { + // floor_char_boundary: largest boundary <= LOG_TRUNCATE_HEAD + let mut h = LOG_TRUNCATE_HEAD.min(s.len()); + while h > 0 && !s.is_char_boundary(h) { + h -= 1; + } + // ceil_char_boundary: smallest boundary >= total - LOG_TRUNCATE_TAIL + let mut t = total.saturating_sub(LOG_TRUNCATE_TAIL); + while t < s.len() && !s.is_char_boundary(t) { + t += 1; + } + (h, t) + } else { + (LOG_TRUNCATE_HEAD, total.saturating_sub(LOG_TRUNCATE_TAIL)) + }; + + let head = &data[..head_end]; + let tail = &data[tail_start..]; + let truncated = tail_start - head_end; + let mut out = Vec::with_capacity(head.len() + tail.len() + 64); + out.extend_from_slice(head); + out.extend_from_slice(b"... "); + out.extend_from_slice(tail); + out.extend_from_slice(format!(", log truncated number of bytes: {}\n", truncated).as_bytes()); + out +} + impl log::Log for VmmLoggerBackend { fn enabled(&self, metadata: &Metadata) -> bool { let log_max_level: LevelFilter; @@ -615,6 +673,7 @@ impl log::Log for VmmLoggerBackend { fn log(&self, record: &Record) { if self.enabled(record.metadata()) { let msg = format!("{}\n", record.args()); + let msg = maybe_truncate(msg.into_bytes()); let mut visitor = RequestIdVisitor { mig_request_id: None, @@ -625,24 +684,21 @@ impl log::Log for VmmLoggerBackend { .mig_request_id .unwrap_or(MIGRATION_REQUEST_ID_SENTINEL); - entrylog(&msg.into_bytes(), record.level(), mig_request_id); + entrylog(&msg, record.level(), mig_request_id); // Also output to debug console for development (skip in test mode to avoid issues) #[cfg(all(not(test), debug_assertions))] { + let msg_str = alloc::string::String::from_utf8_lossy(&msg); if mig_request_id != MIGRATION_REQUEST_ID_SENTINEL { td_logger::dbg_write_string(&format!( - "{} - [req_id: {}] {}\n", + "{} - [req_id: {}] {}", record.level(), mig_request_id, - record.args() + msg_str )); } else { - td_logger::dbg_write_string(&format!( - "{} - {}\n", - record.level(), - record.args() - )); + td_logger::dbg_write_string(&format!("{} - {}", record.level(), msg_str)); } } } @@ -1590,4 +1646,82 @@ mod test { let _ = Box::from_raw(data_buffer_ptr as *mut [u8; PAGE_SIZE]); } } + + #[test] + fn test_maybe_truncate_short_message() { + let msg = b"short message\n".to_vec(); + let result = maybe_truncate(msg.clone()); + assert_eq!(result, msg); + } + + #[test] + fn test_maybe_truncate_at_threshold() { + let msg = vec![b'A'; LOG_TRUNCATE_THRESHOLD]; + let result = maybe_truncate(msg.clone()); + assert_eq!( + result, msg, + "message exactly at threshold should not be truncated" + ); + } + + #[test] + fn test_maybe_truncate_over_threshold() { + // Simulate a real log message: content + trailing newline + let content_len = LOG_TRUNCATE_THRESHOLD + 100; + let mut msg: Vec<u8> = (0..content_len).map(|i| b'A' + (i % 26) as u8).collect(); + msg.push(b'\n'); + let result = maybe_truncate(msg.clone()); + + assert_ne!(result, msg); + // Starts with first LOG_TRUNCATE_HEAD bytes of content + assert_eq!(&result[..LOG_TRUNCATE_HEAD], &msg[..LOG_TRUNCATE_HEAD]); + // Contains "... " separator + assert_eq!(&result[LOG_TRUNCATE_HEAD..LOG_TRUNCATE_HEAD + 4], b"... "); + // Contains last LOG_TRUNCATE_TAIL bytes of content (newline stripped) + assert_eq!( + &result[LOG_TRUNCATE_HEAD + 4..LOG_TRUNCATE_HEAD + 4 + LOG_TRUNCATE_TAIL], + &msg[content_len - LOG_TRUNCATE_TAIL..content_len] + ); + // Ends with the truncation notice (single newline, no double) + let truncated = content_len - LOG_TRUNCATE_HEAD - LOG_TRUNCATE_TAIL; + let trailer = format!(", log truncated number of bytes: {}\n", truncated); + assert!( + result.ends_with(trailer.as_bytes()), + "expected trailer: {trailer}, got: {}", + String::from_utf8_lossy(&result) + ); + // No double newline anywhere + assert!( + !result.windows(2).any(|w| w == b"\n\n"), + "should not contain double newline: {}", + String::from_utf8_lossy(&result) + ); + } + + #[test] + fn test_maybe_truncate_multibyte_utf8() { + // Build a string where the LOG_TRUNCATE_HEAD and LOG_TRUNCATE_TAIL + // byte offsets fall in the middle of multi-byte characters. + // 'é' is 2 bytes (0xC3 0xA9); fill with 'é' so every odd offset + // is mid-character. + let c = 'é'; // 2 bytes each + let char_count = (LOG_TRUNCATE_THRESHOLD / 2) + 60; // well over threshold in bytes + let mut s: String = core::iter::repeat(c).take(char_count).collect(); + s.push('\n'); + let msg = s.into_bytes(); + assert!(msg.len() > LOG_TRUNCATE_THRESHOLD); + + let result = maybe_truncate(msg); + // The result must be valid UTF-8 (no split characters) + let result_str = + core::str::from_utf8(&result).expect("truncated output must be valid UTF-8"); + assert!( + result_str.contains("... "), + "should contain separator: {result_str}" + ); + assert!( + result_str.contains("log truncated number of bytes:"), + "should contain truncation notice: {result_str}" + ); + } } diff --git a/src/migtd/src/migration/mod.rs b/src/migtd/src/migration/mod.rs index fe65f0310..69c037c63 100644 --- a/src/migtd/src/migration/mod.rs +++ b/src/migtd/src/migration/mod.rs @@ -12,6 +12,8 @@ pub mod rebinding; pub mod servtd_ext; #[cfg(feature = "main")] pub mod session; +#[cfg(feature = "spdm_attestation")] +pub mod spdm_session; #[cfg(feature = "main")] pub mod transport; @@ -184,7 +186,8 @@ pub struct MigtdMigrationInformation { // If set, current MigTD is MigTD-s else current MigTD is MigTD-d pub migration_source: u8, - // Per GHCI 1.5: hasInitMigtdData — true if initMigtdData follows at offset 56 + // Per GHCI 1.5: hasInitMigtdData. Retained for wire compatibility; policy + // v2 accepts either form but ignores host-supplied initMigtdData. pub has_init_data: u8, _reserved: [u8; 6], @@ -205,8 +208,9 @@ pub struct MigtdMigrationInformation { pub communication_id: u64, // Per GHCI 1.5: optional 512-byte TDINFO_STRUCT of the initial MigTD. - // Present when `has_init_data == 1`. Use `init_td_info_if_present()` for - // safe access. Sent by the VMM as the raw `TdInfo` bytes (no envelope). + // Retained only to accept older hosts that still append it. The parser + // clears this untrusted field so policy v2 behaves exactly like the + // header-only form and uses the authenticated SERVTD_EXT hash instead. // // NOTE: literal `512` (== TD_INFO_SIZE) is required here because // scroll-derive 0.10.5 only accepts integer literals as array length. @@ -250,8 +254,12 @@ impl MigtdMigrationInformation { #[cfg(feature = "policy_v2")] impl MigtdMigrationInformation { /// Parse a policy_v2 wire payload of either: - /// - header-only (short form, `has_init_data == 0`), or - /// - header + 512-byte TDINFO_STRUCT (full form, `has_init_data == 1`). + /// - header-only (short form), or + /// - header + legacy 512-byte TDINFO_STRUCT (full form). + /// + /// A correctly framed legacy flag and tail are accepted and then normalized + /// away. The host-supplied TDINFO is no longer needed by the one-hash TCB + /// mapping and must not influence policy decisions. /// Header size is transport-dependent (56 for vmcall-raw, 72 otherwise). pub fn read_from_bytes( data_length: u32, @@ -265,7 +273,7 @@ impl MigtdMigrationInformation { if (payload.len() as u32) < data_length { return Err(MigrationResult::InvalidParameter); } - let parsed: Self = if data_length == full_size { + let mut parsed: Self = if data_length == full_size { payload .pread(0) .map_err(|_| MigrationResult::InvalidParameter)? @@ -286,11 +294,15 @@ impl MigtdMigrationInformation { if parsed.has_init_data > 1 { return Err(MigrationResult::InvalidParameter); } - // has_init_data and data_length must be consistent: the full-size - // payload is required iff has_init_data == 1. + // Preserve wire framing validation even though the legacy contents are + // ignored: the full payload is required iff has_init_data == 1. if (parsed.has_init_data == 1) != (data_length == full_size) { return Err(MigrationResult::InvalidParameter); } + + // Backward compatibility: accept but ignore legacy initMigtdData. + parsed.has_init_data = 0; + parsed.init_td_info = [0u8; TD_INFO_SIZE]; Ok(parsed) } } @@ -608,17 +620,15 @@ mod test { } #[test] - fn test_mig_info_with_init_data() { + fn test_mig_info_accepts_and_ignores_init_data() { let tdinfo = make_tdinfo(&[0xCAu8; 48], &[0xFEu8; 48]); let buf = build_mig_info(7, 0, 1, [10, 20, 30, 40], 55, Some(&tdinfo)); let info = MigtdMigrationInformation::read_from_bytes(buf.len() as u32, &buf) .expect("should parse with init data"); assert_eq!(info.mig_request_id, 7); - assert_eq!(info.has_init_data, 1); - let init = info.init_td_info_if_present().expect("should be present"); - assert_eq!(init, &tdinfo); - assert_eq!(td_info_mrowner(init), &[0xCAu8; 48]); - assert_eq!(td_info_mrownerconfig(init), &[0xFEu8; 48]); + assert_eq!(info.has_init_data, 0); + assert!(info.init_td_info_if_present().is_none()); + assert_eq!(info.init_td_info, [0u8; TD_INFO_SIZE]); } #[test] @@ -642,14 +652,14 @@ mod test { #[test] fn test_mig_info_rejects_has_init_data_without_tail() { - // has_init_data=1 but no tail bytes following → flag/length mismatch + // Framing remains strict even though correctly supplied data is ignored. let buf = build_mig_info(1, 0, 1, [0; 4], 0, None); assert!(MigtdMigrationInformation::read_from_bytes(buf.len() as u32, &buf).is_err()); } #[test] fn test_mig_info_rejects_full_form_without_flag() { - // has_init_data=0 but full-size buffer (with init_td_info tail) → flag/length mismatch + // The full legacy form must set has_init_data. let tdinfo = [0u8; TD_INFO_SIZE]; let buf = build_mig_info(1, 0, 0, [0; 4], 0, Some(&tdinfo)); assert!(MigtdMigrationInformation::read_from_bytes(buf.len() as u32, &buf).is_err()); diff --git a/src/migtd/src/migration/pre_session_data.rs b/src/migtd/src/migration/pre_session_data.rs index 8603c6ec5..d7007819c 100644 --- a/src/migtd/src/migration/pre_session_data.rs +++ b/src/migtd/src/migration/pre_session_data.rs @@ -123,6 +123,13 @@ pub(super) async fn send_pre_session_data<T: AsyncRead + AsyncWrite + Unpin>( log::error!("send_pre_session_data: Network error: {:?}\n", e); MigrationResult::NetworkError })?; + // T19: fail-closed on zero-length transport write to avoid a + // livelock when the VMM-mediated transport reports success with + // no progress. See docs/threat_model/T19-presession-zero-length-read-livelock.md. + if n == 0 { + log::error!("send_pre_session_data: zero-length transport write\n"); + return Err(MigrationResult::NetworkError); + } sent += n; } Ok(()) @@ -141,6 +148,14 @@ pub(super) async fn receive_pre_session_data<T: AsyncRead + AsyncWrite + Unpin>( log::error!("receive_pre_session_data: Network error: {:?}\n", e); MigrationResult::NetworkError })?; + // T19: fail-closed on zero-length transport read. `VmcallRaw::recv` + // can return `Ok(0)` when its packet queue is drained and no new + // packets are available; without this guard the loop livelocks. + // See docs/threat_model/T19-presession-zero-length-read-livelock.md. + if n == 0 { + log::error!("receive_pre_session_data: zero-length transport read\n"); + return Err(MigrationResult::NetworkError); + } recvd += n; } Ok(()) @@ -194,6 +209,25 @@ pub(super) async fn receive_pre_session_data_packet<T: AsyncRead + AsyncWrite + } let pre_session_data_payload_size = header.length as usize; + + // T17: bound the VMM-supplied payload length before allocating. + // `header` is read from a VMM-controlled transport and `header.length` + // is a `u32`, so without this check a malicious VMM can request a + // ~4 GiB heap allocation. With `panic = "abort"`, the resulting + // `handle_alloc_error` permanently kills MigTD on every migration + // attempt. 1 MiB is well above any real policy/issuer-chain blob + // (production collateral JSON ≈ 200–500 KB; chain PEM ≈ 5–15 KB). + // See docs/threat_model/T17-presession-unbounded-alloc.md. + const MAX_PRE_SESSION_PAYLOAD_SIZE: usize = 1 * 1024 * 1024; + if pre_session_data_payload_size > MAX_PRE_SESSION_PAYLOAD_SIZE { + log::error!( + "receive_pre_session_data_packet: payload length {} exceeds max {}\n", + pre_session_data_payload_size, + MAX_PRE_SESSION_PAYLOAD_SIZE + ); + return Err(MigrationResult::InvalidParameter); + } + let mut pre_session_data_payload = vec![0u8; pre_session_data_payload_size]; receive_pre_session_data(transport, &mut pre_session_data_payload) .await @@ -385,7 +419,10 @@ pub(crate) fn decode_peer_data(data: &[u8]) -> Option<(&[u8], &[u8])> { #[cfg(feature = "policy_v2")] pub(crate) fn local_peer_data() -> Option<Vec<u8>> { let policy = crate::config::get_policy()?; - let issuer_chain = crate::config::get_policy_issuer_chain()?; + // Send the signer-anchor source: the 48-byte anchor when enrolled + // (CoRIM-only), else the policy issuer chain PEM. The peer resolves either + // form via `policy::resolve_signer_anchor`. + let issuer_chain = crate::config::get_signer_anchor_source()?; encode_peer_data(policy, issuer_chain) } diff --git a/src/migtd/src/migration/rebinding.rs b/src/migtd/src/migration/rebinding.rs index ca1e8e034..46c82f202 100644 --- a/src/migtd/src/migration/rebinding.rs +++ b/src/migtd/src/migration/rebinding.rs @@ -17,7 +17,7 @@ use crate::migration::transport::*; #[cfg(feature = "spdm_attestation")] use crate::spdm; -use crate::{config, migration::pre_session_data::pre_session_data_exchange}; +use crate::migration::pre_session_data::pre_session_data_exchange; use crate::{ driver::ticks::with_timeout, @@ -75,22 +75,6 @@ pub async fn start_rebinding( info: &MigtdMigrationInformation, data: &mut Vec<u8>, ) -> Result<(), MigrationResult> { - // Per GHCI 1.5: if VMM provided initMigtdData, verify policy binding - // before driving the rebinding exchange. Mirrors exchange_msk; without - // this check a hostile VMM could cause the rebind attestation to be - // built over an initial TDINFO whose policy signer hash / SVN would - // be rejected on the standard migration path. - #[cfg(all(feature = "vmcall-raw", feature = "policy_v2"))] - if let Some(init_td_info) = info.init_td_info_if_present() { - crate::mig_policy::verify_init_migtd_data_policy_binding(init_td_info).map_err(|e| { - log::error!( - migration_request_id = info.mig_request_id; - "start_rebinding: initMigtdData policy binding verification failed: {:?}\n", e - ); - MigrationResult::PolicyUnsatisfiedError - })?; - } - let mut transport = setup_transport(info.mig_request_id).await?; // Exchange peer-data (policy + issuer chain) firstly because of the message size limitation of TLS protocol @@ -184,66 +168,24 @@ pub async fn rebinding_old_prepare( data: &mut Vec<u8>, #[cfg(feature = "policy_v2")] peer_data: Vec<u8>, ) -> Result<(), MigrationResult> { - use core::ops::DerefMut; + use crate::migration::spdm_session::{finalize_spdm_session, map_spdm_setup_err}; - const SPDM_TIMEOUT: Duration = Duration::from_secs(60); // 60 seconds - let (mut spdm_requester, device_io_ref) = spdm::spdm_requester(transport).map_err(|_e| { - #[cfg(feature = "vmcall-raw")] - data.extend_from_slice( - &format!( - "Error: rebinding_old_prepare(): Failed in spdm_requester transport. Migration ID: {:x}\n", - info.mig_request_id, - ) - .into_bytes(), - ); - log::error!( - "rebinding: Failed in spdm_requester transport. Migration ID: {}\n", - info.mig_request_id - ); - MigrationResult::SecureSessionError - })?; - with_timeout( - SPDM_TIMEOUT, + let (mut spdm_requester, io_ref) = + spdm::spdm_requester(transport).map_err(|_| map_spdm_setup_err(info.mig_request_id))?; + + finalize_spdm_session( spdm::spdm_requester_rebind_old( &mut spdm_requester, info, #[cfg(feature = "policy_v2")] peer_data, ), + io_ref, + info.mig_request_id, ) - .await - .map_err(|e| { - #[cfg(feature = "vmcall-raw")] - data.extend_from_slice( - &format!( - "Error: rebinding_old_prepare(): spdm_requester_rebind_old timed out ({:?}). Migration ID: {:x}\n", - e, info.mig_request_id, - ) - .into_bytes(), - ); - log::error!( - "rebinding: spdm_requester_rebind_old timeout error: {:?}\n", - e - ); - e - })? - .map_err(|e| { - #[cfg(feature = "vmcall-raw")] - data.extend_from_slice( - &format!( - "Error: rebinding_old_prepare(): spdm_requester_rebind_old failed ({:?}). Migration ID: {:x}\n", - e, info.mig_request_id, - ) - .into_bytes(), - ); - log::error!("rebinding: spdm_requester_rebind_old error: {:?}\n", e); - spdm::decode_spdm_session_err(e) - })?; - log::info!("Rebind completed\n"); + .await?; - let mut transport_lock = device_io_ref.lock(); - let transport = transport_lock.deref_mut(); - shutdown_transport(&mut transport.transport, info.mig_request_id).await?; + log::info!("Rebind completed\n"); Ok(()) } @@ -254,67 +196,24 @@ pub async fn rebinding_new_prepare( data: &mut Vec<u8>, #[cfg(feature = "policy_v2")] peer_data: Vec<u8>, ) -> Result<(), MigrationResult> { - use core::ops::DerefMut; + use crate::migration::spdm_session::{finalize_spdm_session, map_spdm_setup_err}; - const SPDM_TIMEOUT: Duration = Duration::from_secs(60); // 60 seconds - let (mut spdm_responder, device_io_ref) = spdm::spdm_responder(transport).map_err(|_e| { - #[cfg(feature = "vmcall-raw")] - data.extend_from_slice( - &format!( - "Error: rebinding_new_prepare(): Failed in spdm_responder transport. Migration ID: {:x}\n", - info.mig_request_id, - ) - .into_bytes(), - ); - log::error!( - "rebinding: Failed in spdm_responder transport. Migration ID: {}\n", - info.mig_request_id - ); - MigrationResult::SecureSessionError - })?; + let (mut spdm_responder, io_ref) = + spdm::spdm_responder(transport).map_err(|_| map_spdm_setup_err(info.mig_request_id))?; - with_timeout( - SPDM_TIMEOUT, + finalize_spdm_session( spdm::spdm_responder_rebind_new( &mut spdm_responder, info, #[cfg(feature = "policy_v2")] peer_data, ), + io_ref, + info.mig_request_id, ) - .await - .map_err(|e| { - #[cfg(feature = "vmcall-raw")] - data.extend_from_slice( - &format!( - "Error: rebinding_new_prepare(): spdm_responder_rebind_new timed out ({:?}). Migration ID: {:x}\n", - e, info.mig_request_id, - ) - .into_bytes(), - ); - log::error!( - "rebinding: spdm_responder_rebind_new timeout error: {:?}\n", - e - ); - e - })? - .map_err(|e| { - #[cfg(feature = "vmcall-raw")] - data.extend_from_slice( - &format!( - "Error: rebinding_new_prepare(): spdm_responder_rebind_new failed ({:?}). Migration ID: {:x}\n", - e, info.mig_request_id, - ) - .into_bytes(), - ); - log::error!("rebinding: spdm_responder_rebind_new error: {:?}\n", e); - spdm::decode_spdm_session_err(e) - })?; - log::info!("Rebind completed\n"); + .await?; - let mut transport_lock = device_io_ref.lock(); - let transport = transport_lock.deref_mut(); - shutdown_transport(&mut transport.transport, info.mig_request_id).await?; + log::info!("Rebind completed\n"); Ok(()) } @@ -545,6 +444,13 @@ async fn tls_session_write_all( .write(&data[sent..]) .await .map_err(|_| MigrationResult::SecureSessionError)?; + // T21: fail-closed on zero-length transport write to avoid a + // livelock in policy_v2-without-spdm_attestation rebinding builds. + // See docs/threat_model/T21-policyv2-tls-rebinding-zero-progress-livelock.md. + if n == 0 { + log::error!("tls_session_write_all: zero-length transport write\n"); + return Err(MigrationResult::SecureSessionError); + } sent += n; } Ok(()) @@ -560,6 +466,12 @@ async fn tls_session_read_exact( .read(&mut data[recvd..]) .await .map_err(|_| MigrationResult::NetworkError)?; + // T21: fail-closed on zero-length transport read. See + // docs/threat_model/T21-policyv2-tls-rebinding-zero-progress-livelock.md. + if n == 0 { + log::error!("tls_session_read_exact: zero-length transport read\n"); + return Err(MigrationResult::NetworkError); + } recvd += n; } Ok(()) diff --git a/src/migtd/src/migration/session.rs b/src/migtd/src/migration/session.rs index 6e2631f22..c91d0e781 100644 --- a/src/migtd/src/migration/session.rs +++ b/src/migtd/src/migration/session.rs @@ -4,9 +4,11 @@ #[cfg(feature = "policy_v2")] use crate::migration::pre_session_data::pre_session_data_exchange; -#[cfg(not(feature = "spdm_attestation"))] use crate::migration::servtd_ext::verify_servtd_attr; +#[cfg(all(feature = "spdm_attestation", feature = "policy_v2"))] +use crate::migration::servtd_ext::write_approved_servtd_ext_hash; use crate::migration::transport::setup_transport; +#[cfg(not(feature = "spdm_attestation"))] use crate::migration::transport::shutdown_transport; use crate::migration::transport::TransportType; #[cfg(feature = "policy_v2")] @@ -15,6 +17,7 @@ use alloc::collections::BTreeSet; #[cfg(any(feature = "vmcall-interrupt", feature = "vmcall-raw"))] use core::sync::atomic::Ordering; +#[cfg(any(not(feature = "spdm_attestation"), feature = "policy_v2"))] use core::time::Duration; use core::{future::poll_fn, mem::size_of, task::Poll}; #[cfg(any(feature = "vmcall-interrupt", feature = "vmcall-raw"))] @@ -33,6 +36,7 @@ use zerocopy::IntoBytes; type Result<T> = core::result::Result<T, MigrationResult>; use super::{data::*, *}; +#[cfg(any(not(feature = "spdm_attestation"), feature = "policy_v2"))] use crate::driver::ticks::with_timeout; #[cfg(not(feature = "spdm_attestation"))] use crate::ratls; @@ -950,42 +954,52 @@ async fn migration_src_exchange_msk( info: &MigrationInformation, #[cfg(feature = "policy_v2")] peer_data: Vec<u8>, ) -> Result<()> { - use core::ops::DerefMut; + use crate::migration::spdm_session::{finalize_spdm_session, map_spdm_setup_err}; - const SPDM_TIMEOUT: Duration = Duration::from_secs(60); // 60 seconds - let (mut spdm_requester, device_io_ref) = spdm::spdm_requester(transport).map_err(|_e| { - log::error!( - "exchange_msk(): Failed in spdm_requester transport. Migration ID: {}\n", - info.mig_info.mig_request_id - ); - MigrationResult::SecureSessionError + let (mut spdm_requester, io_ref) = spdm::spdm_requester(transport) + .map_err(|_| map_spdm_setup_err(info.mig_info.mig_request_id))?; + + // NOTE: SPDM source historically calls `exchange_info(.., false)` (IMPORT + // versions) and `cal_mig_version(false, ...)` — asymmetric with the TLS + // source path (`is_src=true`). Preserved verbatim by this refactor to + // avoid a behavior change. Tracked as a separate behavior bug. + let exchange_information = exchange_info(&info.mig_info, false).map_err(|e| { + log::error!(migration_request_id = info.mig_info.mig_request_id; + "exchange_msk: exchange_info error: {:?}\n", e); + e })?; - with_timeout( - SPDM_TIMEOUT, + + let remote_information = finalize_spdm_session( spdm::spdm_requester_transfer_msk( &mut spdm_requester, &info.mig_info, + &exchange_information, #[cfg(feature = "policy_v2")] peer_data, ), + io_ref, + info.mig_info.mig_request_id, ) - .await - .map_err(|e| { - log::error!( - "exchange_msk: spdm_requester_transfer_msk timeout error: {:?}\n", + .await?; + + let mig_ver = + cal_mig_version(false, &exchange_information, &remote_information).map_err(|e| { + log::error!(migration_request_id = info.mig_info.mig_request_id; + "exchange_msk: cal_mig_version error: {:?}\n", e); e - ); + })?; + set_mig_version(&info.mig_info, mig_ver).map_err(|e| { + log::error!(migration_request_id = info.mig_info.mig_request_id; + "exchange_msk: set_mig_version error: {:?}\n", e); + e + })?; + write_msk(&info.mig_info, &remote_information.key).map_err(|e| { + log::error!(migration_request_id = info.mig_info.mig_request_id; + "exchange_msk: write_msk error: {:?}\n", e); e - })? - .map_err(|e| { - log::error!("exchange_msk: spdm_requester_transfer_msk error: {:?}\n", e); - spdm::decode_spdm_session_err(e) })?; - log::info!("MSK exchange completed\n"); - let mut transport_lock = device_io_ref.lock(); - let transport = transport_lock.deref_mut(); - shutdown_transport(&mut transport.transport, info.mig_info.mig_request_id).await?; + log::info!(migration_request_id = info.mig_info.mig_request_id; "Set MSK and report status\n"); Ok(()) } @@ -995,60 +1009,75 @@ async fn migration_dst_exchange_msk( info: &MigrationInformation, #[cfg(feature = "policy_v2")] peer_data: Vec<u8>, ) -> Result<()> { - use core::ops::DerefMut; + use crate::migration::spdm_session::{finalize_spdm_session, map_spdm_setup_err}; - const SPDM_TIMEOUT: Duration = Duration::from_secs(60); // 60 seconds - let (mut spdm_responder, device_io_ref) = spdm::spdm_responder(transport).map_err(|_e| { - log::error!( - "exchange_msk(): Failed in spdm_responder transport. Migration ID: {}\n", - info.mig_info.mig_request_id - ); - MigrationResult::SecureSessionError + // `exchange_information` must outlive `spdm_responder` so that the + // responder context's `info` variant can borrow it; declare it first. + let exchange_information = exchange_info(&info.mig_info, false).map_err(|e| { + log::error!(migration_request_id = info.mig_info.mig_request_id; + "exchange_msk: exchange_info error: {:?}\n", e); + e })?; - with_timeout( - SPDM_TIMEOUT, + let (mut spdm_responder, io_ref) = spdm::spdm_responder(transport) + .map_err(|_| map_spdm_setup_err(info.mig_info.mig_request_id))?; + + finalize_spdm_session( spdm::spdm_responder_transfer_msk( &mut spdm_responder, &info.mig_info, + &exchange_information, #[cfg(feature = "policy_v2")] peer_data, ), + io_ref, + info.mig_info.mig_request_id, ) - .await - .map_err(|e| { - log::error!( - "exchange_msk: spdm_responder_transfer_msk timeout error: {:?}\n", + .await?; + + let remote_information = spdm_responder.remote_information.take().ok_or_else(|| { + log::error!(migration_request_id = info.mig_info.mig_request_id; + "exchange_msk: missing remote_information after SPDM responder loop\n"); + MigrationResult::SecureSessionError + })?; + + // Preserve the SPDM responder's historical chain ordering: + // verify_servtd_attr -> cal_mig_version -> set_mig_version -> write_msk. + verify_servtd_attr(info.mig_info.binding_handle, &info.mig_info.target_td_uuid).map_err( + |e| { + log::error!(migration_request_id = info.mig_info.mig_request_id; + "exchange_msk: verify_servtd_attr error: {:?}\n", e); e - ); + }, + )?; + let mig_ver = + cal_mig_version(false, &exchange_information, &remote_information).map_err(|e| { + log::error!(migration_request_id = info.mig_info.mig_request_id; + "exchange_msk: cal_mig_version error: {:?}\n", e); + e + })?; + set_mig_version(&info.mig_info, mig_ver).map_err(|e| { + log::error!(migration_request_id = info.mig_info.mig_request_id; + "exchange_msk: set_mig_version error: {:?}\n", e); + e + })?; + write_msk(&info.mig_info, &remote_information.key).map_err(|e| { + log::error!(migration_request_id = info.mig_info.mig_request_id; + "exchange_msk: write_msk error: {:?}\n", e); e - })? - .map_err(|e| { - log::error!("exchange_msk: spdm_responder_transfer_msk error: {:?}\n", e); - spdm::decode_spdm_session_err(e) })?; - log::info!("MSK exchange completed\n"); - let mut transport_lock = device_io_ref.lock(); - let transport = transport_lock.deref_mut(); - shutdown_transport(&mut transport.transport, info.mig_info.mig_request_id).await?; + #[cfg(feature = "policy_v2")] + if let Some(servtd_ext) = spdm_responder.servtd_ext { + write_approved_servtd_ext_hash(&servtd_ext.calculate_approved_servtd_ext_hash()?)?; + } + + log::info!(migration_request_id = info.mig_info.mig_request_id; "Set MSK and report status\n"); Ok(()) } #[cfg(feature = "main")] pub async fn exchange_msk(info: &MigrationInformation) -> Result<()> { - // Per GHCI 1.5: if VMM provided initMigtdData, verify policy binding - #[cfg(feature = "policy_v2")] - if let Some(init_td_info) = info.mig_info.init_td_info_if_present() { - crate::mig_policy::verify_init_migtd_data_policy_binding(init_td_info).map_err(|e| { - log::error!( - migration_request_id = info.mig_info.mig_request_id; - "exchange_msk: initMigtdData policy binding verification failed: {:?}\n", e - ); - MigrationResult::PolicyUnsatisfiedError - })?; - } - #[allow(unused_mut)] let mut transport = setup_transport( info.mig_info.mig_request_id, @@ -1389,11 +1418,13 @@ mod test { #[cfg(feature = "vmcall-raw")] mod parse_request_tests { use super::super::{parse_request, REQUESTS}; + #[cfg(not(feature = "policy_v2"))] + use crate::migration::MigtdMigrationInformation; #[cfg(feature = "policy_v2")] use crate::migration::MIGTD_MIGRATION_INFO_HEADER_SIZE; use crate::migration::{ data::{RequestDataBufferHeader, WaitForRequestResponse}, - EnableLogAreaInfo, MigrationResult, MigtdMigrationInformation, ReportInfo, + EnableLogAreaInfo, MigrationResult, ReportInfo, }; use core::mem::size_of; use core::task::Poll; @@ -1433,6 +1464,16 @@ mod test { payload } + #[cfg(feature = "policy_v2")] + fn build_migration_payload_with_legacy_init(request_id: u64, is_source: u8) -> Vec<u8> { + let mut payload = vec![0u8; size_of::<crate::migration::MigtdMigrationInformation>()]; + payload[0..8].copy_from_slice(&request_id.to_le_bytes()); + payload[8] = is_source; + payload[9] = 1; + payload[MIGTD_MIGRATION_INFO_HEADER_SIZE..].fill(0xA5); + payload + } + fn cleanup_request(request_id: u64) { REQUESTS.lock().remove(&request_id); } @@ -1492,6 +1533,46 @@ mod test { cleanup_request(request_id); } + #[cfg(feature = "policy_v2")] + #[test] + fn test_parse_start_migration_accepts_and_ignores_legacy_init_tdinfo() { + let request_id: u64 = 0xAA00_0000_0000_0002; + let payload = build_migration_payload_with_legacy_init(request_id, 1); + let buf = build_request_buffer(1, &payload); + let mut pending = None; + let result = parse_request(&buf, HDR_LEN, &mut pending); + match result { + Poll::Ready(Ok(WaitForRequestResponse::StartMigration(info))) => { + assert_eq!(info.mig_info.mig_request_id, request_id); + assert_eq!(info.mig_info.has_init_data, 0); + assert!(info.mig_info.init_td_info_if_present().is_none()); + } + _ => panic!("Expected StartMigration, got unexpected variant"), + } + assert!(pending.is_none()); + cleanup_request(request_id); + } + + #[cfg(all(feature = "policy_v2", feature = "main"))] + #[test] + fn test_parse_start_rebinding_accepts_and_ignores_legacy_init_tdinfo() { + let request_id: u64 = 0xAA00_0000_0000_0003; + let payload = build_migration_payload_with_legacy_init(request_id, 1); + let buf = build_request_buffer(2, &payload); + let mut pending = None; + let result = parse_request(&buf, HDR_LEN, &mut pending); + match result { + Poll::Ready(Ok(WaitForRequestResponse::StartRebinding(info))) => { + assert_eq!(info.mig_request_id, request_id); + assert_eq!(info.has_init_data, 0); + assert!(info.init_td_info_if_present().is_none()); + } + _ => panic!("Expected StartRebinding, got unexpected variant"), + } + assert!(pending.is_none()); + cleanup_request(request_id); + } + #[test] fn test_parse_start_migration_truncated_payload() { // Payload is too short and data_length != expected size diff --git a/src/migtd/src/migration/spdm_session.rs b/src/migtd/src/migration/spdm_session.rs new file mode 100644 index 000000000..4d88f89c1 --- /dev/null +++ b/src/migtd/src/migration/spdm_session.rs @@ -0,0 +1,72 @@ +// Copyright (c) 2026 Microsoft Corporation +// +// SPDX-License-Identifier: BSD-2-Clause-Patent + +//! Shared SPDM session-driving helpers used by both migration (MSK exchange) +//! and rebinding paths. Centralizes the common boilerplate of running the +//! SPDM body under a 60-second timeout and shutting down the transport. + +use core::future::Future; +use core::ops::DerefMut; +use core::time::Duration; +use spdmlib::error::SpdmStatus; + +use super::transport::{shutdown_transport, TransportType}; +use super::MigrationResult; +use crate::driver::ticks::with_timeout; +use crate::spdm::SpdmDeviceIoArc; + +type Result<T> = core::result::Result<T, MigrationResult>; + +/// Timeout that wraps every SPDM session body (requester or responder). +pub(super) const SPDM_TIMEOUT: Duration = Duration::from_secs(60); + +/// Standard error mapping for a failed `spdm::spdm_requester` / +/// `spdm::spdm_responder` transport setup. +pub(super) fn map_spdm_setup_err(mig_request_id: u64) -> MigrationResult { + log::error!( + migration_request_id = mig_request_id; + "SPDM transport setup failed\n" + ); + MigrationResult::SecureSessionError +} + +/// Run an SPDM session `body` under [`SPDM_TIMEOUT`], then shut down the +/// transport associated with `io_ref`. Returns any value produced by `body`. +/// +/// `body` is the already-constructed future returned by an SPDM exchange +/// function (e.g. `spdm_requester_transfer_msk`, `spdm_responder_rebind_new`). +/// The caller owns the SPDM context that `body` borrows; this helper only +/// drives `body` to completion and then takes the device-IO lock to invoke +/// `shutdown_transport`. +pub(super) async fn finalize_spdm_session<Fut, T>( + body: Fut, + io_ref: SpdmDeviceIoArc<TransportType>, + mig_request_id: u64, +) -> Result<T> +where + Fut: Future<Output = core::result::Result<T, SpdmStatus>>, +{ + let value = with_timeout(SPDM_TIMEOUT, body) + .await + .map_err(|e| { + log::error!( + migration_request_id = mig_request_id; + "finalize_spdm_session: body timeout: {e:?}\n" + ); + MigrationResult::from(e) + })? + .map_err(|e| { + log::error!( + migration_request_id = mig_request_id; + "finalize_spdm_session: body error: {e:?}\n" + ); + crate::spdm::decode_spdm_session_err(e) + })?; + + let mut transport_lock = io_ref.lock(); + let transport = transport_lock.deref_mut(); + shutdown_transport(&mut transport.transport, mig_request_id).await?; + + Ok(value) +} diff --git a/src/migtd/src/spdm/handshake.rs b/src/migtd/src/spdm/handshake.rs new file mode 100644 index 000000000..140eb8870 --- /dev/null +++ b/src/migtd/src/spdm/handshake.rs @@ -0,0 +1,81 @@ +// Copyright (c) 2026 Microsoft Corporation +// +// SPDX-License-Identifier: BSD-2-Clause-Patent + +//! Shared SPDM handshake building-blocks for the migration (MSK exchange) +//! and rebinding requester/responder paths. +//! +//! Two paths in this crate (`spdm_requester_transfer_msk` / +//! `spdm_requester_rebind_old` and the responder counterparts) run the same +//! SPDM-layer dance with only the two VDM-defined steps differing. This +//! module factors out the parts that are identical so each path only +//! supplies the bits that genuinely differ between MSK exchange and +//! rebinding. + +use alloc::boxed::Box; +use alloc::vec::Vec; +use codec::{Codec, Writer}; +use spdmlib::{ + error::{SpdmStatus, SPDM_STATUS_BUFFER_FULL}, + protocol::SpdmMeasurementSummaryHashType, + requester::RequesterContext, +}; + +use crate::spdm::{ + spdm_req::send_and_receive_pub_key, + spdm_rsp::{rsp_handle_message, ResponderContextEx}, + SpdmAppContextData, +}; + +/// Run the shared SPDM requester prelude: version → capability → algorithm → +/// `send_and_receive_pub_key` → key_exchange. Returns the negotiated +/// `session_id` for the caller to use in subsequent VDM steps and the +/// final finish / end_session calls. +pub(super) async fn requester_handshake_prelude( + spdm_requester: &mut RequesterContext, +) -> Result<u32, SpdmStatus> { + Box::pin(spdm_requester.send_receive_spdm_version()).await?; + Box::pin(spdm_requester.send_receive_spdm_capability()).await?; + Box::pin(spdm_requester.send_receive_spdm_algorithm()).await?; + Box::pin(send_and_receive_pub_key(spdm_requester)).await?; + Box::pin(spdm_requester.send_receive_spdm_key_exchange( + 0xff, + SpdmMeasurementSummaryHashType::SpdmMeasurementSummaryHashTypeNone, + )) + .await +} + +/// Drive the SPDM responder message loop with a caller-provided +/// `SpdmAppContextData` payload and `peer_data` quote buffer. +/// +/// Steps performed in order: +/// 1. Stash `peer_data` on `spdm_responder_ex` (read by VDM handlers via +/// `upcast_mut`). +/// 2. Encode `app_context` into the responder's `app_context_data_buffer` +/// (read by VDM handlers). +/// 3. Run `rsp_handle_message` until the session ends. +/// +/// This helper does NOT zeroize `app_context_data_buffer` itself: the buffer +/// may carry the caller's ephemeral private key, which must be wiped on +/// *every* return path (including errors), so callers wrap this helper in +/// their own always-zeroize pattern (see `spdm_responder_transfer_msk` / +/// `spdm_responder_rebind_new`). +/// +/// Callers that need to expose extra context to VDM handlers (e.g. setting +/// `spdm_responder_ex.info = RebindInformation(..)`) must do so before +/// invoking this helper. +pub(super) async fn run_responder_message_loop( + spdm_responder_ex: &mut ResponderContextEx<'_>, + peer_data: Vec<u8>, + app_context: SpdmAppContextData, +) -> Result<(), SpdmStatus> { + spdm_responder_ex.peer_data = peer_data; + + let spdm_responder = &mut spdm_responder_ex.responder_context; + let mut writer = Writer::init(&mut spdm_responder.common.app_context_data_buffer); + app_context + .encode(&mut writer) + .map_err(|_| SPDM_STATUS_BUFFER_FULL)?; + + Box::pin(rsp_handle_message(spdm_responder)).await +} diff --git a/src/migtd/src/spdm/mod.rs b/src/migtd/src/spdm/mod.rs index 5c6c7d254..8a2a44e00 100644 --- a/src/migtd/src/spdm/mod.rs +++ b/src/migtd/src/spdm/mod.rs @@ -4,6 +4,7 @@ #![cfg(feature = "spdm_attestation")] +mod handshake; #[cfg(all(feature = "main", feature = "policy_v2", feature = "vmcall-raw"))] mod spdm_rebind; mod spdm_req; @@ -56,7 +57,17 @@ impl<T: AsyncRead + AsyncWrite + Unpin + Send> SpdmDeviceIo for MigtdTransport<T let mut sent = 0; while sent < buffer.len() { match self.transport.write(&buffer[sent..]).await { - Ok(len) => sent += len, + Ok(len) => { + // T20: fail-closed on zero-length transport write to avoid + // a livelock when the VMM-mediated transport reports + // success with no progress. See + // docs/threat_model/T20-spdm-zero-progress-io-livelock.md. + if len == 0 { + log::error!("SPDM MigtdTransport::send: zero-length transport write\n"); + return Err(SPDM_STATUS_SEND_FAIL); + } + sent += len; + } // ConnectionAborted maps from VmcallRawError::VmmCanceled. // The SpdmDeviceIo trait cannot represent this error, so just // log and return the generic SPDM_STATUS_SEND_FAIL. @@ -96,6 +107,12 @@ impl<T: AsyncRead + AsyncWrite + Unpin + Send> SpdmDeviceIo for MigtdTransport<T } 0_usize })?; + // T20: fail-closed on zero-length transport read. See + // docs/threat_model/T20-spdm-zero-progress-io-livelock.md. + if n == 0 { + log::error!("SPDM MigtdTransport::receive header: zero-length transport read\n"); + return Err(0_usize); + } recvd += n; } @@ -119,6 +136,12 @@ impl<T: AsyncRead + AsyncWrite + Unpin + Send> SpdmDeviceIo for MigtdTransport<T } 0_usize })?; + // T20: fail-closed on zero-length transport read. See + // docs/threat_model/T20-spdm-zero-progress-io-livelock.md. + if n == 0 { + log::error!("SPDM MigtdTransport::receive payload: zero-length transport read\n"); + return Err(0_usize); + } recvd += n; } diff --git a/src/migtd/src/spdm/spdm_rebind.rs b/src/migtd/src/spdm/spdm_rebind.rs index a3673c37b..ebd109afa 100644 --- a/src/migtd/src/spdm/spdm_rebind.rs +++ b/src/migtd/src/spdm/spdm_rebind.rs @@ -4,22 +4,15 @@ use crate::{ migration::MigtdMigrationInformation, spdm::{ - spdm_req::{ - send_and_receive_pub_key, send_and_receive_sdm_rebind_attest_info, - send_and_receive_sdm_rebind_info, - }, - spdm_rsp::{rsp_handle_message, ResponderContextEx, ResponderContextExInfo}, + handshake::{requester_handshake_prelude, run_responder_message_loop}, + spdm_req::{send_and_receive_sdm_rebind_attest_info, send_and_receive_sdm_rebind_info}, + spdm_rsp::{ResponderContextEx, ResponderContextExInfo}, PrivateKeyDer, SpdmAppContextData, }, }; use alloc::boxed::Box; use alloc::vec::Vec; -use codec::{Codec, Writer}; -use spdmlib::{ - error::{SpdmStatus, SPDM_STATUS_BUFFER_FULL}, - protocol::SpdmMeasurementSummaryHashType, - requester::RequesterContext, -}; +use spdmlib::{error::SpdmStatus, requester::RequesterContext}; use zeroize::Zeroize; pub async fn spdm_requester_rebind_old( @@ -43,16 +36,7 @@ async fn spdm_requester_rebind_old_inner( rebind_info: &MigtdMigrationInformation, peer_data: Vec<u8>, ) -> Result<(), SpdmStatus> { - Box::pin(spdm_requester.send_receive_spdm_version()).await?; - Box::pin(spdm_requester.send_receive_spdm_capability()).await?; - Box::pin(spdm_requester.send_receive_spdm_algorithm()).await?; - - Box::pin(send_and_receive_pub_key(spdm_requester)).await?; - let session_id = Box::pin(spdm_requester.send_receive_spdm_key_exchange( - 0xff, - SpdmMeasurementSummaryHashType::SpdmMeasurementSummaryHashTypeNone, - )) - .await?; + let session_id = requester_handshake_prelude(spdm_requester).await?; Box::pin(send_and_receive_sdm_rebind_attest_info( spdm_requester, @@ -80,11 +64,15 @@ pub async fn spdm_responder_rebind_new<'a>( rebind_info: &'a MigtdMigrationInformation, peer_data: Vec<u8>, ) -> Result<(), SpdmStatus> { - spdm_responder_ex.peer_data = peer_data; spdm_responder_ex.info = ResponderContextExInfo::RebindInformation(rebind_info); + let app_context = SpdmAppContextData { + migration_info: MigtdMigrationInformation::default(), + private_key: PrivateKeyDer::default(), + }; + // Zeroize the responder key buffer on every return path. - let result = spdm_responder_rebind_new_inner(spdm_responder_ex).await; + let result = run_responder_message_loop(spdm_responder_ex, peer_data, app_context).await; spdm_responder_ex .responder_context .common @@ -93,20 +81,3 @@ pub async fn spdm_responder_rebind_new<'a>( result } - -async fn spdm_responder_rebind_new_inner( - spdm_responder_ex: &mut ResponderContextEx<'_>, -) -> Result<(), SpdmStatus> { - let spdm_responder = &mut spdm_responder_ex.responder_context; - let mut writer = Writer::init(&mut spdm_responder.common.app_context_data_buffer); - - let responder_app_context = SpdmAppContextData { - migration_info: MigtdMigrationInformation::default(), - private_key: PrivateKeyDer::default(), - }; - responder_app_context - .encode(&mut writer) - .map_err(|_| SPDM_STATUS_BUFFER_FULL)?; - - Box::pin(rsp_handle_message(spdm_responder)).await -} diff --git a/src/migtd/src/spdm/spdm_req.rs b/src/migtd/src/spdm/spdm_req.rs index c4dff2f80..105cfa90f 100644 --- a/src/migtd/src/spdm/spdm_req.rs +++ b/src/migtd/src/spdm/spdm_req.rs @@ -4,11 +4,7 @@ use crate::mig_policy; use crate::migration::MigrationResult; use crate::{ - migration::{ - data::MigrationSessionKey, - session::{cal_mig_version, exchange_info, set_mig_version, write_msk}, - MigtdMigrationInformation, - }, + migration::{data::MigrationSessionKey, MigtdMigrationInformation}, spdm::{ build_report_data, gen_quote_spdm, spdm_rsp::SECRET_ASYM_IMPL_INSTANCE, spdm_verify_quote, verify_report_data_binding, verify_tdreport_data_binding, vmcall_msg::VmCallTransportEncap, @@ -91,8 +87,9 @@ pub fn spdm_requester<T: AsyncRead + AsyncWrite + Unpin + Send + Sync + 'static> pub async fn spdm_requester_transfer_msk( spdm_requester: &mut RequesterContext, mig_info: &MigtdMigrationInformation, + exchange_information: &ExchangeInformation, #[cfg(feature = "policy_v2")] peer_data: Vec<u8>, -) -> Result<(), SpdmStatus> { +) -> Result<ExchangeInformation, SpdmStatus> { // `send_and_receive_pub_key` encodes the requester's ephemeral ECDSA // private key into `spdm_requester.common.app_context_data_buffer` so // libspdm's asymmetric signing callback can read it. The libspdm @@ -101,6 +98,7 @@ pub async fn spdm_requester_transfer_msk( let result = spdm_requester_transfer_msk_inner( spdm_requester, mig_info, + exchange_information, #[cfg(feature = "policy_v2")] peer_data, ) @@ -112,18 +110,10 @@ pub async fn spdm_requester_transfer_msk( async fn spdm_requester_transfer_msk_inner( spdm_requester: &mut RequesterContext, mig_info: &MigtdMigrationInformation, + exchange_information: &ExchangeInformation, #[cfg(feature = "policy_v2")] peer_data: Vec<u8>, -) -> Result<(), SpdmStatus> { - Box::pin(spdm_requester.send_receive_spdm_version()).await?; - Box::pin(spdm_requester.send_receive_spdm_capability()).await?; - Box::pin(spdm_requester.send_receive_spdm_algorithm()).await?; - - Box::pin(send_and_receive_pub_key(spdm_requester)).await?; - let session_id = Box::pin(spdm_requester.send_receive_spdm_key_exchange( - 0xff, - SpdmMeasurementSummaryHashType::SpdmMeasurementSummaryHashTypeNone, - )) - .await?; +) -> Result<ExchangeInformation, SpdmStatus> { + let session_id = crate::spdm::handshake::requester_handshake_prelude(spdm_requester).await?; Box::pin(send_and_receive_sdm_migration_attest_info( spdm_requester, @@ -135,15 +125,17 @@ async fn spdm_requester_transfer_msk_inner( .await?; Box::pin(spdm_requester.send_receive_spdm_finish(Some(0xff), session_id)).await?; - Box::pin(send_and_receive_sdm_exchange_migration_info( + + let remote_information = Box::pin(send_and_receive_sdm_exchange_migration_info( spdm_requester, - mig_info, + exchange_information, Some(session_id), )) .await?; + Box::pin(spdm_requester.send_receive_spdm_end_session(session_id)).await?; - Ok(()) + Ok(remote_information) } pub async fn send_and_receive_pub_key(spdm_requester: &mut RequesterContext) -> SpdmResult { @@ -355,8 +347,13 @@ pub async fn send_and_receive_sdm_migration_attest_info( let report_data = build_report_data(b"MigTDReq", &th1)?; + log::info!("BC> REQ-ATT-01 gen_quote_spdm (src)\n"); //quote src let quote_src = gen_quote_spdm(&report_data)?; + log::info!( + "BC> REQ-ATT-02 gen_quote_spdm done, len={}\n", + quote_src.len() + ); // Self-quote verification is only needed for policy v1, which uses // verified_report_local in authenticate_policy(). Policy v2 re-verifies // the quote internally via authenticate_remote(). @@ -497,6 +494,7 @@ pub async fn send_and_receive_sdm_migration_attest_info( send_used += request_payload.spdm_encode(&mut spdm_requester.common, &mut writer)?; let mut receive_buffer = [0u8; config::MAX_SPDM_MSG_SIZE]; + log::info!("BC> REQ-ATT-03 send_receive_spdm_vendor_defined_request_ex (attest_info)\n"); let response = spdm_requester .send_receive_spdm_vendor_defined_request_ex( None, @@ -504,8 +502,12 @@ pub async fn send_and_receive_sdm_migration_attest_info( &mut receive_buffer, ) .await?; + log::info!( + "BC> REQ-ATT-04 attest_info VDM response received, len={}\n", + response.len() + ); - //Format checks + // Format checks let mut reader = Reader::init(response); let _response_header = SpdmMessageHeader::read(&mut reader).ok_or(SPDM_STATUS_INVALID_MSG_SIZE)?; @@ -599,16 +601,21 @@ pub async fn send_and_receive_sdm_migration_attest_info( )?; #[cfg(feature = "policy_v2")] - verify_peer_attestation_v2( - "e_dst_vec, - &event_log_dst_vec, - mig_policy_hash_dst, - &peer_data, - &th1, - spdm_requester, - session_id, - )?; + { + log::info!("BC> REQ-ATT-05 verify_peer_attestation_v2 BEGIN\n"); + verify_peer_attestation_v2( + "e_dst_vec, + &event_log_dst_vec, + mig_policy_hash_dst, + &peer_data, + &th1, + spdm_requester, + session_id, + )?; + log::info!("BC> REQ-ATT-06 verify_peer_attestation_v2 OK\n"); + } + log::info!("BC> REQ-ATT-07 building VDM transcript before finish\n"); let vdm_attest_info_src_hash = digest_sha384(&send_buffer[..send_used]).map_err(|_| SPDM_STATUS_CRYPTO_ERROR)?; let vdm_attest_info_dst_hash = digest_sha384(response).map_err(|_| SPDM_STATUS_CRYPTO_ERROR)?; @@ -625,6 +632,7 @@ pub async fn send_and_receive_sdm_migration_attest_info( error!("Cannot get session id. Attestation failed.\n"); return Err(SPDM_STATUS_INVALID_STATE_LOCAL); } + log::info!("BC> REQ-ATT-08 send_and_receive_sdm_migration_attest_info return Ok\n"); Ok(()) } @@ -698,18 +706,37 @@ fn verify_peer_attestation_v2( spdm_requester: &mut RequesterContext, session_id: u32, ) -> SpdmResult { + log::info!( + "BC> REQ-V2-01 enter verify_peer_attestation_v2 quote_peer.len={} event_log_peer.len={} mig_policy_hash_peer.len={} peer_data.len={}\n", + quote_peer.len(), + event_log_peer.len(), + mig_policy_hash_peer.len(), + peer_data.len() + ); // 1. Verify peer-data hash matches the value bound in the certificate let peer_data_hash = digest_sha384(peer_data).map_err(|_| SPDM_STATUS_CRYPTO_ERROR)?; + log::info!("BC> REQ-V2-02 digest_sha384(peer_data) ok\n"); if mig_policy_hash_peer != peer_data_hash.as_slice() { error!("The received mig policy hash does not match the expected peer_data hash!\n"); + let session = spdm_requester + .common + .get_session_via_id(session_id) + .ok_or(SPDM_STATUS_INVALID_STATE_LOCAL)?; + session.teardown(); return Err(SPDM_STATUS_INVALID_MSG_FIELD); } + log::info!("BC> REQ-V2-03 mig_policy_hash matches peer_data_hash\n"); // 2. Authenticate remote (includes quote verification internally) #[cfg(not(feature = "test_disable_ra_and_accept_all"))] { + log::info!("BC> REQ-V2-04 calling mig_policy::authenticate_remote(is_src=true)\n"); let policy_check_result = mig_policy::authenticate_remote(true, quote_peer, peer_data, event_log_peer); + log::info!( + "BC> REQ-V2-05 authenticate_remote returned ok={}\n", + policy_check_result.is_ok() + ); if let Err(e) = &policy_check_result { error!("Policy v2 check failed, below is the detail information:\n"); error!("{:x?}\n", e); @@ -728,6 +755,7 @@ fn verify_peer_attestation_v2( feature = "use-mock-quote" )))] { + log::info!("BC> REQ-V2-06 verify_report_data_binding\n"); let verified_report_peer = policy_check_result.unwrap(); if verify_report_data_binding(&verified_report_peer, b"MigTDRsp", th1).is_err() { error!("Peer REPORTDATA does not match expected TH1 binding!\n"); @@ -738,23 +766,23 @@ fn verify_peer_attestation_v2( session.teardown(); return Err(SpdmStatus::from(MigrationResult::MutualAttestationError)); } + log::info!("BC> REQ-V2-07 verify_report_data_binding ok\n"); } } + log::info!("BC> REQ-V2-08 verify_peer_attestation_v2 return Ok\n"); Ok(()) } async fn send_and_receive_sdm_exchange_migration_info( spdm_requester: &mut RequesterContext, - mig_info: &MigtdMigrationInformation, + exchange_information: &ExchangeInformation, session_id: Option<u32>, -) -> SpdmResult { +) -> SpdmResult<ExchangeInformation> { let mut vendor_id = [0u8; MAX_SPDM_VENDOR_DEFINED_VENDOR_ID_LEN]; vendor_id[..VDM_MESSAGE_VENDOR_ID_LEN].copy_from_slice(&VDM_MESSAGE_VENDOR_ID); let vendor_id = VendorIDStruct { len: 4, vendor_id }; - let exchange_information = exchange_info(mig_info, true)?; - let mut payload = vec![0u8; MAX_SPDM_VENDOR_DEFINED_PAYLOAD_SIZE]; let mut writer = Writer::init(&mut payload); let mut cnt = 0; @@ -826,6 +854,9 @@ async fn send_and_receive_sdm_exchange_migration_info( send_used += request_payload.spdm_encode(&mut spdm_requester.common, &mut writer)?; let mut receive_buffer = [0u8; config::MAX_SPDM_MSG_SIZE]; + log::info!( + "BC> REQ-MIG-01 send_receive_spdm_vendor_defined_request_ex (exchange_migration_info)\n" + ); let response = spdm_requester .send_receive_spdm_vendor_defined_request_ex( session_id, @@ -833,6 +864,10 @@ async fn send_and_receive_sdm_exchange_migration_info( &mut receive_buffer, ) .await?; + log::info!( + "BC> REQ-MIG-02 exchange_migration_info VDM response received, len={}\n", + response.len() + ); // Format checks let mut reader = Reader::init(response); @@ -916,12 +951,7 @@ async fn send_and_receive_sdm_exchange_migration_info( }, }; - let mig_ver = cal_mig_version(true, &exchange_information, &remote_information)?; - set_mig_version(mig_info, mig_ver)?; - write_msk(mig_info, &remote_information.key)?; - log::info!("Set MSK and report status\n"); - - Ok(()) + Ok(remote_information) } #[cfg(all(feature = "main", feature = "policy_v2", feature = "vmcall-raw"))] @@ -1186,6 +1216,11 @@ pub async fn send_and_receive_sdm_rebind_attest_info( let peer_data_hash = digest_sha384(&peer_data).map_err(|_| SPDM_STATUS_CRYPTO_ERROR)?; if mig_policy_hash_dst != peer_data_hash.as_slice() { error!("The received mig policy hash does not match the expected peer_data hash!\n"); + let session = spdm_requester + .common + .get_session_via_id(session_id) + .ok_or(SPDM_STATUS_INVALID_STATE_LOCAL)?; + session.teardown(); return Err(SPDM_STATUS_INVALID_MSG_FIELD); } @@ -1208,6 +1243,7 @@ pub async fn send_and_receive_sdm_rebind_attest_info( // Verify that the peer's REPORTDATA is bound to this SPDM session's TH1 let verified_report_peer = policy_check_result.unwrap(); + #[cfg(not(any(feature = "AzCVMEmu", feature = "test_mock_report")))] if verify_tdreport_data_binding(&verified_report_peer, b"MigTDRsp", &th1).is_err() { error!("Rebind peer REPORTDATA does not match expected TH1 binding!\n"); let session = spdm_requester @@ -1217,6 +1253,8 @@ pub async fn send_and_receive_sdm_rebind_attest_info( session.teardown(); return Err(SpdmStatus::from(MigrationResult::MutualAttestationError)); } + #[cfg(any(feature = "AzCVMEmu", feature = "test_mock_report"))] + let _ = (&th1, &verified_report_peer); } let vdm_attest_info_src_hash = diff --git a/src/migtd/src/spdm/spdm_rsp.rs b/src/migtd/src/spdm/spdm_rsp.rs index 35ae698fe..8c7161545 100644 --- a/src/migtd/src/spdm/spdm_rsp.rs +++ b/src/migtd/src/spdm/spdm_rsp.rs @@ -7,19 +7,13 @@ use crate::mig_policy; use crate::migration::pre_session_data::local_peer_data; #[cfg(all(feature = "main", feature = "policy_v2", feature = "vmcall-raw"))] use crate::migration::rebinding::{write_rebinding_session_token, write_servtd_rebind_attr}; -#[cfg(not(feature = "policy_v2"))] -use crate::migration::servtd_ext::verify_servtd_attr; #[cfg(feature = "policy_v2")] -use crate::migration::servtd_ext::{verify_servtd_attr, write_approved_servtd_ext_hash, ServtdExt}; +use crate::migration::servtd_ext::{write_approved_servtd_ext_hash, ServtdExt}; use crate::migration::MigrationResult; use crate::{ event_log::get_event_log, migration::{ - data::MigrationSessionKey, - session::{ - cal_mig_version, exchange_info, set_mig_version, write_msk, ExchangeInformation, - }, - MigtdMigrationInformation, + data::MigrationSessionKey, session::ExchangeInformation, MigtdMigrationInformation, }, }; use alloc::sync::Arc; @@ -54,12 +48,22 @@ pub struct ResponderContextEx<'a> { pub peer_data: Vec<u8>, pub info: ResponderContextExInfo<'a>, pub mig_info_exchanged: bool, + /// Populated by the migration responder VDM handler from the peer's + /// `ExchangeMigrationInfoReq`; consumed by the caller after the SPDM + /// loop returns to drive the post-session commit chain. + pub remote_information: Option<ExchangeInformation>, #[cfg(feature = "policy_v2")] pub servtd_ext: Option<ServtdExt>, } pub enum ResponderContextExInfo<'a> { - MigrationInformation(&'a MigtdMigrationInformation), + /// Migration responder context. `exchange_information` is computed by + /// the caller before the SPDM loop and used by the VDM handler to + /// populate the `ExchangeMigrationInfoRsp` payload. + MigrationInformation { + mig_info: &'a MigtdMigrationInformation, + exchange_information: &'a ExchangeInformation, + }, #[cfg(all(feature = "main", feature = "policy_v2", feature = "vmcall-raw"))] RebindInformation(&'a MigtdMigrationInformation), None, @@ -74,9 +78,16 @@ impl ResponderContextEx<'_> { } } +/// SAFETY: `ResponderContextEx` is `#[repr(C)]` with `ResponderContext` as +/// its first field, so a `&mut ResponderContext` that originated from a +/// live `&mut ResponderContextEx` can be upcast back to the outer struct +/// via a zero-offset pointer cast. The caller must ensure `inner` was +/// obtained from `ResponderContextEx::inner_mut` (or equivalent) and that +/// no other reference to the outer struct (or any of its other fields) is +/// live for the duration of the returned borrow. pub unsafe fn upcast_mut(inner: &mut ResponderContext) -> &mut ResponderContextEx { let ptr = inner as *mut ResponderContext as *mut u8; - let outer_ptr = ptr.sub(0) as *mut ResponderContextEx; + let outer_ptr = ptr as *mut ResponderContextEx; &mut *outer_ptr } @@ -142,6 +153,7 @@ pub fn spdm_responder<'a, T: AsyncRead + AsyncWrite + Unpin + Send + Sync + 'sta peer_data: Vec::new(), info: ResponderContextExInfo::None, mig_info_exchanged: false, + remote_information: None, #[cfg(feature = "policy_v2")] servtd_ext: None, }; @@ -149,18 +161,36 @@ pub fn spdm_responder<'a, T: AsyncRead + AsyncWrite + Unpin + Send + Sync + 'sta Ok((responder_context_ex, device_io_ref)) } -pub async fn spdm_responder_transfer_msk( - spdm_responder_ex: &mut ResponderContextEx<'_>, - mig_info: &MigtdMigrationInformation, +pub async fn spdm_responder_transfer_msk<'a>( + spdm_responder_ex: &mut ResponderContextEx<'a>, + mig_info: &'a MigtdMigrationInformation, + exchange_information: &'a ExchangeInformation, #[cfg(feature = "policy_v2")] peer_data: Vec<u8>, ) -> Result<(), SpdmStatus> { #[cfg(not(feature = "policy_v2"))] let peer_data = Vec::new(); - spdm_responder_ex.peer_data = peer_data; + spdm_responder_ex.info = ResponderContextExInfo::MigrationInformation { + mig_info, + exchange_information, + }; + spdm_responder_ex.remote_information = None; + + // The VDM handler reads `mig_info` / `exchange_information` from + // `responder_ex.info`; no per-session app context data is required for + // the migration path beyond placeholder defaults. + let app_context = SpdmAppContextData { + migration_info: MigtdMigrationInformation::default(), + private_key: PrivateKeyDer::default(), + }; // Zeroize the responder key buffer on every return path. - let result = spdm_responder_transfer_msk_inner(spdm_responder_ex, mig_info).await; + let result = crate::spdm::handshake::run_responder_message_loop( + spdm_responder_ex, + peer_data, + app_context, + ) + .await; spdm_responder_ex .responder_context .common @@ -170,32 +200,18 @@ pub async fn spdm_responder_transfer_msk( result } -async fn spdm_responder_transfer_msk_inner( - spdm_responder_ex: &mut ResponderContextEx<'_>, - mig_info: &MigtdMigrationInformation, -) -> Result<(), SpdmStatus> { - let spdm_responder = &mut spdm_responder_ex.responder_context; - let mut writer = Writer::init(&mut spdm_responder.common.app_context_data_buffer); - - let responder_app_context = SpdmAppContextData { - migration_info: mig_info.clone(), - private_key: PrivateKeyDer::default(), - }; - responder_app_context - .encode(&mut writer) - .map_err(|_| SPDM_STATUS_BUFFER_FULL)?; - - Box::pin(rsp_handle_message(spdm_responder)).await -} - pub async fn rsp_handle_message(spdm_responder: &mut ResponderContext) -> Result<(), SpdmStatus> { let mut sid = None; + let mut iter: u32 = 0; loop { + iter = iter.wrapping_add(1); + log::info!("BC> RSP-LOOP-{} await process_message\n", iter); let raw_packet = Arc::new(Mutex::new([0u8; config::RECEIVER_BUFFER_SIZE])); let mut raw_packet = raw_packet.lock(); let raw_packet = raw_packet.deref_mut(); raw_packet.zeroize(); let res = Box::pin(spdm_responder.process_message(false, 0, raw_packet)).await; + log::info!("BC> RSP-LOOP-{} process_message returned\n", iter); let session_id = spdm_responder.common.runtime_info.get_last_session_id(); if session_id.is_some() { @@ -372,11 +388,12 @@ pub fn handle_exchange_mig_attest_info_req( reader: &mut Reader<'_>, vendor_defined_rsp_payload: &mut [u8], ) -> SpdmResult<usize> { + log::info!("BC> RSP-ATT-00 handle_exchange_mig_attest_info_req ENTER\n"); // Migration attestation messages must be handled only when migration info is set. let spdm_responder_ex = unsafe { upcast_mut(responder_context) }; if !matches!( &spdm_responder_ex.info, - ResponderContextExInfo::MigrationInformation(_) + ResponderContextExInfo::MigrationInformation { .. } ) { error!("Migration info is not set in responder context.\n"); return Err(SPDM_STATUS_INVALID_MSG_FIELD); @@ -452,8 +469,13 @@ pub fn handle_exchange_mig_attest_info_req( let report_data = build_report_data(b"MigTDRsp", &th1)?; + log::info!("BC> RSP-ATT-01 gen_quote_spdm (dst)\n"); //quote dst let quote_dst = gen_quote_spdm(&report_data)?; + log::info!( + "BC> RSP-ATT-02 gen_quote_spdm done, len={}\n", + quote_dst.len() + ); // Self-quote verification is only needed for policy v1, which uses // verified_report_local in authenticate_policy(). Policy v2 re-verifies // the quote internally via authenticate_remote(). @@ -584,6 +606,7 @@ pub fn handle_exchange_mig_attest_info_req( let spdm_responder_ex = upcast_mut(responder_context); spdm_responder_ex.peer_data.clone() }; + log::info!("BC> RSP-ATT-03 rsp_verify_peer_attestation_v2 BEGIN\n"); rsp_verify_peer_attestation_v2( "e_src_vec, &event_log_src_vec, @@ -595,6 +618,7 @@ pub fn handle_exchange_mig_attest_info_req( responder_context, session_id, )?; + log::info!("BC> RSP-ATT-04 rsp_verify_peer_attestation_v2 OK\n"); } let mut writer = Writer::init(vendor_defined_rsp_payload); @@ -736,11 +760,16 @@ fn rsp_verify_peer_attestation_v2( let peer_data_hash = digest_sha384(peer_data).map_err(|_| SPDM_STATUS_CRYPTO_ERROR)?; if mig_policy_hash_peer != peer_data_hash.as_slice() { error!("The received mig policy hash does not match the expected peer_data hash!\n"); + let session = responder_context + .common + .get_session_via_id(session_id) + .ok_or(SPDM_STATUS_INVALID_STATE_LOCAL)?; + session.teardown(); return Err(SPDM_STATUS_INVALID_MSG_FIELD); } - // 2. Authenticate remote, verify init TDINFO integrity against ServtdExt, - // and evaluate policy with init TDINFO as reference. + // 2. Authenticate remote, verify init/current mapped-SVN ordering from + // ServtdExt, and evaluate the source against local policy. #[cfg(not(feature = "test_disable_ra_and_accept_all"))] { let verified_report_peer = match mig_policy::authenticate_migration_source_with_init_tdinfo( @@ -802,6 +831,7 @@ pub fn handle_exchange_mig_info_req( reader: &mut Reader<'_>, vendor_defined_rsp_payload: &mut [u8], ) -> SpdmResult<usize> { + log::info!("BC> RSP-MIG-00 handle_exchange_mig_info_req ENTER\n"); // The VDM message for secret migration info exchange MUST be sent after mutual attested session establishment. let session_id = if let Some(sid) = session_id { sid @@ -889,38 +919,25 @@ pub fn handle_exchange_mig_info_req( }, }; - let mut reader = Reader::init(responder_context.common.app_context_data_buffer.as_ref()); - let responder_app_context = - SpdmAppContextData::read(&mut reader).ok_or(SPDM_STATUS_INVALID_MSG_SIZE)?; - let exchange_information = exchange_info(&responder_app_context.migration_info, false)?; - - verify_servtd_attr( - responder_app_context.migration_info.binding_handle, - &responder_app_context.migration_info.target_td_uuid, - )?; - - let mig_ver = cal_mig_version(false, &exchange_information, &remote_information)?; - set_mig_version(&responder_app_context.migration_info, mig_ver)?; - write_msk( - &responder_app_context.migration_info, - &remote_information.key, - )?; - - unsafe { - upcast_mut(responder_context).mig_info_exchanged = true; - } - - // Write APPROVED_SERVTD_EXT_HASH if SERVTD_EXT was received during attestation - #[cfg(feature = "policy_v2")] - { - let servtd_ext = unsafe { - let spdm_responder_ex = upcast_mut(responder_context); - spdm_responder_ex.servtd_ext - }; - if let Some(ext) = servtd_ext { - write_approved_servtd_ext_hash(&ext.calculate_approved_servtd_ext_hash()?)?; + // Read mig_info / exchange_information that the caller stashed in + // `responder_ex.info` before driving the session; stash the parsed + // `remote_information` for the caller to consume after the loop returns. + // + // SAFETY: `responder_context` was obtained from `&mut ResponderContextEx` + // via the SPDM dispatch path. See `upcast_mut` SAFETY notes. + let spdm_responder_ex = unsafe { upcast_mut(responder_context) }; + let exchange_information: &ExchangeInformation = match &spdm_responder_ex.info { + ResponderContextExInfo::MigrationInformation { + mig_info: _, + exchange_information, + } => *exchange_information, + _ => { + error!( + "Migration responder is missing ExchangeMigrationInfo context (caller did not set responder_ex.info)\n" + ); + return Err(SPDM_STATUS_INVALID_STATE_LOCAL); } - } + }; log::info!("Set MSK and report status\n"); @@ -928,6 +945,12 @@ pub fn handle_exchange_mig_info_req( let max_import_version = exchange_information.max_ver; let mig_session_key = exchange_information.key.as_bytes().to_vec(); + spdm_responder_ex.remote_information = Some(remote_information); + // Finalization now happens after the responder loop, so latch the + // accepted request here to prevent a replay from replacing the staged + // migration information before the caller commits it. + spdm_responder_ex.mig_info_exchanged = true; + let mut writer = Writer::init(vendor_defined_rsp_payload); let mut cnt = 0; let vdm_exchange_mig_info = VdmMessage { @@ -1163,6 +1186,11 @@ pub fn handle_exchange_rebind_attest_info_req( let peer_data_hash = digest_sha384(peer_data).map_err(|_| SPDM_STATUS_CRYPTO_ERROR)?; if mig_policy_hash_src_vec != peer_data_hash { error!("The received mig policy hash does not match the expected peer_data hash!\n"); + let session = responder_context + .common + .get_session_via_id(session_id) + .ok_or(SPDM_STATUS_INVALID_STATE_LOCAL)?; + session.teardown(); return Err(SPDM_STATUS_INVALID_MSG_FIELD); } @@ -1186,6 +1214,7 @@ pub fn handle_exchange_rebind_attest_info_req( // Verify that the peer's REPORTDATA is bound to this SPDM session's TH1 let verified_report_peer = policy_check_result.unwrap(); + #[cfg(not(any(feature = "AzCVMEmu", feature = "test_mock_report")))] if verify_tdreport_data_binding(&verified_report_peer, b"MigTDReq", &th1).is_err() { error!("Rebind peer REPORTDATA does not match expected TH1 binding!\n"); let session = responder_context @@ -1195,6 +1224,8 @@ pub fn handle_exchange_rebind_attest_info_req( session.teardown(); return Err(SpdmStatus::from(MigrationResult::MutualAttestationError)); } + #[cfg(any(feature = "AzCVMEmu", feature = "test_mock_report"))] + let _ = (&th1, &verified_report_peer); } unsafe { diff --git a/src/policy/Cargo.toml b/src/policy/Cargo.toml index 9d9568263..350c0963a 100644 --- a/src/policy/Cargo.toml +++ b/src/policy/Cargo.toml @@ -8,6 +8,7 @@ edition = "2018" [dependencies] cc-measurement = { path = "../../deps/td-shim/cc-measurement"} +corim = { version = "0.1.3", default-features = false, features = ["profile-intel"], optional = true } crypto = { path = "../crypto" } log = { version = "0.4.13", optional = true } serde = { version = "1.0", default-features = false, features = ["derive", "alloc"]} @@ -19,3 +20,7 @@ td-shim-interface = { path = "../../deps/td-shim/td-shim-interface"} std = [] AzCVMEmu = [] policy_v2 = [] +# Opt-in signed CoRIM TCB-mapping collateral, keyed by the same tdinfo_hash as +# the legacy JSON collateral. The COSE signature and x5chain signer anchor are +# verified before the payload is decoded. +servtd_corim = ["dep:corim"] diff --git a/src/policy/src/lib.rs b/src/policy/src/lib.rs index a9ff6355c..f3e8ffad7 100644 --- a/src/policy/src/lib.rs +++ b/src/policy/src/lib.rs @@ -54,6 +54,16 @@ pub enum PolicyError { QuoteGeneration, GetTdxReport, PeerCertChainValidation, + /// The `servtdTcbMappingIssuerChain` does not hash to the RTMR1 signer + /// anchor derived from the CFV policy issuer chain. Because that chain is + /// redacted from the RTMR2 measurement, this binding is what keeps it + /// measured (via RTMR1); a mismatch means the mapping signer is not the + /// measured root-of-trust. + SignerAnchorMismatch, + /// A certificate in the servtd signer chain (TCB mapping or identity) is + /// listed in the authoritative signer CRL (`servtdCrl`), or that CRL + /// failed authentication. Fail-closed. + SignerRevoked, } pub struct Report<'a> { @@ -189,6 +199,15 @@ pub enum EventName { MigTdPolicy, SgxRootKey, MigTdPolicySigner, + /// Single RTMR2 extend for v2 policy: canonical bytes of `policyData` + /// with `servtdCollateral.servtdTcbMapping` removed + /// (see `doc/tcb_mapping_design_proposal.md`). Tag ID + /// `TAGGED_EVENT_ID_POLICY_DATA = 0x9`. Replaces the prior six per-field + /// extends; protects every `policyData` field (including + /// `forwardPolicy` / `backwardPolicy` and the issuer chains) by + /// construction, while keeping `servtdTcbMapping` updateable + /// post-IGVM-build. + MigTdPolicyData, Unknown, } @@ -201,6 +220,7 @@ impl From<&str> for EventName { "Digest.MigTdCoreSvn" => Self::MigTdCoreSvn, "Digest.MigTdPolicy" => Self::MigTdPolicy, "Digest.MigTdSgxRootKey" => Self::SgxRootKey, + "Digest.MigTdPolicyData" => Self::MigTdPolicyData, _ => Self::Unknown, } } diff --git a/src/policy/src/v2/measurement.rs b/src/policy/src/v2/measurement.rs new file mode 100644 index 000000000..25975c69a --- /dev/null +++ b/src/policy/src/v2/measurement.rs @@ -0,0 +1,784 @@ +// Copyright (c) 2026 Intel Corporation +// +// SPDX-License-Identifier: BSD-2-Clause-Patent + +//! Policy v2 measurement primitives, per `doc/tcb_mapping_design_proposal.md`. +//! +//! These helpers are used by both the runtime (`migtd::bin::migtd::main`) and +//! the offline build tool (`migtd-hash`) so the two compute identical values +//! and the runtime `replay_event_log` cross-check stays consistent. +//! +//! ## RTMR2 measurement scheme +//! +//! RTMR2 (`mr_index = 0x3`) is extended **once** with the canonical JSON bytes +//! of `policyData` with `servtdCollateral.servtdTcbMapping` **and** +//! `servtdCollateral.servtdTcbMappingIssuerChain` removed. +//! +//! | # | Field | Helper | Tag ID | EventName | +//! |---|-------|--------|--------|-----------| +//! | 1 | `policyData` (redacted: `servtdTcbMapping` + `servtdTcbMappingIssuerChain` omitted) | `extract_canonical_policy_data_bytes` | `0x9` | `MigTdPolicyData` | +//! +//! Two fields are excluded, for two different reasons: +//! * `servtdCollateral.servtdTcbMapping` — must remain updateable after the +//! IGVM is published (re-signed by the issuer without re-releasing the +//! image); it also carries the circular `tdinfo_hash`. +//! * `servtdCollateral.servtdTcbMappingIssuerChain` — already measured into +//! **RTMR1** (the signer anchor), so measuring it again here would be +//! redundant and would re-couple TCB-mapping-signer key rotation to +//! `tdinfo_hash`. +//! +//! Every other field of `policyData` — including `version`, `id`, `policySvn`, +//! `policy`, `forwardPolicy`, `backwardPolicy`, `collaterals`, +//! `servtdCollateral.majorVersion`, `servtdCollateral.minorVersion`, +//! `servtdCollateral.servtdIdentity` (with its signature), and +//! `servtdCollateral.servtdIdentityIssuerChain` — is bound into RTMR2 by +//! virtue of being inside `policyData`. This prevents playback of an obsolete +//! but validly signed identity in JSON-collateral builds. +//! +//! ## Canonicalization +//! +//! "Canonical" means: object keys sorted alphabetically at every nesting +//! level, no whitespace between tokens, array element order preserved, and +//! scalar values rendered by `serde_json` (RFC 8259 JSON literal form). +//! +//! Canonicalization is implemented manually by [`canonical_value_bytes`] and +//! does **not** rely on `serde_json::to_vec`'s ordering, because other crates +//! in this workspace enable `serde_json/preserve_order`. If feature +//! unification ever turns that on in the policy crate's build, the helper +//! still emits sorted output. +//! +//! ## RTMR1 signer anchor +//! +//! `compute_signer_anchor` returns the 48-byte value `A` where +//! `A = SHA384("MIGTD-RTMR1-ANCHOR-V1" || 0x00 || R || 0x00 || EKU_OID)`, +//! `R = SHA384(DER(root_cert))`, and `EKU_OID` is the DER-encoded, dedicated +//! signer-purpose Extended Key Usage OID from the leaf certificate. +//! `A` is the value extended into RTMR1 (replacing the old "hash the full +//! policy issuer chain PEM bytes" scheme). +//! +//! ## `tdinfo_hash` = `init_servtd_info_hash` +//! +//! The TDX module computes `init_servtd_info_hash = SHA384(TDINFO_STRUCT +//! masked by servtd_attr)`. For production MigTDs (`servtd_attr == 0`) this +//! simplifies to `SHA384(unmasked_TDINFO)`. The TCB mapping's +//! `svnMappings[].tdMeasurements.tdinfo_hash` stores this same value, +//! enabling MAA to look up `init_servtd_info_hash` directly against +//! svnMappings without any recomputation. +//! +//! Together, the single-extend RTMR2 (with `servtdTcbMapping` redacted) and +//! the RTMR1 signer anchor break the circular dependency that previously +//! prevented `svnMappings[].tdMeasurements` from being a stable, pre-signing +//! computable function of the build inputs. + +use alloc::{string::String, vec::Vec}; +use crypto::{ + extract_leaf_eku_oid_der_from_chain_pem, hash::digest_sha384, + split_chain_pem_to_leaf_and_root_der, SHA384_DIGEST_SIZE, +}; +use serde_json::Value; + +use crate::PolicyError; + +/// Domain-separation tag for the RTMR1 signer anchor (per redesign §RTMR1 +/// signer-anchor formula). Bumped on any breaking change. +pub const SIGNER_ANCHOR_DOMAIN_TAG: &[u8] = b"MIGTD-RTMR1-ANCHOR-V1"; + +/// Single byte separator (`0x00`) between domain tag, R, and the EKU OID. +const SIGNER_ANCHOR_SEPARATOR: u8 = 0x00; + +/// Canonical `tdinfo_hash` used in svnMappings. +/// +/// Per the TDX module specification, the SEAM module computes: +/// `init_servtd_info_hash = SHA384(TDINFO_STRUCT masked by servtd_attr)` +/// +/// For a production MigTD with `servtd_attr == 0` (no IGNORE bits), masking +/// is a no-op, so `init_servtd_info_hash = SHA384(unmasked_TDINFO)`. +/// +/// The TCB mapping's `svnMappings[].tdMeasurements.tdinfo_hash` stores this +/// same value, enabling direct lookup: MAA can compare +/// `servtd_ext.init_servtd_info_hash` against svnMappings entries without +/// any additional computation. +/// +/// Callers MUST pass the SHA384 of the unmasked, fully-populated 512-byte +/// TDINFO_STRUCT (no IGNORE-mask bits applied). +pub fn compute_tdinfo_hash( + unmasked_tdinfo_sha384: &[u8], +) -> Result<[u8; SHA384_DIGEST_SIZE], PolicyError> { + if unmasked_tdinfo_sha384.len() != SHA384_DIGEST_SIZE { + return Err(PolicyError::InvalidParameter); + } + + let mut out = [0u8; SHA384_DIGEST_SIZE]; + out.copy_from_slice(unmasked_tdinfo_sha384); + Ok(out) +} + +// --------------------------------------------------------------------------- +// Canonicalization +// --------------------------------------------------------------------------- + +/// Emit `v` as canonical JSON bytes into `out`: +/// +/// * **Object keys are sorted alphabetically** at every nesting level. This is +/// the property the runtime / migtd-hash / verifier all rely on, and the one +/// `serde_json::to_vec(Value)` does NOT guarantee when any workspace member +/// enables `serde_json/preserve_order` (which `migtd-policy-generator`, +/// `json-signer`, and `servtd-collateral-generator` all do). +/// * **No whitespace** between tokens. +/// * **Array element order is preserved** (JSON arrays are ordered). +/// * **Scalars** (null, bool, number, string) are emitted by `serde_json` — +/// their representation does not depend on `preserve_order`. +fn canonical_value_bytes_into(v: &Value, out: &mut Vec<u8>) -> Result<(), PolicyError> { + match v { + Value::Object(map) => { + out.push(b'{'); + let mut keys: Vec<&String> = map.keys().collect(); + keys.sort(); + for (i, k) in keys.iter().enumerate() { + if i > 0 { + out.push(b','); + } + // A `Value::String` of the key serializes to a JSON-encoded + // string literal (including the surrounding quotes and any + // necessary escapes). Always safe regardless of feature flags. + let key_bytes = serde_json::to_vec(&Value::String((*k).clone())) + .map_err(|_| PolicyError::InvalidPolicy)?; + out.extend_from_slice(&key_bytes); + out.push(b':'); + canonical_value_bytes_into(map.get(*k).ok_or(PolicyError::InvalidPolicy)?, out)?; + } + out.push(b'}'); + } + Value::Array(arr) => { + out.push(b'['); + for (i, e) in arr.iter().enumerate() { + if i > 0 { + out.push(b','); + } + canonical_value_bytes_into(e, out)?; + } + out.push(b']'); + } + other => { + let scalar_bytes = serde_json::to_vec(other).map_err(|_| PolicyError::InvalidPolicy)?; + out.extend_from_slice(&scalar_bytes); + } + } + Ok(()) +} + +/// Canonical JSON bytes of `v` (sorted object keys at every level, no +/// whitespace). See [`canonical_value_bytes_into`] for details. +pub fn canonical_value_bytes(v: &Value) -> Result<Vec<u8>, PolicyError> { + let mut out = Vec::new(); + canonical_value_bytes_into(v, &mut out)?; + Ok(out) +} + +// --------------------------------------------------------------------------- +// policyData extraction (single redacted extend) +// --------------------------------------------------------------------------- + +/// Parse `policy_input` and return the `policyData` value. Accepts both: +/// * the signed-wrapper form `{"policyData": {...}, "signature": "..."}`, and +/// * a bare `policyData` object (e.g. `policy_data_raw.json` content). +fn parse_policy_data(policy_input: &[u8]) -> Result<Value, PolicyError> { + let top: Value = + serde_json::from_slice(policy_input).map_err(|_| PolicyError::InvalidPolicy)?; + + let policy_data = match top.get("policyData") { + Some(v) => v.clone(), + None => top, + }; + + if !policy_data.is_object() { + return Err(PolicyError::InvalidPolicy); + } + Ok(policy_data) +} + +/// Canonical JSON bytes of `policyData` with `servtdCollateral.servtdTcbMapping` +/// **and** `servtdCollateral.servtdTcbMappingIssuerChain` removed, INCLUDING +/// the outer `{` / `}`. +/// +/// This is the single buffer extended into RTMR2 by the runtime and by +/// `migtd-hash` (tag `TAGGED_EVENT_ID_POLICY_DATA = 0x9`, event name +/// `MigTdPolicyData`). Redacting `servtdTcbMapping` is what breaks the circular +/// dependency between `svnMappings[].tdMeasurements.tdinfo_hash` and RTMR2: +/// every other included `policyData` field is bound by virtue of being part of +/// the canonical object bytes, so the measurement automatically protects future +/// field additions without manual whitelist maintenance. +/// +/// Two fields are redacted: +/// * `servtdCollateral.servtdTcbMapping` (**strict** — its absence is an error) +/// because the release pipeline must re-issue (re-sign) the TCB mapping with +/// updated `svnMappings[]` entries without rebuilding the IGVM image, and it +/// carries the circular `tdinfo_hash`. +/// * `servtdCollateral.servtdTcbMappingIssuerChain` (**non-strict** — removed +/// if present) because it is already measured into RTMR1 (the signer anchor); +/// measuring it again here would be redundant and would re-couple +/// TCB-mapping-signer rotation to `tdinfo_hash`. +/// +/// Every other field — `version`, `id`, `policySvn`, `policy`, `forwardPolicy`, +/// `backwardPolicy`, `collaterals`, `servtdCollateral.majorVersion`, +/// `servtdCollateral.minorVersion`, `servtdCollateral.servtdIdentity` (with its +/// signature), and `servtdCollateral.servtdIdentityIssuerChain` — is bound into +/// RTMR2. +/// +/// ## Strict redaction (schema-drift defense) +/// +/// The redaction is **structurally strict**: it requires +/// `servtdCollateral` to be present as a JSON object, AND +/// `servtdTcbMapping` to be one of its direct children. Any input that +/// violates either condition (missing `servtdCollateral`, non-object +/// `servtdCollateral`, or missing `servtdTcbMapping`) is rejected with +/// `PolicyError::InvalidPolicy`. A silent no-op on a malformed shape +/// would let a future schema change (e.g. moving `servtdTcbMapping` +/// under a new wrapper, making `servtdCollateral` optional, or +/// type-confusing it to null/string/array) silently land the mapping +/// bytes — or zero redaction at all — in the RTMR2 extend, +/// re-introducing the circular dependency this scheme exists to break. +/// The runtime extender already panics on extraction failure, so the +/// stricter error path is fail-closed. +pub fn extract_canonical_policy_data_bytes(policy_input: &[u8]) -> Result<Vec<u8>, PolicyError> { + let mut policy_data = parse_policy_data(policy_input)?; + + // Redact the servtd collateral sub-fields when a `servtdCollateral` object + // is present. A CoRIM-only policy omits `servtdCollateral` entirely; there + // is then nothing to redact and the whole `policyData` is measured as-is. + match policy_data.get_mut("servtdCollateral") { + None => {} + Some(value) => { + let coll = value.as_object_mut().ok_or(PolicyError::InvalidPolicy)?; + + if coll.remove("servtdTcbMapping").is_none() { + return Err(PolicyError::InvalidPolicy); + } + + // Also redact `servtdTcbMappingIssuerChain`: it is already measured + // into RTMR1 (the signer anchor), so measuring it again here would + // be redundant AND would re-couple leaf/intermediate-CA rotation of + // the TCB-mapping signer to `tdinfo_hash`. + // + // Non-strict (remove if present): the security binding does not rest + // on this redaction: `RawPolicyData::verify` separately requires the + // chain that verifies `servtdTcbMapping` to hash to the RTMR1 signer + // anchor, so a swapped/absent chain fails closed there. + coll.remove("servtdTcbMappingIssuerChain"); + } + } + + canonical_value_bytes(&policy_data) +} + +/// Compute the RTMR1 signer anchor `A` from its component digests. +/// +/// `A = SHA384(SIGNER_ANCHOR_DOMAIN_TAG || 0x00 || R || 0x00 || EKU_OID)` +/// +/// where `R = SHA384(DER(root_cert))` and `EKU_OID` is the DER-encoded, +/// dedicated signer-purpose EKU OID from the leaf certificate. +pub fn compute_signer_anchor( + root_der: &[u8], + leaf_eku_oid_der: &[u8], +) -> Result<[u8; SHA384_DIGEST_SIZE], PolicyError> { + let r = digest_sha384(root_der).map_err(|_| PolicyError::HashCalculation)?; + + let mut buf = Vec::with_capacity( + SIGNER_ANCHOR_DOMAIN_TAG.len() + 1 + r.len() + 1 + leaf_eku_oid_der.len(), + ); + buf.extend_from_slice(SIGNER_ANCHOR_DOMAIN_TAG); + buf.push(SIGNER_ANCHOR_SEPARATOR); + buf.extend_from_slice(&r); + buf.push(SIGNER_ANCHOR_SEPARATOR); + buf.extend_from_slice(leaf_eku_oid_der); + + let digest = digest_sha384(&buf).map_err(|_| PolicyError::HashCalculation)?; + let mut out = [0u8; SHA384_DIGEST_SIZE]; + out.copy_from_slice(&digest); + Ok(out) +} + +/// Compute the RTMR1 signer anchor directly from a PEM cert chain (leaf-first). +/// +/// Convenience wrapper combining the crypto crate's chain split + leaf EKU +/// extraction with `compute_signer_anchor`. +pub fn compute_signer_anchor_from_chain_pem( + chain_pem: &[u8], +) -> Result<[u8; SHA384_DIGEST_SIZE], PolicyError> { + let (_leaf_der, root_der) = + split_chain_pem_to_leaf_and_root_der(chain_pem).map_err(|_| PolicyError::InvalidPolicy)?; + let leaf_eku_oid = extract_leaf_eku_oid_der_from_chain_pem(chain_pem) + .map_err(|_| PolicyError::InvalidPolicy)?; + compute_signer_anchor(&root_der, &leaf_eku_oid) +} + +/// Resolve a signer anchor from either representation carried in the CFV / +/// exchanged with a peer: +/// +/// * a **precomputed 48-byte anchor** (exactly `SHA384_DIGEST_SIZE` bytes) — +/// returned as-is (the CoRIM-only enrollment form, which does not carry a +/// full PEM), or +/// * a **PEM issuer chain** (leaf-first) — the anchor is derived via +/// [`compute_signer_anchor_from_chain_pem`] (the legacy JSON form). +/// +/// This lets the runtime accept either enrollment/exchange form and bind the +/// same RTMR1 anchor. A PEM is never 48 bytes, so the discriminator is +/// unambiguous. +pub fn resolve_signer_anchor(input: &[u8]) -> Result<[u8; SHA384_DIGEST_SIZE], PolicyError> { + if input.len() == SHA384_DIGEST_SIZE { + let mut anchor = [0u8; SHA384_DIGEST_SIZE]; + anchor.copy_from_slice(input); + Ok(anchor) + } else { + compute_signer_anchor_from_chain_pem(input) + } +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn signer_anchor_is_stable_for_fixed_inputs() { + // Fixed test vectors so offline + runtime implementations cannot diverge. + let root = b"the-root-DER-placeholder"; + let eku_oid_der = b"\x06\x0a\x2b\x06\x01\x04\x01\x81\xfd\x59\x01\x01"; + let a = compute_signer_anchor(root, eku_oid_der).unwrap(); + // Recompute and ensure deterministic. + let a2 = compute_signer_anchor(root, eku_oid_der).unwrap(); + assert_eq!(a, a2); + + // Verify the formula explicitly. + let r = digest_sha384(root).unwrap(); + let mut buf = Vec::new(); + buf.extend_from_slice(SIGNER_ANCHOR_DOMAIN_TAG); + buf.push(0u8); + buf.extend_from_slice(&r); + buf.push(0u8); + buf.extend_from_slice(eku_oid_der); + let expected = digest_sha384(&buf).unwrap(); + assert_eq!(&a[..], expected.as_slice()); + } + + #[test] + fn signer_anchor_changes_with_root_or_eku() { + let a = compute_signer_anchor(b"root1", b"\x06\x02\x2a\x03").unwrap(); + let b = compute_signer_anchor(b"root2", b"\x06\x02\x2a\x03").unwrap(); + let c = compute_signer_anchor(b"root1", b"\x06\x02\x2a\x04").unwrap(); + assert_ne!(a, b); + assert_ne!(a, c); + assert_ne!(b, c); + } + + #[test] + fn signer_anchor_from_chain_ignores_leaf_subject_and_key() { + let a = compute_signer_anchor_from_chain_pem(include_bytes!( + "../../../crypto/test/eku/signer_a.pem" + )) + .unwrap(); + let rotated = compute_signer_anchor_from_chain_pem(include_bytes!( + "../../../crypto/test/eku/signer_b.pem" + )) + .unwrap(); + let other_purpose = compute_signer_anchor_from_chain_pem(include_bytes!( + "../../../crypto/test/eku/signer_other_eku.pem" + )) + .unwrap(); + + assert_eq!(a, rotated); + assert_ne!(a, other_purpose); + } + + #[test] + fn signer_anchor_from_chain_requires_single_dedicated_eku() { + for chain in [ + include_bytes!("../../../crypto/test/eku/signer_no_eku.pem").as_slice(), + include_bytes!("../../../crypto/test/eku/signer_multiple_eku.pem").as_slice(), + include_bytes!("../../../crypto/test/eku/signer_any_eku.pem").as_slice(), + ] { + assert!(compute_signer_anchor_from_chain_pem(chain).is_err()); + } + } + + // ------------------------------------------------------------------ + // canonical_value_bytes + // ------------------------------------------------------------------ + + #[test] + fn canonical_value_sorts_keys_at_every_level() { + let a: Value = + serde_json::from_str(r#"{"b":{"y":2,"x":1},"a":[{"c":3,"b":2,"a":1}]}"#).unwrap(); + let b: Value = + serde_json::from_str(r#"{"a":[{"a":1,"b":2,"c":3}],"b":{"x":1,"y":2}}"#).unwrap(); + let out_a = canonical_value_bytes(&a).unwrap(); + let out_b = canonical_value_bytes(&b).unwrap(); + assert_eq!(out_a, out_b); + assert_eq!(&out_a, br#"{"a":[{"a":1,"b":2,"c":3}],"b":{"x":1,"y":2}}"#); + } + + #[test] + fn canonical_value_preserves_array_order() { + let v: Value = serde_json::from_str(r#"[3,1,2]"#).unwrap(); + assert_eq!(canonical_value_bytes(&v).unwrap(), b"[3,1,2]"); + } + + #[test] + fn canonical_value_emits_no_whitespace() { + let v: Value = serde_json::from_str("{\n \"a\" : 1 ,\n \"b\" : [ 2 , 3 ]\n}").unwrap(); + assert_eq!(canonical_value_bytes(&v).unwrap(), br#"{"a":1,"b":[2,3]}"#); + } + + // ------------------------------------------------------------------ + // extract_canonical_policy_data_bytes + // ------------------------------------------------------------------ + + /// Minimal bare-policyData with every nested field the redaction scheme + /// must handle: top-level fields, plus `servtdCollateral` containing both + /// `servtdIdentity` (measured) and `servtdTcbMapping` (redacted). + fn sample_bare_policy_data() -> &'static str { + r#"{"id":"X-uuid","version":"2.0","policySvn":7,"policy":[{"global":{"tcb":{"tcbDate":{"reference":"2023","operation":"ge"}}}},{"servtd":{"x":1}}],"collaterals":{"majorVersion":1,"minorVersion":0,"teeType":129},"servtdCollateral":{"majorVersion":1,"minorVersion":0,"servtdIdentityIssuerChain":"chain","servtdIdentity":{"tdIdentity":{"id":"identity-1","version":1,"tcbLevels":[]},"signature":"deadbeef"},"servtdTcbMappingIssuerChain":"mapping-chain","servtdTcbMapping":{"svnMappings":[{"isvsvn":1}]}}}"# + } + + fn sample_wrapped_policy() -> alloc::string::String { + format!( + r#"{{"policyData":{},"signature":"sig"}}"#, + sample_bare_policy_data() + ) + } + + #[test] + fn extract_returns_outer_braces() { + let out = + extract_canonical_policy_data_bytes(sample_bare_policy_data().as_bytes()).unwrap(); + assert_eq!(out.first(), Some(&b'{')); + assert_eq!(out.last(), Some(&b'}')); + } + + #[test] + fn extract_redacts_servtd_tcb_mapping() { + // Two policies that differ ONLY in servtdCollateral.servtdTcbMapping + // must produce identical canonical bytes (the redaction is what makes + // tcbMapping updateable post-IGVM-build). + let a = r#"{"id":"X","version":"2","policySvn":1,"policy":[],"collaterals":{},"servtdCollateral":{"majorVersion":1,"minorVersion":0,"servtdIdentityIssuerChain":"c","servtdIdentity":{"tdIdentity":{"id":"i"},"signature":"aa"},"servtdTcbMappingIssuerChain":"c","servtdTcbMapping":{"svnMappings":[{"isvsvn":1}]}}}"#; + let b = r#"{"id":"X","version":"2","policySvn":1,"policy":[],"collaterals":{},"servtdCollateral":{"majorVersion":1,"minorVersion":0,"servtdIdentityIssuerChain":"c","servtdIdentity":{"tdIdentity":{"id":"i"},"signature":"aa"},"servtdTcbMappingIssuerChain":"c","servtdTcbMapping":{"svnMappings":[{"isvsvn":99},{"isvsvn":100}]}}}"#; + let out_a = extract_canonical_policy_data_bytes(a.as_bytes()).unwrap(); + let out_b = extract_canonical_policy_data_bytes(b.as_bytes()).unwrap(); + assert_eq!(out_a, out_b); + // And the redacted bytes must NOT contain the substring of either + // svnMappings payload. + assert!(!out_a + .windows(b"svnMappings".len()) + .any(|w| w == b"svnMappings")); + } + + #[test] + fn extract_measures_servtd_identity() { + // The signed identity is part of RTMR2. Replaying a different identity + // or signature must therefore change the measured policy bytes. + let a = r#"{"servtdCollateral":{"servtdIdentity":{"tdIdentity":{"id":"i1"},"signature":"aa"},"servtdTcbMapping":{}}}"#; + let b = r#"{"servtdCollateral":{"servtdIdentity":{"tdIdentity":{"id":"i1"},"signature":"bb"},"servtdTcbMapping":{}}}"#; + let out_a = extract_canonical_policy_data_bytes(a.as_bytes()).unwrap(); + let out_b = extract_canonical_policy_data_bytes(b.as_bytes()).unwrap(); + assert_ne!(out_a, out_b); + assert!(out_a + .windows(b"servtdIdentity".len()) + .any(|w| w == b"servtdIdentity")); + } + + #[test] + fn extract_measures_identity_chain_but_redacts_mapping_chain() { + // The identity chain is part of RTMR2, while the mapping chain is + // redacted and bound through the RTMR1 signer anchor. + let base = r#"{"servtdCollateral":{"servtdIdentityIssuerChain":"chain-A","servtdTcbMappingIssuerChain":"chain-A","servtdTcbMapping":{}}}"#; + let diff_identity = r#"{"servtdCollateral":{"servtdIdentityIssuerChain":"chain-B","servtdTcbMappingIssuerChain":"chain-A","servtdTcbMapping":{}}}"#; + let diff_mapping = r#"{"servtdCollateral":{"servtdIdentityIssuerChain":"chain-A","servtdTcbMappingIssuerChain":"chain-B","servtdTcbMapping":{}}}"#; + let out_base = extract_canonical_policy_data_bytes(base.as_bytes()).unwrap(); + let out_diff_identity = + extract_canonical_policy_data_bytes(diff_identity.as_bytes()).unwrap(); + let out_diff_mapping = + extract_canonical_policy_data_bytes(diff_mapping.as_bytes()).unwrap(); + assert_ne!(out_base, out_diff_identity); + assert_eq!(out_base, out_diff_mapping); + } + + #[test] + fn extract_redacts_servtd_tcb_mapping_issuer_chain() { + // Two policies that differ ONLY in + // servtdCollateral.servtdTcbMappingIssuerChain must produce identical + // canonical bytes (the chain is anchored by RTMR1, not RTMR2). This is + // what makes TCB-mapping-signer key/intermediate rotation + // tdinfo_hash-stable. + let a = r#"{"servtdCollateral":{"servtdTcbMappingIssuerChain":"old-leaf-chain","servtdTcbMapping":{}}}"#; + let b = r#"{"servtdCollateral":{"servtdTcbMappingIssuerChain":"rotated-leaf-chain","servtdTcbMapping":{}}}"#; + let out_a = extract_canonical_policy_data_bytes(a.as_bytes()).unwrap(); + let out_b = extract_canonical_policy_data_bytes(b.as_bytes()).unwrap(); + assert_eq!(out_a, out_b); + } + + #[test] + fn extract_accepts_signed_wrapper_and_matches_bare() { + // Extracting from `{"policyData": {...}, "signature": "..."}` must + // produce identical bytes to extracting from the bare object form. + let bare = sample_bare_policy_data(); + let wrapped = sample_wrapped_policy(); + let out_bare = extract_canonical_policy_data_bytes(bare.as_bytes()).unwrap(); + let out_wrapped = extract_canonical_policy_data_bytes(wrapped.as_bytes()).unwrap(); + assert_eq!(out_bare, out_wrapped); + } + + #[test] + fn extract_is_canonical_across_key_order() { + // The same policy serialised with different key orders must produce + // identical bytes after redaction + canonicalization. + let order_a = r#"{"version":"2.0","id":"X","policySvn":7,"policy":[{"b":2,"a":1}],"collaterals":{"teeType":129,"majorVersion":1,"minorVersion":0},"servtdCollateral":{"servtdIdentity":{"tdIdentity":{"version":1,"id":"i"},"signature":"aa"},"servtdTcbMapping":{"x":1}}}"#; + let order_b = r#"{"policy":[{"a":1,"b":2}],"id":"X","policySvn":7,"version":"2.0","servtdCollateral":{"servtdTcbMapping":{"x":1},"servtdIdentity":{"signature":"aa","tdIdentity":{"id":"i","version":1}}},"collaterals":{"minorVersion":0,"majorVersion":1,"teeType":129}}"#; + let out_a = extract_canonical_policy_data_bytes(order_a.as_bytes()).unwrap(); + let out_b = extract_canonical_policy_data_bytes(order_b.as_bytes()).unwrap(); + assert_eq!(out_a, out_b); + } + + #[test] + fn extract_rejects_non_object_top_level() { + assert!(extract_canonical_policy_data_bytes(b"\"just-a-string\"").is_err()); + assert!(extract_canonical_policy_data_bytes(b"[]").is_err()); + assert!(extract_canonical_policy_data_bytes(b"null").is_err()); + assert!(extract_canonical_policy_data_bytes(b"42").is_err()); + } + + #[test] + fn extract_rejects_malformed_json() { + assert!(extract_canonical_policy_data_bytes(b"{not-json").is_err()); + } + + #[test] + fn extract_allows_missing_servtd_collateral() { + // CoRIM-only policies omit `servtdCollateral` entirely: there is nothing + // to redact, so the whole `policyData` is measured as-is (Ok). The + // servtd endorsement is delivered as a separately-enrolled CoRIM. + let input = br#"{"version":"2.0","id":"X","policySvn":1,"policy":[],"collaterals":{}}"#; + assert!(extract_canonical_policy_data_bytes(input).is_ok()); + } + + #[test] + fn extract_measures_top_level_servtd_crl() { + let empty = br#"{"version":"2.0","id":"X","servtdCrl":"empty"}"#; + let revoked = br#"{"version":"2.0","id":"X","servtdCrl":"revoked"}"#; + let out_empty = extract_canonical_policy_data_bytes(empty).unwrap(); + let out_revoked = extract_canonical_policy_data_bytes(revoked).unwrap(); + assert_ne!(out_empty, out_revoked); + } + + #[test] + fn extract_rejects_non_object_servtd_collateral() { + // Schema-drift defense: type-confused servtdCollateral (null, + // string, array, number) MUST be rejected, not silently + // no-op'd. The current strongly-typed PolicyData rejects these + // upstream; the redaction layer enforces the same invariant + // even when called in isolation (e.g. from migtd-hash with raw + // input) so the runtime extender never sees an un-redacted + // policy. + for shape in [ + br#"{"servtdCollateral":null}"#.as_slice(), + br#"{"servtdCollateral":"a-string"}"#.as_slice(), + br#"{"servtdCollateral":[]}"#.as_slice(), + br#"{"servtdCollateral":42}"#.as_slice(), + ] { + assert!( + extract_canonical_policy_data_bytes(shape).is_err(), + "expected error for shape: {:?}", + core::str::from_utf8(shape).unwrap() + ); + } + } + + #[test] + fn extract_rejects_servtd_collateral_without_tcb_mapping() { + // Schema-drift defense: servtdCollateral present but missing + // servtdTcbMapping MUST be rejected. If servtdTcbMapping ever + // moves elsewhere (e.g. hoisted to a top-level peer of + // policyData, or nested under a new release-scoped wrapper), + // the hard-coded path in the redaction would redact the + // (now-empty) old location only and silently land the mapping + // bytes elsewhere in the canonical extend. Failing closed on + // missing servtdTcbMapping forces an explicit code update on + // every such schema migration. + let input = br#"{"servtdCollateral":{"a":1}}"#; + assert!(extract_canonical_policy_data_bytes(input).is_err()); + + let input2 = br#"{"servtdCollateral":{"majorVersion":1,"servtdIdentity":{"tdIdentity":{"id":"i"},"signature":"aa"}}}"#; + assert!(extract_canonical_policy_data_bytes(input2).is_err()); + } + + #[test] + fn extract_empty_tcb_mapping_object_is_equivalent_to_post_redaction() { + // T13 regression pin: the release pipeline's pre-final policy + // template carries `"servtdTcbMapping": {}` so the strict + // redaction in extract_canonical_policy_data_bytes accepts it + // (an empty object satisfies the present-and-then-removed + // contract). Under canonical redaction the result MUST be + // byte-equal to a final policy whose `servtdTcbMapping` + // contains the real signed mapping, because the redacted + // bytes contain neither either way. The CI gate at + // run_release_pipeline_locally.sh proves this invariant for + // the production policy; this unit test pins it at the helper + // boundary so the gate cannot diverge from the helper. + let pre_final = r#"{"servtdCollateral":{"majorVersion":1,"servtdIdentity":{"tdIdentity":{"id":"i"},"signature":"aa"},"servtdTcbMapping":{}}}"#; + let final_pol = r#"{"servtdCollateral":{"majorVersion":1,"servtdIdentity":{"tdIdentity":{"id":"i"},"signature":"aa"},"servtdTcbMapping":{"svnMappings":[{"isvsvn":7,"tdMeasurements":{"tdinfo_hash":"deadbeef"}}],"signature":"bb"}}}"#; + let out_pre = extract_canonical_policy_data_bytes(pre_final.as_bytes()).unwrap(); + let out_final = extract_canonical_policy_data_bytes(final_pol.as_bytes()).unwrap(); + assert_eq!(out_pre, out_final); + } + + #[test] + fn extract_measures_forward_and_backward_policy() { + // Stripping forwardPolicy / backwardPolicy from a policy that has + // them MUST change the extend bytes — otherwise an attacker who can + // ship policy through ESRP could strip migration restrictions + // without changing the measured RTMR2. + let with_fwd_bwd = r#"{"policy":[],"forwardPolicy":[{"deny":"all"}],"backwardPolicy":[{"deny":"all"}],"servtdCollateral":{"servtdTcbMapping":{}}}"#; + let without = r#"{"policy":[],"servtdCollateral":{"servtdTcbMapping":{}}}"#; + let out_with = extract_canonical_policy_data_bytes(with_fwd_bwd.as_bytes()).unwrap(); + let out_without = extract_canonical_policy_data_bytes(without.as_bytes()).unwrap(); + assert_ne!(out_with, out_without); + } + + #[test] + fn extract_sample_policy_canonical_bytes() { + // Pin the canonical bytes for the sample policy as a regression + // fixture: any unintended change to canonicalization (key order, + // whitespace, redaction scope) will fail this assertion. + let out = + extract_canonical_policy_data_bytes(sample_bare_policy_data().as_bytes()).unwrap(); + let expected = br#"{"collaterals":{"majorVersion":1,"minorVersion":0,"teeType":129},"id":"X-uuid","policy":[{"global":{"tcb":{"tcbDate":{"operation":"ge","reference":"2023"}}}},{"servtd":{"x":1}}],"policySvn":7,"servtdCollateral":{"majorVersion":1,"minorVersion":0,"servtdIdentity":{"signature":"deadbeef","tdIdentity":{"id":"identity-1","tcbLevels":[],"version":1}},"servtdIdentityIssuerChain":"chain"},"version":"2.0"}"#; + assert_eq!(&out, expected); + } + + // ------------------------------------------------------------------ + // Schema-drift defense (fix for scenario 10) + // + // These tests are NOT about the current schema shape — they exist to + // catch a future schema change that introduces a new placement of + // `servtdTcbMapping` without updating the redaction logic. + // ------------------------------------------------------------------ + + /// Recursively count the number of object keys named `target` in `v` + /// and record the dotted path of each occurrence. + fn collect_key_paths( + v: &Value, + target: &str, + current: &mut alloc::string::String, + out: &mut Vec<alloc::string::String>, + ) { + match v { + Value::Object(map) => { + for (k, child) in map.iter() { + let prev_len = current.len(); + if !current.is_empty() { + current.push('.'); + } + current.push_str(k); + if k == target { + out.push(current.clone()); + } + collect_key_paths(child, target, current, out); + current.truncate(prev_len); + } + } + Value::Array(arr) => { + for (i, e) in arr.iter().enumerate() { + let prev_len = current.len(); + current.push_str(&format!("[{}]", i)); + collect_key_paths(e, target, current, out); + current.truncate(prev_len); + } + } + _ => {} + } + } + + #[test] + fn extract_input_has_servtd_tcb_mapping_only_at_expected_path() { + // Defense against (2) in the scenario-10 fix recommendation: + // if a future schema places `servtdTcbMapping` anywhere other + // than the single expected path `servtdCollateral.servtdTcbMapping` + // (e.g. nested under a release-scoped wrapper, or hoisted to a + // top-level peer of policyData), this test fails and forces an + // explicit code update to the redaction helper. + // + // Note: this asserts the property of the SAMPLE INPUT used by the + // test suite, not arbitrary inputs. Combined with + // `extract_canonical_bytes_do_not_contain_field_name` below, it + // pins both the schema fixture and the redaction completeness. + let v: Value = serde_json::from_str(sample_bare_policy_data()).unwrap(); + let mut paths = Vec::new(); + let mut cur = alloc::string::String::new(); + collect_key_paths(&v, "servtdTcbMapping", &mut cur, &mut paths); + assert_eq!( + paths.len(), + 1, + "servtdTcbMapping must appear exactly once in the sample; found at: {:?}", + paths + ); + assert_eq!(paths[0], "servtdCollateral.servtdTcbMapping"); + } + + #[test] + fn extract_canonical_bytes_do_not_contain_field_name() { + // Defense against schema drift / regression in the redaction + // helper: the literal substring `"servtdTcbMapping"` (the JSON + // key wrapped in quotes) MUST NOT appear anywhere in the + // canonical extend bytes. A regression that forgets to redact, + // or a refactor that adds a new wrapper containing the same + // key, would cause this assertion to fail. + // + // This complements `extract_redacts_servtd_tcb_mapping` (which + // pins the byte equivalence of two policies that differ only in + // mapping content) by adding a direct lexical check of the + // output. The two tests catch different failure modes: byte + // equivalence catches an additive leak via shared bytes, + // substring absence catches the field surviving anywhere in the + // output JSON. + let out = + extract_canonical_policy_data_bytes(sample_bare_policy_data().as_bytes()).unwrap(); + let needle = b"\"servtdTcbMapping\""; + assert!( + !out.windows(needle.len()).any(|w| w == needle), + "canonical output contained redacted field name: {}", + core::str::from_utf8(&out).unwrap_or("<non-utf8>") + ); + // Also check the inner key as a defense-in-depth measure. + let inner_needle = b"\"svnMappings\""; + assert!( + !out.windows(inner_needle.len()).any(|w| w == inner_needle), + "canonical output contained inner mapping key: {}", + core::str::from_utf8(&out).unwrap_or("<non-utf8>") + ); + // The TCB-mapping issuer chain is redacted too (measured into RTMR1), + // so its field name MUST NOT survive in the RTMR2 extend bytes. + let chain_needle = b"\"servtdTcbMappingIssuerChain\""; + assert!( + !out.windows(chain_needle.len()).any(|w| w == chain_needle), + "canonical output contained redacted issuer-chain field name: {}", + core::str::from_utf8(&out).unwrap_or("<non-utf8>") + ); + } + + // ------------------------------------------------------------------ + // tdinfo_hash (carried over unchanged) + // ------------------------------------------------------------------ + + #[test] + fn compute_tdinfo_hash_is_identity_passthrough() { + let inner = [0xAAu8; SHA384_DIGEST_SIZE]; + let got = compute_tdinfo_hash(&inner).unwrap(); + // compute_tdinfo_hash is now identity: the caller passes in + // SHA384(TDINFO) and the function returns it unchanged. + assert_eq!(&got[..], &inner[..]); + } + + #[test] + fn compute_tdinfo_hash_rejects_wrong_length() { + assert!(compute_tdinfo_hash(b"too-short").is_err()); + assert!(compute_tdinfo_hash(&[0u8; SHA384_DIGEST_SIZE + 1]).is_err()); + } +} diff --git a/src/policy/src/v2/mod.rs b/src/policy/src/v2/mod.rs index e553abbaa..a4bc255e7 100644 --- a/src/policy/src/v2/mod.rs +++ b/src/policy/src/v2/mod.rs @@ -11,6 +11,12 @@ mod collaterals; pub use collaterals::*; mod policy; pub use policy::*; +pub mod measurement; +pub use measurement::*; +#[cfg(feature = "servtd_corim")] +mod servtd_corim; +#[cfg(feature = "servtd_corim")] +pub use servtd_corim::*; impl<'a> Report<'a> { pub fn new(report: &'a [u8]) -> Result<Self, PolicyError> { diff --git a/src/policy/src/v2/policy.rs b/src/policy/src/v2/policy.rs index 721fb2ba9..dd3bd210f 100644 --- a/src/policy/src/v2/policy.rs +++ b/src/policy/src/v2/policy.rs @@ -2,7 +2,7 @@ // // SPDX-License-Identifier: BSD-2-Clause-Patent -use alloc::{collections::BTreeMap, string::String, string::ToString, vec::Vec}; +use alloc::{collections::BTreeMap, string::String, vec::Vec}; use core::{ cmp::Ordering, convert::{TryFrom, TryInto}, @@ -11,127 +11,153 @@ use serde::{Deserialize, Serialize}; use serde_json::{self, value::RawValue}; use crate::{ - v2::{bytes_to_hex_string, hex_string_to_bytes, policy, verify_event_hash}, - CcEvent, Collaterals, EventName, PolicyError, ServtdCollateral, TdIdentity, TdTcbMapping, + v2::{ + bytes_to_hex_string, compute_signer_anchor_from_chain_pem, + measurement::extract_canonical_policy_data_bytes, policy, resolve_signer_anchor, + verify_event_hash, + }, + CcEvent, Collaterals, EventName, PolicyError, Report, ServtdCollateral, TdIdentity, + TdTcbMapping, }; +use crypto::SHA384_DIGEST_SIZE; + +#[cfg(feature = "servtd_corim")] +use crate::v2::ServtdCorim; + +/// Result of a successful servtd lookup: the MigTD's ISV SVN, and — when the +/// optional TD Identity is present — the TCB level (`tcb_date`, `tcb_status`) +/// recorded for that SVN. +/// +/// Produced by [`VerifiedPolicy::servtd_lookup_by_tdinfo_hash`] from either +/// the JSON collateral (one-hash `TdTcbMapping`, plus optional `TdIdentity`) +/// or, when attached, the CoRIM hash endorsement (`servtd_corim` feature). +/// Both resolve a `tdinfo_hash` to the endorsed `isvsvn`. `tcb_date` / +/// `tcb_status` are populated only from the optional JSON TD Identity; the +/// CoRIM path leaves them `None`. +#[derive(Debug, Clone, PartialEq, Eq)] +pub struct ServtdLookup { + pub isvsvn: u16, + pub tcb_date: Option<String>, + pub tcb_status: Option<String>, +} #[derive(Clone, Copy, Debug)] -pub enum TcbStatus { +pub enum ServtdTcbStatus { UpToDate, - SWHardeningNeeded, - ConfigurationNeeded, - ConfigurationAndSWHardeningNeeded, OutOfDate, - OutOfDateConfigurationNeeded, Revoked, } -impl TcbStatus { +impl ServtdTcbStatus { pub fn as_str(&self) -> &str { match self { - TcbStatus::UpToDate => "UpToDate", - TcbStatus::SWHardeningNeeded => "SWHardeningNeeded", - TcbStatus::ConfigurationNeeded => "ConfigurationNeeded", - TcbStatus::ConfigurationAndSWHardeningNeeded => "ConfigurationAndSWHardeningNeeded", - TcbStatus::OutOfDate => "OutOfDate", - TcbStatus::OutOfDateConfigurationNeeded => "OutOfDateConfigurationNeeded", - TcbStatus::Revoked => "Revoked", + ServtdTcbStatus::UpToDate => "UpToDate", + ServtdTcbStatus::OutOfDate => "OutOfDate", + ServtdTcbStatus::Revoked => "Revoked", } } - // "UpToDate" == "SWHardeningNeeded" == "OutOfDate" >= "ConfigurationNeeded" == - // "ConfigurationAndSWHardeningNeeded" == "OutOfDateConfigurationNeeded” > "Revoked" + // "UpToDate" == "OutOfDate" > "Revoked" fn rank(&self) -> u8 { match self { - TcbStatus::UpToDate | TcbStatus::SWHardeningNeeded | TcbStatus::OutOfDate => 2, - TcbStatus::ConfigurationNeeded - | TcbStatus::ConfigurationAndSWHardeningNeeded - | TcbStatus::OutOfDateConfigurationNeeded => 1, - TcbStatus::Revoked => 0, + ServtdTcbStatus::UpToDate | ServtdTcbStatus::OutOfDate => 2, + ServtdTcbStatus::Revoked => 0, } } } -impl TryFrom<&str> for TcbStatus { +impl TryFrom<&str> for ServtdTcbStatus { type Error = PolicyError; fn try_from(value: &str) -> Result<Self, Self::Error> { match value { - "UpToDate" => Ok(TcbStatus::UpToDate), - "SWHardeningNeeded" => Ok(TcbStatus::SWHardeningNeeded), - "ConfigurationNeeded" => Ok(TcbStatus::ConfigurationNeeded), - "ConfigurationAndSWHardeningNeeded" => Ok(TcbStatus::ConfigurationAndSWHardeningNeeded), - "OutOfDate" => Ok(TcbStatus::OutOfDate), - "OutOfDateConfigurationNeeded" => Ok(TcbStatus::OutOfDateConfigurationNeeded), - "Revoked" => Ok(TcbStatus::Revoked), + "UpToDate" => Ok(ServtdTcbStatus::UpToDate), + "OutOfDate" => Ok(ServtdTcbStatus::OutOfDate), + "Revoked" => Ok(ServtdTcbStatus::Revoked), _ => Err(PolicyError::InvalidParameter), } } } -impl PartialOrd for TcbStatus { +impl PartialOrd for ServtdTcbStatus { fn partial_cmp(&self, other: &Self) -> Option<Ordering> { Some(self.rank().cmp(&other.rank())) } } -impl PartialEq for TcbStatus { +impl PartialEq for ServtdTcbStatus { fn eq(&self, other: &Self) -> bool { self.rank() == other.rank() } } -impl Eq for TcbStatus {} +impl Eq for ServtdTcbStatus {} #[derive(Clone, Copy, Debug)] -pub enum ServtdTcbStatus { +pub enum TcbStatus { UpToDate, + SWHardeningNeeded, + ConfigurationNeeded, + ConfigurationAndSWHardeningNeeded, OutOfDate, + OutOfDateConfigurationNeeded, Revoked, } -impl ServtdTcbStatus { +impl TcbStatus { pub fn as_str(&self) -> &str { match self { - ServtdTcbStatus::UpToDate => "UpToDate", - ServtdTcbStatus::OutOfDate => "OutOfDate", - ServtdTcbStatus::Revoked => "Revoked", + TcbStatus::UpToDate => "UpToDate", + TcbStatus::SWHardeningNeeded => "SWHardeningNeeded", + TcbStatus::ConfigurationNeeded => "ConfigurationNeeded", + TcbStatus::ConfigurationAndSWHardeningNeeded => "ConfigurationAndSWHardeningNeeded", + TcbStatus::OutOfDate => "OutOfDate", + TcbStatus::OutOfDateConfigurationNeeded => "OutOfDateConfigurationNeeded", + TcbStatus::Revoked => "Revoked", } } - // "UpToDate" == "OutOfDate" > "Revoked" + // "UpToDate" == "SWHardeningNeeded" == "OutOfDate" >= "ConfigurationNeeded" == + // "ConfigurationAndSWHardeningNeeded" == "OutOfDateConfigurationNeeded” > "Revoked" fn rank(&self) -> u8 { match self { - ServtdTcbStatus::UpToDate | ServtdTcbStatus::OutOfDate => 2, - ServtdTcbStatus::Revoked => 0, + TcbStatus::UpToDate | TcbStatus::SWHardeningNeeded | TcbStatus::OutOfDate => 2, + TcbStatus::ConfigurationNeeded + | TcbStatus::ConfigurationAndSWHardeningNeeded + | TcbStatus::OutOfDateConfigurationNeeded => 1, + TcbStatus::Revoked => 0, } } } -impl TryFrom<&str> for ServtdTcbStatus { +impl TryFrom<&str> for TcbStatus { type Error = PolicyError; fn try_from(value: &str) -> Result<Self, Self::Error> { match value { - "UpToDate" => Ok(ServtdTcbStatus::UpToDate), - "OutOfDate" => Ok(ServtdTcbStatus::OutOfDate), - "Revoked" => Ok(ServtdTcbStatus::Revoked), + "UpToDate" => Ok(TcbStatus::UpToDate), + "SWHardeningNeeded" => Ok(TcbStatus::SWHardeningNeeded), + "ConfigurationNeeded" => Ok(TcbStatus::ConfigurationNeeded), + "ConfigurationAndSWHardeningNeeded" => Ok(TcbStatus::ConfigurationAndSWHardeningNeeded), + "OutOfDate" => Ok(TcbStatus::OutOfDate), + "OutOfDateConfigurationNeeded" => Ok(TcbStatus::OutOfDateConfigurationNeeded), + "Revoked" => Ok(TcbStatus::Revoked), _ => Err(PolicyError::InvalidParameter), } } } -impl PartialOrd for ServtdTcbStatus { +impl PartialOrd for TcbStatus { fn partial_cmp(&self, other: &Self) -> Option<Ordering> { Some(self.rank().cmp(&other.rank())) } } -impl PartialEq for ServtdTcbStatus { +impl PartialEq for TcbStatus { fn eq(&self, other: &Self) -> bool { self.rank() == other.rank() } } -impl Eq for ServtdTcbStatus {} +impl Eq for TcbStatus {} /// Contains all required data to be evaluated against a rebinding policy #[derive(Debug, Clone, Default)] @@ -154,10 +180,11 @@ pub struct PolicyEvaluationInfo { /// The isvsvn of the MigTD TCB pub migtd_isvsvn: Option<u16>, - /// The status of the MigTD TCB + /// The status of the MigTD TCB (from the optional TD Identity) pub migtd_tcb_status: Option<String>, - /// The date of the MigTD TCB in ISO-8601 format, e.g. "2023-06-19T00:00:00Z" + /// The date of the MigTD TCB in ISO-8601 format (from the optional TD + /// Identity), e.g. "2023-06-19T00:00:00Z" pub migtd_tcb_date: Option<String>, /// The minimal crl_num of pck_crl @@ -165,19 +192,66 @@ pub struct PolicyEvaluationInfo { /// The minimal crl_num of root_ca_crl pub root_ca_crl_num: Option<u32>, + + /// The CRL number of the servtd signer CRL (`servtdCrl`), used + /// for monotonic anti-rollback of the signer revocation list. See + /// `doc/rtmr1_signer_anchor_proposal.md` §revocation. + pub servtd_crl_num: Option<u32>, } pub struct VerifiedPolicy<'a> { pub policy_data: policy::PolicyData<'a>, - pub servtd_identity: TdIdentity, - pub servtd_identity_issuer_chain: String, - pub servtd_tcb_mapping: TdTcbMapping, - pub servtd_tcb_mapping_issuer_chain: String, - /// The policy signing certificate chain (PEM) used to verify this policy. - pub policy_issuer_chain: String, + /// Verified one-hash TCB mapping from the JSON `servtdCollateral`. `None` + /// for a CoRIM-only policy (no `servtdCollateral`); lookups then resolve + /// through the attached CoRIM (fail-closed if none is attached). + pub servtd_tcb_mapping: Option<TdTcbMapping>, + /// Issuer chain (PEM) for the JSON mapping signer. `None` when the JSON + /// `servtdCollateral` is absent (CoRIM-only). + pub servtd_tcb_mapping_issuer_chain: Option<String>, + /// Optional MigTD TD Identity (`isvsvn -> (tcb_date, tcb_status)`), present + /// only when the JSON collateral ships a `servtdIdentity`. When absent, + /// policy is driven by the ISV SVN alone. + pub servtd_identity: Option<TdIdentity>, + /// Optional TD Identity issuer chain (PEM), present iff `servtd_identity` + /// is. Retained so the runtime can cross-check a peer's identity chain. + pub servtd_identity_issuer_chain: Option<String>, + /// Optional PEM CRL for the servTD signer chain, from + /// top-level `servtdCrl` or the legacy + /// `servtdCollateral.servtdCrl`. Retained so the runtime can cross-check a + /// peer's signer chain against the local trusted CRL. The top-level form + /// allows CoRIM-only policies to carry revocation state without restoring + /// JSON TCB-mapping enrollment. + pub servtd_crl: Option<String>, + /// The RTMR1 signer anchor `A = SHA384(tag ‖ H(rootDER) ‖ leafEkuOidDER)` + /// (hash of the root cert plus the leaf's dedicated signer-purpose EKU OID + /// DER) this policy was bound to (resolved from the CFV signer-anchor slot + /// or a PEM issuer chain). Used for the anchor-based peer cross-check. + pub signer_anchor: [u8; SHA384_DIGEST_SIZE], + /// Optional CoRIM-encoded servtd collateral. When attached it is the sole + /// authority for servtd lookups (fail-closed: a CoRIM miss is a miss, + /// with no fallback to the legacy JSON collateral). Only available with + /// the `servtd_corim` feature. + #[cfg(feature = "servtd_corim")] + servtd_corim: Option<ServtdCorimAuthority<'a>>, +} + +#[cfg(feature = "servtd_corim")] +enum ServtdCorimAuthority<'a> { + Owned(ServtdCorim), + Borrowed(&'a ServtdCorim), +} + +#[cfg(feature = "servtd_corim")] +impl ServtdCorimAuthority<'_> { + fn as_ref(&self) -> &ServtdCorim { + match self { + Self::Owned(corim) => corim, + Self::Borrowed(corim) => corim, + } + } } -impl VerifiedPolicy<'_> { +impl<'a> VerifiedPolicy<'a> { pub fn get_collaterals(&self) -> &Collaterals { &self.policy_data.collaterals } @@ -185,13 +259,114 @@ impl VerifiedPolicy<'_> { pub fn get_version(&self) -> &str { &self.policy_data.version } + + /// Attach decoded CoRIM servtd collateral. Once set, **all** servtd + /// lookups resolve against the CoRIM and the legacy JSON collateral is no + /// longer consulted. + #[cfg(feature = "servtd_corim")] + pub fn set_servtd_corim(&mut self, corim: ServtdCorim) { + self.servtd_corim = Some(ServtdCorimAuthority::Owned(corim)); + } + + /// Use the local, already signature/anchor-verified CoRIM as the authority + /// for peer TCB lookups. Peers do not supply a CoRIM or CRL for this step. + #[cfg(feature = "servtd_corim")] + pub fn set_servtd_corim_from(&mut self, local_policy: &'static VerifiedPolicy<'static>) { + self.servtd_corim = local_policy + .servtd_corim + .as_ref() + .map(|corim| ServtdCorimAuthority::Borrowed(corim.as_ref())); + } + + /// Check every retained servTD signer chain against an authoritative CRL. + /// + /// For local initialization, `authoritative_crl` is the CRL measured in + /// this policy. For peer authentication, callers must pass the local + /// policy's CRL rather than the peer's delivered CRL. + pub fn verify_signer_chains_not_revoked( + &self, + authoritative_crl: &[u8], + ) -> Result<(), PolicyError> { + if let Some(mapping_chain) = self.servtd_tcb_mapping_issuer_chain.as_deref() { + crypto::verify_signer_chain_not_revoked( + crypto::SignerChain::Pem(mapping_chain.as_bytes()), + authoritative_crl, + ) + .map_err(|_| PolicyError::SignerRevoked)?; + } + if let Some(identity_chain) = self.servtd_identity_issuer_chain.as_deref() { + crypto::verify_signer_chain_not_revoked( + crypto::SignerChain::Pem(identity_chain.as_bytes()), + authoritative_crl, + ) + .map_err(|_| PolicyError::SignerRevoked)?; + } + #[cfg(feature = "servtd_corim")] + if let Some(corim) = self.servtd_corim.as_ref() { + corim + .as_ref() + .verify_signer_chain_not_revoked(authoritative_crl)?; + } + Ok(()) + } + + /// Resolve the MigTD ISV SVN (and, when the optional TD Identity is + /// present, its `tcb_date` / `tcb_status`) from a 48-byte `tdinfo_hash` + /// (= `init/cur_servtd_info_hash`). + /// + /// When the `servtd_corim` feature is enabled and a CoRIM is attached, it + /// is the sole authority (**fail-closed**: a CoRIM miss returns `None`, + /// the JSON collateral is not consulted) and returns SVN only (no TD + /// Identity date/status). Otherwise the lookup uses the JSON collateral's + /// `TdTcbMapping::get_engine_svn_by_tdinfo_hash`, then \u2014 if a `TdIdentity` + /// is present \u2014 `TdIdentity::get_tcb_level_by_svn` for the date/status. + pub fn servtd_lookup_by_tdinfo_hash(&self, tdinfo_hash: &[u8]) -> Option<ServtdLookup> { + #[cfg(feature = "servtd_corim")] + if let Some(corim) = &self.servtd_corim { + return corim.as_ref().lookup_by_tdinfo_hash(tdinfo_hash); + } + // JSON path — hash -> SVN via the one-hash TCB mapping, then optional + // SVN -> (date, status) via the TD Identity when it is shipped. + let isvsvn = self + .servtd_tcb_mapping + .as_ref()? + .get_engine_svn_by_tdinfo_hash(tdinfo_hash)?; + let (tcb_date, tcb_status) = match &self.servtd_identity { + Some(identity) => { + let level = identity.get_tcb_level_by_svn(isvsvn)?; + (Some(level.tcb_date.clone()), Some(level.tcb_status.clone())) + } + None => (None, None), + }; + Some(ServtdLookup { + isvsvn, + tcb_date, + tcb_status, + }) + } + + /// Convenience: compute the `tdinfo_hash` from a verified `Report` and + /// resolve through [`servtd_lookup_by_tdinfo_hash`]. + /// + /// [`servtd_lookup_by_tdinfo_hash`]: VerifiedPolicy::servtd_lookup_by_tdinfo_hash + pub fn servtd_lookup_by_report(&self, report: &Report) -> Option<ServtdLookup> { + let hash = crate::v2::compute_tdinfo_hash_from_report(report).ok()?; + self.servtd_lookup_by_tdinfo_hash(&hash) + } } pub fn check_policy_integrity( policy: &[u8], events: &BTreeMap<EventName, CcEvent>, ) -> Result<(), PolicyError> { - if !verify_event_hash(events, &EventName::MigTdPolicy, policy)? { + // RTMR2 is extended once with the canonical bytes of `policyData` with + // `servtdCollateral.servtdTcbMapping` removed. See + // `doc/tcb_mapping_design_proposal.md` for the rationale. The verifier + // recomputes those exact bytes via the same helper used by the runtime + // extender (`get_policy_and_measure`) and `migtd-hash` (offline RTMR2 + // simulator), then asserts the event-log entry's recorded digest matches. + let policy_data_bytes = extract_canonical_policy_data_bytes(policy)?; + if !verify_event_hash(events, &EventName::MigTdPolicyData, &policy_data_bytes)? { return Err(PolicyError::PolicyHashMismatch); } @@ -203,7 +378,16 @@ pub fn check_policy_integrity( pub struct RawPolicyData<'a> { #[serde(borrow)] pub policy_data: &'a RawValue, - pub signature: String, + /// Legacy outer policy-blob signature. + /// + /// The outer signature has been **removed** from the trust model (per + /// `doc/tcb_mapping_design_proposal.md`): `policyData` integrity is now + /// established solely by the RTMR2 measurement (`check_policy_integrity`), + /// not by an outer signature. This field is retained as an optional, + /// **ignored** value only so that pre-existing signed policy blobs still + /// deserialize. New policies omit it. + #[serde(default, skip_serializing_if = "Option::is_none")] + pub signature: Option<String>, } impl<'a> RawPolicyData<'a> { @@ -217,59 +401,150 @@ impl<'a> RawPolicyData<'a> { Ok(policy_data.collaterals) } - /// Verify the policy signature and servtd collateral using the given issuer chain. + /// Verify the servtd collateral using the given (RTMR1-anchored) issuer + /// chain. + /// + /// The outer policy-blob signature has been **removed** from the trust + /// model: `policyData` integrity is established by the RTMR2 measurement + /// (`check_policy_integrity`), so this function no longer verifies an outer + /// signature. It parses `policyData` directly and verifies the inner servtd + /// collateral signatures against their embedded issuer chains. pub fn verify(&self, issuer_chain: &[u8]) -> Result<VerifiedPolicy<'a>, PolicyError> { - let policy_issuer_chain = core::str::from_utf8(issuer_chain) - .map_err(|_| PolicyError::InvalidPolicy)? - .to_string(); - - // Step 1: Verify signature over raw policy data - let policy_data = self.verify_policy_data_signature(issuer_chain)?; - - // Step 2: Verify servtd collateral signatures using their own embedded chains - let servtd_collateral = &policy_data.servtd_collateral; - let servtd_identity = servtd_collateral - .servtd_identity - .verify_signature(servtd_collateral.servtd_identity_issuer_chain.as_bytes())?; - let servtd_tcb_mapping = servtd_collateral - .servtd_tcb_mapping - .verify_signature(servtd_collateral.servtd_tcb_mapping_issuer_chain.as_bytes())?; + let verified_policy = self.verify_signatures_and_anchors(issuer_chain)?; + if let Some(servtd_crl) = verified_policy.servtd_crl.as_deref() { + verified_policy.verify_signer_chains_not_revoked(servtd_crl.as_bytes())?; + } + Ok(verified_policy) + } - let servtd_identity_issuer_chain = servtd_collateral.servtd_identity_issuer_chain.clone(); - let servtd_tcb_mapping_issuer_chain = - servtd_collateral.servtd_tcb_mapping_issuer_chain.clone(); + /// Verify a peer policy while applying only the caller-provided, + /// locally-authoritative servTD CRL to its signer chains. The peer's own + /// delivered CRL remains part of its measured policy data but is not + /// trusted for revocation decisions. + pub fn verify_with_authoritative_servtd_crl( + &self, + issuer_chain: &[u8], + authoritative_crl: Option<&[u8]>, + ) -> Result<VerifiedPolicy<'a>, PolicyError> { + let verified_policy = self.verify_signatures_and_anchors(issuer_chain)?; + if let Some(servtd_crl) = authoritative_crl { + verified_policy.verify_signer_chains_not_revoked(servtd_crl)?; + } + Ok(verified_policy) + } + + fn verify_signatures_and_anchors( + &self, + issuer_chain: &[u8], + ) -> Result<VerifiedPolicy<'a>, PolicyError> { + // `issuer_chain` is the RTMR1 signer-anchor source: either a + // precomputed 48-byte anchor (CoRIM-only enrollment) or a PEM issuer + // chain (legacy JSON enrollment). Both resolve to the same anchor. + let cfv_anchor = resolve_signer_anchor(issuer_chain)?; + + // The outer policy-blob signature is no longer part of the trust model + // (integrity comes from RTMR2). Parse policyData directly. + let policy_data: PolicyData<'a> = + serde_json::from_str(self.policy_data.get()).map_err(|_| PolicyError::InvalidPolicy)?; - // Step 3: Sanity checks + let servtd_crl = match ( + policy_data.servtd_crl.as_ref(), + policy_data + .servtd_collateral + .as_ref() + .and_then(|collateral| collateral.servtd_crl.as_ref()), + ) { + (Some(top_level), Some(legacy)) if top_level != legacy => { + return Err(PolicyError::InvalidCollateral); + } + (Some(top_level), _) => Some(top_level.clone()), + (None, legacy) => legacy.cloned(), + }; + + // Optional JSON servtd collateral. When absent (CoRIM-only), there is + // no embedded chain to verify/bind here: the enrolled anchor is bound + // to the CoRIM signer by `ServtdCorim::decode_signed`, and all servtd + // lookups resolve through the CoRIM attached post-verify (fail-closed + // when none is attached). + let ( + servtd_tcb_mapping, + servtd_tcb_mapping_issuer_chain, + servtd_identity, + servtd_identity_issuer_chain, + ) = match &policy_data.servtd_collateral { + Some(servtd_collateral) => { + // Verify servtd collateral signature using its embedded chain + let servtd_tcb_mapping = servtd_collateral.servtd_tcb_mapping.verify_signature( + servtd_collateral.servtd_tcb_mapping_issuer_chain.as_bytes(), + )?; + + // Verify the optional TD Identity signature against its embedded + // chain. `servtdIdentity` and `servtdIdentityIssuerChain` must + // be present or absent together; a half-present pair fails closed. + let servtd_identity = match ( + servtd_collateral.servtd_identity.as_ref(), + servtd_collateral.servtd_identity_issuer_chain.as_deref(), + ) { + (Some(raw_identity), Some(identity_chain)) => { + Some(raw_identity.verify_signature(identity_chain.as_bytes())?) + } + (None, None) => None, + _ => return Err(PolicyError::InvalidServtdIdentity), + }; + + // Bind the TCB-mapping signer chain to the RTMR1 signer anchor. + // `servtdTcbMappingIssuerChain` is redacted from RTMR2 (measured + // into RTMR1 instead), so require the chain that verified + // `servtdTcbMapping` to hash to the same anchor RTMR1 commits to. + // A swapped chain fails closed; leaf/intermediate rotation under + // the same root + EKU keeps the anchor stable. + let mapping_anchor = compute_signer_anchor_from_chain_pem( + servtd_collateral.servtd_tcb_mapping_issuer_chain.as_bytes(), + )?; + if cfv_anchor != mapping_anchor { + return Err(PolicyError::SignerAnchorMismatch); + } + + // The optional TD Identity and issuer chain are measured into + // RTMR2. Also require the chain to share the RTMR1 signer + // anchor so mapping and identity stay in one trust domain. + if let Some(identity_chain) = + servtd_collateral.servtd_identity_issuer_chain.as_deref() + { + let identity_anchor = + compute_signer_anchor_from_chain_pem(identity_chain.as_bytes())?; + if cfv_anchor != identity_anchor { + return Err(PolicyError::SignerAnchorMismatch); + } + } + + ( + Some(servtd_tcb_mapping), + Some(servtd_collateral.servtd_tcb_mapping_issuer_chain.clone()), + servtd_identity, + servtd_collateral.servtd_identity_issuer_chain.clone(), + ) + } + None => (None, None, None, None), + }; + + // Sanity checks if !policy_data.validate() { return Err(PolicyError::InvalidParameter); } Ok(VerifiedPolicy { policy_data, - servtd_identity, - servtd_identity_issuer_chain, servtd_tcb_mapping, servtd_tcb_mapping_issuer_chain, - policy_issuer_chain, + servtd_identity, + servtd_identity_issuer_chain, + servtd_crl, + signer_anchor: cfv_anchor, + #[cfg(feature = "servtd_corim")] + servtd_corim: None, }) } - - fn verify_policy_data_signature( - &self, - issuer_chain: &[u8], - ) -> Result<PolicyData<'a>, PolicyError> { - let signature = hex_string_to_bytes(&self.signature)?; - - crypto::verify_cert_chain_and_signature( - issuer_chain, - self.policy_data.get().as_bytes(), - &signature, - ) - .map_err(|_| PolicyError::SignatureVerificationFailed)?; - - serde_json::from_str::<PolicyData>(self.policy_data.get()) - .map_err(|_| PolicyError::InvalidPolicy) - } } #[derive(Debug, Serialize, Deserialize)] @@ -282,8 +557,15 @@ pub struct PolicyData<'a> { forward_policy: Option<Vec<PolicyTypes>>, backward_policy: Option<Vec<PolicyTypes>>, pub collaterals: Collaterals, - #[serde(borrow)] - pub servtd_collateral: ServtdCollateral<'a>, + /// Optional locally-authoritative servTD signer CRL. This top-level form + /// is used by CoRIM-only policies; the legacy copy nested under + /// `servtdCollateral` remains accepted for backward compatibility. + #[serde(default, skip_serializing_if = "Option::is_none")] + pub servtd_crl: Option<String>, + /// Optional JSON servtd collateral. Absent for a CoRIM-only policy, whose + /// servtd endorsement is delivered as a separately-enrolled CoRIM. + #[serde(borrow, default, skip_serializing_if = "Option::is_none")] + pub servtd_collateral: Option<ServtdCollateral<'a>>, } impl<'a> PolicyData<'a> { @@ -495,6 +777,7 @@ impl PlatformPolicy { struct CrlPolicy { pck_crl_num: Option<PolicyProperty>, root_ca_crl_num: Option<PolicyProperty>, + servtd_crl_num: Option<PolicyProperty>, } impl CrlPolicy { @@ -517,6 +800,13 @@ impl CrlPolicy { } } + if let Some(property) = &self.servtd_crl_num { + let servtd_crl_num = value.servtd_crl_num.ok_or(PolicyError::CrlEvaluation)?; + if !property.evaluate_integer(servtd_crl_num, relative_reference.servtd_crl_num)? { + return Err(PolicyError::CrlEvaluation); + } + } + Ok(()) } } @@ -545,6 +835,10 @@ impl ServtdPolicy { } } + // `tcbDate` / `tcbStatus` bars require the optional TD Identity to be + // shipped. `migtd_tcb_date` / `migtd_tcb_status` are populated only when + // the lookup resolved through a `TdIdentity`; a date/status bar with no + // TD Identity present therefore fails closed here. if let Some(property) = &self.migtd_identity.tcb_date { if !property.evaluate_string( value @@ -815,14 +1109,14 @@ impl PolicyProperty { } } - /// Evaluate a ServtdTcbStatus property against a reference value + /// Evaluate a ServtdTcbStatus property against a reference value. fn evaluate_servtd_tcb_status( &self, value: ServtdTcbStatus, _relative_reference: Option<ServtdTcbStatus>, ) -> Result<bool, PolicyError> { // "UpToDate" is always allowed. - // "OutOfDate" is always allowed, because time stamp is not trusted. + // "OutOfDate" is always allowed, because the time stamp is not trusted. const ALWAYS_ALLOW: &[ServtdTcbStatus] = &[ServtdTcbStatus::UpToDate, ServtdTcbStatus::OutOfDate]; // "Revoked" is always denied. @@ -836,8 +1130,8 @@ impl PolicyProperty { return Ok(true); } - // Every status already falls into either the always-allow or always-deny - // set. + // Every status already falls into either the always-allow or + // always-deny set. Ok(false) } } @@ -845,7 +1139,16 @@ impl PolicyProperty { #[cfg(test)] mod test { use super::*; - use alloc::{string::ToString, vec}; + use alloc::{format, string::ToString, vec}; + + fn delivered_servtd_crl(policy: &RawPolicyData<'_>) -> String { + let policy_data: serde_json::Value = + serde_json::from_str(policy.policy_data.get()).unwrap(); + policy_data["servtdCollateral"]["servtdCrl"] + .as_str() + .unwrap() + .to_string() + } #[test] fn test_parse_policy_data() { @@ -862,6 +1165,388 @@ mod test { policy.verify(issuer_chain).unwrap(); } + /// SVN-only deployment: a policy whose `servtdCollateral` ships **no** + /// `servtdIdentity` (nor `servtdIdentityIssuerChain`) must still verify. + /// The optional TD Identity is absent, so: + /// * `verify()` succeeds (the independent `servtdTcbMapping` signature + /// and its RTMR1 anchor binding are unaffected by the missing identity); + /// * `servtd_identity` / `servtd_identity_issuer_chain` are `None`; + /// * a servtd lookup resolves the SVN but leaves `tcb_date` / `tcb_status` + /// unset (there is no date/status source without TD Identity). + /// + /// The fixture is derived from `policy_v2.json` by dropping the two + /// identity fields; the mapping signature signs only the `tdTcbMapping` + /// bytes, so it remains valid. + #[test] + fn test_verify_policy_svn_only_no_identity() { + use crate::v2::hex_string_to_bytes; + + let policy_data = include_bytes!("../../test/policy_v2/policy_v2_svn_only.json"); + let policy = RawPolicyData::deserialize_from_json(policy_data).unwrap(); + let issuer_chain = + include_bytes!("../../test/policy_v2/cert_chain/policy_issuer_chain.pem"); + let verified = policy.verify(issuer_chain).unwrap(); + + assert!(verified.servtd_identity.is_none()); + assert!(verified.servtd_identity_issuer_chain.is_none()); + + // The SVN resolves, but there is no date/status without TD Identity. + let known_hash = hex_string_to_bytes( + &verified.servtd_tcb_mapping.as_ref().unwrap().svn_mappings[0] + .td_measurements + .tdinfo_hash, + ) + .unwrap(); + let lookup = verified + .servtd_lookup_by_tdinfo_hash(&known_hash) + .expect("known hash resolves"); + assert!(lookup.tcb_date.is_none()); + assert!(lookup.tcb_status.is_none()); + } + + /// SVN-only policy evaluation: with no TD Identity present, a `migtdIdentity` + /// policy that uses only an `isvsvn` bar passes, while a `tcbStatus` / + /// `tcbDate` bar fails closed because `migtd_tcb_status` / `migtd_tcb_date` + /// are unpopulated (there is no date/status source without TD Identity). + #[test] + fn servtd_policy_svn_only_bars_and_fail_closed() { + // SVN value present but no date/status (identity-absent lookup). + let mut value = PolicyEvaluationInfo { + migtd_isvsvn: Some(5), + ..Default::default() + }; + let relative = PolicyEvaluationInfo::default(); + + // isvsvn-only bar: passes when the SVN qualifies. + let svn_only: ServtdPolicy = serde_json::from_str( + r#"{"migtdIdentity":{"isvsvn":{"operation":"greater-or-equal","reference":5}}}"#, + ) + .unwrap(); + assert!(svn_only.evaluate(&value, &relative).is_ok()); + + // A tcbStatus bar with no TD Identity present fails closed. + let status_bar: ServtdPolicy = serde_json::from_str( + r#"{"migtdIdentity":{"isvsvn":{"operation":"greater-or-equal","reference":5},"tcbStatusAccepted":{"operation":"string-equal","reference":"UpToDate"}}}"#, + ) + .unwrap(); + assert!(status_bar.evaluate(&value, &relative).is_err()); + + // A tcbDate bar with no TD Identity present also fails closed. + let date_bar: ServtdPolicy = serde_json::from_str( + r#"{"migtdIdentity":{"tcbDate":{"operation":"greater-or-equal","reference":"2024-01-01T00:00:00Z"}}}"#, + ) + .unwrap(); + assert!(date_bar.evaluate(&value, &relative).is_err()); + + // Once the (optional) TD Identity supplies date/status, the same bars + // are satisfiable. + value.migtd_tcb_status = Some("UpToDate".to_string()); + value.migtd_tcb_date = Some("2025-01-01T00:00:00Z".to_string()); + assert!(status_bar.evaluate(&value, &relative).is_ok()); + assert!(date_bar.evaluate(&value, &relative).is_ok()); + } + + #[cfg(feature = "servtd_corim")] + #[test] + fn azure_corim_policy_uses_svn_only_servtd_rule() { + use crate::v2::hex_string_to_bytes; + + let policy: serde_json::Value = serde_json::from_slice(include_bytes!( + "../../../../config/Azure/policy_data_raw.json" + )) + .unwrap(); + let servtd = policy["policy"] + .as_array() + .unwrap() + .iter() + .find_map(|entry| entry.get("servtd")) + .unwrap() + .clone(); + let servtd: ServtdPolicy = serde_json::from_value(servtd).unwrap(); + + let corim = ServtdCorim::decode( + include_bytes!("../../test/policy_v2/corim/tcb_mapping.cbor"), + 0, + ) + .unwrap(); + let endorsed_hash = hex_string_to_bytes( + "347c6170a91341351937962e08a7695703e7b87984b1c69216372c380302ac420\ + d42381e4585007057b20b2579286384", + ) + .unwrap(); + let lookup = corim.lookup_by_tdinfo_hash(&endorsed_hash).unwrap(); + assert!(lookup.tcb_date.is_none()); + assert!(lookup.tcb_status.is_none()); + + let same_peer = PolicyEvaluationInfo { + migtd_isvsvn: Some(lookup.isvsvn), + migtd_tcb_date: lookup.tcb_date, + migtd_tcb_status: lookup.tcb_status, + ..Default::default() + }; + let same = PolicyEvaluationInfo { + migtd_isvsvn: Some(lookup.isvsvn), + ..Default::default() + }; + assert!(servtd.evaluate(&same_peer, &same).is_ok()); + + let newer_peer = PolicyEvaluationInfo { + migtd_isvsvn: Some(lookup.isvsvn + 1), + ..Default::default() + }; + assert!(servtd.evaluate(&newer_peer, &same).is_ok()); + + let newer_local = PolicyEvaluationInfo { + migtd_isvsvn: Some(lookup.isvsvn + 1), + ..Default::default() + }; + assert!(servtd.evaluate(&same_peer, &newer_local).is_err()); + } + + /// The outer policy-blob signature has been removed from the trust model. + /// A policy with **no** outer `signature` field must still deserialize and + /// verify — integrity is established by the RTMR2 measurement, checked + /// separately in `check_policy_integrity`. The `policyData` bytes (and thus + /// the inner servtd signatures) are preserved verbatim. + #[test] + fn test_verify_policy_without_outer_signature() { + let policy_data = include_bytes!("../../test/policy_v2/policy_v2.json"); + let signed = RawPolicyData::deserialize_from_json(policy_data).unwrap(); + assert!( + signed.signature.is_some(), + "fixture is expected to carry a legacy outer signature" + ); + + // Re-wrap the exact same policyData bytes with NO outer signature. + let no_sig = format!("{{\"policyData\":{}}}", signed.policy_data.get()); + let unsigned = RawPolicyData::deserialize_from_json(no_sig.as_bytes()).unwrap(); + assert!(unsigned.signature.is_none()); + + let issuer_chain = + include_bytes!("../../test/policy_v2/cert_chain/policy_issuer_chain.pem"); + unsigned.verify(issuer_chain).unwrap(); + } + + /// A bogus outer signature must be **ignored** (never verified), because + /// the outer signature is no longer part of the trust model. If it were + /// still verified this garbage value would fail closed. + #[test] + fn test_outer_signature_is_ignored() { + let policy_data = include_bytes!("../../test/policy_v2/policy_v2.json"); + let signed = RawPolicyData::deserialize_from_json(policy_data).unwrap(); + + let tampered = format!( + "{{\"policyData\":{},\"signature\":\"deadbeef\"}}", + signed.policy_data.get() + ); + let policy = RawPolicyData::deserialize_from_json(tampered.as_bytes()).unwrap(); + assert_eq!(policy.signature.as_deref(), Some("deadbeef")); + + // Verification succeeds despite the bogus outer signature. + policy + .verify(include_bytes!( + "../../test/policy_v2/cert_chain/policy_issuer_chain.pem" + )) + .unwrap(); + } + + /// RTMR1 signer-anchor binding (security-critical): because + /// `servtdTcbMappingIssuerChain` is redacted from the RTMR2 measurement, it + /// is kept measured only by requiring it to hash to the RTMR1 signer anchor + /// derived from the CFV issuer chain. Verifying against an unrelated CFV + /// chain (different root + leaf signer EKU fingerprint) must fail closed with + /// `SignerAnchorMismatch` — even though the embedded chains still validate + /// the inner signatures. + #[test] + fn test_verify_policy_rejects_mapping_chain_anchor_mismatch() { + let policy_data = include_bytes!("../../test/policy_v2/policy_v2.json"); + let policy = RawPolicyData::deserialize_from_json(policy_data).unwrap(); + let unrelated_chain = + include_bytes!("../../test/policy_v2/cert_chain/unrelated_issuer_chain.pem"); + match policy.verify(unrelated_chain) { + Err(PolicyError::SignerAnchorMismatch) => {} + Err(other) => panic!("expected SignerAnchorMismatch, got {:?}", other), + Ok(_) => panic!("expected SignerAnchorMismatch, but verify() succeeded"), + } + } + + /// End-to-end `verify()` revocation enforcement: a policy whose delivered + /// servTD CRL revokes the signer leaf must fail closed + /// with `SignerRevoked`, while the same policy carrying a revocation-free + /// CRL verifies. The fixtures under `test/policy_v2/revocation/` are a + /// self-contained PKI (one signer for both identity and mapping) with + /// matching empty and revoking CRLs. + #[test] + fn verify_enforces_servtd_signer_revocation() { + let chain = include_bytes!("../../test/policy_v2/revocation/signer_chain.pem"); + + let ok = include_bytes!("../../test/policy_v2/revocation/policy_ok.json"); + RawPolicyData::deserialize_from_json(ok) + .unwrap() + .verify(chain) + .expect("policy with an unrevoked signer should verify"); + + let revoked = include_bytes!("../../test/policy_v2/revocation/policy_revoked.json"); + match RawPolicyData::deserialize_from_json(revoked) + .unwrap() + .verify(chain) + { + Err(PolicyError::SignerRevoked) => {} + Err(other) => panic!("expected SignerRevoked, got {:?}", other), + Ok(_) => panic!("expected SignerRevoked, but verify() succeeded"), + } + } + + /// Peer authentication must use the local CRL, never the CRL delivered in + /// the peer's measured policy. A locally revoking CRL rejects a peer that + /// advertises an empty CRL, while a local empty CRL accepts the same signer + /// even if the peer advertises a revoking CRL. + #[test] + fn peer_verification_uses_authoritative_local_servtd_crl() { + let chain = include_bytes!("../../test/policy_v2/revocation/signer_chain.pem"); + + let peer_empty = RawPolicyData::deserialize_from_json(include_bytes!( + "../../test/policy_v2/revocation/policy_ok.json" + )) + .unwrap(); + let empty_crl = delivered_servtd_crl(&peer_empty); + let peer_revoking = RawPolicyData::deserialize_from_json(include_bytes!( + "../../test/policy_v2/revocation/policy_revoked.json" + )) + .unwrap(); + let revoked_crl = delivered_servtd_crl(&peer_revoking); + + assert!(matches!( + peer_empty.verify_with_authoritative_servtd_crl(chain, Some(revoked_crl.as_bytes())), + Err(PolicyError::SignerRevoked) + )); + + peer_revoking + .verify_with_authoritative_servtd_crl(chain, Some(empty_crl.as_bytes())) + .expect("the peer CRL must not override the local CRL"); + } + + /// CoRIM-only policies can carry the authoritative CRL without restoring + /// the legacy JSON mapping. The CRL remains measured as part of policyData + /// and is retained until the separately enrolled CoRIM chain is attached. + #[test] + fn corim_only_policy_retains_top_level_servtd_crl() { + let raw = RawPolicyData::deserialize_from_json(include_bytes!( + "../../test/policy_v2/revocation/policy_ok.json" + )) + .unwrap(); + let mut policy_data: serde_json::Value = + serde_json::from_str(raw.policy_data.get()).unwrap(); + let servtd_crl = policy_data["servtdCollateral"]["servtdCrl"].take(); + let policy_data = policy_data.as_object_mut().unwrap(); + policy_data.remove("servtdCollateral"); + policy_data.insert("servtdCrl".to_string(), servtd_crl.clone()); + + let wrapped = format!( + r#"{{"policyData":{}}}"#, + serde_json::Value::Object(policy_data.clone()) + ); + let policy = RawPolicyData::deserialize_from_json(wrapped.as_bytes()).unwrap(); + let verified = policy + .verify(&[0xA5; SHA384_DIGEST_SIZE]) + .expect("CoRIM-only policy should retain its CRL"); + + assert!(verified.servtd_tcb_mapping.is_none()); + assert_eq!(verified.servtd_crl.as_deref(), servtd_crl.as_str()); + } + + #[test] + fn conflicting_servtd_crl_locations_fail_closed() { + let raw = RawPolicyData::deserialize_from_json(include_bytes!( + "../../test/policy_v2/revocation/policy_ok.json" + )) + .unwrap(); + let mut policy_data: serde_json::Value = + serde_json::from_str(raw.policy_data.get()).unwrap(); + policy_data["servtdCrl"] = serde_json::Value::String("different CRL".to_string()); + + let wrapped = format!(r#"{{"policyData":{policy_data}}}"#); + let policy = RawPolicyData::deserialize_from_json(wrapped.as_bytes()).unwrap(); + assert!(matches!( + policy.verify(include_bytes!( + "../../test/policy_v2/revocation/signer_chain.pem" + )), + Err(PolicyError::InvalidCollateral) + )); + } + + /// Anti-rollback floor on the servtd signer CRL number: a policy `crl` + /// block with `servtdCrlNum` rejects a delivered CRL whose number is below + /// the floor (a rolled-back revocation list), and rejects a missing number + /// when a floor is set. Fail-closed. Mirrors the pck/root_ca CRL floors. + #[test] + fn crl_policy_enforces_servtd_crl_num_floor() { + let policy: CrlPolicy = serde_json::from_str( + r#"{"servtdCrlNum":{"operation":"greater-or-equal","reference":4097}}"#, + ) + .unwrap(); + let reference = PolicyEvaluationInfo::default(); + + let mut value = PolicyEvaluationInfo::default(); + // At or above the floor passes. + value.servtd_crl_num = Some(4097); + assert!(policy.evaluate(&value, &reference).is_ok()); + value.servtd_crl_num = Some(5000); + assert!(policy.evaluate(&value, &reference).is_ok()); + // Below the floor (rolled-back CRL) fails closed. + value.servtd_crl_num = Some(4096); + assert!(policy.evaluate(&value, &reference).is_err()); + // Missing CRL number while a floor is set fails closed. + value.servtd_crl_num = None; + assert!(policy.evaluate(&value, &reference).is_err()); + } + + /// Once a CoRIM is attached, `servtd_lookup_by_tdinfo_hash` is + /// fail-closed: the legacy collateral is no longer consulted, so a hash + /// the legacy table resolves misses (the CoRIM does not know it), while a + /// hash the CoRIM knows resolves through it. + #[cfg(feature = "servtd_corim")] + #[test] + fn servtd_lookup_is_fail_closed_when_corim_attached() { + use crate::v2::{hex_string_to_bytes, ServtdCorim}; + + let policy_data = include_bytes!("../../test/policy_v2/policy_v2.json"); + let policy = RawPolicyData::deserialize_from_json(policy_data).unwrap(); + let issuer_chain = + include_bytes!("../../test/policy_v2/cert_chain/policy_issuer_chain.pem"); + let mut verified = policy.verify(issuer_chain).unwrap(); + + // A hash the *legacy* embedded tcb_mapping resolves. + let legacy_hash = hex_string_to_bytes( + &verified.servtd_tcb_mapping.as_ref().unwrap().svn_mappings[0] + .td_measurements + .tdinfo_hash, + ) + .unwrap(); + assert!(verified + .servtd_lookup_by_tdinfo_hash(&legacy_hash) + .is_some()); + + // Attach a CoRIM that only knows the pipeline sample's release + // (hash 347c6170…79286384 -> svn 1). + let tcb = include_bytes!("../../test/policy_v2/corim/tcb_mapping.cbor"); + verified.set_servtd_corim(ServtdCorim::decode(tcb, 0).unwrap()); + + // Fail-closed: the legacy hash is no longer resolvable (no fallback). + assert!(verified + .servtd_lookup_by_tdinfo_hash(&legacy_hash) + .is_none()); + + // ...but a hash the CoRIM knows resolves through it. + let corim_hash = hex_string_to_bytes( + "347c6170a91341351937962e08a7695703e7b87984b1c69216372c380302ac420d42381e4585007057b20b2579286384", + ) + .unwrap(); + let hit = verified.servtd_lookup_by_tdinfo_hash(&corim_hash); + assert!(hit.is_some()); + assert_eq!(hit.unwrap().isvsvn, 1); + } + #[test] fn test_global_policy() { let global = include_str!("../../test/policy_v2/global.json"); @@ -872,11 +1557,12 @@ mod test { tcb_status: Some("UpToDate".to_string()), tcb_evaluation_number: Some(15), fmspc: Some([0x10, 0xC0, 0x6F, 0x00, 0x00, 0x00]), + migtd_isvsvn: None, migtd_tcb_status: None, migtd_tcb_date: None, - migtd_isvsvn: None, pck_crl_num: None, root_ca_crl_num: None, + servtd_crl_num: None, }; let relative_ref = PolicyEvaluationInfo::default(); assert!(global_policy.evaluate(&value, &relative_ref).is_ok()); @@ -932,13 +1618,6 @@ mod test { .unwrap()); } - #[test] - fn test_servtd_tcb_status_comparison() { - assert!(ServtdTcbStatus::UpToDate == ServtdTcbStatus::OutOfDate); - assert!(ServtdTcbStatus::UpToDate > ServtdTcbStatus::Revoked); - assert!(ServtdTcbStatus::OutOfDate > ServtdTcbStatus::Revoked); - } - #[test] fn test_tcb_status_comparison() { assert!(TcbStatus::UpToDate == TcbStatus::OutOfDate); @@ -1118,51 +1797,6 @@ mod test { ); } - #[test] - fn test_policy_servtd_tcb_status() { - let assert_servtd_tcb_status_allowed = - |policy: PolicyProperty, - relative_reference: ServtdTcbStatus, - allow_list: &[ServtdTcbStatus], - deny_list: &[ServtdTcbStatus]| { - for value in allow_list { - assert!(policy - .evaluate_servtd_tcb_status(*value, Some(relative_reference)) - .unwrap()); - } - for value in deny_list { - assert!(!policy - .evaluate_servtd_tcb_status(*value, Some(relative_reference)) - .unwrap()); - } - }; - let relative_reference = ServtdTcbStatus::UpToDate; - - // Test with an empty "allow-list" - let tcb_status_policy = PolicyProperty { - operation: "allow-list".to_string(), - reference: Reference::StringList(vec![]), - }; - assert_servtd_tcb_status_allowed( - tcb_status_policy, - relative_reference, - &[ServtdTcbStatus::UpToDate, ServtdTcbStatus::OutOfDate], - &[ServtdTcbStatus::Revoked], - ); - - // Test with an "allow-list" operation and "Revoked" reference - let tcb_status_policy = PolicyProperty { - operation: "allow-list".to_string(), - reference: Reference::StringList(vec!["Revoked".to_string()]), - }; - assert_servtd_tcb_status_allowed( - tcb_status_policy, - relative_reference, - &[ServtdTcbStatus::UpToDate, ServtdTcbStatus::OutOfDate], - &[ServtdTcbStatus::Revoked], - ); - } - #[test] fn test_policy_tcb_evaluation_number() { // Test with a value reference diff --git a/src/policy/src/v2/servtd_collateral.rs b/src/policy/src/v2/servtd_collateral.rs index e746ac3cc..d9b183249 100644 --- a/src/policy/src/v2/servtd_collateral.rs +++ b/src/policy/src/v2/servtd_collateral.rs @@ -7,27 +7,38 @@ use serde::{Deserialize, Serialize}; use serde_json::{self, value::RawValue}; use crate::{ - v2::{bytes_to_hex_string, hex_string_to_bytes}, + v2::{bytes_to_hex_string, compute_tdinfo_hash, hex_string_to_bytes}, MigTdInfoProperty, PolicyError, Report, }; -#[derive(Debug, Serialize, Deserialize)] -#[serde(rename_all = "camelCase")] -pub struct VerifiedServtdCollateral { - pub servtd_identity: TdIdentity, - pub servtd_tcb_mapping: TdTcbMapping, -} +use crypto::{hash::digest_sha384, SHA384_DIGEST_SIZE}; #[derive(Debug, Serialize, Deserialize)] #[serde(rename_all = "camelCase")] pub struct ServtdCollateral<'a> { pub major_version: u32, pub minor_version: u32, - pub servtd_identity_issuer_chain: String, - #[serde(borrow)] - pub servtd_identity: RawServtdIdentity<'a>, pub servtd_tcb_mapping_issuer_chain: String, + #[serde(borrow)] pub servtd_tcb_mapping: RawServtdTcbMapping<'a>, + /// Optional TD Identity issuer chain (PEM). Present only when the optional + /// `servtdIdentity` is shipped; measured into RTMR2 and also bound to the + /// RTMR1 signer anchor in `RawPolicyData::verify`. + #[serde(default, skip_serializing_if = "Option::is_none")] + pub servtd_identity_issuer_chain: Option<String>, + /// Optional MigTD TD Identity (`isvsvn -> (tcb_date, tcb_status)`). + /// + /// JSON-only and optional (there is no CoRIM form). When present it lets + /// migration policy use `tcbDate` / `tcbStatus` bars; when absent, policy + /// is driven by the ISV SVN alone. See + /// `doc/corim_attestation_design.md` §3.2. + #[serde(borrow, default, skip_serializing_if = "Option::is_none")] + pub servtd_identity: Option<RawServtdIdentity<'a>>, + /// Legacy location for the optional PEM CRL covering the servTD signer + /// chain. New policies use top-level `servtdCrl` so CoRIM-only enrollment + /// can carry the same authoritative CRL without a JSON TCB mapping. + #[serde(default, skip_serializing_if = "Option::is_none")] + pub servtd_crl: Option<String>, } #[derive(Debug, Serialize, Deserialize)] @@ -59,6 +70,16 @@ impl<'a> RawServtdIdentity<'a> { } } +/// MigTD TD Identity (optional, JSON-only), simplified per the hash-based +/// TCB-mapping redesign. +/// +/// Because the TCB Mapping now matches by `SERVTD_INFO_HASH`, TD Identity no +/// longer describes the MigTD's `TDINFO_STRUCT`; the former register +/// descriptors (`xfam`, `attributes`, `mrConfigId`, `mrOwner`, +/// `mrOwnerConfig`, MRTD/RTMRs) and the SGX-enclave `mrsigner` / `isvProdId` +/// fields are dropped. It reduces to an envelope plus an +/// `isvsvn -> (tcb_date, tcb_status)` table. See +/// `doc/corim_attestation_design.md` §3.2. #[derive(Debug, Serialize, Deserialize)] #[serde(rename_all = "camelCase")] pub struct TdIdentity { @@ -66,14 +87,6 @@ pub struct TdIdentity { pub version: u32, pub issue_date: String, pub next_update: String, - pub tcb_evaluation_number: u32, - pub xfam: String, - pub attributes: String, - pub mr_config_id: String, - pub mr_owner: String, - pub mr_owner_config: String, - pub mrsigner: String, - pub isv_prod_id: u16, pub tcb_levels: Vec<TcbLevel>, } @@ -127,8 +140,10 @@ impl<'a> RawServtdTcbMapping<'a> { ) .map_err(|_| PolicyError::SignatureVerificationFailed)?; - serde_json::from_str::<TdTcbMapping>(self.td_tcb_mapping.get()) - .map_err(|_| PolicyError::InvalidServtdTcbMapping) + let mapping = serde_json::from_str::<TdTcbMapping>(self.td_tcb_mapping.get()) + .map_err(|_| PolicyError::InvalidServtdTcbMapping)?; + mapping.validate()?; + Ok(mapping) } } @@ -139,8 +154,6 @@ pub struct TdTcbMapping { pub version: u32, pub issue_date: String, pub next_update: String, - pub mr_signer: String, - pub isv_prod_id: u16, pub svn_mappings: Vec<SvnMapping>, } @@ -151,73 +164,73 @@ pub struct SvnMapping { pub isvsvn: u16, } -#[derive(Debug, Serialize, Deserialize, PartialEq, Eq)] +#[derive(Debug, Serialize, Deserialize, PartialEq, Eq, Clone)] pub struct Measurements { - pub mrtd: String, - pub rtmr0: String, - pub rtmr1: String, - pub rtmr2: Option<String>, - pub rtmr3: Option<String>, + /// Single-hash measurement key per the TCB-mapping redesign + /// (`doc/tcb_mapping_design_proposal.md`). + /// + /// Equals `init_servtd_info_hash` for production MigTDs (servtd_attr=0): + /// tdinfo_hash = SHA384(unmasked TDINFO_STRUCT bytes) + /// + /// Hex-encoded (case-insensitive). The serde alias accepts both + /// the canonical snake_case key and the legacy camelCase spelling. + #[serde(rename = "tdinfo_hash", alias = "tdinfoHash")] + pub tdinfo_hash: String, } impl Measurements { - pub fn new_from_bytes( - mrtd: &[u8], - rtmr0: &[u8], - rtmr1: &[u8], - rtmr2: Option<&[u8]>, - rtmr3: Option<&[u8]>, - ) -> Self { + pub fn new_from_bytes(tdinfo_hash: &[u8]) -> Self { Measurements { - mrtd: bytes_to_hex_string(mrtd), - rtmr0: bytes_to_hex_string(rtmr0), - rtmr1: bytes_to_hex_string(rtmr1), - rtmr2: rtmr2.map(|b| bytes_to_hex_string(b)), - rtmr3: rtmr3.map(|b| bytes_to_hex_string(b)), + tdinfo_hash: bytes_to_hex_string(tdinfo_hash), } } fn to_ascii_uppercase(&self) -> Self { Measurements { - mrtd: self.mrtd.to_ascii_uppercase(), - rtmr0: self.rtmr0.to_ascii_uppercase(), - rtmr1: self.rtmr1.to_ascii_uppercase(), - rtmr2: self.rtmr2.as_ref().map(|v| v.to_ascii_uppercase()), - rtmr3: self.rtmr3.as_ref().map(|v| v.to_ascii_uppercase()), + tdinfo_hash: self.tdinfo_hash.to_ascii_uppercase(), } } } impl TdTcbMapping { + fn validate(&self) -> Result<(), PolicyError> { + for (index, mapping) in self.svn_mappings.iter().enumerate() { + let hash = hex_string_to_bytes(&mapping.td_measurements.tdinfo_hash) + .map_err(|_| PolicyError::InvalidServtdTcbMapping)?; + if hash.len() != SHA384_DIGEST_SIZE { + return Err(PolicyError::InvalidServtdTcbMapping); + } + + for previous in &self.svn_mappings[..index] { + if previous + .td_measurements + .tdinfo_hash + .eq_ignore_ascii_case(&mapping.td_measurements.tdinfo_hash) + && previous.isvsvn != mapping.isvsvn + { + return Err(PolicyError::InvalidServtdTcbMapping); + } + } + } + Ok(()) + } + + /// Look up the engine SVN for the TD represented by `report` by computing + /// `tdinfo_hash` (per redesign §RTMR-layout) and matching the + /// `svnMappings[].tdMeasurements.tdinfoHash` entries. pub fn get_engine_svn_by_report(&self, report: &Report) -> Option<u16> { - let measurements = Measurements { - mrtd: bytes_to_hex_string( - report - .get_migtd_info_property(&MigTdInfoProperty::MrTd) - .ok()?, - ), - rtmr0: bytes_to_hex_string( - report - .get_migtd_info_property(&MigTdInfoProperty::Rtmr0) - .ok()?, - ), - rtmr1: bytes_to_hex_string( - report - .get_migtd_info_property(&MigTdInfoProperty::Rtmr1) - .ok()?, - ), - rtmr2: Some(bytes_to_hex_string( - report - .get_migtd_info_property(&MigTdInfoProperty::Rtmr2) - .ok()?, - )), - rtmr3: Some(bytes_to_hex_string( - report - .get_migtd_info_property(&MigTdInfoProperty::Rtmr3) - .ok()?, - )), - }; - self.get_engine_svn_by_measurements(&measurements) + let tdinfo_hash = compute_tdinfo_hash_from_report(report).ok()?; + self.get_engine_svn_by_tdinfo_hash(&tdinfo_hash) + } + + /// Look up the engine SVN by an already-computed `tdinfo_hash` + /// (48 raw bytes). This is the canonical entry point for the redesign. + pub fn get_engine_svn_by_tdinfo_hash(&self, tdinfo_hash: &[u8]) -> Option<u16> { + if tdinfo_hash.len() != SHA384_DIGEST_SIZE { + return None; + } + let target = Measurements::new_from_bytes(tdinfo_hash); + self.get_engine_svn_by_measurements(&target) } pub fn get_engine_svn_by_measurements(&self, measurements: &Measurements) -> Option<u16> { @@ -231,38 +244,146 @@ impl TdTcbMapping { #[inline] fn compare_measurements(pattern: &Measurements, target: &Measurements) -> bool { - // Convert both to uppercase for case-insensitive comparison + // Hex strings are case-insensitive. let pattern = pattern.to_ascii_uppercase(); let target = target.to_ascii_uppercase(); + pattern.tdinfo_hash == target.tdinfo_hash + } +} - if pattern.mrtd != target.mrtd - || pattern.rtmr0 != target.rtmr0 - || pattern.rtmr1 != target.rtmr1 - { - return false; - } +/// Total size of `TdInfoStruct` packed bytes (per +/// `td-shim-tools::tee_info_hash::TdInfoStruct::pack`): +/// attributes(8) + xfam(8) + 8*sha384(48) + reserved(0x70) = 512. +/// +/// The 8 SHA-384 fields are, in order: +/// `mrtd`, `mrconfig_id`, `mrowner`, `mrownerconfig`, `rtmr0`, `rtmr1`, +/// `rtmr2`, `rtmr3`. +const TDINFO_PACKED_SIZE: usize = 8 + 8 + 8 * SHA384_DIGEST_SIZE + TDINFO_RESERVED_SIZE; +const TDINFO_RESERVED_SIZE: usize = 0x70; + +/// Pack the *unmasked* `TdInfoStruct` bytes from its 10 measurement fields in +/// the same canonical order used by `td-shim-tools` (and therefore by +/// `migtd-hash`). +/// +/// Field order: attributes, xfam, mrtd, mrconfigid, mrowner, mrownerconfig, +/// rtmr0, rtmr1, rtmr2, rtmr3, reserved(0x70 zero bytes). +/// +/// The trailing 0x70 bytes are zero. This corresponds to the SEAM module's +/// internal `TDINFO_STRUCT` layout used to compute `init_servtd_info_hash` +/// when a service TD is bound; for the bound MigTD itself, `servtd_hash` is +/// always zero (no nested bindings). +pub fn pack_unmasked_tdinfo( + attributes: &[u8; 8], + xfam: &[u8; 8], + mrtd: &[u8; SHA384_DIGEST_SIZE], + mrconfig_id: &[u8; SHA384_DIGEST_SIZE], + mrowner: &[u8; SHA384_DIGEST_SIZE], + mrownerconfig: &[u8; SHA384_DIGEST_SIZE], + rtmr0: &[u8; SHA384_DIGEST_SIZE], + rtmr1: &[u8; SHA384_DIGEST_SIZE], + rtmr2: &[u8; SHA384_DIGEST_SIZE], + rtmr3: &[u8; SHA384_DIGEST_SIZE], +) -> [u8; TDINFO_PACKED_SIZE] { + let mut buf = [0u8; TDINFO_PACKED_SIZE]; + let mut off = 0usize; + let mut put = |off: &mut usize, src: &[u8]| { + buf[*off..*off + src.len()].copy_from_slice(src); + *off += src.len(); + }; + put(&mut off, attributes); + put(&mut off, xfam); + put(&mut off, mrtd); + put(&mut off, mrconfig_id); + put(&mut off, mrowner); + put(&mut off, mrownerconfig); + put(&mut off, rtmr0); + put(&mut off, rtmr1); + put(&mut off, rtmr2); + put(&mut off, rtmr3); + // Trailing reserved region stays zero. + debug_assert_eq!(off, TDINFO_PACKED_SIZE - TDINFO_RESERVED_SIZE); + buf +} - // Optional RTMR2 / RTMR3: - // If pattern provides a value -> target must also provide and match. - // If pattern is None -> treated as wildcard (ignore target value). - if pattern.rtmr2.is_some() { - match (&pattern.rtmr2, &target.rtmr2) { - (Some(p), Some(t)) if p != t => return false, - (Some(_), None) => return false, - _ => {} - } - } +/// Compute `tdinfo_hash` from the 10 individual TDINFO measurement fields. +/// Equals `init_servtd_info_hash` for MigTDs bound with `servtd_attr == 0`. +/// +/// Formula: `SHA384(pack(attributes, xfam, mrtd, ..., rtmr3, reserved))` +pub fn compute_tdinfo_hash_from_fields( + attributes: &[u8; 8], + xfam: &[u8; 8], + mrtd: &[u8; SHA384_DIGEST_SIZE], + mrconfig_id: &[u8; SHA384_DIGEST_SIZE], + mrowner: &[u8; SHA384_DIGEST_SIZE], + mrownerconfig: &[u8; SHA384_DIGEST_SIZE], + rtmr0: &[u8; SHA384_DIGEST_SIZE], + rtmr1: &[u8; SHA384_DIGEST_SIZE], + rtmr2: &[u8; SHA384_DIGEST_SIZE], + rtmr3: &[u8; SHA384_DIGEST_SIZE], +) -> Result<[u8; SHA384_DIGEST_SIZE], PolicyError> { + let packed = pack_unmasked_tdinfo( + attributes, + xfam, + mrtd, + mrconfig_id, + mrowner, + mrownerconfig, + rtmr0, + rtmr1, + rtmr2, + rtmr3, + ); + let inner = digest_sha384(&packed).map_err(|_| PolicyError::HashCalculation)?; + compute_tdinfo_hash(&inner) +} - if pattern.rtmr3.is_some() { - match (&pattern.rtmr3, &target.rtmr3) { - (Some(p), Some(t)) if p != t => return false, - (Some(_), None) => return false, - _ => {} - } - } +/// Extract a fixed-size array from a slice, validating length. +fn as_array<const N: usize>(slice: &[u8]) -> Result<&[u8; N], PolicyError> { + use core::convert::TryInto; + slice.try_into().map_err(|_| PolicyError::InvalidParameter) +} - true - } +/// Compute `tdinfo_hash` for the TD described by `report`. +/// +/// Returns the 48-byte hash, equals `init_servtd_info_hash` for +/// production MigTDs (`servtd_attr == 0`). +pub fn compute_tdinfo_hash_from_report( + report: &Report, +) -> Result<[u8; SHA384_DIGEST_SIZE], PolicyError> { + let attributes = + as_array::<8>(report.get_migtd_info_property(&MigTdInfoProperty::Attributes)?)?; + let xfam = as_array::<8>(report.get_migtd_info_property(&MigTdInfoProperty::Xfam)?)?; + let mrtd = + as_array::<SHA384_DIGEST_SIZE>(report.get_migtd_info_property(&MigTdInfoProperty::MrTd)?)?; + let mrconfig_id = as_array::<SHA384_DIGEST_SIZE>( + report.get_migtd_info_property(&MigTdInfoProperty::MrConfigId)?, + )?; + let mrowner = as_array::<SHA384_DIGEST_SIZE>( + report.get_migtd_info_property(&MigTdInfoProperty::MrOwner)?, + )?; + let mrownerconfig = as_array::<SHA384_DIGEST_SIZE>( + report.get_migtd_info_property(&MigTdInfoProperty::MrOwnerConfig)?, + )?; + let rtmr0 = + as_array::<SHA384_DIGEST_SIZE>(report.get_migtd_info_property(&MigTdInfoProperty::Rtmr0)?)?; + let rtmr1 = + as_array::<SHA384_DIGEST_SIZE>(report.get_migtd_info_property(&MigTdInfoProperty::Rtmr1)?)?; + let rtmr2 = + as_array::<SHA384_DIGEST_SIZE>(report.get_migtd_info_property(&MigTdInfoProperty::Rtmr2)?)?; + let rtmr3 = + as_array::<SHA384_DIGEST_SIZE>(report.get_migtd_info_property(&MigTdInfoProperty::Rtmr3)?)?; + compute_tdinfo_hash_from_fields( + attributes, + xfam, + mrtd, + mrconfig_id, + mrowner, + mrownerconfig, + rtmr0, + rtmr1, + rtmr2, + rtmr3, + ) } #[cfg(test)] @@ -273,38 +394,58 @@ mod test { fn test_get_engine_svn() { let engine_bytes = include_bytes!("../../test/policy_v2/tcb_mapping.json"); let engine: TdTcbMapping = serde_json::from_slice(engine_bytes).unwrap(); - let mrtd = String::from("E2C7DA7CF0D93973480F0A34A6FE52A204EA81B4F1B6CD16018F5B4CAEE7B3B544A9738464A7C95E1705E20687A0ADA6"); - let rtmr0 = String::from("518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4"); - let rtmr1 = String::from("518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4"); - let rtmr3 = String::from("000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"); - - let mut td_measurements = Measurements { - mrtd: mrtd.clone(), - rtmr0, - rtmr1, - rtmr2: None, - rtmr3: Some(rtmr3), + engine.validate().unwrap(); + + // A source policy must retain both the historical hash that initialized + // the tenant TD and the current source MigTD hash. + let init_hash = engine.svn_mappings[0].td_measurements.tdinfo_hash.clone(); + let current_hash = engine.svn_mappings[1].td_measurements.tdinfo_hash.clone(); + let target = Measurements { + tdinfo_hash: init_hash.clone(), }; - assert_eq!( - engine.get_engine_svn_by_measurements(&td_measurements), - Some(1) - ); + assert_eq!(engine.get_engine_svn_by_measurements(&target), Some(1)); + let current = Measurements { + tdinfo_hash: current_hash, + }; + assert_eq!(engine.get_engine_svn_by_measurements(¤t), Some(2)); - td_measurements.mrtd = String::from("abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890"); - assert!(engine - .get_engine_svn_by_measurements(&td_measurements) - .is_none()); + // Case-insensitive match. + let lower = Measurements { + tdinfo_hash: init_hash.to_ascii_lowercase(), + }; + assert_eq!(engine.get_engine_svn_by_measurements(&lower), Some(1)); - td_measurements.mrtd = mrtd.to_ascii_lowercase(); - assert_eq!( - engine.get_engine_svn_by_measurements(&td_measurements), - Some(1) - ); + // Wrong hash -> no match. + let bogus = Measurements { + tdinfo_hash: + "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff" + .into(), + }; + assert!(engine.get_engine_svn_by_measurements(&bogus).is_none()); + } - td_measurements.rtmr3 = None; - assert!(engine - .get_engine_svn_by_measurements(&td_measurements) - .is_none()); + #[test] + fn conflicting_duplicate_tdinfo_hash_is_invalid() { + let hash = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; + let mapping: TdTcbMapping = serde_json::from_str(&format!( + r#"{{ + "id": "mapping", + "version": 1, + "issueDate": "2025-01-01T00:00:00Z", + "nextUpdate": "2026-01-01T00:00:00Z", + "svnMappings": [ + {{"tdMeasurements": {{"tdinfo_hash": "{hash}"}}, "isvsvn": 1}}, + {{"tdMeasurements": {{"tdinfo_hash": "{}"}}, "isvsvn": 2}} + ] + }}"#, + hash.to_ascii_lowercase() + )) + .unwrap(); + + assert!(matches!( + mapping.validate(), + Err(PolicyError::InvalidServtdTcbMapping) + )); } #[test] @@ -316,9 +457,153 @@ mod test { .servtd_tcb_mapping .verify_signature(collateral.servtd_tcb_mapping_issuer_chain.as_bytes()) .is_ok()); - assert!(collateral - .servtd_identity - .verify_signature(collateral.servtd_tcb_mapping_issuer_chain.as_bytes()) - .is_ok()); + } + + #[test] + fn td_identity_simplified_parse_and_lookup() { + // The simplified TD Identity carries only the envelope + tcbLevels; + // the dropped TDINFO / SGX-enclave fields must not be required. + let json = r#"{ + "id": "identity-1", + "version": 1, + "issueDate": "2025-01-01T00:00:00Z", + "nextUpdate": "2026-01-01T00:00:00Z", + "tcbLevels": [ + { "tcb": { "isvsvn": 1 }, "tcbDate": "2025-01-01T00:00:00Z", "tcbStatus": "UpToDate" }, + { "tcb": { "isvsvn": 3 }, "tcbDate": "2025-06-01T00:00:00Z", "tcbStatus": "OutOfDate" } + ] + }"#; + let identity = TdIdentity::deserialize_from_json(json.as_bytes()).unwrap(); + let level = identity.get_tcb_level_by_svn(3).expect("svn 3 present"); + assert_eq!(level.tcb.isvsvn, 3); + assert_eq!(level.tcb_date, "2025-06-01T00:00:00Z"); + assert_eq!(level.tcb_status, "OutOfDate"); + assert!(identity.get_tcb_level_by_svn(2).is_none()); + } + + #[test] + fn servtd_collateral_identity_is_optional() { + // With TD Identity present, both optional fields deserialize. + let with_identity = r#"{ + "majorVersion": 1, + "minorVersion": 0, + "servtdTcbMappingIssuerChain": "chain", + "servtdTcbMapping": { "tdTcbMapping": {}, "signature": "aa" }, + "servtdIdentityIssuerChain": "chain", + "servtdIdentity": { "tdIdentity": {}, "signature": "bb" } + }"#; + let coll: ServtdCollateral = + serde_json::from_slice(with_identity.as_bytes()).expect("parse with identity"); + assert!(coll.servtd_identity.is_some()); + assert!(coll.servtd_identity_issuer_chain.is_some()); + + // SVN-only: omitting the identity fields is valid and leaves them None. + let svn_only = r#"{ + "majorVersion": 1, + "minorVersion": 0, + "servtdTcbMappingIssuerChain": "chain", + "servtdTcbMapping": { "tdTcbMapping": {}, "signature": "aa" } + }"#; + let coll: ServtdCollateral = + serde_json::from_slice(svn_only.as_bytes()).expect("parse svn-only"); + assert!(coll.servtd_identity.is_none()); + assert!(coll.servtd_identity_issuer_chain.is_none()); + } + + /// Regression test for the TDINFO packed-size constant. The packed buffer + /// MUST be exactly 512 bytes (attributes(8) + xfam(8) + 8×SHA384(48) + + /// reserved(0x70)). If `TDINFO_PACKED_SIZE` is off by even one field, the + /// `pack_unmasked_tdinfo` helper panics on out-of-bounds write. + #[test] + fn packed_tdinfo_size_matches_servtd_ext_layout() { + assert_eq!(TDINFO_PACKED_SIZE, 512); + let attributes = [0x01u8; 8]; + let xfam = [0x02u8; 8]; + let m = [ + [0x10u8; SHA384_DIGEST_SIZE], + [0x20u8; SHA384_DIGEST_SIZE], + [0x30u8; SHA384_DIGEST_SIZE], + [0x40u8; SHA384_DIGEST_SIZE], + [0x50u8; SHA384_DIGEST_SIZE], + [0x60u8; SHA384_DIGEST_SIZE], + [0x70u8; SHA384_DIGEST_SIZE], + [0x80u8; SHA384_DIGEST_SIZE], + ]; + let packed = pack_unmasked_tdinfo( + &attributes, + &xfam, + &m[0], + &m[1], + &m[2], + &m[3], + &m[4], + &m[5], + &m[6], + &m[7], + ); + assert_eq!(packed.len(), 512); + // First 16 bytes: attributes || xfam. + assert_eq!(&packed[..8], &attributes); + assert_eq!(&packed[8..16], &xfam); + // The 8 SHA384 fields follow in the documented order. + for (i, expected) in m.iter().enumerate() { + let off = 16 + i * SHA384_DIGEST_SIZE; + assert_eq!(&packed[off..off + SHA384_DIGEST_SIZE], &expected[..]); + } + // Final 112 bytes are the all-zero reserved region. + assert!(packed[16 + 8 * SHA384_DIGEST_SIZE..] + .iter() + .all(|b| *b == 0)); + } + + /// Cross-implementation parity: `tdinfo_hash` computed from the + /// canonical 10 fields here MUST equal `SHA384(unmasked_TDINFO_512)` used + /// by `migtd-hash`, the TCB-mapping CoRIM production tools, and the bash + /// mock-test scripts. If they ever drift, runtime policy lookup silently + /// fails for all valid TDs. + #[test] + fn tdinfo_hash_matches_direct_sha384_formula() { + use crypto::hash::digest_sha384; + let attributes = [0xAAu8; 8]; + let xfam = [0xBBu8; 8]; + let mrtd = [0x11u8; SHA384_DIGEST_SIZE]; + let mrconfig_id = [0x22u8; SHA384_DIGEST_SIZE]; + let mrowner = [0x33u8; SHA384_DIGEST_SIZE]; + let mrownerconfig = [0x44u8; SHA384_DIGEST_SIZE]; + let rtmr0 = [0x55u8; SHA384_DIGEST_SIZE]; + let rtmr1 = [0x66u8; SHA384_DIGEST_SIZE]; + let rtmr2 = [0x77u8; SHA384_DIGEST_SIZE]; + let rtmr3 = [0x88u8; SHA384_DIGEST_SIZE]; + + let got = compute_tdinfo_hash_from_fields( + &attributes, + &xfam, + &mrtd, + &mrconfig_id, + &mrowner, + &mrownerconfig, + &rtmr0, + &rtmr1, + &rtmr2, + &rtmr3, + ) + .unwrap(); + + let packed = pack_unmasked_tdinfo( + &attributes, + &xfam, + &mrtd, + &mrconfig_id, + &mrowner, + &mrownerconfig, + &rtmr0, + &rtmr1, + &rtmr2, + &rtmr3, + ); + assert_eq!(packed.len(), 512); + let expected = digest_sha384(&packed).unwrap(); + + assert_eq!(&got[..], expected.as_slice()); } } diff --git a/src/policy/src/v2/servtd_corim.rs b/src/policy/src/v2/servtd_corim.rs new file mode 100644 index 000000000..effc96a10 --- /dev/null +++ b/src/policy/src/v2/servtd_corim.rs @@ -0,0 +1,632 @@ +// Copyright (c) 2026 Intel Corporation +// +// SPDX-License-Identifier: BSD-2-Clause-Patent + +//! CoRIM-based hash endorsement: decodes the signed TCB-mapping CoRIM generated +//! during a MigTD production release (referred to as the "producer" below) and +//! resolves a `tdinfo_hash` to a [`ServtdLookup`] (the MigTD ISV SVN). This is +//! the only alternative to the legacy JSON collateral; the legacy path stays +//! unchanged from the one-hash redesign. +//! +//! # One document +//! +//! The producer emits a single signed **TCB Mapping CoRIM** +//! (`SERVTD_INFO_HASH -> isvsvn`), which MigTD carries in its CFV. Each +//! authorized release contributes two triples in the shared `migration-td` +//! environment (`class = { vendor: "Intel", model: "TDX" }`, +//! `instance = #6.560("migration-td")`): +//! +//! * a `reference-triple` whose single `MeasurementMap.mval.digests[0]` is +//! the ServTD info hash (authenticity), and +//! * a `conditional-endorsement-series` (CES) triple whose series record +//! *selects* on that digest and *adds* `mval.svn = ExactValue(svn)`. +//! +//! The hash -> svn lookup is driven by the CES triples. There is no TD +//! Identity document: the SVN is the endorsement, and the MigTD `tcb_date` / +//! `tcb_status` translation moved to policy-authoring time (see +//! `doc/corim_attestation_design.md` §7). +//! +//! # `no_std` +//! +//! Built `#![no_std]` in MigTD; decode uses +//! [`corim::validate::decode_and_validate_at`] (the `_at` variant) so no +//! `SystemTime` is touched. +//! +//! # Signature verification +//! +//! [`ServtdCorim::decode_signed`] verifies the surrounding `COSE_Sign1` +//! envelope: it checks the ES384 signature against the embedded RFC 9360 +//! `x5chain` (via the `crypto` crate) and binds the chain's trust anchor to +//! the RTMR1-measured policy signer anchor ([`compute_signer_anchor`]), so a +//! CoRIM is only trusted when signed by the same root-of-trust the firmware +//! measured from the CFV policy issuer chain. [`ServtdCorim::decode`] takes +//! already-verified inner payload bytes and performs decode + match only. + +use alloc::vec::Vec; +use core::convert::TryFrom; + +use corim::{ + types::{ + comid::ComidTag, + environment::EnvironmentMap, + measurement::{MeasurementMap, SvnChoice}, + signed::{decode_signed_corim, CoseAlgorithm, CwtClaims}, + triples::ConditionalEndorsementSeriesTriple, + }, + validate::decode_and_validate_at, +}; + +use crypto::SHA384_DIGEST_SIZE; + +use crate::{ + v2::{compute_signer_anchor, ServtdLookup}, + PolicyError, +}; + +// ---- MigTD CoRIM wire-format constants ----------------------------------- + +/// Component class for both documents: `class = { vendor: "Intel", +/// model: "TDX" }` (no `class-id`). The producer switched from a shared +/// class-id UUID to this vendor/model class. +pub const CLASS_VENDOR: &str = "Intel"; +/// See [`CLASS_VENDOR`]. +pub const CLASS_MODEL: &str = "TDX"; + +/// Instance bytes shared by both documents' environments +/// (`environment.instance = #6.560("migration-td")`). The TCB Mapping and +/// TD Identity CoRIMs are no longer distinguished by instance — they are +/// separate signed files, and within each the triple shape (digest-selecting +/// vs svn-selecting CES) determines the lookup. +pub const MIGRATION_TD_INSTANCE_BYTES: &[u8] = b"migration-td"; + +// `tcb_date` and `tcb_status` are carried under the Intel-profile extension +// keys re-exported from `corim::profile::intel`: +// MVAL_TEE_TCBDATE = -72 (`tee.tcbdate`, CBOR #6.1(epoch-seconds)) +// MVAL_TEE_TCBSTATUS = -88 (`tee.tcbstatus`, text) +// No MigTD-local key numbers are defined here. + +/// Decoded CoRIM servtd collateral: the TCB Mapping document (hash -> svn). +pub struct ServtdCorim { + /// CoMID tags from the TCB Mapping CoRIM (digest-selecting CES). + tcb_mapping: Vec<ComidTag>, + /// Verified leaf-first COSE `x5chain`, retained so callers can apply the + /// locally authoritative servTD CRL after signature/anchor verification. + signer_chain: Option<Vec<Vec<u8>>>, +} + +impl ServtdCorim { + /// Decode the TCB Mapping CoRIM blob (CBOR, `#6.501` unsigned wrapper) and + /// validate it structurally per draft-ietf-rats-corim-10. + /// `now_epoch_secs` evaluates any embedded validity windows. + /// + /// Signature verification of the surrounding `COSE_Sign1` envelope is the + /// caller's responsibility; this input is the inner payload bytes. + pub fn decode(tcb_mapping_cbor: &[u8], now_epoch_secs: i64) -> Result<Self, PolicyError> { + let (_c1, tcb_mapping) = decode_and_validate_at(tcb_mapping_cbor, now_epoch_secs) + .map_err(|_| PolicyError::InvalidServtdTcbMapping)?; + Ok(Self { + tcb_mapping, + signer_chain: None, + }) + } + + /// Decode from the **signed** TCB Mapping CoRIM document + /// (`COSE_Sign1-corim`, `#6.18`) shipped in the `.cose` file, verifying the + /// signature before any payload byte is trusted. + /// + /// The COSE envelope is parsed, its embedded RFC 9360 `x5chain` and ES384 + /// signature are verified, and the chain's trust anchor is bound to + /// `expected_signer_anchor` — the RTMR1-measured policy signer anchor + /// derived from the CFV policy issuer chain (see [`compute_signer_anchor`]). + /// This ties the CoRIM signer to the exact root-of-trust the firmware + /// measured at boot, mirroring how the legacy JSON collateral is rooted in + /// the measured policy issuer chain. Only after the anchor matches is the + /// inner CoRIM payload (`bstr .cbor #6.501(corim-map)`) extracted and + /// decoded via [`decode`](Self::decode). + pub fn decode_signed( + tcb_mapping_cose: &[u8], + now_epoch_secs: i64, + expected_signer_anchor: &[u8; SHA384_DIGEST_SIZE], + ) -> Result<Self, PolicyError> { + let (tcb_payload, signer_chain) = + verify_and_extract_payload(tcb_mapping_cose, expected_signer_anchor) + .map_err(|_| PolicyError::InvalidServtdTcbMapping)?; + let mut corim = Self::decode(&tcb_payload, now_epoch_secs)?; + corim.signer_chain = Some(signer_chain); + Ok(corim) + } + + /// Apply an authenticated servTD CRL to the verified COSE signer chain. + /// + /// The CRL must come from the local measured policy. Peer-supplied CRLs + /// must never be passed here as authority. + pub fn verify_signer_chain_not_revoked(&self, servtd_crl: &[u8]) -> Result<(), PolicyError> { + let signer_chain = self + .signer_chain + .as_ref() + .ok_or(PolicyError::SignatureVerificationFailed)?; + let signer_chain: Vec<&[u8]> = signer_chain.iter().map(|cert| cert.as_slice()).collect(); + crypto::verify_signer_chain_not_revoked(crypto::SignerChain::Der(&signer_chain), servtd_crl) + .map_err(|_| PolicyError::SignerRevoked) + } + + /// Resolve `SERVTD_INFO_HASH -> isvsvn` via the TCB Mapping CES triples. + /// + /// The digest is matched by **value** only; the producer currently labels + /// the 48-byte SHA-384 ServTD info hash with the SHA-256 algorithm id + /// (see the design-review gap note), so the algorithm field is not + /// enforced here. + fn svn_for_hash(&self, hash: &[u8]) -> Option<u16> { + for comid in &self.tcb_mapping { + let Some(ces_list) = comid.triples.conditional_endorsement_series.as_ref() else { + continue; + }; + for ces in ces_list { + if let Some(svn) = ces_svn_for_hash(ces, hash) { + return Some(svn); + } + } + } + None + } + + /// Number of CoMID tags in the TCB Mapping document. Exposed for + /// diagnostics. + pub fn comid_count(&self) -> usize { + self.tcb_mapping.len() + } + + /// Resolve the MigTD ISV SVN for the MigTD whose masked `TDINFO_STRUCT` + /// hashes to `tdinfo_hash` (the 48-byte `init/cur_servtd_info_hash`). + /// Returns `None` if the hash is not endorsed by this CoRIM. + pub fn lookup_by_tdinfo_hash(&self, tdinfo_hash: &[u8]) -> Option<ServtdLookup> { + let isvsvn = self.svn_for_hash(tdinfo_hash)?; + // The CoRIM path endorses `hash -> SVN` only; there is no CoRIM form of + // TD Identity, so date/status are left unset. + Some(ServtdLookup { + isvsvn, + tcb_date: None, + tcb_status: None, + }) + } +} + +// ---- COSE_Sign1 envelope + signature verification -------------------------- + +/// Verify a signed `COSE_Sign1-corim` (`#6.18`) and return its attached CoRIM +/// payload bytes (`bstr .cbor #6.501(corim-map)`) plus the verified `x5chain`. +/// +/// The signature and RTMR1-anchor checks are performed before any byte is +/// returned. The caller retains the returned chain and applies the locally +/// authoritative servTD CRL before trusting the CoRIM: +/// 1. Parse the COSE envelope; require an **attached** payload. +/// 2. Require the protected `alg` to be ES384/ESP384 (ECDSA-P384/SHA-384) and +/// an RFC 9360 `x5chain` to be present. +/// 3. Verify the x5chain integrity and the COSE signature over the +/// `Sig_structure1` TBS (delegated to the `crypto` crate). +/// 4. Bind the chain's root plus **any** EKU purpose the leaf asserts to +/// `expected_signer_anchor` — the RTMR1-measured policy signer anchor — so +/// the CoRIM signer is the same root-of-trust the firmware measured from the +/// CFV. The anchor is recomputed for each asserted purpose and one must +/// reproduce the measured value; otherwise it is fatal (fail-closed). +fn verify_and_extract_payload( + cose: &[u8], + expected_signer_anchor: &[u8; SHA384_DIGEST_SIZE], +) -> Result<(Vec<u8>, Vec<Vec<u8>>), PolicyError> { + let envelope = + decode_signed_corim(cose).map_err(|_| PolicyError::SignatureVerificationFailed)?; + + if has_cwt_time_claims(envelope.protected.cwt_claims.as_ref()) { + return Err(PolicyError::SignatureVerificationFailed); + } + + // Only ECDSA-P384/SHA-384 is supported by the crypto crate. Accept both + // the deprecated polymorphic ES384 (-35, what the producer emits today) + // and its fully-specified RFC 9864 replacement ESP384 (-51). + match envelope.protected.alg { + CoseAlgorithm::Es384 | CoseAlgorithm::Esp384 => {} + _ => return Err(PolicyError::SignatureVerificationFailed), + } + + let x5chain = envelope + .protected + .x5chain + .as_ref() + .ok_or(PolicyError::SignatureVerificationFailed)?; + let certs = x5chain.certs(); + + let tbs = envelope + .to_be_signed(&[]) + .map_err(|_| PolicyError::SignatureVerificationFailed)?; + + let (root_der, leaf_eku_oids_der) = + crypto::verify_cose_sign1_es384_x5chain(&certs, &tbs, &envelope.signature) + .map_err(|_| PolicyError::SignatureVerificationFailed)?; + + // Anchor-first match: the signer leaf may assert the dedicated MigTD + // policy-signer purpose alongside unrelated EKUs (e.g. a code-signing OID). + // Recompute the signer anchor for each asserted purpose and accept iff one + // reproduces the RTMR1-measured `expected_signer_anchor` under the presented + // root. This binds the CoRIM signer to the measured root-of-trust without + // the firmware hard-coding which EKU OID identifies the signer. + let mut anchor_matches = false; + for leaf_eku_oid_der in &leaf_eku_oids_der { + if compute_signer_anchor(&root_der, leaf_eku_oid_der)? == *expected_signer_anchor { + anchor_matches = true; + break; + } + } + if !anchor_matches { + return Err(PolicyError::SignatureVerificationFailed); + } + + let payload = envelope + .payload + .ok_or(PolicyError::SignatureVerificationFailed)?; + let signer_chain = certs.iter().map(|cert| cert.to_vec()).collect(); + Ok((payload, signer_chain)) +} + +fn has_cwt_time_claims(claims: Option<&CwtClaims>) -> bool { + matches!(claims, Some(claims) if claims.nbf.is_some() || claims.exp.is_some()) +} + +// ---- Environment matching -------------------------------------------------- + +/// Both documents now share `class = { vendor: "Intel", model: "TDX" }` and +/// `instance = #6.560("migration-td")`. A triple is in the migration-TD +/// environment iff both match. +fn is_migration_td_environment(env: &EnvironmentMap) -> bool { + use corim::types::common::InstanceIdChoice; + + let class_ok = env + .class + .as_ref() + .map(|c| { + c.vendor.as_deref() == Some(CLASS_VENDOR) && c.model.as_deref() == Some(CLASS_MODEL) + }) + .unwrap_or(false); + + let instance_ok = matches!( + env.instance.as_ref(), + Some(InstanceIdChoice::Bytes(b)) if b.as_slice() == MIGRATION_TD_INSTANCE_BYTES + ); + + class_ok && instance_ok +} + +// ---- TCB Mapping (CES) helpers -------------------------------------------- + +/// If this CES triple is in the migration-TD environment and its first +/// series record selects on `hash`, return the SVN it adds. +fn ces_svn_for_hash(ces: &ConditionalEndorsementSeriesTriple, hash: &[u8]) -> Option<u16> { + if !is_migration_td_environment(&ces.condition().environment) { + return None; + } + for record in ces.series() { + let selected = record + .selection() + .first() + .and_then(digest_value) + .map(|d| d == hash) + .unwrap_or(false); + if !selected { + continue; + } + if let Some(svn) = record.addition().first().and_then(svn_exact) { + return u16::try_from(svn).ok(); + } + } + None +} + +/// First digest value of a measurement (the ServTD info hash). +fn digest_value(m: &MeasurementMap) -> Option<&[u8]> { + Some(m.mval.digests.as_ref()?.first()?.value()) +} + +/// The exact SVN carried by a measurement's `mval.svn`, if present. +fn svn_exact(m: &MeasurementMap) -> Option<u64> { + match m.mval.svn { + Some(SvnChoice::ExactValue(n)) => Some(n), + _ => None, + } +} + +#[cfg(test)] +mod test { + use super::*; + use alloc::{vec, vec::Vec}; + use corim::{ + builder::{ComidBuilder, CorimBuilder}, + types::{ + common::{InstanceIdChoice, TagIdChoice}, + corim::CorimId, + environment::{ClassMap, EnvironmentMap}, + measurement::{Digest, MeasurementValuesMap}, + signed::SignedCorimBuilder, + triples::{CesCondition, ConditionalSeriesRecord, ReferenceTriple}, + }, + }; + + /// Producer's (mislabeled) digest alg id — see the SHA-256/SHA-384 gap. + const SHA256_ALG: i64 = 1; + + fn class() -> ClassMap { + ClassMap { + class_id: None, + vendor: Some(CLASS_VENDOR.into()), + model: Some(CLASS_MODEL.into()), + layer: None, + index: None, + } + } + + fn migration_td_env() -> EnvironmentMap { + EnvironmentMap { + class: Some(class()), + instance: Some(InstanceIdChoice::Bytes( + MIGRATION_TD_INSTANCE_BYTES.to_vec(), + )), + group: None, + } + } + + fn ref_triple(hash: &[u8]) -> ReferenceTriple { + ReferenceTriple::new( + migration_td_env(), + vec![MeasurementMap { + mkey: None, + mval: MeasurementValuesMap { + digests: Some(vec![Digest::new(SHA256_ALG, hash.to_vec())]), + ..MeasurementValuesMap::new() + }, + authorized_by: None, + }], + ) + } + + fn ces_triple(hash: &[u8], svn: u16) -> ConditionalEndorsementSeriesTriple { + let condition = CesCondition { + environment: migration_td_env(), + claims_list: Vec::new(), + authorized_by: None, + }; + let selection = MeasurementMap { + mkey: None, + mval: MeasurementValuesMap { + digests: Some(vec![Digest::new(SHA256_ALG, hash.to_vec())]), + ..MeasurementValuesMap::new() + }, + authorized_by: None, + }; + let addition = MeasurementMap { + mkey: None, + mval: MeasurementValuesMap { + svn: Some(SvnChoice::ExactValue(svn as u64)), + ..MeasurementValuesMap::new() + }, + authorized_by: None, + }; + ConditionalEndorsementSeriesTriple::new( + condition, + vec![ConditionalSeriesRecord::new( + vec![selection], + vec![addition], + )], + ) + } + + /// Build a TCB Mapping CoRIM mirroring `TcbMappingCorim::add_release`: + /// a reference-triple plus a CES triple per `(hash, svn)`. + fn build_tcb_mapping(entries: &[(Vec<u8>, u16)]) -> Vec<u8> { + let mut comid = ComidBuilder::new(TagIdChoice::Text("migtd-tcb-mapping".into())); + for (hash, svn) in entries { + comid = comid.add_reference_triple(ref_triple(hash)); + comid = comid.add_conditional_endorsement_series(ces_triple(hash, *svn)); + } + let comid = comid.build().expect("build tcb-mapping comid"); + CorimBuilder::new(CorimId::Text("migtd-tcb-mapping".into())) + .add_comid_tag(comid) + .expect("attach comid") + .build_bytes() + .expect("encode corim") + } + + fn hash(byte: u8) -> Vec<u8> { + vec![byte; 48] + } + + #[test] + fn hash_lookup_resolves_svn() { + let tcb = build_tcb_mapping(&[(hash(0xAA), 5), (hash(0xBB), 7)]); + let provider = ServtdCorim::decode(&tcb, 0).expect("decode"); + assert_eq!(provider.comid_count(), 1); + + let hit = provider.lookup_by_tdinfo_hash(&hash(0xAA)).expect("match"); + assert_eq!(hit.isvsvn, 5); + + let hit2 = provider.lookup_by_tdinfo_hash(&hash(0xBB)).expect("match"); + assert_eq!(hit2.isvsvn, 7); + } + + #[test] + fn unknown_hash_misses() { + let tcb = build_tcb_mapping(&[(hash(0xAA), 5)]); + let provider = ServtdCorim::decode(&tcb, 0).expect("decode"); + assert!(provider.lookup_by_tdinfo_hash(&hash(0xCC)).is_none()); + } + + #[test] + fn wrong_length_hash_misses() { + let tcb = build_tcb_mapping(&[(hash(0xAA), 5)]); + let provider = ServtdCorim::decode(&tcb, 0).expect("decode"); + assert!(provider.lookup_by_tdinfo_hash(&[0xAA; 32]).is_none()); + } + + /// Interop regression: decode the inner CoRIM payload from a real + /// pipeline-signed sample (envelope stripped) and resolve the endorsed + /// release `347c6170…79286384 -> svn 1`. + #[test] + fn interop_with_producer() { + let tcb = include_bytes!("../../test/policy_v2/corim/tcb_mapping.cbor"); + let provider = ServtdCorim::decode(tcb, 0).expect("decode producer CoRIM CBOR"); + + let mut hash = [0u8; 48]; + hex_decode( + "347c6170a91341351937962e08a7695703e7b87984b1c69216372c380302ac42\ + 0d42381e4585007057b20b2579286384", + &mut hash, + ); + let hit = provider + .lookup_by_tdinfo_hash(&hash) + .expect("sample hash -> svn 1"); + assert_eq!(hit.isvsvn, 1); + + assert!(provider.lookup_by_tdinfo_hash(&[0xCC; 48]).is_none()); + } + + #[test] + fn rejects_cwt_nbf_and_exp_claims() { + assert!(!has_cwt_time_claims(Some(&CwtClaims::new("test-signer")))); + assert!(has_cwt_time_claims(Some( + &CwtClaims::new("test-signer").with_nbf(1) + ))); + assert!(has_cwt_time_claims(Some( + &CwtClaims::new("test-signer").with_exp(-1) + ))); + + let payload = build_tcb_mapping(&[(hash(0xAA), 5)]); + let claims = CwtClaims::new("test-signer").with_nbf(1).with_exp(-1); + let cose = SignedCorimBuilder::new(CoseAlgorithm::Es384, payload) + .set_cwt_claims(claims) + .build_with_signature(vec![0; 96]) + .expect("build signed CoRIM"); + assert!(matches!( + verify_and_extract_payload(&cose, &[0; SHA384_DIGEST_SIZE]), + Err(PolicyError::SignatureVerificationFailed) + )); + } + + /// End-to-end with a real signed `COSE_Sign1` pipeline sample: verify the + /// envelope's ES384 signature + `x5chain`, bind the signer to the RTMR1 + /// signer anchor, then resolve a hash. The sample endorses a single + /// release: `347c6170…79286384 -> svn 1`. + #[test] + fn interop_with_signed_cose_samples() { + let tcb = include_bytes!("../../test/policy_v2/corim/tcb_mapping.cose"); + + // The anchor the firmware would measure into RTMR1 for this signer. + // Deriving it exercises the real ES384 + chain verification path. + let anchor = signer_anchor_from_sample(tcb); + + // 2025-01-01T00:00:00Z — inside the endorsement validity window. + let provider = + ServtdCorim::decode_signed(tcb, 1_735_689_600, &anchor).expect("decode signed COSE"); + + let mut hash = [0u8; 48]; + hex_decode( + "347c6170a91341351937962e08a7695703e7b87984b1c69216372c380302ac42\ + 0d42381e4585007057b20b2579286384", + &mut hash, + ); + let hit = provider + .lookup_by_tdinfo_hash(&hash) + .expect("signed-sample hash -> svn 1"); + assert_eq!(hit.isvsvn, 1); + } + + /// Fail-closed: a signer anchor that does not match the COSE x5chain's + /// root-of-trust must be rejected, even though the signature itself is + /// cryptographically valid. This is the RTMR1 binding that ties the CoRIM + /// signer to the firmware-measured policy issuer. + #[test] + fn signed_cose_rejects_unmeasured_signer() { + let tcb = include_bytes!("../../test/policy_v2/corim/tcb_mapping.cose"); + + let mut wrong = signer_anchor_from_sample(tcb); + wrong[0] ^= 0xFF; // any anchor other than the signer's + + assert!(ServtdCorim::decode_signed(tcb, 1_735_689_600, &wrong).is_err()); + } + + #[test] + fn signed_cose_accepts_non_revoked_signer_chain() { + let tcb = include_bytes!("../../test/policy_v2/corim/revocation/tcb_mapping.cose"); + let crl = include_bytes!("../../test/policy_v2/corim/revocation/crl_empty.pem"); + let anchor = signer_anchor_from_sample(tcb); + + let provider = ServtdCorim::decode_signed(tcb, 0, &anchor).expect("decode signed COSE"); + provider + .verify_signer_chain_not_revoked(crl) + .expect("non-revoked CoRIM signer should be accepted"); + } + + #[test] + fn signed_cose_rejects_revoked_leaf() { + let tcb = include_bytes!("../../test/policy_v2/corim/revocation/tcb_mapping.cose"); + let crl = include_bytes!("../../test/policy_v2/corim/revocation/crl_leaf_revoked.pem"); + let anchor = signer_anchor_from_sample(tcb); + + let provider = ServtdCorim::decode_signed(tcb, 0, &anchor).expect("decode signed COSE"); + assert!(matches!( + provider.verify_signer_chain_not_revoked(crl), + Err(PolicyError::SignerRevoked) + )); + } + + #[test] + fn signed_cose_rejects_revoked_intermediate() { + let tcb = include_bytes!("../../test/policy_v2/corim/revocation/tcb_mapping.cose"); + let crl = + include_bytes!("../../test/policy_v2/corim/revocation/crl_intermediate_revoked.pem"); + let anchor = signer_anchor_from_sample(tcb); + + let provider = ServtdCorim::decode_signed(tcb, 0, &anchor).expect("decode signed COSE"); + assert!(matches!( + provider.verify_signer_chain_not_revoked(crl), + Err(PolicyError::SignerRevoked) + )); + } + + #[test] + fn signed_cose_rejects_crl_from_wrong_authority() { + let tcb = include_bytes!("../../test/policy_v2/corim/revocation/tcb_mapping.cose"); + let wrong_crl = include_bytes!("../../../crypto/test/crl/crl_empty.pem"); + let anchor = signer_anchor_from_sample(tcb); + + let provider = ServtdCorim::decode_signed(tcb, 0, &anchor).expect("decode signed COSE"); + assert!(matches!( + provider.verify_signer_chain_not_revoked(wrong_crl), + Err(PolicyError::SignerRevoked) + )); + } + + /// Recover a signer anchor `A = compute_signer_anchor(root, leaf-EKU)` + /// from a sample's embedded x5chain, running the full signature + chain + /// verification on the way (so a tampered sample would fail here). The leaf + /// may assert several EKU purposes; any one of them reproduces an anchor + /// that `decode_signed`'s anchor-first match will accept, so the first + /// asserted purpose is used. + fn signer_anchor_from_sample(cose: &[u8]) -> [u8; SHA384_DIGEST_SIZE] { + let env = decode_signed_corim(cose).expect("decode COSE"); + let tbs = env.to_be_signed(&[]).expect("tbs"); + let chain = env.protected.x5chain.as_ref().expect("x5chain"); + let certs = chain.certs(); + let (root_der, leaf_eku_oids_der) = + crypto::verify_cose_sign1_es384_x5chain(&certs, &tbs, &env.signature) + .expect("verify signature"); + let leaf_eku_oid_der = leaf_eku_oids_der.first().expect("leaf asserts >= 1 EKU"); + compute_signer_anchor(&root_der, leaf_eku_oid_der).expect("anchor") + } + + fn hex_decode(s: &str, out: &mut [u8]) { + let bytes: Vec<u8> = s.bytes().filter(|b| !b.is_ascii_whitespace()).collect(); + assert_eq!(bytes.len(), out.len() * 2); + for (i, byte) in out.iter_mut().enumerate() { + let hi = (bytes[2 * i] as char).to_digit(16).unwrap() as u8; + let lo = (bytes[2 * i + 1] as char).to_digit(16).unwrap() as u8; + *byte = (hi << 4) | lo; + } + } +} diff --git a/src/policy/test/policy_v2/cert_chain/policy_issuer_chain.pem b/src/policy/test/policy_v2/cert_chain/policy_issuer_chain.pem index a96fc9001..8a43f97ec 100644 --- a/src/policy/test/policy_v2/cert_chain/policy_issuer_chain.pem +++ b/src/policy/test/policy_v2/cert_chain/policy_issuer_chain.pem @@ -1,45 +1,47 @@ -----BEGIN CERTIFICATE----- -MIICVzCCAd6gAwIBAgIUVKXleE/7DfWQZ7seyT3TqMXwAqcwCgYIKoZIzj0EAwMw +MIICfzCCAgWgAwIBAgIUb4Ary1FxNDv2tgK5KjW92D71wx8wCgYIKoZIzj0EAwMw dDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy YTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV -TWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI1MDkwNTA1NTI1M1oXDTI2MDkwNTA1 -NTI1M1owYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50 +TWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcyMTAyMjIzMVoXDTI3MDcyMTAy +MjIzMVowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50 YSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ -bmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL1rH/Pc4KUchfNLqm2z -Wc1FC7RfBI4xGUSU/hBnRDmEj5HKWdN2p7YIeUn+z0RiYXUxr5nHed+pvaD2CZ1b -y2wymsVZQpWIwtf8shfePFJcQrHsYsmmvvwi5ocOXe6ZkaNCMEAwHQYDVR0OBBYE -FHIbR1J8L+HjJNaHdXioZJ5r9zrSMB8GA1UdIwQYMBaAFJYGgWjSezCJ0vsgGDCl -W1a/KQLdMAoGCCqGSM49BAMDA2cAMGQCMCshcjFfbTVDx6XJL+ERXKqfTJdhK1oH -tMQ+m74KW6AfKZt0lqZ5eeFXc/RFW8pKpQIwHsObyRhFH6OaFqxw+oItj2qCRUlz -cCnHD8l/TBHhUoubb2OMLoENlBLECLtFHV2X +bmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL+t1XLepbWKHwd7iVJl +Uy3P5ZC/XmlelGaGAVHtzT+uyqf95dCdppfmATm5iL6mPCMi/B0EdUVWC8IsRrAb +tIVKOT+6uQvaqjgBDy8/jpULNFU2amH+tFXaK+3mI3FoXaNpMGcwDgYDVR0PAQH/ +BAQDAgeAMBUGA1UdJQQOMAwGCisGAQQBgf1ZAQEwHQYDVR0OBBYEFAQ3bgBAZVtA +xB6bSKABbGXJzUg9MB8GA1UdIwQYMBaAFKrpv7T3Goq7ozzv7XybB7KDXfwqMAoG +CCqGSM49BAMDA2gAMGUCMAC9OBINzzySAY9e6iqUSdueZuL6hNbS7FJjzd4AhLBt +aFDNptrDJzq8QG7TqgDZVAIxAOH/CNjzoJ4Vy/9Wc1gYQvFp/Y8OyIchE+LooQim +3TOl4G9HofEZt+KxtJ2RtWDESw== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIICVDCCAdqgAwIBAgIUY4sE3O7mKGtP/otJ0s4WQtwn4ZswCgYIKoZIzj0EAwMw +MIICdTCCAfugAwIBAgIUDNYWZVBywkKMCpLBMn/ZrbpVAngwCgYIKoZIzj0EAwMw XzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy YTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB -MB4XDTI1MDkwNTA1NDQ0M1oXDTMwMDkwNDA1NDQ0M1owdDELMAkGA1UEBhMCVVMx +MB4XDTI2MDcyMTAyMjIzMVoXDTMxMDcyMDAyMjIzMVowdDELMAkGA1UEBhMCVVMx CzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln VEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp -YXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhf4d4GTrO4NhJ24aG5A3i4Qu -mwGZ+Jsfo3siVVy1/vke9tN+ylkZlR5M2bl4O4y2eeUMGrzwSu84L/7crgqnnZsH -XrOQslNsSYJzB+YrbeJ1GBG+oDnCxvYgLTvCDtDio0IwQDAdBgNVHQ4EFgQUlgaB -aNJ7MInS+yAYMKVbVr8pAt0wHwYDVR0jBBgwFoAUpXzUSS/yVomZP8e814EZVbC8 -FY0wCgYIKoZIzj0EAwMDaAAwZQIwHoKqUxUqI2Zw8omp82svEjmN477njoK9YtOU -XtukW4+7RkU6VqSR6ND/9H83PMrLAjEAkPcCM/8QG3yZL1pxvKv87JwOIMJd5eUu -QDT7gy1UxPCjOETC2ygJyjJdYxBbXQrr +YXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhtbR7QbD7v9wmJHiLUdRE9SX +OeGsIpHD2yVPsKeYthmXkK9URtDY4DoeUIxjTPOvJPuH+oGBxuJoQB1DlHNud1e4 +ARK1un5WLqJQAM7YH4MDk4e8IgzildxR68Wf5S4Mo2MwYTAPBgNVHRMBAf8EBTAD +AQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUqum/tPcairujPO/tfJsHsoNd +/CowHwYDVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwCgYIKoZIzj0EAwMD +aAAwZQIwTq/MJUn2EN0Ky18A4BLrKyJvrpozm2JLzPZeMJC7JS8hLCXOtpTF1V9l +gSKpqbi9AjEAuMTlfVDUvFQGMR6cAOKScwHOJnUMB5eyyIg7AYlY5WcjwLNaV//d +zw3fC7CR1QR/ -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIICTzCCAdagAwIBAgIUeUyrqFAE0stc3jxOpGo12mTasB0wCgYIKoZIzj0EAwMw +MIICTzCCAdagAwIBAgIUYTmEV7kebAA5XSFYNCudbbU/Co8wCgYIKoZIzj0EAwMw XzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy YTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB -MB4XDTI1MDkwNTA1NDIxNVoXDTM1MDkwMzA1NDIxNVowXzELMAkGA1UEBhMCVVMx +MB4XDTI2MDcyMTAyMjIzMVoXDTM2MDcxODAyMjIzMVowXzELMAkGA1UEBhMCVVMx CzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln VEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF -K4EEACIDYgAEDnCmBt1r87/4VTwChvkyyrbfL79z5cx0NrVN4Gmp6HvpndL95MCd -ArnSdslXL/WmupFbxzy+a6mP4jdmR3oC7KyEaCKftOAct+Pz/e1KVI+QA3arR3IK -xW5TYzSQpoMdo1MwUTAdBgNVHQ4EFgQUpXzUSS/yVomZP8e814EZVbC8FY0wHwYD -VR0jBBgwFoAUpXzUSS/yVomZP8e814EZVbC8FY0wDwYDVR0TAQH/BAUwAwEB/zAK -BggqhkjOPQQDAwNnADBkAjBLN5JiAwPChO4RWfAMy+XjUbllaTFTxRqwCRliwx0v -f4aNNQ6Vrzv3pYXXmwl0CaoCMGFKKLm6EVwvQcILpSL3JpkfcKMfsUlJgdkVlF/W -rPSb+wS9KsT0dcF2DU5F12BycQ== +K4EEACIDYgAEKVtiVC3icjTPZ6yEwO46wmbk38a9N5GZEkTnjXypSwTsC/GfXLA4 +e4wvvwZ/1+sGrogN5DBX/auAFeicLw0CMFNiSocyqalh+LNjYB0vkBLqC5+PQoCa +avI9zsLmyJjUo1MwUTAdBgNVHQ4EFgQULZkd6aI5/Xdm7qbmkrf4JOIgdtEwHwYD +VR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwDwYDVR0TAQH/BAUwAwEB/zAK +BggqhkjOPQQDAwNnADBkAjAGWyxXJ4x3oWj1xDkLpcsYCBas0SNIGhXHPQmMbVqM +mtcDX//3RwD26+yBeZguCIYCMHgCQotN2FZ9PHwcmkA5tQkusL4Ab55d9JfvkjZ7 +HFibzfq7pmApshWt7mQ80fRu/Q== -----END CERTIFICATE----- diff --git a/src/policy/test/policy_v2/cert_chain/unrelated_issuer_chain.pem b/src/policy/test/policy_v2/cert_chain/unrelated_issuer_chain.pem new file mode 100644 index 000000000..6384c928b --- /dev/null +++ b/src/policy/test/policy_v2/cert_chain/unrelated_issuer_chain.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIICBjCCAYygAwIBAgIUQfMe6jmoFe9dKYc/KLiGbCVu8UwwCgYIKoZIzj0EAwMw +LjETMBEGA1UECgwKTWlnVEQgVGVzdDEXMBUGA1UEAwwOVW5yZWxhdGVkIFJvb3Qw +HhcNMjYwNzIxMDIyMzUzWhcNMjcwNzIxMDIyMzUzWjAwMRMwEQYDVQQKDApNaWdU +RCBUZXN0MRkwFwYDVQQDDBBVbnJlbGF0ZWQgU2lnbmVyMHYwEAYHKoZIzj0CAQYF +K4EEACIDYgAEWnV5+gwl2L6dTssw0MKmMgk67fGGYbo/1BCspyv3A4SRtrFBg2Ph +t4947ks9JN9+ESfRjl7J18mQOGPGowl75tnkmGqbWP9hFHIt5j+C0nMqn/HVgxj4 +lxD+G34fqfFeo2kwZzAOBgNVHQ8BAf8EBAMCB4AwFQYDVR0lBA4wDAYKKwYBBAGB +/VkBATAdBgNVHQ4EFgQUIRIBLqLwgx1nFT2PRgfdxNIyO10wHwYDVR0jBBgwFoAU +OHmmIU1AaFhoVBcxouAB7zUublUwCgYIKoZIzj0EAwMDaAAwZQIwQC2ttTNpmekr +zP0Hqsg3fC94PPEFKiS8JRU6xFE/mQZ/Ri9N5Z/gb3nNHbYYr5HiAjEAi9GvSGXz +u7s6+mMPUUDxcSuMFEac0b2QY0aJVJfLILKk6SfVthqJlEr/s2VFv/Ga +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIB/TCCAYSgAwIBAgIUAmNEj7QEN9MI389PBHKUDSAPsFYwCgYIKoZIzj0EAwMw +LjETMBEGA1UECgwKTWlnVEQgVGVzdDEXMBUGA1UEAwwOVW5yZWxhdGVkIFJvb3Qw +HhcNMjYwNzIxMDIyMzUzWhcNMzYwNzE4MDIyMzUzWjAuMRMwEQYDVQQKDApNaWdU +RCBUZXN0MRcwFQYDVQQDDA5VbnJlbGF0ZWQgUm9vdDB2MBAGByqGSM49AgEGBSuB +BAAiA2IABJ7lRkmM4Vtfg5EU1m9Rk7pmoYs22v5/o4TuYQ9v3qarf93tuRtOslf4 +eSnUjLnmszpWSkCAeCFwCrdnFjKQDIoJaoUTVQ7p/VNOrwvaWMLkehh0ZkjIh3Be +EeIpPZ7sFaNjMGEwHQYDVR0OBBYEFDh5piFNQGhYaFQXMaLgAe81Lm5VMB8GA1Ud +IwQYMBaAFDh5piFNQGhYaFQXMaLgAe81Lm5VMA8GA1UdEwEB/wQFMAMBAf8wDgYD +VR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2cAMGQCMBi5nqaDACPqS3FisL3Up2Qs +QaPM86RuGNUrtxGhFkwZJ2O5CPGPkGE1N+VwAwUKFAIwMIwQgwLlImffkOOXaJuh +c28+AwkuqV/ZyUsd8ylMLvn97l9+ArC5CnpPOpUdvrOc +-----END CERTIFICATE----- diff --git a/src/policy/test/policy_v2/corim/revocation/crl_empty.pem b/src/policy/test/policy_v2/corim/revocation/crl_empty.pem new file mode 100644 index 000000000..3c1d91d88 --- /dev/null +++ b/src/policy/test/policy_v2/corim/revocation/crl_empty.pem @@ -0,0 +1,7 @@ +-----BEGIN X509 CRL----- +MIHsMHQCAQEwCgYIKoZIzj0EAwMwNDEeMBwGA1UEAwwVTWlnVEQgQ29SSU0gVGVz +dCBSb290MRIwEAYDVQQKDAlNaWNyb3NvZnQXDTI2MDcyNjA0MTA1MloXDTM2MDcy +MzA0MTA1MlqgDzANMAsGA1UdFAQEAgIQADAKBggqhkjOPQQDAwNoADBlAjA4+7BY +QS8BS+2OodUXEk+c3Np1Ygcbhz92WDGTjkGIW1km5gcyyp/xrxCjlNSMsEUCMQCk +ju72mtW/Fm20r2Q5Vm81VuAxh79kku3F4wLL1ISZ5andXR5BIU7LKdcak6cDPBA= +-----END X509 CRL----- diff --git a/src/policy/test/policy_v2/corim/revocation/crl_intermediate_revoked.pem b/src/policy/test/policy_v2/corim/revocation/crl_intermediate_revoked.pem new file mode 100644 index 000000000..768ce4876 --- /dev/null +++ b/src/policy/test/policy_v2/corim/revocation/crl_intermediate_revoked.pem @@ -0,0 +1,8 @@ +-----BEGIN X509 CRL----- +MIIBBDCBiwIBATAKBggqhkjOPQQDAzA0MR4wHAYDVQQDDBVNaWdURCBDb1JJTSBU +ZXN0IFJvb3QxEjAQBgNVBAoMCU1pY3Jvc29mdBcNMjYwNzI2MDQxMDUyWhcNMzYw +NzIzMDQxMDUyWjAVMBMCAhAAFw0yNjA3MjYwNDEwNTJaoA8wDTALBgNVHRQEBAIC +EAEwCgYIKoZIzj0EAwMDaAAwZQIwaKkOus0qoJpaaK4/zKfPmkw7KiQj9LlD+0QX +qd8vseW4XqjpPD+/6mLbGF6F2CyvAjEAov+Z1hG+ApWlNKpDcGS1LvEdbbAFDE49 +EYo0TTM0psG34bHqPxhM+VboaIJ56fgp +-----END X509 CRL----- diff --git a/src/policy/test/policy_v2/corim/revocation/crl_leaf_revoked.pem b/src/policy/test/policy_v2/corim/revocation/crl_leaf_revoked.pem new file mode 100644 index 000000000..94e86a012 --- /dev/null +++ b/src/policy/test/policy_v2/corim/revocation/crl_leaf_revoked.pem @@ -0,0 +1,8 @@ +-----BEGIN X509 CRL----- +MIIBCzCBkwIBATAKBggqhkjOPQQDAzA8MSYwJAYDVQQDDB1NaWdURCBDb1JJTSBU +ZXN0IEludGVybWVkaWF0ZTESMBAGA1UECgwJTWljcm9zb2Z0Fw0yNjA3MjYwNDEw +NTJaFw0zNjA3MjMwNDEwNTJaMBUwEwICIAAXDTI2MDcyNjA0MTA1MlqgDzANMAsG +A1UdFAQEAgIgADAKBggqhkjOPQQDAwNnADBkAjAfNeYUhGhOESpUJwLEPbnHWsg5 +WS/73u8YHWAFWgVTdypFmhI8u5KX38Yy+7ovsmECMEyv2uWDRwTscE/51JXay4Si +cjnV9Vxr7n0nZbCLUPaGjfhQEs76PuJ2lVg7RH8+Vw== +-----END X509 CRL----- diff --git a/src/policy/test/policy_v2/corim/revocation/tcb_mapping.cose b/src/policy/test/policy_v2/corim/revocation/tcb_mapping.cose new file mode 100644 index 000000000..ac4164878 Binary files /dev/null and b/src/policy/test/policy_v2/corim/revocation/tcb_mapping.cose differ diff --git a/src/policy/test/policy_v2/corim/tcb_mapping.cbor b/src/policy/test/policy_v2/corim/tcb_mapping.cbor new file mode 100644 index 000000000..f37e5fb3e Binary files /dev/null and b/src/policy/test/policy_v2/corim/tcb_mapping.cbor differ diff --git a/src/policy/test/policy_v2/corim/tcb_mapping.cose b/src/policy/test/policy_v2/corim/tcb_mapping.cose new file mode 100644 index 000000000..4dd0b3539 Binary files /dev/null and b/src/policy/test/policy_v2/corim/tcb_mapping.cose differ diff --git a/src/policy/test/policy_v2/policy_data.json b/src/policy/test/policy_v2/policy_data.json index ff5daf9c4..3f4f40f14 100644 --- a/src/policy/test/policy_v2/policy_data.json +++ b/src/policy/test/policy_v2/policy_data.json @@ -1 +1 @@ -{"id":"E6643BDC-E50A-4315-9EF7-F217CE8AF9A6","version":"2.0","policySvn":1,"policy":[{"global":{"tcb":{"tcbEvaluationDataNumber":{"operation":"greater-or-equal","reference":13},"tcbDate":{"operation":"greater-or-equal","reference":"2025-01-01T00:00:00Z"},"tcbStatusAccepted":{"operation":"allow-list","reference":["UpToDate","ConfigurationNeeded"]}},"platform":{"fmspc":{"operation":"allow-list","reference":["00706A000000","00706E170000","00A068070000","20C06F000000","10A06E040000","40806F000000","10706A000000","10A067110000","20606A000000","10906EA50000","20906EA10000","10906EB10000","10806F000000","00706E070000","50A06D000000","10606A000000","10706A800000","10706A100000","B0806F000000","00706D050000","10806EB70000","10906ED10000","00A06F010000","00A06D070000","40806F200000","60806F000000","10A06E050000","40A06D000000","10606C040000","50A06F000000","00A06D000000","10806EA60000","00706D010000","10806F070000","20D06D010000","00706E270000","00A06F000000","10A06D050000","00C06F000000","30806F000000","20906EA50000","10706E370000","20806F070000","10906EC50000","10806F040000","10D06D000000","10906EA10000","20806F000000","10A067010000","30A06E000000","10A06F000000","70806F000000","10906EC10000","20A06D050000","00606A000000"]}}}}],"collaterals":{"majorVersion":1,"minorVersion":0,"teeType":129,"rootCa":"-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----","pckCrlIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICmjCCAkCgAwIBAgIUWSPTp0qoY1QuOXCt4A8HK1ckKrcwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTM0MTAzMTEyMzM0N1owcDEiMCAG\nA1UEAwwZSW50ZWwgU0dYIFBDSyBQbGF0Zm9ybSBDQTEaMBgGA1UECgwRSW50ZWwg\nQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEL\nMAkGA1UEBhMCVVMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQwp+Lc+TUBtg1H\n+U8JIsMsbjHjCkTtXb8jPM6r2dhu9zIblhDZ7INfqt3Ix8XcFKD8k0NEXrkZ66qJ\nXa1KzLIKo4G/MIG8MB8GA1UdIwQYMBaAFOnoRFJTNlxLGJoR/EMYLKXcIIBIMFYG\nA1UdHwRPME0wS6BJoEeGRWh0dHBzOi8vc2J4LWNlcnRpZmljYXRlcy50cnVzdGVk\nc2VydmljZXMuaW50ZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQU\nWSPTp0qoY1QuOXCt4A8HK1ckKrcwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQI\nMAYBAf8CAQAwCgYIKoZIzj0EAwIDSAAwRQIhAJ1q+FTz+gUuVfBQuCgJsFrL2TTS\ne1aBZ53O52TjFie6AiAriPaRahUX9Oa9kGLlAchWXKT6j4RWSR50BqhrN3UT4A==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","rootCaCrl":"-----BEGIN X509 CRL-----\nMIIBITCByAIBATAKBggqhkjOPQQDAjBoMRowGAYDVQQDDBFJbnRlbCBTR1ggUm9v\ndCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRh\nIENsYXJhMQswCQYDVQQIDAJDQTELMAkGA1UEBhMCVVMXDTI1MDkxNjExNTMxMloX\nDTI2MDkxNjExNTMxMlqgLzAtMAoGA1UdFAQDAgEBMB8GA1UdIwQYMBaAFOnoRFJT\nNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMCA0gAMEUCIQDv5KEBogNCzPgupOPj\nFIYJaOubypBPCGqnE0XcYTgFDwIgeSfXk71tIbV5lqp6gWCpN98/xu/8c7y36EV3\npkfootI=\n-----END X509 CRL-----","pckCrl":"-----BEGIN X509 CRL-----\nMIIBKTCB0AIBATAKBggqhkjOPQQDAjBwMSIwIAYDVQQDDBlJbnRlbCBTR1ggUENL\nIFBsYXRmb3JtIENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3JhdGlvbjEUMBIGA1UE\nBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQGEwJVUxcNMjUxMDIx\nMTAwMDQ1WhcNMjUxMTIwMTAwMDQ1WqAvMC0wCgYDVR0UBAMCAQEwHwYDVR0jBBgw\nFoAUWSPTp0qoY1QuOXCt4A8HK1ckKrcwCgYIKoZIzj0EAwIDSAAwRQIhAMyASL3c\nx2EzWL2vYSgVohy/wFV4CRDaDjg+jr2a1hiMAiBJ0EydeGFHj8SHaGyDwXOVzpJR\nL3cPZdDrut6pXRKdUw==\n-----END X509 CRL-----\n","platforms":[{"fmspc":"20C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:35Z\",\"nextUpdate\":\"2025-11-20T09:44:35Z\",\"fmspc\":\"20C06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"6f9cf0afa28bc6434a141f849c0920d842b8ec1651cc3bffb1fecc916af91195b750950fbea44e0071bd1a3647d7a55ea9a0fe0c58f66ef700e3aa2b4616405b\"}"},{"fmspc":"10A06E040000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:36Z\",\"nextUpdate\":\"2025-11-20T09:44:36Z\",\"fmspc\":\"10A06E040000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"70c93242def0bf52e292ffb548ad3a219d9be54e0764d0c28fe5a6805c2321f02dc8de8dc93dcaf5d8dfbcda869af8be9ea3fc07d3dd64f6652ec77c7bb14f7d\"}"},{"fmspc":"40806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:37Z\",\"nextUpdate\":\"2025-11-20T09:44:37Z\",\"fmspc\":\"40806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"a3a55dc486f550f535978f890365b03fcdcba8c90a273bdec1d57bc7f501dd108d514feb445d0521c28110a02384b13415dd0a9497651e15f8e61532fa92c64b\"}"},{"fmspc":"10806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:47:41Z\",\"nextUpdate\":\"2025-11-20T09:47:41Z\",\"fmspc\":\"10806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":10,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":10,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2020-05-28T00:00:00Z\",\"tcbStatus\":\"OutOfDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":9,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2020-03-22T00:00:00Z\",\"tcbStatus\":\"OutOfDate\"}]},\"signature\":\"00d8093fe0e80be196794b1876b376ea41bb44d7af2bbc0814bf2d2bc800a4107652ebf346ab852035b2fca22c557887e5f89a40382569392be6d66139e6f10f\"}"},{"fmspc":"50A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:40Z\",\"nextUpdate\":\"2025-11-20T09:44:40Z\",\"fmspc\":\"50A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"056f99c9823ba9a8215898756d866c0dd22a88ebfb39762c84cb72b2873c1af32b59cd551fc8a236e2dcc61413f0634548291a34cafbc985a3a0e6d4a6b13286\"}"},{"fmspc":"B0806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:42Z\",\"nextUpdate\":\"2025-11-20T09:44:42Z\",\"fmspc\":\"B0806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"96959d2b488667845e33570700387b0ecf19210a3056859b310c8b87873e58f94cc0cdb11e0a4328948abb952b5c91dce0199582a39b596a089bfd99bc630412\"}"},{"fmspc":"00A06F010000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:43Z\",\"nextUpdate\":\"2025-11-20T09:44:43Z\",\"fmspc\":\"00A06F010000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"a014048ff8bed6c8eb8f040fd730944dc797c0a81410888637ede908b56d150ccabd352b46d1d692d8bdcfd4c908c8c66f6c5a63a3065f5cb81c84a3e405c3ac\"}"},{"fmspc":"00A06D070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:44Z\",\"nextUpdate\":\"2025-11-20T09:44:44Z\",\"fmspc\":\"00A06D070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"34a7fdc12879c5fd74642251c896d41c05fd3cf89c633c7640f8799b3de88e5607d602b89aa525a5ae5febcad8846e6e3d6dd08ca12199aa762f64e7fd843d07\"}"},{"fmspc":"60806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:46Z\",\"nextUpdate\":\"2025-11-20T09:44:46Z\",\"fmspc\":\"60806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"10721ed2805aa913b76ccd8ee6eedf18f8db70573ab158ae6f1d8c1fc9529babc81af8866965afae550479ee1621383ff03bcfb8d9c5ca3ee50bfcb3ae2be73e\"}"},{"fmspc":"10A06E050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:47Z\",\"nextUpdate\":\"2025-11-20T09:44:47Z\",\"fmspc\":\"10A06E050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"6759cb09cb2686414749b863a284273c587fd7825106c1f854b3249901d3fecaef8b152b5b947540ad1f49c04f5031f3681ad8ac4bcad5c54b6ae72c0c26f2d7\"}"},{"fmspc":"40A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:48Z\",\"nextUpdate\":\"2025-11-20T09:44:48Z\",\"fmspc\":\"40A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"6639a8db412a07e163db290e36b63594f7fa2409184e96c952454bef4a6034c937cb629a49e92a57eae3a6dee1d1b77617389c9095b2d5c7569f8335512be132\"}"},{"fmspc":"50A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:50Z\",\"nextUpdate\":\"2025-11-20T09:44:50Z\",\"fmspc\":\"50A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"03e210a7e12af4a3b1f1eca77b30ef3e52b262a53681dc31733c58face31945d71ebce458af7422a72910d3dc7a7641ff1e05843bab16eda0429bf91ae72b527\"}"},{"fmspc":"00A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:51Z\",\"nextUpdate\":\"2025-11-20T09:44:51Z\",\"fmspc\":\"00A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"f789a0cdbbcb4475e988ff598cf63e1640f23c9c340e3cdd2ecd8e99607511be1d020d02bda4b7e5364bdf2f251ad72965519fb578fee1efa86927bdc8279690\"}"},{"fmspc":"10806F070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:52Z\",\"nextUpdate\":\"2025-11-20T09:44:52Z\",\"fmspc\":\"10806F070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"c97da1d2116279e490db192e5daf7793951473da3a231e09309b882a1e02528f3efe56ff9fff0f718db1aa94aeba4c9256d435e51c075aab5af85db2e43c109e\"}"},{"fmspc":"20D06D010000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:53Z\",\"nextUpdate\":\"2025-11-20T09:44:53Z\",\"fmspc\":\"20D06D010000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"ba5cbb2dfd8589a8de85243b8c376a07016d3e8d4eecadc0803e909dfb829b05e1978362fb17dddad611190eced87431ea138bd743cb165ded7dcc2fc8de9c70\"}"},{"fmspc":"00A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:54Z\",\"nextUpdate\":\"2025-11-20T09:44:54Z\",\"fmspc\":\"00A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"e0080569485b49d471cb1fb0246a089e90d3f8b4f696d586cf40b87d4ea7ec711ccc63a4bb5023417575ec2e62c99ae1e0a0ac8514fb2b7c919552dfb15c2687\"}"},{"fmspc":"10A06D050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:55Z\",\"nextUpdate\":\"2025-11-20T09:44:55Z\",\"fmspc\":\"10A06D050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":0,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"7b47307324b11bb25a8c13ee295f052290ea5e50ff216fb59ec5b5fba4ac363da03b98c930c347501d4654438ee1c4dd2e5a6bf4001419d3f79c90ce483340eb\"}"},{"fmspc":"00C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:56Z\",\"nextUpdate\":\"2025-11-20T09:44:56Z\",\"fmspc\":\"00C06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"4208d603a0c646cdfba3a764de628aabf599d844ec36901373d8b70b0b03dedac28ad21769cf7d288045936e43f520f9cbd38cd4a09ae770fef67c1508b35300\"}"},{"fmspc":"30806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:57Z\",\"nextUpdate\":\"2025-11-20T09:44:57Z\",\"fmspc\":\"30806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"274fed414afb6217575b8487ca1554d61bc5092f0085c89b9aac7b3f7585a679723f843828d695626927af11bc2b9f0f7a50243cef471ebdd664a0f6db391e75\"}"},{"fmspc":"20806F070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:58Z\",\"nextUpdate\":\"2025-11-20T09:44:58Z\",\"fmspc\":\"20806F070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"ae4a3c73b3ca87ae3a897baf0f0a62c5ae335a00a39118e9be8dcd28e2bd3bbb8be7e56293617f27f2d10e0282eefc6d4b965505774dca4b7478febdd654b040\"}"},{"fmspc":"10806F040000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:59Z\",\"nextUpdate\":\"2025-11-20T09:44:59Z\",\"fmspc\":\"10806F040000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"8be7cbb359c180b54d61066ee4a120662bb721e863754557705c5d591a4df70d18bea90fe309958448422dcc7ef55d1cf26b44d6a9c15ec733f30f74d87800d1\"}"},{"fmspc":"10D06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:45:00Z\",\"nextUpdate\":\"2025-11-20T09:45:00Z\",\"fmspc\":\"10D06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"96930bf1e63d69a94325123ff73ec127f670267d15e23fe119ae226354bc7c53707c1fd812d3e6648639883d81709494d96d6061e71c586f6f4d5ff743337587\"}"},{"fmspc":"20806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:45:01Z\",\"nextUpdate\":\"2025-11-20T09:45:01Z\",\"fmspc\":\"20806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"02e92c4d0dedf02a2a11522b8626d426da8dc5d3be26e66bd11039b9786fe88bf65e07257a06d16fb570a3304261b3c35952b686423e84ac8bdc5038d417deb3\"}"},{"fmspc":"30A06E000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:45:02Z\",\"nextUpdate\":\"2025-11-20T09:45:02Z\",\"fmspc\":\"30A06E000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5e1784749fd8b95b4c8773833a1041cfd2b85f13658fa22cd69a3f9de9cc43d371a3eef0de86d3effe08dc4a1dca81dcf3ab65344a222ea9523a8726772c3aa5\"}"},{"fmspc":"10A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:45:03Z\",\"nextUpdate\":\"2025-11-20T09:45:03Z\",\"fmspc\":\"10A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"25f80ad77ef746554afc7104f58b7ec995a19150738c71029e0a0137ecf1b3af439affe7f4d9f8c298852d71f3fa516f4127eb6147ffc0965e6a5babf2fd8660\"}"},{"fmspc":"20A06D050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:45:04Z\",\"nextUpdate\":\"2025-11-20T09:45:04Z\",\"fmspc\":\"20A06D050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"c7379d069530fd76842570f993ac8f615c509e3889fe93bb87e8b40faa46e3604ec2c21458af982065f7b392007d38a0fa12321e116379c82cfaefaa3ecaff21\"}"}],"qeIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","qeIdentity":"{\"enclaveIdentity\":{\"id\":\"TD_QE\",\"version\":2,\"issueDate\":\"2025-10-21T09:44:31Z\",\"nextUpdate\":\"2025-11-20T09:44:31Z\",\"tcbEvaluationDataNumber\":5,\"miscselect\":\"00000000\",\"miscselectMask\":\"FFFFFFFF\",\"attributes\":\"11000000000000000000000000000000\",\"attributesMask\":\"FBFFFFFFFFFFFFFF0000000000000000\",\"mrsigner\":\"DC9E2A7C6F948F17474E34A7FC43ED030F7C1563F1BABDDF6340C82E0E54A8C5\",\"isvprodid\":2,\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"f1f88349d25691d01a443ae086d480cdbf525ea8593ec61a32e4f943c054b6df18677d26bd733c0542128940fd5c792ac11c6bb50a9750f1f8d60d9b674607a5\"}"},"servtdCollateral":{"majorVersion":1,"minorVersion":0,"servtdIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICVzCCAd6gAwIBAgIUVKXleE/7DfWQZ7seyT3TqMXwAqcwCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI1MDkwNTA1NTI1M1oXDTI2MDkwNTA1\nNTI1M1owYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL1rH/Pc4KUchfNLqm2z\nWc1FC7RfBI4xGUSU/hBnRDmEj5HKWdN2p7YIeUn+z0RiYXUxr5nHed+pvaD2CZ1b\ny2wymsVZQpWIwtf8shfePFJcQrHsYsmmvvwi5ocOXe6ZkaNCMEAwHQYDVR0OBBYE\nFHIbR1J8L+HjJNaHdXioZJ5r9zrSMB8GA1UdIwQYMBaAFJYGgWjSezCJ0vsgGDCl\nW1a/KQLdMAoGCCqGSM49BAMDA2cAMGQCMCshcjFfbTVDx6XJL+ERXKqfTJdhK1oH\ntMQ+m74KW6AfKZt0lqZ5eeFXc/RFW8pKpQIwHsObyRhFH6OaFqxw+oItj2qCRUlz\ncCnHD8l/TBHhUoubb2OMLoENlBLECLtFHV2X\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICVDCCAdqgAwIBAgIUY4sE3O7mKGtP/otJ0s4WQtwn4ZswCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI1MDkwNTA1NDQ0M1oXDTMwMDkwNDA1NDQ0M1owdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhf4d4GTrO4NhJ24aG5A3i4Qu\nmwGZ+Jsfo3siVVy1/vke9tN+ylkZlR5M2bl4O4y2eeUMGrzwSu84L/7crgqnnZsH\nXrOQslNsSYJzB+YrbeJ1GBG+oDnCxvYgLTvCDtDio0IwQDAdBgNVHQ4EFgQUlgaB\naNJ7MInS+yAYMKVbVr8pAt0wHwYDVR0jBBgwFoAUpXzUSS/yVomZP8e814EZVbC8\nFY0wCgYIKoZIzj0EAwMDaAAwZQIwHoKqUxUqI2Zw8omp82svEjmN477njoK9YtOU\nXtukW4+7RkU6VqSR6ND/9H83PMrLAjEAkPcCM/8QG3yZL1pxvKv87JwOIMJd5eUu\nQDT7gy1UxPCjOETC2ygJyjJdYxBbXQrr\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUeUyrqFAE0stc3jxOpGo12mTasB0wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI1MDkwNTA1NDIxNVoXDTM1MDkwMzA1NDIxNVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEDnCmBt1r87/4VTwChvkyyrbfL79z5cx0NrVN4Gmp6HvpndL95MCd\nArnSdslXL/WmupFbxzy+a6mP4jdmR3oC7KyEaCKftOAct+Pz/e1KVI+QA3arR3IK\nxW5TYzSQpoMdo1MwUTAdBgNVHQ4EFgQUpXzUSS/yVomZP8e814EZVbC8FY0wHwYD\nVR0jBBgwFoAUpXzUSS/yVomZP8e814EZVbC8FY0wDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjBLN5JiAwPChO4RWfAMy+XjUbllaTFTxRqwCRliwx0v\nf4aNNQ6Vrzv3pYXXmwl0CaoCMGFKKLm6EVwvQcILpSL3JpkfcKMfsUlJgdkVlF/W\nrPSb+wS9KsT0dcF2DU5F12BycQ==\n-----END CERTIFICATE-----\n","servtdIdentity":{"tdIdentity":{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbEvaluationNumber":1,"xfam":"E71A060000000000","attributes":"0000000000000000","mrConfigId":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwnerConfig":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrsigner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","isvProdId":1,"tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}]},"signature":"3064023028CAFFB4B83AD5A8E00A2FD7BDA58E176495E5591E1D9EB9FBC80FD0ABFDA06705B316AD2299BFCD07B82524336328A102306A11A93912045B2438FCD719F84F78D0CDB91CCFC9ED55FF49B47C518CC6071D0B5662E3AECAB78E786000C477A18773"},"servtdTcbMappingIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICVzCCAd6gAwIBAgIUVKXleE/7DfWQZ7seyT3TqMXwAqcwCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI1MDkwNTA1NTI1M1oXDTI2MDkwNTA1\nNTI1M1owYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL1rH/Pc4KUchfNLqm2z\nWc1FC7RfBI4xGUSU/hBnRDmEj5HKWdN2p7YIeUn+z0RiYXUxr5nHed+pvaD2CZ1b\ny2wymsVZQpWIwtf8shfePFJcQrHsYsmmvvwi5ocOXe6ZkaNCMEAwHQYDVR0OBBYE\nFHIbR1J8L+HjJNaHdXioZJ5r9zrSMB8GA1UdIwQYMBaAFJYGgWjSezCJ0vsgGDCl\nW1a/KQLdMAoGCCqGSM49BAMDA2cAMGQCMCshcjFfbTVDx6XJL+ERXKqfTJdhK1oH\ntMQ+m74KW6AfKZt0lqZ5eeFXc/RFW8pKpQIwHsObyRhFH6OaFqxw+oItj2qCRUlz\ncCnHD8l/TBHhUoubb2OMLoENlBLECLtFHV2X\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICVDCCAdqgAwIBAgIUY4sE3O7mKGtP/otJ0s4WQtwn4ZswCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI1MDkwNTA1NDQ0M1oXDTMwMDkwNDA1NDQ0M1owdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhf4d4GTrO4NhJ24aG5A3i4Qu\nmwGZ+Jsfo3siVVy1/vke9tN+ylkZlR5M2bl4O4y2eeUMGrzwSu84L/7crgqnnZsH\nXrOQslNsSYJzB+YrbeJ1GBG+oDnCxvYgLTvCDtDio0IwQDAdBgNVHQ4EFgQUlgaB\naNJ7MInS+yAYMKVbVr8pAt0wHwYDVR0jBBgwFoAUpXzUSS/yVomZP8e814EZVbC8\nFY0wCgYIKoZIzj0EAwMDaAAwZQIwHoKqUxUqI2Zw8omp82svEjmN477njoK9YtOU\nXtukW4+7RkU6VqSR6ND/9H83PMrLAjEAkPcCM/8QG3yZL1pxvKv87JwOIMJd5eUu\nQDT7gy1UxPCjOETC2ygJyjJdYxBbXQrr\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUeUyrqFAE0stc3jxOpGo12mTasB0wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI1MDkwNTA1NDIxNVoXDTM1MDkwMzA1NDIxNVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEDnCmBt1r87/4VTwChvkyyrbfL79z5cx0NrVN4Gmp6HvpndL95MCd\nArnSdslXL/WmupFbxzy+a6mP4jdmR3oC7KyEaCKftOAct+Pz/e1KVI+QA3arR3IK\nxW5TYzSQpoMdo1MwUTAdBgNVHQ4EFgQUpXzUSS/yVomZP8e814EZVbC8FY0wHwYD\nVR0jBBgwFoAUpXzUSS/yVomZP8e814EZVbC8FY0wDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjBLN5JiAwPChO4RWfAMy+XjUbllaTFTxRqwCRliwx0v\nf4aNNQ6Vrzv3pYXXmwl0CaoCMGFKKLm6EVwvQcILpSL3JpkfcKMfsUlJgdkVlF/W\nrPSb+wS9KsT0dcF2DU5F12BycQ==\n-----END CERTIFICATE-----\n","servtdTcbMapping":{"tdTcbMapping":{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","mrSigner":"00000000000000000000000000000000","isvProdId":1,"svnMappings":[{"tdMeasurements":{"mrtd":"E2C7DA7CF0D93973480F0A34A6FE52A204EA81B4F1B6CD16018F5B4CAEE7B3B544A9738464A7C95E1705E20687A0ADA6","rtmr0":"518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4","rtmr1":"518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4"},"isvsvn":1}]},"signature":"306602310096D8260507E3F02698895732273709837C0CBF42DA29AA0891A18F8F4FEC648826E1E0DFB5C590B953F65B5EFB77F0B8023100B18CC20F8EF7C1D4E1CBCAEFF17C0722AC6213A0B7E83FDD580CA760BBDA91D25E714CFA2240BCEBDF039646D749ED84"}}} \ No newline at end of file +{"id":"E6643BDC-E50A-4315-9EF7-F217CE8AF9A6","version":"2.0","policySvn":1,"policy":[{"global":{"tcb":{"tcbEvaluationDataNumber":{"operation":"greater-or-equal","reference":5},"tcbDate":{"operation":"greater-or-equal","reference":"2022-11-09T00:00:00Z"},"tcbStatusAccepted":{"operation":"allow-list","reference":["UpToDate","ConfigurationNeeded"]}},"platform":{"fmspc":{"operation":"allow-list","reference":["00706A000000","00706E170000","00A068070000","20C06F000000","10A06E040000","40806F000000","10706A000000","10A067110000","20606A000000","10906EA50000","20906EA10000","10906EB10000","10806F000000","00706E070000","50A06D000000","10606A000000","10706A800000","10706A100000","B0806F000000","00706D050000","10806EB70000","10906ED10000","00A06F010000","00A06D070000","40806F200000","60806F000000","10A06E050000","40A06D000000","10606C040000","50A06F000000","00A06D000000","10806EA60000","00706D010000","10806F070000","20D06D010000","00706E270000","00A06F000000","10A06D050000","00C06F000000","30806F000000","20906EA50000","10706E370000","20806F070000","10906EC50000","10806F040000","10D06D000000","10906EA10000","20806F000000","10A067010000","30A06E000000","10A06F000000","70806F000000","10906EC10000","20A06D050000","00606A000000"]}},"crl":{"pckCrlNum":{"operation":"greater-or-equal","reference":1},"rootCaCrlNum":{"operation":"greater-or-equal","reference":1}}}}],"collaterals":{"majorVersion":1,"minorVersion":0,"teeType":129,"rootCa":"-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----","pckCrlIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICmjCCAkCgAwIBAgIUWSPTp0qoY1QuOXCt4A8HK1ckKrcwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTM0MTAzMTEyMzM0N1owcDEiMCAG\nA1UEAwwZSW50ZWwgU0dYIFBDSyBQbGF0Zm9ybSBDQTEaMBgGA1UECgwRSW50ZWwg\nQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEL\nMAkGA1UEBhMCVVMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQwp+Lc+TUBtg1H\n+U8JIsMsbjHjCkTtXb8jPM6r2dhu9zIblhDZ7INfqt3Ix8XcFKD8k0NEXrkZ66qJ\nXa1KzLIKo4G/MIG8MB8GA1UdIwQYMBaAFOnoRFJTNlxLGJoR/EMYLKXcIIBIMFYG\nA1UdHwRPME0wS6BJoEeGRWh0dHBzOi8vc2J4LWNlcnRpZmljYXRlcy50cnVzdGVk\nc2VydmljZXMuaW50ZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQU\nWSPTp0qoY1QuOXCt4A8HK1ckKrcwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQI\nMAYBAf8CAQAwCgYIKoZIzj0EAwIDSAAwRQIhAJ1q+FTz+gUuVfBQuCgJsFrL2TTS\ne1aBZ53O52TjFie6AiAriPaRahUX9Oa9kGLlAchWXKT6j4RWSR50BqhrN3UT4A==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","rootCaCrl":"-----BEGIN X509 CRL-----\nMIIBITCByAIBATAKBggqhkjOPQQDAjBoMRowGAYDVQQDDBFJbnRlbCBTR1ggUm9v\ndCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRh\nIENsYXJhMQswCQYDVQQIDAJDQTELMAkGA1UEBhMCVVMXDTI1MDkxNjExNTMxMloX\nDTI2MDkxNjExNTMxMlqgLzAtMAoGA1UdFAQDAgEBMB8GA1UdIwQYMBaAFOnoRFJT\nNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMCA0gAMEUCIQDv5KEBogNCzPgupOPj\nFIYJaOubypBPCGqnE0XcYTgFDwIgeSfXk71tIbV5lqp6gWCpN98/xu/8c7y36EV3\npkfootI=\n-----END X509 CRL-----","pckCrl":"-----BEGIN X509 CRL-----\nMIIBKTCB0AIBATAKBggqhkjOPQQDAjBwMSIwIAYDVQQDDBlJbnRlbCBTR1ggUENL\nIFBsYXRmb3JtIENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3JhdGlvbjEUMBIGA1UE\nBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQGEwJVUxcNMjYwNzAx\nMDk0NjIzWhcNMjYwNzMxMDk0NjIzWqAvMC0wCgYDVR0UBAMCAQEwHwYDVR0jBBgw\nFoAUWSPTp0qoY1QuOXCt4A8HK1ckKrcwCgYIKoZIzj0EAwIDSAAwRQIgcGtzcbJl\n2S3wCJYxAd7KNnRsztqrU+u2NaDupYb0lTgCIQCA6I7FwSIA0s2r9sVOz6dIqV1w\naBnaP08fyNmvo7VbCA==\n-----END X509 CRL-----","platforms":[{"fmspc":"20C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20C06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"3d0d3653b9341dc41c362f8f7cd38e9f4b829d057811ce6cafbcc77f167b6447522b4717b3d5c58a71648eec12af0b8e935edbb6cd773c4ceb7ad90e68cf001e\"}"},{"fmspc":"0400F1300000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1300000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"bcb9b79749670cca6342f83b2a5590595faf905d450ec175c7efdf9ff4dca6ad1dc3d10b8570ab0318a5bc3fd24c58a1729f09994b47bd0f82d49cfbb71ee3dd\"}"},{"fmspc":"10A06E040000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06E040000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"3bb24f39c796226e15a38616fe60e4c28d7ec28acb5d67e25b659555b29f404f472a7b0f9ee26fa065941ce915966f7c3759f52e27dc07bb1c2a29da08bb094d\"}"},{"fmspc":"40806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"40806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5320e541877e904a23caa7ee30c8ca7d794a72617b4c16cf6028746731fee7248f2583eda07683edcbd3e08e14e91d846cfafa7355866e10d6150bf8b47ae269\"}"},{"fmspc":"0400F1370000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1370000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"361c382377cc1515aa6f6f5d74a3b8ab02aca6eafb30f97322715f61fdfcfffa549c12f4e74e4769fd248483124cc2228c134577cf3bd199fbd3d03244a80610\"}"},{"fmspc":"0400F1100000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1100000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d33030e843729d88c8b9c5a4aae1185f6a0f43a2fc6bdbf7eff62ae0dc14411ae097b3a50ae6d411748950aa2c0953adbbb128d59bc337bede6792b0248a2a3b\"}"},{"fmspc":"10806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T09:46:20Z\",\"nextUpdate\":\"2026-07-31T09:46:20Z\",\"fmspc\":\"10806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":10,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":10,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2020-05-28T00:00:00Z\",\"tcbStatus\":\"OutOfDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":9,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2020-03-22T00:00:00Z\",\"tcbStatus\":\"OutOfDate\"}]},\"signature\":\"19a007d6ca2b8a300ce6ff7d34f93ef32a98462b6c1b003a8a230743be6c7ec80cfcb869dfb9be29c5e30d4d14817899d5249ddb1d146f04b623f87010837657\"}"},{"fmspc":"50A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"50A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"28e87299fb0ed2b63890a895f6b8fe86abcf087c7023f79cb93aaa3ceb8fdefd694ec5bcaed2fb00e83e9696557ff70b1649107de1269f477723db74cd815653\"}"},{"fmspc":"B0806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"B0806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"da0312fbe582e1d32136ddd517abf928c2c9ccdcb686d3306a6c4401a96190d6fdd753da816ffaa27d7b536298713f48de3f45d1a7a8e364d3ea75159452614c\"}"},{"fmspc":"00A06F010000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06F010000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"a1309265fe850a27482fc8cdb2854cab6ff10f5ca4099af209a676a062b4b45943155227d431d4058c47c70be382dc43defde577b980412653b59ec4e298a23b\"}"},{"fmspc":"00A06D070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06D070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"98641e3b215e1134191c0637028cd6031ab109354d8c68083769bd63757418d83c2837f396ecad4f7e1e13176b0b2367e46cd1045dc6032df731c7edebe124e2\"}"},{"fmspc":"60806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"60806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"85ecac3694bcca3320c5ce5cdbc67bbec0d85ae9642561a13e47e6dafb1bec844c9b023760b33ea981bec268d814aa039e27063674b41671e079f39bb3509cfd\"}"},{"fmspc":"10A06E050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06E050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"0a8a99b3c165ef65b54c2e313764342850bfd1c31aa201f2cfdb93399a115ae3f20faabbf53f1bb66565c58763eb300c852a0fa796aa065b64b79138585f5682\"}"},{"fmspc":"40A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"40A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"f049caf6905eebfbba2a1eccc7e96268a4c4f3d7d8a31ca340f260ea2035ec596cf5fe7bef4e86f42ecd2014b6a10feace6e622df152ce6faf74eafb54329dee\"}"},{"fmspc":"0400F1000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":0,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"589d8a6a5a60f3e12b303f6bd0ab9b3e70ad77500216936a5245c734443c6ea847a682b28324aa99e705f974446a66bad79fab7ee0291d62650db0c7681bd61b\"}"},{"fmspc":"50A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"50A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"8ef380408be7b4d51e2e19c03cecd5685467d0203719efeeac19c44d79b2b4358695345ec7adfb3abb71698001ddeb0de24adba24cc82ede59c4c828b3c52f59\"}"},{"fmspc":"00A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"126fd0874cbcee488f4fa793f0ca020f41a5f44965622b6e7768f9b4e677e7920105bbf3c3735e3ed7c6ad3f4e501534ee8e6c29df6a0c4367287d3d5176c72f\"}"},{"fmspc":"0400F1070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"b35cffb8b5af48c3026ee5ae3ad56bb1b45ef872ca2ec744a562073ffb57940cff890454f385ef57a39a5941fd4aa6049ce502be027ef5cf1b33f12bb4af9fd0\"}"},{"fmspc":"10806F070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10806F070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"9ed0865391001855b2e35740fdeb3978b284364201d1d568cc8c85bd640e707767c73cad516c00e2b29a2e81963fe5560c93ef20f391e936b33db74c1aa5b26c\"}"},{"fmspc":"20D06D010000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20D06D010000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5214de9edac3522fe9a68abba903fc88c59c37651c8f4bf2b79bebf2381fc32907dc9790ed883d15a948b7ba91f4ad8fe1712c56390d8398ac0641a55eb80f21\"}"},{"fmspc":"00A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"ac626a284a933532e9ad33ce2c2dbc24ad7e79dbef9a33dc8697fed09e2c46e5a8f508d057dc619d801eded0536502fb9be503a626cc5cbb2b02dd3da1f0b921\"}"},{"fmspc":"10A06D050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06D050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":0,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5ab60c67e4c6477c8767bf2b615cf985211e1ee3a3ecb06cd045b2907f5e120cd3f2dad24c2143d887e0596b8ffdb477e0edf417509a871f932e06debceff864\"}"},{"fmspc":"00C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00C06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"f787aeb769a57e7aa4e8cd64ba199b71966d6ffb441b9a5de66bcbc4e93b65f049da696bdefad506e3ece86249a4688b12f077bb559f1cace27899a5a4541f2c\"}"},{"fmspc":"30806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"30806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"c7bfb3a1d338bb64803c232efff231a25871dd14b06ecd4d119adc6998b0c90bd8d3f109af79f40d4cb24c2e939c596c2ab0896b289569b8d3dadc920900a98a\"}"},{"fmspc":"0400F1200000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1200000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"8c8c10f373ab61fa882f2f10f3885cea3b4ad34cfcbef833be573cbf631e7e84c31ad26ec05ee640fd91aa0ef0433e53c4d0fbc82c14cf055aabd698a96da216\"}"},{"fmspc":"20806F070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20806F070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d6154c177ad2e3f782dba2df4bf13e2fe2f6a07e20ae09d63cd4e1c3a7caca1afdecbc2c6959619e810926f6d6df4fe5b6d62e7a3f3abfc0bc440e768084298d\"}"},{"fmspc":"10806F040000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10806F040000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"c04cb69c8a57965018da713e624baa6c11f290f762b1b73cf01f90087334ba8d6c33e10fb3ca766b7dd99d87387b8b4241f25f3e91328c160c193deb70ec0bdb\"}"},{"fmspc":"10D06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10D06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"29ec7d93a60c101cd878f061467e933088dd0f393d8cbfd26ecba14cdf22c839b89b9fca57440105770449c022b3f7c1c514b294a46e504718b81deda3620d76\"}"},{"fmspc":"20806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"89ccc75f7e47334690d6ac8ba90d0ea84850d837ce51698dfe7b4b778476afd09fcd3119e3bc93e660b195e7db805d69cf8ed4ce1705eed3beaca4de8027ec8d\"}"},{"fmspc":"30A06E000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"30A06E000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d5550e6e74aed8bd2806e47cbdc99ed75b833401896a662727b5ff62e205e118e17afc952158d54b132719eebe45a5dde9e8c501dcba827320f76f1053460f8b\"}"},{"fmspc":"10A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"7ce7382154fbea591d0851952f283b16edf79ce56cba3757dd2297cfd0296c6bc3408eaa416ae14d13936f7662ba42741f4e718888dc0ad9f2630fde233810fa\"}"},{"fmspc":"20A06D050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20A06D050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"4fceb18caf6eb5ba2ca7138d55d24a6b8d81f99147383bcb5dec755572bf5a24d496fdcdbda75ce076682703685fdac3c9b0f0f53059ab2a3d8d0a8cba9631eb\"}"}],"qeIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","qeIdentity":"{\"enclaveIdentity\":{\"id\":\"TD_QE\",\"version\":2,\"issueDate\":\"2026-07-01T10:33:44Z\",\"nextUpdate\":\"2026-07-31T10:33:44Z\",\"tcbEvaluationDataNumber\":5,\"miscselect\":\"00000000\",\"miscselectMask\":\"FFFFFFFF\",\"attributes\":\"11000000000000000000000000000000\",\"attributesMask\":\"FBFFFFFFFFFFFFFF0000000000000000\",\"mrsigner\":\"DC9E2A7C6F948F17474E34A7FC43ED030F7C1563F1BABDDF6340C82E0E54A8C5\",\"isvprodid\":2,\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"bccb9464275b040819102bd2357fb77e2f1936f218c4d06afebe55b97d7bf416c7d70839897df145c94c6cc65a090c274f94df9b158c245fd37c344272527703\"}"},"servtdCollateral":{"majorVersion":1,"minorVersion":0,"servtdTcbMapping":{"tdTcbMapping":{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","svnMappings":[{"tdMeasurements":{"tdinfo_hash":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"},"isvsvn":1}]},"signature":"306502302DF213408E43734941EE22050FB1566E9C3AB600D0C0ADE9EDD99A0C91E2D2E44DD54C6B6658C5C2277BD63EF6EE33B702310092B91C8CDED39E93D0E67B02813388445116123AA2298E956559917FE817B8143CA12A9352DA7CCEC2F6D1F58E025F92"},"servtdTcbMappingIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICfzCCAgWgAwIBAgIUb4Ary1FxNDv2tgK5KjW92D71wx8wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcyMTAyMjIzMVoXDTI3MDcyMTAy\nMjIzMVowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL+t1XLepbWKHwd7iVJl\nUy3P5ZC/XmlelGaGAVHtzT+uyqf95dCdppfmATm5iL6mPCMi/B0EdUVWC8IsRrAb\ntIVKOT+6uQvaqjgBDy8/jpULNFU2amH+tFXaK+3mI3FoXaNpMGcwDgYDVR0PAQH/\nBAQDAgeAMBUGA1UdJQQOMAwGCisGAQQBgf1ZAQEwHQYDVR0OBBYEFAQ3bgBAZVtA\nxB6bSKABbGXJzUg9MB8GA1UdIwQYMBaAFKrpv7T3Goq7ozzv7XybB7KDXfwqMAoG\nCCqGSM49BAMDA2gAMGUCMAC9OBINzzySAY9e6iqUSdueZuL6hNbS7FJjzd4AhLBt\naFDNptrDJzq8QG7TqgDZVAIxAOH/CNjzoJ4Vy/9Wc1gYQvFp/Y8OyIchE+LooQim\n3TOl4G9HofEZt+KxtJ2RtWDESw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUDNYWZVBywkKMCpLBMn/ZrbpVAngwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTMxMDcyMDAyMjIzMVowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhtbR7QbD7v9wmJHiLUdRE9SX\nOeGsIpHD2yVPsKeYthmXkK9URtDY4DoeUIxjTPOvJPuH+oGBxuJoQB1DlHNud1e4\nARK1un5WLqJQAM7YH4MDk4e8IgzildxR68Wf5S4Mo2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUqum/tPcairujPO/tfJsHsoNd\n/CowHwYDVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwCgYIKoZIzj0EAwMD\naAAwZQIwTq/MJUn2EN0Ky18A4BLrKyJvrpozm2JLzPZeMJC7JS8hLCXOtpTF1V9l\ngSKpqbi9AjEAuMTlfVDUvFQGMR6cAOKScwHOJnUMB5eyyIg7AYlY5WcjwLNaV//d\nzw3fC7CR1QR/\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTmEV7kebAA5XSFYNCudbbU/Co8wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTM2MDcxODAyMjIzMVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEKVtiVC3icjTPZ6yEwO46wmbk38a9N5GZEkTnjXypSwTsC/GfXLA4\ne4wvvwZ/1+sGrogN5DBX/auAFeicLw0CMFNiSocyqalh+LNjYB0vkBLqC5+PQoCa\navI9zsLmyJjUo1MwUTAdBgNVHQ4EFgQULZkd6aI5/Xdm7qbmkrf4JOIgdtEwHwYD\nVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjAGWyxXJ4x3oWj1xDkLpcsYCBas0SNIGhXHPQmMbVqM\nmtcDX//3RwD26+yBeZguCIYCMHgCQotN2FZ9PHwcmkA5tQkusL4Ab55d9JfvkjZ7\nHFibzfq7pmApshWt7mQ80fRu/Q==\n-----END CERTIFICATE-----\n","servtdIdentity":{"tdIdentity":{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}]},"signature":"3066023100A3895AA95723C3DD3975C55480676494940833B0F9D83F8E7DD8F011DEF212B3326EE32FFA1BDF3C41941FF4D4FD86E6023100A5A52A633A85C39D9FE64516256763ADC84E2D548655935508053FD61AA03DB8CDA1FD5116E5A38CD08DAA2C44FFB42C"},"servtdIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICfzCCAgWgAwIBAgIUb4Ary1FxNDv2tgK5KjW92D71wx8wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcyMTAyMjIzMVoXDTI3MDcyMTAy\nMjIzMVowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL+t1XLepbWKHwd7iVJl\nUy3P5ZC/XmlelGaGAVHtzT+uyqf95dCdppfmATm5iL6mPCMi/B0EdUVWC8IsRrAb\ntIVKOT+6uQvaqjgBDy8/jpULNFU2amH+tFXaK+3mI3FoXaNpMGcwDgYDVR0PAQH/\nBAQDAgeAMBUGA1UdJQQOMAwGCisGAQQBgf1ZAQEwHQYDVR0OBBYEFAQ3bgBAZVtA\nxB6bSKABbGXJzUg9MB8GA1UdIwQYMBaAFKrpv7T3Goq7ozzv7XybB7KDXfwqMAoG\nCCqGSM49BAMDA2gAMGUCMAC9OBINzzySAY9e6iqUSdueZuL6hNbS7FJjzd4AhLBt\naFDNptrDJzq8QG7TqgDZVAIxAOH/CNjzoJ4Vy/9Wc1gYQvFp/Y8OyIchE+LooQim\n3TOl4G9HofEZt+KxtJ2RtWDESw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUDNYWZVBywkKMCpLBMn/ZrbpVAngwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTMxMDcyMDAyMjIzMVowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhtbR7QbD7v9wmJHiLUdRE9SX\nOeGsIpHD2yVPsKeYthmXkK9URtDY4DoeUIxjTPOvJPuH+oGBxuJoQB1DlHNud1e4\nARK1un5WLqJQAM7YH4MDk4e8IgzildxR68Wf5S4Mo2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUqum/tPcairujPO/tfJsHsoNd\n/CowHwYDVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwCgYIKoZIzj0EAwMD\naAAwZQIwTq/MJUn2EN0Ky18A4BLrKyJvrpozm2JLzPZeMJC7JS8hLCXOtpTF1V9l\ngSKpqbi9AjEAuMTlfVDUvFQGMR6cAOKScwHOJnUMB5eyyIg7AYlY5WcjwLNaV//d\nzw3fC7CR1QR/\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTmEV7kebAA5XSFYNCudbbU/Co8wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTM2MDcxODAyMjIzMVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEKVtiVC3icjTPZ6yEwO46wmbk38a9N5GZEkTnjXypSwTsC/GfXLA4\ne4wvvwZ/1+sGrogN5DBX/auAFeicLw0CMFNiSocyqalh+LNjYB0vkBLqC5+PQoCa\navI9zsLmyJjUo1MwUTAdBgNVHQ4EFgQULZkd6aI5/Xdm7qbmkrf4JOIgdtEwHwYD\nVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjAGWyxXJ4x3oWj1xDkLpcsYCBas0SNIGhXHPQmMbVqM\nmtcDX//3RwD26+yBeZguCIYCMHgCQotN2FZ9PHwcmkA5tQkusL4Ab55d9JfvkjZ7\nHFibzfq7pmApshWt7mQ80fRu/Q==\n-----END CERTIFICATE-----\n"}} \ No newline at end of file diff --git a/src/policy/test/policy_v2/policy_v2.json b/src/policy/test/policy_v2/policy_v2.json index d914e6f4f..2edd0606a 100644 --- a/src/policy/test/policy_v2/policy_v2.json +++ b/src/policy/test/policy_v2/policy_v2.json @@ -1 +1 @@ -{"policyData":{"id":"E6643BDC-E50A-4315-9EF7-F217CE8AF9A6","version":"2.0","policySvn":1,"policy":[{"global":{"tcb":{"tcbEvaluationDataNumber":{"operation":"greater-or-equal","reference":13},"tcbDate":{"operation":"greater-or-equal","reference":"2025-01-01T00:00:00Z"},"tcbStatusAccepted":{"operation":"allow-list","reference":["UpToDate","ConfigurationNeeded"]}},"platform":{"fmspc":{"operation":"allow-list","reference":["00706A000000","00706E170000","00A068070000","20C06F000000","10A06E040000","40806F000000","10706A000000","10A067110000","20606A000000","10906EA50000","20906EA10000","10906EB10000","10806F000000","00706E070000","50A06D000000","10606A000000","10706A800000","10706A100000","B0806F000000","00706D050000","10806EB70000","10906ED10000","00A06F010000","00A06D070000","40806F200000","60806F000000","10A06E050000","40A06D000000","10606C040000","50A06F000000","00A06D000000","10806EA60000","00706D010000","10806F070000","20D06D010000","00706E270000","00A06F000000","10A06D050000","00C06F000000","30806F000000","20906EA50000","10706E370000","20806F070000","10906EC50000","10806F040000","10D06D000000","10906EA10000","20806F000000","10A067010000","30A06E000000","10A06F000000","70806F000000","10906EC10000","20A06D050000","00606A000000"]}}}}],"collaterals":{"majorVersion":1,"minorVersion":0,"teeType":129,"rootCa":"-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----","pckCrlIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICmjCCAkCgAwIBAgIUWSPTp0qoY1QuOXCt4A8HK1ckKrcwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTM0MTAzMTEyMzM0N1owcDEiMCAG\nA1UEAwwZSW50ZWwgU0dYIFBDSyBQbGF0Zm9ybSBDQTEaMBgGA1UECgwRSW50ZWwg\nQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEL\nMAkGA1UEBhMCVVMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQwp+Lc+TUBtg1H\n+U8JIsMsbjHjCkTtXb8jPM6r2dhu9zIblhDZ7INfqt3Ix8XcFKD8k0NEXrkZ66qJ\nXa1KzLIKo4G/MIG8MB8GA1UdIwQYMBaAFOnoRFJTNlxLGJoR/EMYLKXcIIBIMFYG\nA1UdHwRPME0wS6BJoEeGRWh0dHBzOi8vc2J4LWNlcnRpZmljYXRlcy50cnVzdGVk\nc2VydmljZXMuaW50ZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQU\nWSPTp0qoY1QuOXCt4A8HK1ckKrcwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQI\nMAYBAf8CAQAwCgYIKoZIzj0EAwIDSAAwRQIhAJ1q+FTz+gUuVfBQuCgJsFrL2TTS\ne1aBZ53O52TjFie6AiAriPaRahUX9Oa9kGLlAchWXKT6j4RWSR50BqhrN3UT4A==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","rootCaCrl":"-----BEGIN X509 CRL-----\nMIIBITCByAIBATAKBggqhkjOPQQDAjBoMRowGAYDVQQDDBFJbnRlbCBTR1ggUm9v\ndCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRh\nIENsYXJhMQswCQYDVQQIDAJDQTELMAkGA1UEBhMCVVMXDTI1MDkxNjExNTMxMloX\nDTI2MDkxNjExNTMxMlqgLzAtMAoGA1UdFAQDAgEBMB8GA1UdIwQYMBaAFOnoRFJT\nNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMCA0gAMEUCIQDv5KEBogNCzPgupOPj\nFIYJaOubypBPCGqnE0XcYTgFDwIgeSfXk71tIbV5lqp6gWCpN98/xu/8c7y36EV3\npkfootI=\n-----END X509 CRL-----","pckCrl":"-----BEGIN X509 CRL-----\nMIIBKTCB0AIBATAKBggqhkjOPQQDAjBwMSIwIAYDVQQDDBlJbnRlbCBTR1ggUENL\nIFBsYXRmb3JtIENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3JhdGlvbjEUMBIGA1UE\nBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQGEwJVUxcNMjUxMDIx\nMTAwMDQ1WhcNMjUxMTIwMTAwMDQ1WqAvMC0wCgYDVR0UBAMCAQEwHwYDVR0jBBgw\nFoAUWSPTp0qoY1QuOXCt4A8HK1ckKrcwCgYIKoZIzj0EAwIDSAAwRQIhAMyASL3c\nx2EzWL2vYSgVohy/wFV4CRDaDjg+jr2a1hiMAiBJ0EydeGFHj8SHaGyDwXOVzpJR\nL3cPZdDrut6pXRKdUw==\n-----END X509 CRL-----\n","platforms":[{"fmspc":"20C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:35Z\",\"nextUpdate\":\"2025-11-20T09:44:35Z\",\"fmspc\":\"20C06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"6f9cf0afa28bc6434a141f849c0920d842b8ec1651cc3bffb1fecc916af91195b750950fbea44e0071bd1a3647d7a55ea9a0fe0c58f66ef700e3aa2b4616405b\"}"},{"fmspc":"10A06E040000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:36Z\",\"nextUpdate\":\"2025-11-20T09:44:36Z\",\"fmspc\":\"10A06E040000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"70c93242def0bf52e292ffb548ad3a219d9be54e0764d0c28fe5a6805c2321f02dc8de8dc93dcaf5d8dfbcda869af8be9ea3fc07d3dd64f6652ec77c7bb14f7d\"}"},{"fmspc":"40806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:37Z\",\"nextUpdate\":\"2025-11-20T09:44:37Z\",\"fmspc\":\"40806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"a3a55dc486f550f535978f890365b03fcdcba8c90a273bdec1d57bc7f501dd108d514feb445d0521c28110a02384b13415dd0a9497651e15f8e61532fa92c64b\"}"},{"fmspc":"10806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:47:41Z\",\"nextUpdate\":\"2025-11-20T09:47:41Z\",\"fmspc\":\"10806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":10,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":10,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2020-05-28T00:00:00Z\",\"tcbStatus\":\"OutOfDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":9,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2020-03-22T00:00:00Z\",\"tcbStatus\":\"OutOfDate\"}]},\"signature\":\"00d8093fe0e80be196794b1876b376ea41bb44d7af2bbc0814bf2d2bc800a4107652ebf346ab852035b2fca22c557887e5f89a40382569392be6d66139e6f10f\"}"},{"fmspc":"50A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:40Z\",\"nextUpdate\":\"2025-11-20T09:44:40Z\",\"fmspc\":\"50A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"056f99c9823ba9a8215898756d866c0dd22a88ebfb39762c84cb72b2873c1af32b59cd551fc8a236e2dcc61413f0634548291a34cafbc985a3a0e6d4a6b13286\"}"},{"fmspc":"B0806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:42Z\",\"nextUpdate\":\"2025-11-20T09:44:42Z\",\"fmspc\":\"B0806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"96959d2b488667845e33570700387b0ecf19210a3056859b310c8b87873e58f94cc0cdb11e0a4328948abb952b5c91dce0199582a39b596a089bfd99bc630412\"}"},{"fmspc":"00A06F010000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:43Z\",\"nextUpdate\":\"2025-11-20T09:44:43Z\",\"fmspc\":\"00A06F010000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"a014048ff8bed6c8eb8f040fd730944dc797c0a81410888637ede908b56d150ccabd352b46d1d692d8bdcfd4c908c8c66f6c5a63a3065f5cb81c84a3e405c3ac\"}"},{"fmspc":"00A06D070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:44Z\",\"nextUpdate\":\"2025-11-20T09:44:44Z\",\"fmspc\":\"00A06D070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"34a7fdc12879c5fd74642251c896d41c05fd3cf89c633c7640f8799b3de88e5607d602b89aa525a5ae5febcad8846e6e3d6dd08ca12199aa762f64e7fd843d07\"}"},{"fmspc":"60806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:46Z\",\"nextUpdate\":\"2025-11-20T09:44:46Z\",\"fmspc\":\"60806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"10721ed2805aa913b76ccd8ee6eedf18f8db70573ab158ae6f1d8c1fc9529babc81af8866965afae550479ee1621383ff03bcfb8d9c5ca3ee50bfcb3ae2be73e\"}"},{"fmspc":"10A06E050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:47Z\",\"nextUpdate\":\"2025-11-20T09:44:47Z\",\"fmspc\":\"10A06E050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"6759cb09cb2686414749b863a284273c587fd7825106c1f854b3249901d3fecaef8b152b5b947540ad1f49c04f5031f3681ad8ac4bcad5c54b6ae72c0c26f2d7\"}"},{"fmspc":"40A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:48Z\",\"nextUpdate\":\"2025-11-20T09:44:48Z\",\"fmspc\":\"40A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"6639a8db412a07e163db290e36b63594f7fa2409184e96c952454bef4a6034c937cb629a49e92a57eae3a6dee1d1b77617389c9095b2d5c7569f8335512be132\"}"},{"fmspc":"50A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:50Z\",\"nextUpdate\":\"2025-11-20T09:44:50Z\",\"fmspc\":\"50A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"03e210a7e12af4a3b1f1eca77b30ef3e52b262a53681dc31733c58face31945d71ebce458af7422a72910d3dc7a7641ff1e05843bab16eda0429bf91ae72b527\"}"},{"fmspc":"00A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:51Z\",\"nextUpdate\":\"2025-11-20T09:44:51Z\",\"fmspc\":\"00A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"f789a0cdbbcb4475e988ff598cf63e1640f23c9c340e3cdd2ecd8e99607511be1d020d02bda4b7e5364bdf2f251ad72965519fb578fee1efa86927bdc8279690\"}"},{"fmspc":"10806F070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:52Z\",\"nextUpdate\":\"2025-11-20T09:44:52Z\",\"fmspc\":\"10806F070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"c97da1d2116279e490db192e5daf7793951473da3a231e09309b882a1e02528f3efe56ff9fff0f718db1aa94aeba4c9256d435e51c075aab5af85db2e43c109e\"}"},{"fmspc":"20D06D010000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:53Z\",\"nextUpdate\":\"2025-11-20T09:44:53Z\",\"fmspc\":\"20D06D010000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"ba5cbb2dfd8589a8de85243b8c376a07016d3e8d4eecadc0803e909dfb829b05e1978362fb17dddad611190eced87431ea138bd743cb165ded7dcc2fc8de9c70\"}"},{"fmspc":"00A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:54Z\",\"nextUpdate\":\"2025-11-20T09:44:54Z\",\"fmspc\":\"00A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"e0080569485b49d471cb1fb0246a089e90d3f8b4f696d586cf40b87d4ea7ec711ccc63a4bb5023417575ec2e62c99ae1e0a0ac8514fb2b7c919552dfb15c2687\"}"},{"fmspc":"10A06D050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:55Z\",\"nextUpdate\":\"2025-11-20T09:44:55Z\",\"fmspc\":\"10A06D050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":0,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"7b47307324b11bb25a8c13ee295f052290ea5e50ff216fb59ec5b5fba4ac363da03b98c930c347501d4654438ee1c4dd2e5a6bf4001419d3f79c90ce483340eb\"}"},{"fmspc":"00C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:56Z\",\"nextUpdate\":\"2025-11-20T09:44:56Z\",\"fmspc\":\"00C06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"4208d603a0c646cdfba3a764de628aabf599d844ec36901373d8b70b0b03dedac28ad21769cf7d288045936e43f520f9cbd38cd4a09ae770fef67c1508b35300\"}"},{"fmspc":"30806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:57Z\",\"nextUpdate\":\"2025-11-20T09:44:57Z\",\"fmspc\":\"30806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"274fed414afb6217575b8487ca1554d61bc5092f0085c89b9aac7b3f7585a679723f843828d695626927af11bc2b9f0f7a50243cef471ebdd664a0f6db391e75\"}"},{"fmspc":"20806F070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:58Z\",\"nextUpdate\":\"2025-11-20T09:44:58Z\",\"fmspc\":\"20806F070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"ae4a3c73b3ca87ae3a897baf0f0a62c5ae335a00a39118e9be8dcd28e2bd3bbb8be7e56293617f27f2d10e0282eefc6d4b965505774dca4b7478febdd654b040\"}"},{"fmspc":"10806F040000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:44:59Z\",\"nextUpdate\":\"2025-11-20T09:44:59Z\",\"fmspc\":\"10806F040000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"8be7cbb359c180b54d61066ee4a120662bb721e863754557705c5d591a4df70d18bea90fe309958448422dcc7ef55d1cf26b44d6a9c15ec733f30f74d87800d1\"}"},{"fmspc":"10D06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:45:00Z\",\"nextUpdate\":\"2025-11-20T09:45:00Z\",\"fmspc\":\"10D06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"96930bf1e63d69a94325123ff73ec127f670267d15e23fe119ae226354bc7c53707c1fd812d3e6648639883d81709494d96d6061e71c586f6f4d5ff743337587\"}"},{"fmspc":"20806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:45:01Z\",\"nextUpdate\":\"2025-11-20T09:45:01Z\",\"fmspc\":\"20806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"02e92c4d0dedf02a2a11522b8626d426da8dc5d3be26e66bd11039b9786fe88bf65e07257a06d16fb570a3304261b3c35952b686423e84ac8bdc5038d417deb3\"}"},{"fmspc":"30A06E000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:45:02Z\",\"nextUpdate\":\"2025-11-20T09:45:02Z\",\"fmspc\":\"30A06E000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5e1784749fd8b95b4c8773833a1041cfd2b85f13658fa22cd69a3f9de9cc43d371a3eef0de86d3effe08dc4a1dca81dcf3ab65344a222ea9523a8726772c3aa5\"}"},{"fmspc":"10A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:45:03Z\",\"nextUpdate\":\"2025-11-20T09:45:03Z\",\"fmspc\":\"10A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"25f80ad77ef746554afc7104f58b7ec995a19150738c71029e0a0137ecf1b3af439affe7f4d9f8c298852d71f3fa516f4127eb6147ffc0965e6a5babf2fd8660\"}"},{"fmspc":"20A06D050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2025-10-21T09:45:04Z\",\"nextUpdate\":\"2025-11-20T09:45:04Z\",\"fmspc\":\"20A06D050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"c7379d069530fd76842570f993ac8f615c509e3889fe93bb87e8b40faa46e3604ec2c21458af982065f7b392007d38a0fa12321e116379c82cfaefaa3ecaff21\"}"}],"qeIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","qeIdentity":"{\"enclaveIdentity\":{\"id\":\"TD_QE\",\"version\":2,\"issueDate\":\"2025-10-21T09:44:31Z\",\"nextUpdate\":\"2025-11-20T09:44:31Z\",\"tcbEvaluationDataNumber\":5,\"miscselect\":\"00000000\",\"miscselectMask\":\"FFFFFFFF\",\"attributes\":\"11000000000000000000000000000000\",\"attributesMask\":\"FBFFFFFFFFFFFFFF0000000000000000\",\"mrsigner\":\"DC9E2A7C6F948F17474E34A7FC43ED030F7C1563F1BABDDF6340C82E0E54A8C5\",\"isvprodid\":2,\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"f1f88349d25691d01a443ae086d480cdbf525ea8593ec61a32e4f943c054b6df18677d26bd733c0542128940fd5c792ac11c6bb50a9750f1f8d60d9b674607a5\"}"},"servtdCollateral":{"majorVersion":1,"minorVersion":0,"servtdIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICVzCCAd6gAwIBAgIUVKXleE/7DfWQZ7seyT3TqMXwAqcwCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI1MDkwNTA1NTI1M1oXDTI2MDkwNTA1\nNTI1M1owYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL1rH/Pc4KUchfNLqm2z\nWc1FC7RfBI4xGUSU/hBnRDmEj5HKWdN2p7YIeUn+z0RiYXUxr5nHed+pvaD2CZ1b\ny2wymsVZQpWIwtf8shfePFJcQrHsYsmmvvwi5ocOXe6ZkaNCMEAwHQYDVR0OBBYE\nFHIbR1J8L+HjJNaHdXioZJ5r9zrSMB8GA1UdIwQYMBaAFJYGgWjSezCJ0vsgGDCl\nW1a/KQLdMAoGCCqGSM49BAMDA2cAMGQCMCshcjFfbTVDx6XJL+ERXKqfTJdhK1oH\ntMQ+m74KW6AfKZt0lqZ5eeFXc/RFW8pKpQIwHsObyRhFH6OaFqxw+oItj2qCRUlz\ncCnHD8l/TBHhUoubb2OMLoENlBLECLtFHV2X\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICVDCCAdqgAwIBAgIUY4sE3O7mKGtP/otJ0s4WQtwn4ZswCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI1MDkwNTA1NDQ0M1oXDTMwMDkwNDA1NDQ0M1owdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhf4d4GTrO4NhJ24aG5A3i4Qu\nmwGZ+Jsfo3siVVy1/vke9tN+ylkZlR5M2bl4O4y2eeUMGrzwSu84L/7crgqnnZsH\nXrOQslNsSYJzB+YrbeJ1GBG+oDnCxvYgLTvCDtDio0IwQDAdBgNVHQ4EFgQUlgaB\naNJ7MInS+yAYMKVbVr8pAt0wHwYDVR0jBBgwFoAUpXzUSS/yVomZP8e814EZVbC8\nFY0wCgYIKoZIzj0EAwMDaAAwZQIwHoKqUxUqI2Zw8omp82svEjmN477njoK9YtOU\nXtukW4+7RkU6VqSR6ND/9H83PMrLAjEAkPcCM/8QG3yZL1pxvKv87JwOIMJd5eUu\nQDT7gy1UxPCjOETC2ygJyjJdYxBbXQrr\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUeUyrqFAE0stc3jxOpGo12mTasB0wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI1MDkwNTA1NDIxNVoXDTM1MDkwMzA1NDIxNVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEDnCmBt1r87/4VTwChvkyyrbfL79z5cx0NrVN4Gmp6HvpndL95MCd\nArnSdslXL/WmupFbxzy+a6mP4jdmR3oC7KyEaCKftOAct+Pz/e1KVI+QA3arR3IK\nxW5TYzSQpoMdo1MwUTAdBgNVHQ4EFgQUpXzUSS/yVomZP8e814EZVbC8FY0wHwYD\nVR0jBBgwFoAUpXzUSS/yVomZP8e814EZVbC8FY0wDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjBLN5JiAwPChO4RWfAMy+XjUbllaTFTxRqwCRliwx0v\nf4aNNQ6Vrzv3pYXXmwl0CaoCMGFKKLm6EVwvQcILpSL3JpkfcKMfsUlJgdkVlF/W\nrPSb+wS9KsT0dcF2DU5F12BycQ==\n-----END CERTIFICATE-----\n","servtdIdentity":{"tdIdentity":{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbEvaluationNumber":1,"xfam":"E71A060000000000","attributes":"0000000000000000","mrConfigId":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwnerConfig":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrsigner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","isvProdId":1,"tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}]},"signature":"3064023028CAFFB4B83AD5A8E00A2FD7BDA58E176495E5591E1D9EB9FBC80FD0ABFDA06705B316AD2299BFCD07B82524336328A102306A11A93912045B2438FCD719F84F78D0CDB91CCFC9ED55FF49B47C518CC6071D0B5662E3AECAB78E786000C477A18773"},"servtdTcbMappingIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICVzCCAd6gAwIBAgIUVKXleE/7DfWQZ7seyT3TqMXwAqcwCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI1MDkwNTA1NTI1M1oXDTI2MDkwNTA1\nNTI1M1owYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL1rH/Pc4KUchfNLqm2z\nWc1FC7RfBI4xGUSU/hBnRDmEj5HKWdN2p7YIeUn+z0RiYXUxr5nHed+pvaD2CZ1b\ny2wymsVZQpWIwtf8shfePFJcQrHsYsmmvvwi5ocOXe6ZkaNCMEAwHQYDVR0OBBYE\nFHIbR1J8L+HjJNaHdXioZJ5r9zrSMB8GA1UdIwQYMBaAFJYGgWjSezCJ0vsgGDCl\nW1a/KQLdMAoGCCqGSM49BAMDA2cAMGQCMCshcjFfbTVDx6XJL+ERXKqfTJdhK1oH\ntMQ+m74KW6AfKZt0lqZ5eeFXc/RFW8pKpQIwHsObyRhFH6OaFqxw+oItj2qCRUlz\ncCnHD8l/TBHhUoubb2OMLoENlBLECLtFHV2X\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICVDCCAdqgAwIBAgIUY4sE3O7mKGtP/otJ0s4WQtwn4ZswCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI1MDkwNTA1NDQ0M1oXDTMwMDkwNDA1NDQ0M1owdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhf4d4GTrO4NhJ24aG5A3i4Qu\nmwGZ+Jsfo3siVVy1/vke9tN+ylkZlR5M2bl4O4y2eeUMGrzwSu84L/7crgqnnZsH\nXrOQslNsSYJzB+YrbeJ1GBG+oDnCxvYgLTvCDtDio0IwQDAdBgNVHQ4EFgQUlgaB\naNJ7MInS+yAYMKVbVr8pAt0wHwYDVR0jBBgwFoAUpXzUSS/yVomZP8e814EZVbC8\nFY0wCgYIKoZIzj0EAwMDaAAwZQIwHoKqUxUqI2Zw8omp82svEjmN477njoK9YtOU\nXtukW4+7RkU6VqSR6ND/9H83PMrLAjEAkPcCM/8QG3yZL1pxvKv87JwOIMJd5eUu\nQDT7gy1UxPCjOETC2ygJyjJdYxBbXQrr\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUeUyrqFAE0stc3jxOpGo12mTasB0wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI1MDkwNTA1NDIxNVoXDTM1MDkwMzA1NDIxNVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEDnCmBt1r87/4VTwChvkyyrbfL79z5cx0NrVN4Gmp6HvpndL95MCd\nArnSdslXL/WmupFbxzy+a6mP4jdmR3oC7KyEaCKftOAct+Pz/e1KVI+QA3arR3IK\nxW5TYzSQpoMdo1MwUTAdBgNVHQ4EFgQUpXzUSS/yVomZP8e814EZVbC8FY0wHwYD\nVR0jBBgwFoAUpXzUSS/yVomZP8e814EZVbC8FY0wDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjBLN5JiAwPChO4RWfAMy+XjUbllaTFTxRqwCRliwx0v\nf4aNNQ6Vrzv3pYXXmwl0CaoCMGFKKLm6EVwvQcILpSL3JpkfcKMfsUlJgdkVlF/W\nrPSb+wS9KsT0dcF2DU5F12BycQ==\n-----END CERTIFICATE-----\n","servtdTcbMapping":{"tdTcbMapping":{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","mrSigner":"00000000000000000000000000000000","isvProdId":1,"svnMappings":[{"tdMeasurements":{"mrtd":"E2C7DA7CF0D93973480F0A34A6FE52A204EA81B4F1B6CD16018F5B4CAEE7B3B544A9738464A7C95E1705E20687A0ADA6","rtmr0":"518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4","rtmr1":"518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4"},"isvsvn":1}]},"signature":"306602310096D8260507E3F02698895732273709837C0CBF42DA29AA0891A18F8F4FEC648826E1E0DFB5C590B953F65B5EFB77F0B8023100B18CC20F8EF7C1D4E1CBCAEFF17C0722AC6213A0B7E83FDD580CA760BBDA91D25E714CFA2240BCEBDF039646D749ED84"}}},"signature":"3066023100C0BCAF2F7E635F39497F14B322376D6097E3476FC0BC4C5DAD826C5C647F0A30C113BA4947B83E4CC94D079C45320C39023100A88DEEB488D00B8AAD1939CCB73EAF3E91E1C6BE9B515E33A375D3D1FB0C45A9A17241622D834C161A27D8C03BBB6CBF"} \ No newline at end of file +{"policyData":{"id":"E6643BDC-E50A-4315-9EF7-F217CE8AF9A6","version":"2.0","policySvn":1,"policy":[{"global":{"tcb":{"tcbEvaluationDataNumber":{"operation":"greater-or-equal","reference":5},"tcbDate":{"operation":"greater-or-equal","reference":"2022-11-09T00:00:00Z"},"tcbStatusAccepted":{"operation":"allow-list","reference":["UpToDate","ConfigurationNeeded"]}},"platform":{"fmspc":{"operation":"allow-list","reference":["00706A000000","00706E170000","00A068070000","20C06F000000","10A06E040000","40806F000000","10706A000000","10A067110000","20606A000000","10906EA50000","20906EA10000","10906EB10000","10806F000000","00706E070000","50A06D000000","10606A000000","10706A800000","10706A100000","B0806F000000","00706D050000","10806EB70000","10906ED10000","00A06F010000","00A06D070000","40806F200000","60806F000000","10A06E050000","40A06D000000","10606C040000","50A06F000000","00A06D000000","10806EA60000","00706D010000","10806F070000","20D06D010000","00706E270000","00A06F000000","10A06D050000","00C06F000000","30806F000000","20906EA50000","10706E370000","20806F070000","10906EC50000","10806F040000","10D06D000000","10906EA10000","20806F000000","10A067010000","30A06E000000","10A06F000000","70806F000000","10906EC10000","20A06D050000","00606A000000"]}},"crl":{"pckCrlNum":{"operation":"greater-or-equal","reference":1},"rootCaCrlNum":{"operation":"greater-or-equal","reference":1}}}}],"collaterals":{"majorVersion":1,"minorVersion":0,"teeType":129,"rootCa":"-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----","pckCrlIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICmjCCAkCgAwIBAgIUWSPTp0qoY1QuOXCt4A8HK1ckKrcwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTM0MTAzMTEyMzM0N1owcDEiMCAG\nA1UEAwwZSW50ZWwgU0dYIFBDSyBQbGF0Zm9ybSBDQTEaMBgGA1UECgwRSW50ZWwg\nQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEL\nMAkGA1UEBhMCVVMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQwp+Lc+TUBtg1H\n+U8JIsMsbjHjCkTtXb8jPM6r2dhu9zIblhDZ7INfqt3Ix8XcFKD8k0NEXrkZ66qJ\nXa1KzLIKo4G/MIG8MB8GA1UdIwQYMBaAFOnoRFJTNlxLGJoR/EMYLKXcIIBIMFYG\nA1UdHwRPME0wS6BJoEeGRWh0dHBzOi8vc2J4LWNlcnRpZmljYXRlcy50cnVzdGVk\nc2VydmljZXMuaW50ZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQU\nWSPTp0qoY1QuOXCt4A8HK1ckKrcwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQI\nMAYBAf8CAQAwCgYIKoZIzj0EAwIDSAAwRQIhAJ1q+FTz+gUuVfBQuCgJsFrL2TTS\ne1aBZ53O52TjFie6AiAriPaRahUX9Oa9kGLlAchWXKT6j4RWSR50BqhrN3UT4A==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","rootCaCrl":"-----BEGIN X509 CRL-----\nMIIBITCByAIBATAKBggqhkjOPQQDAjBoMRowGAYDVQQDDBFJbnRlbCBTR1ggUm9v\ndCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRh\nIENsYXJhMQswCQYDVQQIDAJDQTELMAkGA1UEBhMCVVMXDTI1MDkxNjExNTMxMloX\nDTI2MDkxNjExNTMxMlqgLzAtMAoGA1UdFAQDAgEBMB8GA1UdIwQYMBaAFOnoRFJT\nNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMCA0gAMEUCIQDv5KEBogNCzPgupOPj\nFIYJaOubypBPCGqnE0XcYTgFDwIgeSfXk71tIbV5lqp6gWCpN98/xu/8c7y36EV3\npkfootI=\n-----END X509 CRL-----","pckCrl":"-----BEGIN X509 CRL-----\nMIIBKTCB0AIBATAKBggqhkjOPQQDAjBwMSIwIAYDVQQDDBlJbnRlbCBTR1ggUENL\nIFBsYXRmb3JtIENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3JhdGlvbjEUMBIGA1UE\nBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQGEwJVUxcNMjYwNzAx\nMDk0NjIzWhcNMjYwNzMxMDk0NjIzWqAvMC0wCgYDVR0UBAMCAQEwHwYDVR0jBBgw\nFoAUWSPTp0qoY1QuOXCt4A8HK1ckKrcwCgYIKoZIzj0EAwIDSAAwRQIgcGtzcbJl\n2S3wCJYxAd7KNnRsztqrU+u2NaDupYb0lTgCIQCA6I7FwSIA0s2r9sVOz6dIqV1w\naBnaP08fyNmvo7VbCA==\n-----END X509 CRL-----","platforms":[{"fmspc":"20C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20C06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"3d0d3653b9341dc41c362f8f7cd38e9f4b829d057811ce6cafbcc77f167b6447522b4717b3d5c58a71648eec12af0b8e935edbb6cd773c4ceb7ad90e68cf001e\"}"},{"fmspc":"0400F1300000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1300000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"bcb9b79749670cca6342f83b2a5590595faf905d450ec175c7efdf9ff4dca6ad1dc3d10b8570ab0318a5bc3fd24c58a1729f09994b47bd0f82d49cfbb71ee3dd\"}"},{"fmspc":"10A06E040000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06E040000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"3bb24f39c796226e15a38616fe60e4c28d7ec28acb5d67e25b659555b29f404f472a7b0f9ee26fa065941ce915966f7c3759f52e27dc07bb1c2a29da08bb094d\"}"},{"fmspc":"40806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"40806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5320e541877e904a23caa7ee30c8ca7d794a72617b4c16cf6028746731fee7248f2583eda07683edcbd3e08e14e91d846cfafa7355866e10d6150bf8b47ae269\"}"},{"fmspc":"0400F1370000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1370000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"361c382377cc1515aa6f6f5d74a3b8ab02aca6eafb30f97322715f61fdfcfffa549c12f4e74e4769fd248483124cc2228c134577cf3bd199fbd3d03244a80610\"}"},{"fmspc":"0400F1100000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1100000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d33030e843729d88c8b9c5a4aae1185f6a0f43a2fc6bdbf7eff62ae0dc14411ae097b3a50ae6d411748950aa2c0953adbbb128d59bc337bede6792b0248a2a3b\"}"},{"fmspc":"10806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T09:46:20Z\",\"nextUpdate\":\"2026-07-31T09:46:20Z\",\"fmspc\":\"10806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":10,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":10,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2020-05-28T00:00:00Z\",\"tcbStatus\":\"OutOfDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":9,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2020-03-22T00:00:00Z\",\"tcbStatus\":\"OutOfDate\"}]},\"signature\":\"19a007d6ca2b8a300ce6ff7d34f93ef32a98462b6c1b003a8a230743be6c7ec80cfcb869dfb9be29c5e30d4d14817899d5249ddb1d146f04b623f87010837657\"}"},{"fmspc":"50A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"50A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"28e87299fb0ed2b63890a895f6b8fe86abcf087c7023f79cb93aaa3ceb8fdefd694ec5bcaed2fb00e83e9696557ff70b1649107de1269f477723db74cd815653\"}"},{"fmspc":"B0806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"B0806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"da0312fbe582e1d32136ddd517abf928c2c9ccdcb686d3306a6c4401a96190d6fdd753da816ffaa27d7b536298713f48de3f45d1a7a8e364d3ea75159452614c\"}"},{"fmspc":"00A06F010000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06F010000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"a1309265fe850a27482fc8cdb2854cab6ff10f5ca4099af209a676a062b4b45943155227d431d4058c47c70be382dc43defde577b980412653b59ec4e298a23b\"}"},{"fmspc":"00A06D070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06D070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"98641e3b215e1134191c0637028cd6031ab109354d8c68083769bd63757418d83c2837f396ecad4f7e1e13176b0b2367e46cd1045dc6032df731c7edebe124e2\"}"},{"fmspc":"60806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"60806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"85ecac3694bcca3320c5ce5cdbc67bbec0d85ae9642561a13e47e6dafb1bec844c9b023760b33ea981bec268d814aa039e27063674b41671e079f39bb3509cfd\"}"},{"fmspc":"10A06E050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06E050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"0a8a99b3c165ef65b54c2e313764342850bfd1c31aa201f2cfdb93399a115ae3f20faabbf53f1bb66565c58763eb300c852a0fa796aa065b64b79138585f5682\"}"},{"fmspc":"40A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"40A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"f049caf6905eebfbba2a1eccc7e96268a4c4f3d7d8a31ca340f260ea2035ec596cf5fe7bef4e86f42ecd2014b6a10feace6e622df152ce6faf74eafb54329dee\"}"},{"fmspc":"0400F1000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":0,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"589d8a6a5a60f3e12b303f6bd0ab9b3e70ad77500216936a5245c734443c6ea847a682b28324aa99e705f974446a66bad79fab7ee0291d62650db0c7681bd61b\"}"},{"fmspc":"50A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"50A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"8ef380408be7b4d51e2e19c03cecd5685467d0203719efeeac19c44d79b2b4358695345ec7adfb3abb71698001ddeb0de24adba24cc82ede59c4c828b3c52f59\"}"},{"fmspc":"00A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"126fd0874cbcee488f4fa793f0ca020f41a5f44965622b6e7768f9b4e677e7920105bbf3c3735e3ed7c6ad3f4e501534ee8e6c29df6a0c4367287d3d5176c72f\"}"},{"fmspc":"0400F1070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"b35cffb8b5af48c3026ee5ae3ad56bb1b45ef872ca2ec744a562073ffb57940cff890454f385ef57a39a5941fd4aa6049ce502be027ef5cf1b33f12bb4af9fd0\"}"},{"fmspc":"10806F070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10806F070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"9ed0865391001855b2e35740fdeb3978b284364201d1d568cc8c85bd640e707767c73cad516c00e2b29a2e81963fe5560c93ef20f391e936b33db74c1aa5b26c\"}"},{"fmspc":"20D06D010000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20D06D010000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5214de9edac3522fe9a68abba903fc88c59c37651c8f4bf2b79bebf2381fc32907dc9790ed883d15a948b7ba91f4ad8fe1712c56390d8398ac0641a55eb80f21\"}"},{"fmspc":"00A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"ac626a284a933532e9ad33ce2c2dbc24ad7e79dbef9a33dc8697fed09e2c46e5a8f508d057dc619d801eded0536502fb9be503a626cc5cbb2b02dd3da1f0b921\"}"},{"fmspc":"10A06D050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06D050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":0,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5ab60c67e4c6477c8767bf2b615cf985211e1ee3a3ecb06cd045b2907f5e120cd3f2dad24c2143d887e0596b8ffdb477e0edf417509a871f932e06debceff864\"}"},{"fmspc":"00C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00C06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"f787aeb769a57e7aa4e8cd64ba199b71966d6ffb441b9a5de66bcbc4e93b65f049da696bdefad506e3ece86249a4688b12f077bb559f1cace27899a5a4541f2c\"}"},{"fmspc":"30806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"30806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"c7bfb3a1d338bb64803c232efff231a25871dd14b06ecd4d119adc6998b0c90bd8d3f109af79f40d4cb24c2e939c596c2ab0896b289569b8d3dadc920900a98a\"}"},{"fmspc":"0400F1200000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1200000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"8c8c10f373ab61fa882f2f10f3885cea3b4ad34cfcbef833be573cbf631e7e84c31ad26ec05ee640fd91aa0ef0433e53c4d0fbc82c14cf055aabd698a96da216\"}"},{"fmspc":"20806F070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20806F070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d6154c177ad2e3f782dba2df4bf13e2fe2f6a07e20ae09d63cd4e1c3a7caca1afdecbc2c6959619e810926f6d6df4fe5b6d62e7a3f3abfc0bc440e768084298d\"}"},{"fmspc":"10806F040000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10806F040000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"c04cb69c8a57965018da713e624baa6c11f290f762b1b73cf01f90087334ba8d6c33e10fb3ca766b7dd99d87387b8b4241f25f3e91328c160c193deb70ec0bdb\"}"},{"fmspc":"10D06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10D06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"29ec7d93a60c101cd878f061467e933088dd0f393d8cbfd26ecba14cdf22c839b89b9fca57440105770449c022b3f7c1c514b294a46e504718b81deda3620d76\"}"},{"fmspc":"20806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"89ccc75f7e47334690d6ac8ba90d0ea84850d837ce51698dfe7b4b778476afd09fcd3119e3bc93e660b195e7db805d69cf8ed4ce1705eed3beaca4de8027ec8d\"}"},{"fmspc":"30A06E000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"30A06E000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d5550e6e74aed8bd2806e47cbdc99ed75b833401896a662727b5ff62e205e118e17afc952158d54b132719eebe45a5dde9e8c501dcba827320f76f1053460f8b\"}"},{"fmspc":"10A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"7ce7382154fbea591d0851952f283b16edf79ce56cba3757dd2297cfd0296c6bc3408eaa416ae14d13936f7662ba42741f4e718888dc0ad9f2630fde233810fa\"}"},{"fmspc":"20A06D050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20A06D050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"4fceb18caf6eb5ba2ca7138d55d24a6b8d81f99147383bcb5dec755572bf5a24d496fdcdbda75ce076682703685fdac3c9b0f0f53059ab2a3d8d0a8cba9631eb\"}"}],"qeIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","qeIdentity":"{\"enclaveIdentity\":{\"id\":\"TD_QE\",\"version\":2,\"issueDate\":\"2026-07-01T10:33:44Z\",\"nextUpdate\":\"2026-07-31T10:33:44Z\",\"tcbEvaluationDataNumber\":5,\"miscselect\":\"00000000\",\"miscselectMask\":\"FFFFFFFF\",\"attributes\":\"11000000000000000000000000000000\",\"attributesMask\":\"FBFFFFFFFFFFFFFF0000000000000000\",\"mrsigner\":\"DC9E2A7C6F948F17474E34A7FC43ED030F7C1563F1BABDDF6340C82E0E54A8C5\",\"isvprodid\":2,\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"bccb9464275b040819102bd2357fb77e2f1936f218c4d06afebe55b97d7bf416c7d70839897df145c94c6cc65a090c274f94df9b158c245fd37c344272527703\"}"},"servtdCollateral":{"majorVersion":1,"minorVersion":0,"servtdTcbMapping":{"tdTcbMapping":{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","svnMappings":[{"tdMeasurements":{"tdinfo_hash":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"},"isvsvn":1}]},"signature":"306502302DF213408E43734941EE22050FB1566E9C3AB600D0C0ADE9EDD99A0C91E2D2E44DD54C6B6658C5C2277BD63EF6EE33B702310092B91C8CDED39E93D0E67B02813388445116123AA2298E956559917FE817B8143CA12A9352DA7CCEC2F6D1F58E025F92"},"servtdTcbMappingIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICfzCCAgWgAwIBAgIUb4Ary1FxNDv2tgK5KjW92D71wx8wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcyMTAyMjIzMVoXDTI3MDcyMTAy\nMjIzMVowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL+t1XLepbWKHwd7iVJl\nUy3P5ZC/XmlelGaGAVHtzT+uyqf95dCdppfmATm5iL6mPCMi/B0EdUVWC8IsRrAb\ntIVKOT+6uQvaqjgBDy8/jpULNFU2amH+tFXaK+3mI3FoXaNpMGcwDgYDVR0PAQH/\nBAQDAgeAMBUGA1UdJQQOMAwGCisGAQQBgf1ZAQEwHQYDVR0OBBYEFAQ3bgBAZVtA\nxB6bSKABbGXJzUg9MB8GA1UdIwQYMBaAFKrpv7T3Goq7ozzv7XybB7KDXfwqMAoG\nCCqGSM49BAMDA2gAMGUCMAC9OBINzzySAY9e6iqUSdueZuL6hNbS7FJjzd4AhLBt\naFDNptrDJzq8QG7TqgDZVAIxAOH/CNjzoJ4Vy/9Wc1gYQvFp/Y8OyIchE+LooQim\n3TOl4G9HofEZt+KxtJ2RtWDESw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUDNYWZVBywkKMCpLBMn/ZrbpVAngwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTMxMDcyMDAyMjIzMVowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhtbR7QbD7v9wmJHiLUdRE9SX\nOeGsIpHD2yVPsKeYthmXkK9URtDY4DoeUIxjTPOvJPuH+oGBxuJoQB1DlHNud1e4\nARK1un5WLqJQAM7YH4MDk4e8IgzildxR68Wf5S4Mo2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUqum/tPcairujPO/tfJsHsoNd\n/CowHwYDVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwCgYIKoZIzj0EAwMD\naAAwZQIwTq/MJUn2EN0Ky18A4BLrKyJvrpozm2JLzPZeMJC7JS8hLCXOtpTF1V9l\ngSKpqbi9AjEAuMTlfVDUvFQGMR6cAOKScwHOJnUMB5eyyIg7AYlY5WcjwLNaV//d\nzw3fC7CR1QR/\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTmEV7kebAA5XSFYNCudbbU/Co8wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTM2MDcxODAyMjIzMVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEKVtiVC3icjTPZ6yEwO46wmbk38a9N5GZEkTnjXypSwTsC/GfXLA4\ne4wvvwZ/1+sGrogN5DBX/auAFeicLw0CMFNiSocyqalh+LNjYB0vkBLqC5+PQoCa\navI9zsLmyJjUo1MwUTAdBgNVHQ4EFgQULZkd6aI5/Xdm7qbmkrf4JOIgdtEwHwYD\nVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjAGWyxXJ4x3oWj1xDkLpcsYCBas0SNIGhXHPQmMbVqM\nmtcDX//3RwD26+yBeZguCIYCMHgCQotN2FZ9PHwcmkA5tQkusL4Ab55d9JfvkjZ7\nHFibzfq7pmApshWt7mQ80fRu/Q==\n-----END CERTIFICATE-----\n","servtdIdentity":{"tdIdentity":{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}]},"signature":"3066023100A3895AA95723C3DD3975C55480676494940833B0F9D83F8E7DD8F011DEF212B3326EE32FFA1BDF3C41941FF4D4FD86E6023100A5A52A633A85C39D9FE64516256763ADC84E2D548655935508053FD61AA03DB8CDA1FD5116E5A38CD08DAA2C44FFB42C"},"servtdIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICfzCCAgWgAwIBAgIUb4Ary1FxNDv2tgK5KjW92D71wx8wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcyMTAyMjIzMVoXDTI3MDcyMTAy\nMjIzMVowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL+t1XLepbWKHwd7iVJl\nUy3P5ZC/XmlelGaGAVHtzT+uyqf95dCdppfmATm5iL6mPCMi/B0EdUVWC8IsRrAb\ntIVKOT+6uQvaqjgBDy8/jpULNFU2amH+tFXaK+3mI3FoXaNpMGcwDgYDVR0PAQH/\nBAQDAgeAMBUGA1UdJQQOMAwGCisGAQQBgf1ZAQEwHQYDVR0OBBYEFAQ3bgBAZVtA\nxB6bSKABbGXJzUg9MB8GA1UdIwQYMBaAFKrpv7T3Goq7ozzv7XybB7KDXfwqMAoG\nCCqGSM49BAMDA2gAMGUCMAC9OBINzzySAY9e6iqUSdueZuL6hNbS7FJjzd4AhLBt\naFDNptrDJzq8QG7TqgDZVAIxAOH/CNjzoJ4Vy/9Wc1gYQvFp/Y8OyIchE+LooQim\n3TOl4G9HofEZt+KxtJ2RtWDESw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUDNYWZVBywkKMCpLBMn/ZrbpVAngwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTMxMDcyMDAyMjIzMVowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhtbR7QbD7v9wmJHiLUdRE9SX\nOeGsIpHD2yVPsKeYthmXkK9URtDY4DoeUIxjTPOvJPuH+oGBxuJoQB1DlHNud1e4\nARK1un5WLqJQAM7YH4MDk4e8IgzildxR68Wf5S4Mo2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUqum/tPcairujPO/tfJsHsoNd\n/CowHwYDVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwCgYIKoZIzj0EAwMD\naAAwZQIwTq/MJUn2EN0Ky18A4BLrKyJvrpozm2JLzPZeMJC7JS8hLCXOtpTF1V9l\ngSKpqbi9AjEAuMTlfVDUvFQGMR6cAOKScwHOJnUMB5eyyIg7AYlY5WcjwLNaV//d\nzw3fC7CR1QR/\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTmEV7kebAA5XSFYNCudbbU/Co8wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTM2MDcxODAyMjIzMVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEKVtiVC3icjTPZ6yEwO46wmbk38a9N5GZEkTnjXypSwTsC/GfXLA4\ne4wvvwZ/1+sGrogN5DBX/auAFeicLw0CMFNiSocyqalh+LNjYB0vkBLqC5+PQoCa\navI9zsLmyJjUo1MwUTAdBgNVHQ4EFgQULZkd6aI5/Xdm7qbmkrf4JOIgdtEwHwYD\nVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjAGWyxXJ4x3oWj1xDkLpcsYCBas0SNIGhXHPQmMbVqM\nmtcDX//3RwD26+yBeZguCIYCMHgCQotN2FZ9PHwcmkA5tQkusL4Ab55d9JfvkjZ7\nHFibzfq7pmApshWt7mQ80fRu/Q==\n-----END CERTIFICATE-----\n"}},"signature":"3065023100C621FF5BCB1C20AC294F2AE46BE90549D8C5CFB7FF1C156D9A58C7EFB4A525B88F4F1909769ECC906A7A7AA01BFDD0F5023034AD6F84B41DC0CD63D2603D3F7FA8FB8D5E17FD30D400C1D48AEAF9C688BD8C6E8AC64D833DF12DC910250A23601CA8"} \ No newline at end of file diff --git a/src/policy/test/policy_v2/policy_v2_svn_only.json b/src/policy/test/policy_v2/policy_v2_svn_only.json new file mode 100644 index 000000000..d5af6c947 --- /dev/null +++ b/src/policy/test/policy_v2/policy_v2_svn_only.json @@ -0,0 +1 @@ +{"policyData":{"id":"E6643BDC-E50A-4315-9EF7-F217CE8AF9A6","version":"2.0","policySvn":1,"policy":[{"global":{"tcb":{"tcbEvaluationDataNumber":{"operation":"greater-or-equal","reference":5},"tcbDate":{"operation":"greater-or-equal","reference":"2022-11-09T00:00:00Z"},"tcbStatusAccepted":{"operation":"allow-list","reference":["UpToDate","ConfigurationNeeded"]}},"platform":{"fmspc":{"operation":"allow-list","reference":["00706A000000","00706E170000","00A068070000","20C06F000000","10A06E040000","40806F000000","10706A000000","10A067110000","20606A000000","10906EA50000","20906EA10000","10906EB10000","10806F000000","00706E070000","50A06D000000","10606A000000","10706A800000","10706A100000","B0806F000000","00706D050000","10806EB70000","10906ED10000","00A06F010000","00A06D070000","40806F200000","60806F000000","10A06E050000","40A06D000000","10606C040000","50A06F000000","00A06D000000","10806EA60000","00706D010000","10806F070000","20D06D010000","00706E270000","00A06F000000","10A06D050000","00C06F000000","30806F000000","20906EA50000","10706E370000","20806F070000","10906EC50000","10806F040000","10D06D000000","10906EA10000","20806F000000","10A067010000","30A06E000000","10A06F000000","70806F000000","10906EC10000","20A06D050000","00606A000000"]}},"crl":{"pckCrlNum":{"operation":"greater-or-equal","reference":1},"rootCaCrlNum":{"operation":"greater-or-equal","reference":1}}}}],"collaterals":{"majorVersion":1,"minorVersion":0,"teeType":129,"rootCa":"-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----","pckCrlIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICmjCCAkCgAwIBAgIUWSPTp0qoY1QuOXCt4A8HK1ckKrcwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTM0MTAzMTEyMzM0N1owcDEiMCAG\nA1UEAwwZSW50ZWwgU0dYIFBDSyBQbGF0Zm9ybSBDQTEaMBgGA1UECgwRSW50ZWwg\nQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEL\nMAkGA1UEBhMCVVMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQwp+Lc+TUBtg1H\n+U8JIsMsbjHjCkTtXb8jPM6r2dhu9zIblhDZ7INfqt3Ix8XcFKD8k0NEXrkZ66qJ\nXa1KzLIKo4G/MIG8MB8GA1UdIwQYMBaAFOnoRFJTNlxLGJoR/EMYLKXcIIBIMFYG\nA1UdHwRPME0wS6BJoEeGRWh0dHBzOi8vc2J4LWNlcnRpZmljYXRlcy50cnVzdGVk\nc2VydmljZXMuaW50ZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQU\nWSPTp0qoY1QuOXCt4A8HK1ckKrcwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQI\nMAYBAf8CAQAwCgYIKoZIzj0EAwIDSAAwRQIhAJ1q+FTz+gUuVfBQuCgJsFrL2TTS\ne1aBZ53O52TjFie6AiAriPaRahUX9Oa9kGLlAchWXKT6j4RWSR50BqhrN3UT4A==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","rootCaCrl":"-----BEGIN X509 CRL-----\nMIIBITCByAIBATAKBggqhkjOPQQDAjBoMRowGAYDVQQDDBFJbnRlbCBTR1ggUm9v\ndCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRh\nIENsYXJhMQswCQYDVQQIDAJDQTELMAkGA1UEBhMCVVMXDTI1MDkxNjExNTMxMloX\nDTI2MDkxNjExNTMxMlqgLzAtMAoGA1UdFAQDAgEBMB8GA1UdIwQYMBaAFOnoRFJT\nNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMCA0gAMEUCIQDv5KEBogNCzPgupOPj\nFIYJaOubypBPCGqnE0XcYTgFDwIgeSfXk71tIbV5lqp6gWCpN98/xu/8c7y36EV3\npkfootI=\n-----END X509 CRL-----","pckCrl":"-----BEGIN X509 CRL-----\nMIIBKTCB0AIBATAKBggqhkjOPQQDAjBwMSIwIAYDVQQDDBlJbnRlbCBTR1ggUENL\nIFBsYXRmb3JtIENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3JhdGlvbjEUMBIGA1UE\nBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQGEwJVUxcNMjYwNzAx\nMDk0NjIzWhcNMjYwNzMxMDk0NjIzWqAvMC0wCgYDVR0UBAMCAQEwHwYDVR0jBBgw\nFoAUWSPTp0qoY1QuOXCt4A8HK1ckKrcwCgYIKoZIzj0EAwIDSAAwRQIgcGtzcbJl\n2S3wCJYxAd7KNnRsztqrU+u2NaDupYb0lTgCIQCA6I7FwSIA0s2r9sVOz6dIqV1w\naBnaP08fyNmvo7VbCA==\n-----END X509 CRL-----","platforms":[{"fmspc":"20C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20C06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"3d0d3653b9341dc41c362f8f7cd38e9f4b829d057811ce6cafbcc77f167b6447522b4717b3d5c58a71648eec12af0b8e935edbb6cd773c4ceb7ad90e68cf001e\"}"},{"fmspc":"0400F1300000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1300000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"bcb9b79749670cca6342f83b2a5590595faf905d450ec175c7efdf9ff4dca6ad1dc3d10b8570ab0318a5bc3fd24c58a1729f09994b47bd0f82d49cfbb71ee3dd\"}"},{"fmspc":"10A06E040000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06E040000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"3bb24f39c796226e15a38616fe60e4c28d7ec28acb5d67e25b659555b29f404f472a7b0f9ee26fa065941ce915966f7c3759f52e27dc07bb1c2a29da08bb094d\"}"},{"fmspc":"40806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"40806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5320e541877e904a23caa7ee30c8ca7d794a72617b4c16cf6028746731fee7248f2583eda07683edcbd3e08e14e91d846cfafa7355866e10d6150bf8b47ae269\"}"},{"fmspc":"0400F1370000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1370000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"361c382377cc1515aa6f6f5d74a3b8ab02aca6eafb30f97322715f61fdfcfffa549c12f4e74e4769fd248483124cc2228c134577cf3bd199fbd3d03244a80610\"}"},{"fmspc":"0400F1100000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1100000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d33030e843729d88c8b9c5a4aae1185f6a0f43a2fc6bdbf7eff62ae0dc14411ae097b3a50ae6d411748950aa2c0953adbbb128d59bc337bede6792b0248a2a3b\"}"},{"fmspc":"10806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T09:46:20Z\",\"nextUpdate\":\"2026-07-31T09:46:20Z\",\"fmspc\":\"10806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":10,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":10,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2020-05-28T00:00:00Z\",\"tcbStatus\":\"OutOfDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":9,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2020-03-22T00:00:00Z\",\"tcbStatus\":\"OutOfDate\"}]},\"signature\":\"19a007d6ca2b8a300ce6ff7d34f93ef32a98462b6c1b003a8a230743be6c7ec80cfcb869dfb9be29c5e30d4d14817899d5249ddb1d146f04b623f87010837657\"}"},{"fmspc":"50A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"50A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"28e87299fb0ed2b63890a895f6b8fe86abcf087c7023f79cb93aaa3ceb8fdefd694ec5bcaed2fb00e83e9696557ff70b1649107de1269f477723db74cd815653\"}"},{"fmspc":"B0806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"B0806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"da0312fbe582e1d32136ddd517abf928c2c9ccdcb686d3306a6c4401a96190d6fdd753da816ffaa27d7b536298713f48de3f45d1a7a8e364d3ea75159452614c\"}"},{"fmspc":"00A06F010000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06F010000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"a1309265fe850a27482fc8cdb2854cab6ff10f5ca4099af209a676a062b4b45943155227d431d4058c47c70be382dc43defde577b980412653b59ec4e298a23b\"}"},{"fmspc":"00A06D070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06D070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"98641e3b215e1134191c0637028cd6031ab109354d8c68083769bd63757418d83c2837f396ecad4f7e1e13176b0b2367e46cd1045dc6032df731c7edebe124e2\"}"},{"fmspc":"60806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"60806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"85ecac3694bcca3320c5ce5cdbc67bbec0d85ae9642561a13e47e6dafb1bec844c9b023760b33ea981bec268d814aa039e27063674b41671e079f39bb3509cfd\"}"},{"fmspc":"10A06E050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06E050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"0a8a99b3c165ef65b54c2e313764342850bfd1c31aa201f2cfdb93399a115ae3f20faabbf53f1bb66565c58763eb300c852a0fa796aa065b64b79138585f5682\"}"},{"fmspc":"40A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"40A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"f049caf6905eebfbba2a1eccc7e96268a4c4f3d7d8a31ca340f260ea2035ec596cf5fe7bef4e86f42ecd2014b6a10feace6e622df152ce6faf74eafb54329dee\"}"},{"fmspc":"0400F1000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":0,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"589d8a6a5a60f3e12b303f6bd0ab9b3e70ad77500216936a5245c734443c6ea847a682b28324aa99e705f974446a66bad79fab7ee0291d62650db0c7681bd61b\"}"},{"fmspc":"50A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"50A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"8ef380408be7b4d51e2e19c03cecd5685467d0203719efeeac19c44d79b2b4358695345ec7adfb3abb71698001ddeb0de24adba24cc82ede59c4c828b3c52f59\"}"},{"fmspc":"00A06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"126fd0874cbcee488f4fa793f0ca020f41a5f44965622b6e7768f9b4e677e7920105bbf3c3735e3ed7c6ad3f4e501534ee8e6c29df6a0c4367287d3d5176c72f\"}"},{"fmspc":"0400F1070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"b35cffb8b5af48c3026ee5ae3ad56bb1b45ef872ca2ec744a562073ffb57940cff890454f385ef57a39a5941fd4aa6049ce502be027ef5cf1b33f12bb4af9fd0\"}"},{"fmspc":"10806F070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10806F070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"9ed0865391001855b2e35740fdeb3978b284364201d1d568cc8c85bd640e707767c73cad516c00e2b29a2e81963fe5560c93ef20f391e936b33db74c1aa5b26c\"}"},{"fmspc":"20D06D010000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20D06D010000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5214de9edac3522fe9a68abba903fc88c59c37651c8f4bf2b79bebf2381fc32907dc9790ed883d15a948b7ba91f4ad8fe1712c56390d8398ac0641a55eb80f21\"}"},{"fmspc":"00A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"ac626a284a933532e9ad33ce2c2dbc24ad7e79dbef9a33dc8697fed09e2c46e5a8f508d057dc619d801eded0536502fb9be503a626cc5cbb2b02dd3da1f0b921\"}"},{"fmspc":"10A06D050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06D050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":0,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"5ab60c67e4c6477c8767bf2b615cf985211e1ee3a3ecb06cd045b2907f5e120cd3f2dad24c2143d887e0596b8ffdb477e0edf417509a871f932e06debceff864\"}"},{"fmspc":"00C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"00C06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"f787aeb769a57e7aa4e8cd64ba199b71966d6ffb441b9a5de66bcbc4e93b65f049da696bdefad506e3ece86249a4688b12f077bb559f1cace27899a5a4541f2c\"}"},{"fmspc":"30806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"30806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"c7bfb3a1d338bb64803c232efff231a25871dd14b06ecd4d119adc6998b0c90bd8d3f109af79f40d4cb24c2e939c596c2ab0896b289569b8d3dadc920900a98a\"}"},{"fmspc":"0400F1200000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"0400F1200000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"8c8c10f373ab61fa882f2f10f3885cea3b4ad34cfcbef833be573cbf631e7e84c31ad26ec05ee640fd91aa0ef0433e53c4d0fbc82c14cf055aabd698a96da216\"}"},{"fmspc":"20806F070000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20806F070000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d6154c177ad2e3f782dba2df4bf13e2fe2f6a07e20ae09d63cd4e1c3a7caca1afdecbc2c6959619e810926f6d6df4fe5b6d62e7a3f3abfc0bc440e768084298d\"}"},{"fmspc":"10806F040000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10806F040000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"c04cb69c8a57965018da713e624baa6c11f290f762b1b73cf01f90087334ba8d6c33e10fb3ca766b7dd99d87387b8b4241f25f3e91328c160c193deb70ec0bdb\"}"},{"fmspc":"10D06D000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10D06D000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"29ec7d93a60c101cd878f061467e933088dd0f393d8cbfd26ecba14cdf22c839b89b9fca57440105770449c022b3f7c1c514b294a46e504718b81deda3620d76\"}"},{"fmspc":"20806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20806F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"89ccc75f7e47334690d6ac8ba90d0ea84850d837ce51698dfe7b4b778476afd09fcd3119e3bc93e660b195e7db805d69cf8ed4ce1705eed3beaca4de8027ec8d\"}"},{"fmspc":"30A06E000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"30A06E000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"d5550e6e74aed8bd2806e47cbdc99ed75b833401896a662727b5ff62e205e118e17afc952158d54b132719eebe45a5dde9e8c501dcba827320f76f1053460f8b\"}"},{"fmspc":"10A06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"10A06F000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"7ce7382154fbea591d0851952f283b16edf79ce56cba3757dd2297cfd0296c6bc3408eaa416ae14d13936f7662ba42741f4e718888dc0ad9f2630fde233810fa\"}"},{"fmspc":"20A06D050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2026-07-01T10:00:45Z\",\"nextUpdate\":\"2026-07-31T10:00:45Z\",\"fmspc\":\"20A06D050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":5,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_02\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_05\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":1,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":0,\"tdxtcbcomponents\":[{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":1,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"4fceb18caf6eb5ba2ca7138d55d24a6b8d81f99147383bcb5dec755572bf5a24d496fdcdbda75ce076682703685fdac3c9b0f0f53059ab2a3d8d0a8cba9631eb\"}"}],"qeIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICkDCCAjagAwIBAgIUTh8n662T/sqPZK+7n3H67/KGwu0wCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE5MTAzMTEyMzM0N1oXDTI2MTAzMTEyMzM0N1owbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOnYw9LbN/JmyUttXa0M\niBEenjPbxbR4C8MuVYxDI+Le8lDBLp9X4wMzCAUF/fI/31giClXp/y0erLbLZjdV\n07+jgbkwgbYwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0f\nBE8wTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2\naWNlcy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBROHyfr\nrZP+yo9kr7ufcfrv8obC7TAOBgNVHQ8BAf8EBAMCBsAwDAYDVR0TAQH/BAIwADAK\nBggqhkjOPQQDAgNIADBFAiEA9xQeifK+2abQGnrAgk0hrOhdyvJQorh2cEMn4Gwr\n4hoCIFHW5qQ9G2wBJ4GMNQqv/oMfbPtzmyTlaWWzwxkqM0CT\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIClDCCAjmgAwIBAgIVAOnoRFJTNlxLGJoR/EMYLKXcIIBIMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xOTEwMzEwOTQ5MjFaFw00OTEyMzEyMzU5NTlaMGgxGjAY\nBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3Jh\ndGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYDVQQG\nEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE/6D/1WHNrWwPmNMIyBKMW5\nJ6JzMsjo6xP2vkK1cdZGb1PGRP/C/8ECgiDkmklmzwLzLi+000m7LLrtKJA3oC2j\ngb8wgbwwHwYDVR0jBBgwFoAU6ehEUlM2XEsYmhH8QxgspdwggEgwVgYDVR0fBE8w\nTTBLoEmgR4ZFaHR0cHM6Ly9zYngtY2VydGlmaWNhdGVzLnRydXN0ZWRzZXJ2aWNl\ncy5pbnRlbC5jb20vSW50ZWxTR1hSb290Q0EuZGVyMB0GA1UdDgQWBBTp6ERSUzZc\nSxiaEfxDGCyl3CCASDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB\nATAKBggqhkjOPQQDAgNJADBGAiEAzw9zdUiUHPMUd0C4mx41jlFZkrM3y5f1lgnV\nO7FbjOoCIQCoGtUmT4cXt7V+ySHbJ8Hob9AanpvXNH1ER+/gZF+opQ==\n-----END CERTIFICATE-----\n","qeIdentity":"{\"enclaveIdentity\":{\"id\":\"TD_QE\",\"version\":2,\"issueDate\":\"2026-07-01T10:33:44Z\",\"nextUpdate\":\"2026-07-31T10:33:44Z\",\"tcbEvaluationDataNumber\":5,\"miscselect\":\"00000000\",\"miscselectMask\":\"FFFFFFFF\",\"attributes\":\"11000000000000000000000000000000\",\"attributesMask\":\"FBFFFFFFFFFFFFFF0000000000000000\",\"mrsigner\":\"DC9E2A7C6F948F17474E34A7FC43ED030F7C1563F1BABDDF6340C82E0E54A8C5\",\"isvprodid\":2,\"tcbLevels\":[{\"tcb\":{\"isvsvn\":0},\"tcbDate\":\"2022-11-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"bccb9464275b040819102bd2357fb77e2f1936f218c4d06afebe55b97d7bf416c7d70839897df145c94c6cc65a090c274f94df9b158c245fd37c344272527703\"}"},"servtdCollateral":{"majorVersion":1,"minorVersion":0,"servtdTcbMapping":{"tdTcbMapping":{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","svnMappings":[{"tdMeasurements":{"tdinfo_hash":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"},"isvsvn":1}]},"signature":"306502302DF213408E43734941EE22050FB1566E9C3AB600D0C0ADE9EDD99A0C91E2D2E44DD54C6B6658C5C2277BD63EF6EE33B702310092B91C8CDED39E93D0E67B02813388445116123AA2298E956559917FE817B8143CA12A9352DA7CCEC2F6D1F58E025F92"},"servtdTcbMappingIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICfzCCAgWgAwIBAgIUb4Ary1FxNDv2tgK5KjW92D71wx8wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcyMTAyMjIzMVoXDTI3MDcyMTAy\nMjIzMVowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL+t1XLepbWKHwd7iVJl\nUy3P5ZC/XmlelGaGAVHtzT+uyqf95dCdppfmATm5iL6mPCMi/B0EdUVWC8IsRrAb\ntIVKOT+6uQvaqjgBDy8/jpULNFU2amH+tFXaK+3mI3FoXaNpMGcwDgYDVR0PAQH/\nBAQDAgeAMBUGA1UdJQQOMAwGCisGAQQBgf1ZAQEwHQYDVR0OBBYEFAQ3bgBAZVtA\nxB6bSKABbGXJzUg9MB8GA1UdIwQYMBaAFKrpv7T3Goq7ozzv7XybB7KDXfwqMAoG\nCCqGSM49BAMDA2gAMGUCMAC9OBINzzySAY9e6iqUSdueZuL6hNbS7FJjzd4AhLBt\naFDNptrDJzq8QG7TqgDZVAIxAOH/CNjzoJ4Vy/9Wc1gYQvFp/Y8OyIchE+LooQim\n3TOl4G9HofEZt+KxtJ2RtWDESw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUDNYWZVBywkKMCpLBMn/ZrbpVAngwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTMxMDcyMDAyMjIzMVowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhtbR7QbD7v9wmJHiLUdRE9SX\nOeGsIpHD2yVPsKeYthmXkK9URtDY4DoeUIxjTPOvJPuH+oGBxuJoQB1DlHNud1e4\nARK1un5WLqJQAM7YH4MDk4e8IgzildxR68Wf5S4Mo2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUqum/tPcairujPO/tfJsHsoNd\n/CowHwYDVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwCgYIKoZIzj0EAwMD\naAAwZQIwTq/MJUn2EN0Ky18A4BLrKyJvrpozm2JLzPZeMJC7JS8hLCXOtpTF1V9l\ngSKpqbi9AjEAuMTlfVDUvFQGMR6cAOKScwHOJnUMB5eyyIg7AYlY5WcjwLNaV//d\nzw3fC7CR1QR/\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTmEV7kebAA5XSFYNCudbbU/Co8wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTM2MDcxODAyMjIzMVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEKVtiVC3icjTPZ6yEwO46wmbk38a9N5GZEkTnjXypSwTsC/GfXLA4\ne4wvvwZ/1+sGrogN5DBX/auAFeicLw0CMFNiSocyqalh+LNjYB0vkBLqC5+PQoCa\navI9zsLmyJjUo1MwUTAdBgNVHQ4EFgQULZkd6aI5/Xdm7qbmkrf4JOIgdtEwHwYD\nVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjAGWyxXJ4x3oWj1xDkLpcsYCBas0SNIGhXHPQmMbVqM\nmtcDX//3RwD26+yBeZguCIYCMHgCQotN2FZ9PHwcmkA5tQkusL4Ab55d9JfvkjZ7\nHFibzfq7pmApshWt7mQ80fRu/Q==\n-----END CERTIFICATE-----\n"}},"signature":"3065023100C621FF5BCB1C20AC294F2AE46BE90549D8C5CFB7FF1C156D9A58C7EFB4A525B88F4F1909769ECC906A7A7AA01BFDD0F5023034AD6F84B41DC0CD63D2603D3F7FA8FB8D5E17FD30D400C1D48AEAF9C688BD8C6E8AC64D833DF12DC910250A23601CA8"} diff --git a/src/policy/test/policy_v2/revocation/policy_ok.json b/src/policy/test/policy_v2/revocation/policy_ok.json new file mode 100644 index 000000000..c5c6005e8 --- /dev/null +++ b/src/policy/test/policy_v2/revocation/policy_ok.json @@ -0,0 +1 @@ +{"policyData":{"id":"E6643BDC-E50A-4315-9EF7-F217CE8AF9A6","version":"2.0","policySvn":1,"policy":[{"global":{"tcb":{"tcbEvaluationDataNumber":{"operation":"greater-or-equal","reference":13},"tcbDate":{"operation":"greater-or-equal","reference":"2023-07-01T00:00:00Z"},"tcbStatusAccepted":{"operation":"allow-list","reference":["UpToDate","ConfigurationNeeded"]}},"platform":{"fmspc":{"operation":"allow-list","reference":["00706A000000","00706E170000","00A068070000","90C06F000000","20C06F000000","10A06E040000","40806F000000","10706A000000","10A067110000","20606A000000","10906EA50000","20906EA10000","10906EB10000","10806F000000","00706E070000","50A06D000000","10606A000000","10706A800000","10706A100000","B0806F000000","00706D050000","10806EB70000","10906ED10000","00A06F010000","00A06D070000","40806F200000","60806F000000","10A06E050000","40A06D000000","10606C040000","50A06F000000","00A06D000000","10806EA60000","00706D010000","10806F070000","20D06D010000","00706E270000","00A06F000000","10A06D050000","00C06F000000","30806F000000","20906EA50000","10706E370000","20806F070000","10906EC50000","10806F040000","10D06D000000","10906EA10000","20806F000000","10A067010000","30A06E000000","10A06F000000","70806F000000","10906EC10000","20A06D050000","00606A000000"]}}}}],"collaterals":{"majorVersion":1,"minorVersion":0,"teeType":129,"rootCa":"-----BEGIN CERTIFICATE-----\nMIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgG\nA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0\naW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYT\nAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEC6nEwMDIYZOj/iPWsCzaEKi7\n1OiOSLRFhWGjbnBVJfVnkY4u3IjkDYYL0MxO4mqsyYjlBalTVYxFP2sJBK5zlKOB\nuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBSBgNVHR8ESzBJ\nMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2VydmljZXMuaW50\nZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUImUM1lqdNInzg7SV\nUr9QGzknBqwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwCgYI\nKoZIzj0EAwIDSQAwRgIhAOW/5QkR+S9CiSDcNoowLuPRLsWGf/Yi7GSX94BgwTwg\nAiEA4J0lrHoMs+Xo5o/sX6O9QWxHRAvZUGOdRQ7cvqRXaqI=\n-----END CERTIFICATE-----","pckCrlIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICljCCAj2gAwIBAgIVAJVvXc29G+HpQEnJ1PQzzgFXC95UMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xODA1MjExMDUwMTBaFw0zMzA1MjExMDUwMTBaMHAxIjAg\nBgNVBAMMGUludGVsIFNHWCBQQ0sgUGxhdGZvcm0gQ0ExGjAYBgNVBAoMEUludGVs\nIENvcnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0Ex\nCzAJBgNVBAYTAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAENSB/7t21lXSO\n2Cuzpxw74eJB72EyDGgW5rXCtx2tVTLq6hKk6z+UiRZCnqR7psOvgqFeSxlmTlJl\neTmi2WYz3qOBuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBS\nBgNVHR8ESzBJMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2Vy\ndmljZXMuaW50ZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUlW9d\nzb0b4elAScnU9DPOAVcL3lQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYB\nAf8CAQAwCgYIKoZIzj0EAwIDRwAwRAIgXsVki0w+i6VYGW3UF/22uaXe0YJDj1Ue\nnA+TjD1ai5cCICYb1SAmD5xkfTVpvo4UoyiSYxrDWLmUR4CI9NKyfPN+\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgG\nA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0\naW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYT\nAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEC6nEwMDIYZOj/iPWsCzaEKi7\n1OiOSLRFhWGjbnBVJfVnkY4u3IjkDYYL0MxO4mqsyYjlBalTVYxFP2sJBK5zlKOB\nuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBSBgNVHR8ESzBJ\nMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2VydmljZXMuaW50\nZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUImUM1lqdNInzg7SV\nUr9QGzknBqwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwCgYI\nKoZIzj0EAwIDSQAwRgIhAOW/5QkR+S9CiSDcNoowLuPRLsWGf/Yi7GSX94BgwTwg\nAiEA4J0lrHoMs+Xo5o/sX6O9QWxHRAvZUGOdRQ7cvqRXaqI=\n-----END CERTIFICATE-----\n","rootCaCrl":"-----BEGIN X509 CRL-----\nMIIBIDCByAIBATAKBggqhkjOPQQDAjBoMRowGAYDVQQDDBFJbnRlbCBTR1ggUm9v\ndCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRh\nIENsYXJhMQswCQYDVQQIDAJDQTELMAkGA1UEBhMCVVMXDTI1MDMyMDExMjE1N1oX\nDTI2MDQwMzExMjE1N1qgLzAtMAoGA1UdFAQDAgEBMB8GA1UdIwQYMBaAFCJlDNZa\nnTSJ84O0lVK/UBs5JwasMAoGCCqGSM49BAMCA0cAMEQCIDDJ/OFDjaCpTk//3UbJ\nZQ45O+blp4YtTk5zUnky0ErzAiBlOe/j9zTD198g2d/EYw4cf/BDmg+OzhAfFbXq\n/5tPMw==\n-----END X509 CRL-----","pckCrl":"-----BEGIN X509 CRL-----\nMIIL1zCCC30CAQEwCgYIKoZIzj0EAwIwcDEiMCAGA1UEAwwZSW50ZWwgU0dYIFBD\nSyBQbGF0Zm9ybSBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9yYXRpb24xFDASBgNV\nBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTELMAkGA1UEBhMCVVMXDTI1MTEx\nMDIxNDcxOVoXDTI1MTIxMDIxNDcxOVowggqpMDMCFG/DTlAj5yiSNDXWGqS4PGGB\nZq01Fw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwNAIVAO+ubpcV/KE7h+Mz\n6CYe1tmQqSatFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwNAIVAP1ghkhi\nnLpzB4tNSS9LPqdBrQjNFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwNAIV\nAIr5JBhOHVr93XPD1joS9ei1c35WFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMK\nAQEwNAIVALEleXjPqczdB1mr+MXKcvrjp4qbFw0yNTExMTAyMTQ3MTlaMAwwCgYD\nVR0VBAMKAQEwMwIUdP6mFKlyvg4oQ/IFmDWBHthy+bMXDTI1MTExMDIxNDcxOVow\nDDAKBgNVHRUEAwoBATA0AhUA+cTvVrOrSNV34Qi67fS/iAFCFLkXDTI1MTExMDIx\nNDcxOVowDDAKBgNVHRUEAwoBATAzAhQHHeB3j55fxPKHjzDWsHyaMOazCxcNMjUx\nMTEwMjE0NzE5WjAMMAoGA1UdFQQDCgEBMDQCFQDN4kJPlyzqlP8jmTf02AwlAp3W\nCxcNMjUxMTEwMjE0NzE5WjAMMAoGA1UdFQQDCgEBMDMCFGwzGeUQm2RQfTzxEyzg\nA0nvUnMZFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwNAIVAN8I11a2anSX\n9DtbtYraBNP096k3Fw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwMwIUKK9I\nW2z2fkCaOdXLWu5FmPeo+nsXDTI1MTExMDIxNDcxOVowDDAKBgNVHRUEAwoBATA0\nAhUA+4strsCSytqKqbxP8vHCDQNGZowXDTI1MTExMDIxNDcxOVowDDAKBgNVHRUE\nAwoBATA0AhUAzUhQrFK9zGmmpvBYyLxXu9C1+GQXDTI1MTExMDIxNDcxOVowDDAK\nBgNVHRUEAwoBATA0AhUAmU3TZm9SdfuAX5XdAr1QyyZ52K0XDTI1MTExMDIxNDcx\nOVowDDAKBgNVHRUEAwoBATAzAhQHAhNpACUidNkDXu31RXRi+tDvTBcNMjUxMTEw\nMjE0NzE5WjAMMAoGA1UdFQQDCgEBMDMCFGHyv3Pjm04EqifYAb1z0kMZtb+AFw0y\nNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwMwIUOZK+hRuWkC7/OJWebC7/GwZR\npLUXDTI1MTExMDIxNDcxOVowDDAKBgNVHRUEAwoBATAzAhQP2kOgC2jqebfC3q6s\nC0mL37KvkBcNMjUxMTEwMjE0NzE5WjAMMAoGA1UdFQQDCgEBMDMCFGOfE5pQQP3P\n8ZHopPsb8IbtYDlxFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwNAIVAJWd\nUz+SSdweUTVEzcgwvxm38fMBFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEw\nMwIUeuN3SKn5EvTGO6erB8WTzh0dEYEXDTI1MTExMDIxNDcxOVowDDAKBgNVHRUE\nAwoBATAzAhQTiEszJpk4wZWqFw/KddoXdTjfCxcNMjUxMTEwMjE0NzE5WjAMMAoG\nA1UdFQQDCgEBMDQCFQCF08k4G3en4E0RnJ5a1nSf8/+rhxcNMjUxMTEwMjE0NzE5\nWjAMMAoGA1UdFQQDCgEBMDQCFQCTiHykQR56kjvR/tKBmylJ8gG1tBcNMjUxMTEw\nMjE0NzE5WjAMMAoGA1UdFQQDCgEBMDMCFCSY3GKDkwmW/YvyOjesviajvtRXFw0y\nNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwNAIVAIpm8adJSIZnaJzDkDrFTGYr\ncS5zFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwNAIVAK/BNhC902y3mF0Q\nZIGogNOgH9oHFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwNAIVAO/gSywz\n0DaqyWymc78emke2TVy7Fw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwNAIV\nAIPZrI2LtQnRxsgJrXEuhDBVntfzFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMK\nAQEwMwIUeTH9ULUHHBu/xbe23ti0W52LhSkXDTI1MTExMDIxNDcxOVowDDAKBgNV\nHRUEAwoBATAzAhQfog4pcL3l1X97jd+DOUhOHx0IIxcNMjUxMTEwMjE0NzE5WjAM\nMAoGA1UdFQQDCgEBMDMCFB6HssOzLY0j5BHO80GXuVrwyK31Fw0yNTExMTAyMTQ3\nMTlaMAwwCgYDVR0VBAMKAQEwNAIVAJr9LukKRzVQoWfZlpEUN8dQLR8JFw0yNTEx\nMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwMwIURIGw8RcooTtpbT6px3CgsV7FjdoX\nDTI1MTExMDIxNDcxOVowDDAKBgNVHRUEAwoBATA0AhUAp4WfV5gu8OZ9N7yO8u9a\nyDX/GqkXDTI1MTExMDIxNDcxOVowDDAKBgNVHRUEAwoBATA0AhUAnWd1O4HkcJCu\np2P77ExFSbzbmTMXDTI1MTExMDIxNDcxOVowDDAKBgNVHRUEAwoBATAzAhQ0v7t6\nHZxWgUfhGLYU97du0+9o3xcNMjUxMTEwMjE0NzE5WjAMMAoGA1UdFQQDCgEBMDMC\nFCw8xv6SedsVFtXOOfKomM2loXXhFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMK\nAQEwMwIUcXlIaHUJI0vpeeS33ObzG+9ktowXDTI1MTExMDIxNDcxOVowDDAKBgNV\nHRUEAwoBATA0AhUAnXbvLDnBNuhli25zlrHXRFonYx8XDTI1MTExMDIxNDcxOVow\nDDAKBgNVHRUEAwoBATA0AhUAw+Al/KmV829ZtIRnk54+NOY2Gm8XDTI1MTExMDIx\nNDcxOVowDDAKBgNVHRUEAwoBATA0AhUAjF9rMlfaBbF0KeLmG6ll1nMwYGoXDTI1\nMTExMDIxNDcxOVowDDAKBgNVHRUEAwoBATA0AhUAoXxRci7B4MMnj+i98FIFnL7E\n5kgXDTI1MTExMDIxNDcxOVowDDAKBgNVHRUEAwoBATAzAhQ0uk/Xa95TCSEM8d0f\n+0lMY4qRVxcNMjUxMTEwMjE0NzE5WjAMMAoGA1UdFQQDCgEBMDMCFAQ+BJGdquE0\nQySDlQlNKi6s/Hb+Fw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwMwIUR/xX\nfS0JTL3ycHFe1oSKk4Va00sXDTI1MTExMDIxNDcxOVowDDAKBgNVHRUEAwoBATAz\nAhR9YqL15vOG5GllP///BF0KgXjo5xcNMjUxMTEwMjE0NzE5WjAMMAoGA1UdFQQD\nCgEBMDQCFQDE7UX+Amu2pH6uw16oC370B84GLBcNMjUxMTEwMjE0NzE5WjAMMAoG\nA1UdFQQDCgEBMDQCFQDPmDEHejyk8aLFaGe/VbGOzL7/2BcNMjUxMTEwMjE0NzE5\nWjAMMAoGA1UdFQQDCgEBMDMCFGwrgdfqLkNnIM4p8dCxzLeiGGAPFw0yNTExMTAy\nMTQ3MTlaMAwwCgYDVR0VBAMKAQGgLzAtMAoGA1UdFAQDAgEBMB8GA1UdIwQYMBaA\nFJVvXc29G+HpQEnJ1PQzzgFXC95UMAoGCCqGSM49BAMCA0gAMEUCIQD0RW5z1XhH\nshEHUDoCwV+E/oPU2KkJov8crzIwjwIamAIgfwPSEiTXLS3fKAohav2sv9FoOK+l\nZC1WF9Afo6UM11c=\n-----END X509 CRL-----","platforms":[{"fmspc":"50806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICjTCCAjKgAwIBAgIUfjiC1ftVKUpASY5FhAPpFJG99FUwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTI1MDUwNjA5MjUwMFoXDTMyMDUwNjA5MjUwMFowbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABENFG8xzydWRfK92bmGv\nP+mAh91PEyV7Jh6FGJd5ndE9aBH7R3E4A7ubrlh/zN3C4xvpoouGlirMba+W2lju\nypajgbUwgbIwHwYDVR0jBBgwFoAUImUM1lqdNInzg7SVUr9QGzknBqwwUgYDVR0f\nBEswSTBHoEWgQ4ZBaHR0cHM6Ly9jZXJ0aWZpY2F0ZXMudHJ1c3RlZHNlcnZpY2Vz\nLmludGVsLmNvbS9JbnRlbFNHWFJvb3RDQS5kZXIwHQYDVR0OBBYEFH44gtX7VSlK\nQEmORYQD6RSRvfRVMA4GA1UdDwEB/wQEAwIGwDAMBgNVHRMBAf8EAjAAMAoGCCqG\nSM49BAMCA0kAMEYCIQDdmmRuAo3qCO8TC1IoJMITAoOEw4dlgEBHzSz1TuMSTAIh\nAKVTqOkt59+co0O3m3hC+v5Fb00FjYWcgeu3EijOULo5\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgG\nA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0\naW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYT\nAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEC6nEwMDIYZOj/iPWsCzaEKi7\n1OiOSLRFhWGjbnBVJfVnkY4u3IjkDYYL0MxO4mqsyYjlBalTVYxFP2sJBK5zlKOB\nuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBSBgNVHR8ESzBJ\nMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2VydmljZXMuaW50\nZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUImUM1lqdNInzg7SV\nUr9QGzknBqwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwCgYI\nKoZIzj0EAwIDSQAwRgIhAOW/5QkR+S9CiSDcNoowLuPRLsWGf/Yi7GSX94BgwTwg\nAiEA4J0lrHoMs+Xo5o/sX6O9QWxHRAvZUGOdRQ7cvqRXaqI=\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2024-09-18T05:15:56Z\",\"nextUpdate\":\"2024-10-18T05:15:56Z\",\"fmspc\":\"50806f000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":16,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":2},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":2},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":6,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":6,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":2,\"category\":\"BIOS\"},{\"svn\":3,\"category\":\"BIOS\"},{\"svn\":1,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":6,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":5,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":5,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":2,\"category\":\"BIOS\"},{\"svn\":3,\"category\":\"BIOS\"},{\"svn\":1,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":5,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2023-02-15T00:00:00Z\",\"tcbStatus\":\"OutOfDate\",\"advisoryIDs\":[\"INTEL-SA-00837\"]},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":5,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":5,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":2,\"category\":\"BIOS\"},{\"svn\":3,\"category\":\"BIOS\"},{\"svn\":1,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":5,\"tdxtcbcomponents\":[{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":5,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2018-01-04T00:00:00Z\",\"tcbStatus\":\"OutOfDate\",\"advisoryIDs\":[\"INTEL-SA-00106\",\"INTEL-SA-00115\",\"INTEL-SA-00135\",\"INTEL-SA-00203\",\"INTEL-SA-00220\",\"INTEL-SA-00233\",\"INTEL-SA-00270\",\"INTEL-SA-00293\",\"INTEL-SA-00320\",\"INTEL-SA-00329\",\"INTEL-SA-00381\",\"INTEL-SA-00389\",\"INTEL-SA-00477\",\"INTEL-SA-00837\"]}]},\"signature\":\"4daddccfa807a40bc2af47c4255b05536d680dc3647de999e7fe23399b395431403922757a0458019728e7a75ff65cb88515966dbbbee313aee9e9f21b99b2c9\"}"},{"fmspc":"00806F050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICjTCCAjKgAwIBAgIUfjiC1ftVKUpASY5FhAPpFJG99FUwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTI1MDUwNjA5MjUwMFoXDTMyMDUwNjA5MjUwMFowbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABENFG8xzydWRfK92bmGv\nP+mAh91PEyV7Jh6FGJd5ndE9aBH7R3E4A7ubrlh/zN3C4xvpoouGlirMba+W2lju\nypajgbUwgbIwHwYDVR0jBBgwFoAUImUM1lqdNInzg7SVUr9QGzknBqwwUgYDVR0f\nBEswSTBHoEWgQ4ZBaHR0cHM6Ly9jZXJ0aWZpY2F0ZXMudHJ1c3RlZHNlcnZpY2Vz\nLmludGVsLmNvbS9JbnRlbFNHWFJvb3RDQS5kZXIwHQYDVR0OBBYEFH44gtX7VSlK\nQEmORYQD6RSRvfRVMA4GA1UdDwEB/wQEAwIGwDAMBgNVHRMBAf8EAjAAMAoGCCqG\nSM49BAMCA0kAMEYCIQDdmmRuAo3qCO8TC1IoJMITAoOEw4dlgEBHzSz1TuMSTAIh\nAKVTqOkt59+co0O3m3hC+v5Fb00FjYWcgeu3EijOULo5\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgG\nA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0\naW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYT\nAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEC6nEwMDIYZOj/iPWsCzaEKi7\n1OiOSLRFhWGjbnBVJfVnkY4u3IjkDYYL0MxO4mqsyYjlBalTVYxFP2sJBK5zlKOB\nuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBSBgNVHR8ESzBJ\nMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2VydmljZXMuaW50\nZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUImUM1lqdNInzg7SV\nUr9QGzknBqwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwCgYI\nKoZIzj0EAwIDSQAwRgIhAOW/5QkR+S9CiSDcNoowLuPRLsWGf/Yi7GSX94BgwTwg\nAiEA4J0lrHoMs+Xo5o/sX6O9QWxHRAvZUGOdRQ7cvqRXaqI=\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2024-09-18T05:15:56Z\",\"nextUpdate\":\"2024-10-18T05:15:56Z\",\"fmspc\":\"00806F050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":16,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":2},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":2},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":6,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":6,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":2,\"category\":\"BIOS\"},{\"svn\":3,\"category\":\"BIOS\"},{\"svn\":1,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":6,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":5,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":5,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":2,\"category\":\"BIOS\"},{\"svn\":3,\"category\":\"BIOS\"},{\"svn\":1,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":5,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2023-02-15T00:00:00Z\",\"tcbStatus\":\"OutOfDate\",\"advisoryIDs\":[\"INTEL-SA-00837\"]},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":5,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":5,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":2,\"category\":\"BIOS\"},{\"svn\":3,\"category\":\"BIOS\"},{\"svn\":1,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":5,\"tdxtcbcomponents\":[{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":5,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2018-01-04T00:00:00Z\",\"tcbStatus\":\"OutOfDate\",\"advisoryIDs\":[\"INTEL-SA-00106\",\"INTEL-SA-00115\",\"INTEL-SA-00135\",\"INTEL-SA-00203\",\"INTEL-SA-00220\",\"INTEL-SA-00233\",\"INTEL-SA-00270\",\"INTEL-SA-00293\",\"INTEL-SA-00320\",\"INTEL-SA-00329\",\"INTEL-SA-00381\",\"INTEL-SA-00389\",\"INTEL-SA-00477\",\"INTEL-SA-00837\"]}]},\"signature\":\"a89c562e956b6567cae3782b017d66a62d5c1c172d12412535fc81e5534c8fe0b3dc624eb4613f6667aec9cc8d961658178f72aa8642a56fcddc90a4fd12e3f2\"}"},{"fmspc":"90C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICjTCCAjKgAwIBAgIUfjiC1ftVKUpASY5FhAPpFJG99FUwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTI1MDUwNjA5MjUwMFoXDTMyMDUwNjA5MjUwMFowbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABENFG8xzydWRfK92bmGv\nP+mAh91PEyV7Jh6FGJd5ndE9aBH7R3E4A7ubrlh/zN3C4xvpoouGlirMba+W2lju\nypajgbUwgbIwHwYDVR0jBBgwFoAUImUM1lqdNInzg7SVUr9QGzknBqwwUgYDVR0f\nBEswSTBHoEWgQ4ZBaHR0cHM6Ly9jZXJ0aWZpY2F0ZXMudHJ1c3RlZHNlcnZpY2Vz\nLmludGVsLmNvbS9JbnRlbFNHWFJvb3RDQS5kZXIwHQYDVR0OBBYEFH44gtX7VSlK\nQEmORYQD6RSRvfRVMA4GA1UdDwEB/wQEAwIGwDAMBgNVHRMBAf8EAjAAMAoGCCqG\nSM49BAMCA0kAMEYCIQDdmmRuAo3qCO8TC1IoJMITAoOEw4dlgEBHzSz1TuMSTAIh\nAKVTqOkt59+co0O3m3hC+v5Fb00FjYWcgeu3EijOULo5\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgG\nA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0\naW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYT\nAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEC6nEwMDIYZOj/iPWsCzaEKi7\n1OiOSLRFhWGjbnBVJfVnkY4u3IjkDYYL0MxO4mqsyYjlBalTVYxFP2sJBK5zlKOB\nuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBSBgNVHR8ESzBJ\nMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2VydmljZXMuaW50\nZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUImUM1lqdNInzg7SV\nUr9QGzknBqwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwCgYI\nKoZIzj0EAwIDSQAwRgIhAOW/5QkR+S9CiSDcNoowLuPRLsWGf/Yi7GSX94BgwTwg\nAiEA4J0lrHoMs+Xo5o/sX6O9QWxHRAvZUGOdRQ7cvqRXaqI=\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2024-07-15T14:31:12Z\",\"nextUpdate\":\"2024-08-14T14:31:12Z\",\"fmspc\":\"90c06f000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":16,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":2},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":2},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":2,\"category\":\"BIOS\"},{\"svn\":3,\"category\":\"BIOS\"},{\"svn\":1,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":13,\"tdxtcbcomponents\":[{\"svn\":4,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":2,\"category\":\"BIOS\"},{\"svn\":3,\"category\":\"BIOS\"},{\"svn\":1,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":5,\"tdxtcbcomponents\":[{\"svn\":4,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2018-01-04T00:00:00Z\",\"tcbStatus\":\"OutOfDate\",\"advisoryIDs\":[\"INTEL-SA-00106\",\"INTEL-SA-00115\",\"INTEL-SA-00135\",\"INTEL-SA-00203\",\"INTEL-SA-00220\",\"INTEL-SA-00233\",\"INTEL-SA-00270\",\"INTEL-SA-00293\",\"INTEL-SA-00320\",\"INTEL-SA-00329\",\"INTEL-SA-00381\",\"INTEL-SA-00389\",\"INTEL-SA-00477\",\"INTEL-SA-00837\"]}]},\"signature\":\"e8e15c17e42c84384e3731d2d6d2cdf01cd94b4e1e46fd72328d1f522661c06f7ee69e7c5e8f478bd4a68a230d54120c08fcfbae90684a37223d8580baa0ded5\"}"}],"qeIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICjTCCAjKgAwIBAgIUfjiC1ftVKUpASY5FhAPpFJG99FUwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTI1MDUwNjA5MjUwMFoXDTMyMDUwNjA5MjUwMFowbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABENFG8xzydWRfK92bmGv\nP+mAh91PEyV7Jh6FGJd5ndE9aBH7R3E4A7ubrlh/zN3C4xvpoouGlirMba+W2lju\nypajgbUwgbIwHwYDVR0jBBgwFoAUImUM1lqdNInzg7SVUr9QGzknBqwwUgYDVR0f\nBEswSTBHoEWgQ4ZBaHR0cHM6Ly9jZXJ0aWZpY2F0ZXMudHJ1c3RlZHNlcnZpY2Vz\nLmludGVsLmNvbS9JbnRlbFNHWFJvb3RDQS5kZXIwHQYDVR0OBBYEFH44gtX7VSlK\nQEmORYQD6RSRvfRVMA4GA1UdDwEB/wQEAwIGwDAMBgNVHRMBAf8EAjAAMAoGCCqG\nSM49BAMCA0kAMEYCIQDdmmRuAo3qCO8TC1IoJMITAoOEw4dlgEBHzSz1TuMSTAIh\nAKVTqOkt59+co0O3m3hC+v5Fb00FjYWcgeu3EijOULo5\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgG\nA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0\naW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYT\nAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEC6nEwMDIYZOj/iPWsCzaEKi7\n1OiOSLRFhWGjbnBVJfVnkY4u3IjkDYYL0MxO4mqsyYjlBalTVYxFP2sJBK5zlKOB\nuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBSBgNVHR8ESzBJ\nMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2VydmljZXMuaW50\nZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUImUM1lqdNInzg7SV\nUr9QGzknBqwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwCgYI\nKoZIzj0EAwIDSQAwRgIhAOW/5QkR+S9CiSDcNoowLuPRLsWGf/Yi7GSX94BgwTwg\nAiEA4J0lrHoMs+Xo5o/sX6O9QWxHRAvZUGOdRQ7cvqRXaqI=\n-----END CERTIFICATE-----\n","qeIdentity":"{\"enclaveIdentity\":{\"id\":\"TD_QE\",\"version\":2,\"issueDate\":\"2024-09-18T04:54:41Z\",\"nextUpdate\":\"2024-10-18T04:54:41Z\",\"tcbEvaluationDataNumber\":16,\"miscselect\":\"00000000\",\"miscselectMask\":\"FFFFFFFF\",\"attributes\":\"11000000000000000000000000000000\",\"attributesMask\":\"FBFFFFFFFFFFFFFF0000000000000000\",\"mrsigner\":\"DC9E2A7C6F948F17474E34A7FC43ED030F7C1563F1BABDDF6340C82E0E54A8C5\",\"isvprodid\":2,\"tcbLevels\":[{\"tcb\":{\"isvsvn\":4},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"9a55465480464a6f8d234b427e9500019df8947eecb5db37fab5bb27728384d2b1b9b8cf7539321493be71daf4ae932ca80d77dc6794f4efd174105a072c57ae\"}"},"servtdCollateral":{"majorVersion":1,"minorVersion":0,"servtdTcbMapping":{"tdTcbMapping":{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","svnMappings":[{"tdMeasurements":{"tdinfo_hash":"1ADC25055B5188A615FF0A2B4781C0E1F38D4369CA688C775EE321E142FBE4534C14EDE61D9C570967996F6C8E8F5F76"},"isvsvn":1}]},"signature":"30650230399B7A607A380AD765720B70EA82F9027C6638662BC8C10A0591B488D7E0EB369959206434EFDD0D860A5EB9E7443D9C023100ADF9FAF38CAB4EB589A52EB32305D19D5F8313343F0BD08017574D0B22342D9BABA7A786E01A2094C29781F986FE6988"},"servtdTcbMappingIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICGDCCAZ6gAwIBAgIUI2qCSZ4o/j7/l/3Nl6Ey59u103swCgYIKoZIzj0EAwMw\nNDEWMBQGA1UEAwwNTWlnVEQgUm9vdCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9y\nYXRpb24wHhcNMjYwNzIxMDIyNjIzWhcNMjcwNzIxMDIyNjIzWjA/MSEwHwYDVQQD\nDBhNaWdURCBUQ0IgTWFwcGluZyBJc3N1ZXIxGjAYBgNVBAoMEUludGVsIENvcnBv\ncmF0aW9uMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE0DLuzrOa8Iwlckmi+q5XRyga\nAOi/KmCuedEcxcIueU6YaG2zFdI/aP5Tg2BW0ibNrlwrIRuFO5yG/kVvLjqzPHXt\neKz6PGUsAzsjO0YO6oVxSehaGoteFOYHeRkzvTceo2YwZDALBgNVHQ8EBAMCB4Aw\nFQYDVR0lBA4wDAYKKwYBBAGB/VkBATAdBgNVHQ4EFgQUb1W97VrkSsQ2DLBf3pIy\nkYybJ9AwHwYDVR0jBBgwFoAUzbjA8WoRclwlFqbtJoFmo8DFKQ4wCgYIKoZIzj0E\nAwMDaAAwZQIxAMrEiV2BRq6Dlyj90ICNOIDGxeJDkgQgdh9QnCKGf4BzEvuM86D9\n/ohPFc+aPPM4ZQIwFRzINodzbocmwhHdY2gnMdBdZYSGcy5Os7k423D9f69HuTok\nWWQgNP2t1A+0CtbU\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIB+jCCAYCgAwIBAgIUMX1+LqRwwfhB6bDtTlX7N4iJhc0wCgYIKoZIzj0EAwMw\nNDEWMBQGA1UEAwwNTWlnVEQgUm9vdCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9y\nYXRpb24wHhcNMjYwNzIxMDIyNjIzWhcNMjcwNzIxMDIyNjIzWjA0MRYwFAYDVQQD\nDA1NaWdURCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3JhdGlvbjB2MBAG\nByqGSM49AgEGBSuBBAAiA2IABBptQ9M3xyA0cohyQFUukjbZhNgjosbK1Z7op9zQ\nu+IcCY58uSUulesJEt3Q5Ki30WQ5ThX8Lwc6CNjqDPNQqXaTyzcwMRAi7evnfsji\nywKjNxPUuDE6MmlTXG9SS3J+w6NTMFEwHQYDVR0OBBYEFM24wPFqEXJcJRam7SaB\nZqPAxSkOMB8GA1UdIwQYMBaAFM24wPFqEXJcJRam7SaBZqPAxSkOMA8GA1UdEwEB\n/wQFMAMBAf8wCgYIKoZIzj0EAwMDaAAwZQIwOtC/ZbeDkk6pjxeW5xb0Er5Vf88J\nB4rC1N27vz8JFEQ1cGVbVktZ1Ngg3C5foD+DAjEAg00nYaIHw1ZE/g/wyQLFfZhN\n07qIK1LbLfTcPDpWtW7UD5FvOAndCHyKTgq9cBbk\n-----END CERTIFICATE-----\n","servtdIdentity":{"tdIdentity":{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}],"xfam":"E718060000000000","attributes":"0000000000000000","mrConfigId":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwnerConfig":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrsigner":"","isvProdId":0},"signature":"306402306B3A04E658F9326DE0332E7E1722AE9D47D1D2AA8DF98AD11891041F40682D12EED235B8271BE064026C9F242281EE8502301A422BD89A00CEDF14CACFE8C64E71C2A37783D6F603EFD98EB6522A06E0C67ADDB22E8C14C64D1C42B0239C1A4BCC36"},"servtdIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICGDCCAZ6gAwIBAgIUI2qCSZ4o/j7/l/3Nl6Ey59u1030wCgYIKoZIzj0EAwMw\nNDEWMBQGA1UEAwwNTWlnVEQgUm9vdCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9y\nYXRpb24wHhcNMjYwNzIxMDIyNjIzWhcNMjcwNzIxMDIyNjIzWjA/MSEwHwYDVQQD\nDBhNaWdURCBUQ0IgTWFwcGluZyBJc3N1ZXIxGjAYBgNVBAoMEUludGVsIENvcnBv\ncmF0aW9uMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAExykffZEMbJoBRF1lBbOEQWIq\n8ugnf+sIW0R0kzgg/hJrzd0Tc/dx56YOMQ8uLajZJc6Uw/VCPTPcWIKNW+qDLq3p\nV/WYCLs2jQIK0Wi2DvXNHbdeRJ8r7m2b4Eet7ATuo2YwZDALBgNVHQ8EBAMCB4Aw\nFQYDVR0lBA4wDAYKKwYBBAGB/VkBATAdBgNVHQ4EFgQUDseXgtURvY6G41eQmO/I\nx/4jiEswHwYDVR0jBBgwFoAUzbjA8WoRclwlFqbtJoFmo8DFKQ4wCgYIKoZIzj0E\nAwMDaAAwZQIwQtZuyECGGaz+YIsK7MtQZs6L0sP0Yrsm84AScFx0gDwBBpbFsHIW\nOkgFBfATYt7yAjEAxg88iDqFGHWGLtS7fPvlmvP2zZIuLR5uSq2SQJu5hPfbZt86\nTAP6RHdEsC3vnTwS\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIB+jCCAYCgAwIBAgIUMX1+LqRwwfhB6bDtTlX7N4iJhc0wCgYIKoZIzj0EAwMw\nNDEWMBQGA1UEAwwNTWlnVEQgUm9vdCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9y\nYXRpb24wHhcNMjYwNzIxMDIyNjIzWhcNMjcwNzIxMDIyNjIzWjA0MRYwFAYDVQQD\nDA1NaWdURCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3JhdGlvbjB2MBAG\nByqGSM49AgEGBSuBBAAiA2IABBptQ9M3xyA0cohyQFUukjbZhNgjosbK1Z7op9zQ\nu+IcCY58uSUulesJEt3Q5Ki30WQ5ThX8Lwc6CNjqDPNQqXaTyzcwMRAi7evnfsji\nywKjNxPUuDE6MmlTXG9SS3J+w6NTMFEwHQYDVR0OBBYEFM24wPFqEXJcJRam7SaB\nZqPAxSkOMB8GA1UdIwQYMBaAFM24wPFqEXJcJRam7SaBZqPAxSkOMA8GA1UdEwEB\n/wQFMAMBAf8wCgYIKoZIzj0EAwMDaAAwZQIwOtC/ZbeDkk6pjxeW5xb0Er5Vf88J\nB4rC1N27vz8JFEQ1cGVbVktZ1Ngg3C5foD+DAjEAg00nYaIHw1ZE/g/wyQLFfZhN\n07qIK1LbLfTcPDpWtW7UD5FvOAndCHyKTgq9cBbk\n-----END CERTIFICATE-----\n","servtdCrl":"-----BEGIN X509 CRL-----\nMIHrMHQCAQEwCgYIKoZIzj0EAwMwNDEWMBQGA1UEAwwNTWlnVEQgUm9vdCBDQTEa\nMBgGA1UECgwRSW50ZWwgQ29ycG9yYXRpb24XDTI2MDcyMTAyMjYyM1oXDTM2MDcx\nODAyMjYyM1qgDzANMAsGA1UdFAQEAgIQADAKBggqhkjOPQQDAwNnADBkAjB8Yyhd\nED9LlopkMm/6JT6DATJO3QZXmMXGTsMFENMAjXAqnUB+LKozL+HXY5ThuJMCMHw7\nM2mloQxhxu8lIIXDDVtHwbIem0iWCFXWO14O+Eb8DFGGCbdM96bRw60B0F1JFg==\n-----END X509 CRL-----\n"}},"signature":"306402306D29C2F009BD0A9B964111C9A79F5515DD5DB971155B5DCB676D67B29498591E58E784F24800E3AF307D2973F06FAC1E02304CCB290B2CBC32662BCCFD842EFF813A15B7A5A2B561C1F658355C345B0873C0D6595E5756C79CAA85A1239149E8B240"} \ No newline at end of file diff --git a/src/policy/test/policy_v2/revocation/policy_revoked.json b/src/policy/test/policy_v2/revocation/policy_revoked.json new file mode 100644 index 000000000..348849a86 --- /dev/null +++ b/src/policy/test/policy_v2/revocation/policy_revoked.json @@ -0,0 +1 @@ +{"policyData":{"id":"E6643BDC-E50A-4315-9EF7-F217CE8AF9A6","version":"2.0","policySvn":1,"policy":[{"global":{"tcb":{"tcbEvaluationDataNumber":{"operation":"greater-or-equal","reference":13},"tcbDate":{"operation":"greater-or-equal","reference":"2023-07-01T00:00:00Z"},"tcbStatusAccepted":{"operation":"allow-list","reference":["UpToDate","ConfigurationNeeded"]}},"platform":{"fmspc":{"operation":"allow-list","reference":["00706A000000","00706E170000","00A068070000","90C06F000000","20C06F000000","10A06E040000","40806F000000","10706A000000","10A067110000","20606A000000","10906EA50000","20906EA10000","10906EB10000","10806F000000","00706E070000","50A06D000000","10606A000000","10706A800000","10706A100000","B0806F000000","00706D050000","10806EB70000","10906ED10000","00A06F010000","00A06D070000","40806F200000","60806F000000","10A06E050000","40A06D000000","10606C040000","50A06F000000","00A06D000000","10806EA60000","00706D010000","10806F070000","20D06D010000","00706E270000","00A06F000000","10A06D050000","00C06F000000","30806F000000","20906EA50000","10706E370000","20806F070000","10906EC50000","10806F040000","10D06D000000","10906EA10000","20806F000000","10A067010000","30A06E000000","10A06F000000","70806F000000","10906EC10000","20A06D050000","00606A000000"]}}}}],"collaterals":{"majorVersion":1,"minorVersion":0,"teeType":129,"rootCa":"-----BEGIN CERTIFICATE-----\nMIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgG\nA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0\naW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYT\nAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEC6nEwMDIYZOj/iPWsCzaEKi7\n1OiOSLRFhWGjbnBVJfVnkY4u3IjkDYYL0MxO4mqsyYjlBalTVYxFP2sJBK5zlKOB\nuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBSBgNVHR8ESzBJ\nMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2VydmljZXMuaW50\nZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUImUM1lqdNInzg7SV\nUr9QGzknBqwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwCgYI\nKoZIzj0EAwIDSQAwRgIhAOW/5QkR+S9CiSDcNoowLuPRLsWGf/Yi7GSX94BgwTwg\nAiEA4J0lrHoMs+Xo5o/sX6O9QWxHRAvZUGOdRQ7cvqRXaqI=\n-----END CERTIFICATE-----","pckCrlIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICljCCAj2gAwIBAgIVAJVvXc29G+HpQEnJ1PQzzgFXC95UMAoGCCqGSM49BAMC\nMGgxGjAYBgNVBAMMEUludGVsIFNHWCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBD\nb3Jwb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQsw\nCQYDVQQGEwJVUzAeFw0xODA1MjExMDUwMTBaFw0zMzA1MjExMDUwMTBaMHAxIjAg\nBgNVBAMMGUludGVsIFNHWCBQQ0sgUGxhdGZvcm0gQ0ExGjAYBgNVBAoMEUludGVs\nIENvcnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0Ex\nCzAJBgNVBAYTAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAENSB/7t21lXSO\n2Cuzpxw74eJB72EyDGgW5rXCtx2tVTLq6hKk6z+UiRZCnqR7psOvgqFeSxlmTlJl\neTmi2WYz3qOBuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBS\nBgNVHR8ESzBJMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2Vy\ndmljZXMuaW50ZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUlW9d\nzb0b4elAScnU9DPOAVcL3lQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYB\nAf8CAQAwCgYIKoZIzj0EAwIDRwAwRAIgXsVki0w+i6VYGW3UF/22uaXe0YJDj1Ue\nnA+TjD1ai5cCICYb1SAmD5xkfTVpvo4UoyiSYxrDWLmUR4CI9NKyfPN+\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgG\nA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0\naW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYT\nAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEC6nEwMDIYZOj/iPWsCzaEKi7\n1OiOSLRFhWGjbnBVJfVnkY4u3IjkDYYL0MxO4mqsyYjlBalTVYxFP2sJBK5zlKOB\nuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBSBgNVHR8ESzBJ\nMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2VydmljZXMuaW50\nZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUImUM1lqdNInzg7SV\nUr9QGzknBqwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwCgYI\nKoZIzj0EAwIDSQAwRgIhAOW/5QkR+S9CiSDcNoowLuPRLsWGf/Yi7GSX94BgwTwg\nAiEA4J0lrHoMs+Xo5o/sX6O9QWxHRAvZUGOdRQ7cvqRXaqI=\n-----END CERTIFICATE-----\n","rootCaCrl":"-----BEGIN X509 CRL-----\nMIIBIDCByAIBATAKBggqhkjOPQQDAjBoMRowGAYDVQQDDBFJbnRlbCBTR1ggUm9v\ndCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9yYXRpb24xFDASBgNVBAcMC1NhbnRh\nIENsYXJhMQswCQYDVQQIDAJDQTELMAkGA1UEBhMCVVMXDTI1MDMyMDExMjE1N1oX\nDTI2MDQwMzExMjE1N1qgLzAtMAoGA1UdFAQDAgEBMB8GA1UdIwQYMBaAFCJlDNZa\nnTSJ84O0lVK/UBs5JwasMAoGCCqGSM49BAMCA0cAMEQCIDDJ/OFDjaCpTk//3UbJ\nZQ45O+blp4YtTk5zUnky0ErzAiBlOe/j9zTD198g2d/EYw4cf/BDmg+OzhAfFbXq\n/5tPMw==\n-----END X509 CRL-----","pckCrl":"-----BEGIN X509 CRL-----\nMIIL1zCCC30CAQEwCgYIKoZIzj0EAwIwcDEiMCAGA1UEAwwZSW50ZWwgU0dYIFBD\nSyBQbGF0Zm9ybSBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9yYXRpb24xFDASBgNV\nBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTELMAkGA1UEBhMCVVMXDTI1MTEx\nMDIxNDcxOVoXDTI1MTIxMDIxNDcxOVowggqpMDMCFG/DTlAj5yiSNDXWGqS4PGGB\nZq01Fw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwNAIVAO+ubpcV/KE7h+Mz\n6CYe1tmQqSatFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwNAIVAP1ghkhi\nnLpzB4tNSS9LPqdBrQjNFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwNAIV\nAIr5JBhOHVr93XPD1joS9ei1c35WFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMK\nAQEwNAIVALEleXjPqczdB1mr+MXKcvrjp4qbFw0yNTExMTAyMTQ3MTlaMAwwCgYD\nVR0VBAMKAQEwMwIUdP6mFKlyvg4oQ/IFmDWBHthy+bMXDTI1MTExMDIxNDcxOVow\nDDAKBgNVHRUEAwoBATA0AhUA+cTvVrOrSNV34Qi67fS/iAFCFLkXDTI1MTExMDIx\nNDcxOVowDDAKBgNVHRUEAwoBATAzAhQHHeB3j55fxPKHjzDWsHyaMOazCxcNMjUx\nMTEwMjE0NzE5WjAMMAoGA1UdFQQDCgEBMDQCFQDN4kJPlyzqlP8jmTf02AwlAp3W\nCxcNMjUxMTEwMjE0NzE5WjAMMAoGA1UdFQQDCgEBMDMCFGwzGeUQm2RQfTzxEyzg\nA0nvUnMZFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwNAIVAN8I11a2anSX\n9DtbtYraBNP096k3Fw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwMwIUKK9I\nW2z2fkCaOdXLWu5FmPeo+nsXDTI1MTExMDIxNDcxOVowDDAKBgNVHRUEAwoBATA0\nAhUA+4strsCSytqKqbxP8vHCDQNGZowXDTI1MTExMDIxNDcxOVowDDAKBgNVHRUE\nAwoBATA0AhUAzUhQrFK9zGmmpvBYyLxXu9C1+GQXDTI1MTExMDIxNDcxOVowDDAK\nBgNVHRUEAwoBATA0AhUAmU3TZm9SdfuAX5XdAr1QyyZ52K0XDTI1MTExMDIxNDcx\nOVowDDAKBgNVHRUEAwoBATAzAhQHAhNpACUidNkDXu31RXRi+tDvTBcNMjUxMTEw\nMjE0NzE5WjAMMAoGA1UdFQQDCgEBMDMCFGHyv3Pjm04EqifYAb1z0kMZtb+AFw0y\nNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwMwIUOZK+hRuWkC7/OJWebC7/GwZR\npLUXDTI1MTExMDIxNDcxOVowDDAKBgNVHRUEAwoBATAzAhQP2kOgC2jqebfC3q6s\nC0mL37KvkBcNMjUxMTEwMjE0NzE5WjAMMAoGA1UdFQQDCgEBMDMCFGOfE5pQQP3P\n8ZHopPsb8IbtYDlxFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwNAIVAJWd\nUz+SSdweUTVEzcgwvxm38fMBFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEw\nMwIUeuN3SKn5EvTGO6erB8WTzh0dEYEXDTI1MTExMDIxNDcxOVowDDAKBgNVHRUE\nAwoBATAzAhQTiEszJpk4wZWqFw/KddoXdTjfCxcNMjUxMTEwMjE0NzE5WjAMMAoG\nA1UdFQQDCgEBMDQCFQCF08k4G3en4E0RnJ5a1nSf8/+rhxcNMjUxMTEwMjE0NzE5\nWjAMMAoGA1UdFQQDCgEBMDQCFQCTiHykQR56kjvR/tKBmylJ8gG1tBcNMjUxMTEw\nMjE0NzE5WjAMMAoGA1UdFQQDCgEBMDMCFCSY3GKDkwmW/YvyOjesviajvtRXFw0y\nNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwNAIVAIpm8adJSIZnaJzDkDrFTGYr\ncS5zFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwNAIVAK/BNhC902y3mF0Q\nZIGogNOgH9oHFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwNAIVAO/gSywz\n0DaqyWymc78emke2TVy7Fw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwNAIV\nAIPZrI2LtQnRxsgJrXEuhDBVntfzFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMK\nAQEwMwIUeTH9ULUHHBu/xbe23ti0W52LhSkXDTI1MTExMDIxNDcxOVowDDAKBgNV\nHRUEAwoBATAzAhQfog4pcL3l1X97jd+DOUhOHx0IIxcNMjUxMTEwMjE0NzE5WjAM\nMAoGA1UdFQQDCgEBMDMCFB6HssOzLY0j5BHO80GXuVrwyK31Fw0yNTExMTAyMTQ3\nMTlaMAwwCgYDVR0VBAMKAQEwNAIVAJr9LukKRzVQoWfZlpEUN8dQLR8JFw0yNTEx\nMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwMwIURIGw8RcooTtpbT6px3CgsV7FjdoX\nDTI1MTExMDIxNDcxOVowDDAKBgNVHRUEAwoBATA0AhUAp4WfV5gu8OZ9N7yO8u9a\nyDX/GqkXDTI1MTExMDIxNDcxOVowDDAKBgNVHRUEAwoBATA0AhUAnWd1O4HkcJCu\np2P77ExFSbzbmTMXDTI1MTExMDIxNDcxOVowDDAKBgNVHRUEAwoBATAzAhQ0v7t6\nHZxWgUfhGLYU97du0+9o3xcNMjUxMTEwMjE0NzE5WjAMMAoGA1UdFQQDCgEBMDMC\nFCw8xv6SedsVFtXOOfKomM2loXXhFw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMK\nAQEwMwIUcXlIaHUJI0vpeeS33ObzG+9ktowXDTI1MTExMDIxNDcxOVowDDAKBgNV\nHRUEAwoBATA0AhUAnXbvLDnBNuhli25zlrHXRFonYx8XDTI1MTExMDIxNDcxOVow\nDDAKBgNVHRUEAwoBATA0AhUAw+Al/KmV829ZtIRnk54+NOY2Gm8XDTI1MTExMDIx\nNDcxOVowDDAKBgNVHRUEAwoBATA0AhUAjF9rMlfaBbF0KeLmG6ll1nMwYGoXDTI1\nMTExMDIxNDcxOVowDDAKBgNVHRUEAwoBATA0AhUAoXxRci7B4MMnj+i98FIFnL7E\n5kgXDTI1MTExMDIxNDcxOVowDDAKBgNVHRUEAwoBATAzAhQ0uk/Xa95TCSEM8d0f\n+0lMY4qRVxcNMjUxMTEwMjE0NzE5WjAMMAoGA1UdFQQDCgEBMDMCFAQ+BJGdquE0\nQySDlQlNKi6s/Hb+Fw0yNTExMTAyMTQ3MTlaMAwwCgYDVR0VBAMKAQEwMwIUR/xX\nfS0JTL3ycHFe1oSKk4Va00sXDTI1MTExMDIxNDcxOVowDDAKBgNVHRUEAwoBATAz\nAhR9YqL15vOG5GllP///BF0KgXjo5xcNMjUxMTEwMjE0NzE5WjAMMAoGA1UdFQQD\nCgEBMDQCFQDE7UX+Amu2pH6uw16oC370B84GLBcNMjUxMTEwMjE0NzE5WjAMMAoG\nA1UdFQQDCgEBMDQCFQDPmDEHejyk8aLFaGe/VbGOzL7/2BcNMjUxMTEwMjE0NzE5\nWjAMMAoGA1UdFQQDCgEBMDMCFGwrgdfqLkNnIM4p8dCxzLeiGGAPFw0yNTExMTAy\nMTQ3MTlaMAwwCgYDVR0VBAMKAQGgLzAtMAoGA1UdFAQDAgEBMB8GA1UdIwQYMBaA\nFJVvXc29G+HpQEnJ1PQzzgFXC95UMAoGCCqGSM49BAMCA0gAMEUCIQD0RW5z1XhH\nshEHUDoCwV+E/oPU2KkJov8crzIwjwIamAIgfwPSEiTXLS3fKAohav2sv9FoOK+l\nZC1WF9Afo6UM11c=\n-----END X509 CRL-----","platforms":[{"fmspc":"50806F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICjTCCAjKgAwIBAgIUfjiC1ftVKUpASY5FhAPpFJG99FUwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTI1MDUwNjA5MjUwMFoXDTMyMDUwNjA5MjUwMFowbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABENFG8xzydWRfK92bmGv\nP+mAh91PEyV7Jh6FGJd5ndE9aBH7R3E4A7ubrlh/zN3C4xvpoouGlirMba+W2lju\nypajgbUwgbIwHwYDVR0jBBgwFoAUImUM1lqdNInzg7SVUr9QGzknBqwwUgYDVR0f\nBEswSTBHoEWgQ4ZBaHR0cHM6Ly9jZXJ0aWZpY2F0ZXMudHJ1c3RlZHNlcnZpY2Vz\nLmludGVsLmNvbS9JbnRlbFNHWFJvb3RDQS5kZXIwHQYDVR0OBBYEFH44gtX7VSlK\nQEmORYQD6RSRvfRVMA4GA1UdDwEB/wQEAwIGwDAMBgNVHRMBAf8EAjAAMAoGCCqG\nSM49BAMCA0kAMEYCIQDdmmRuAo3qCO8TC1IoJMITAoOEw4dlgEBHzSz1TuMSTAIh\nAKVTqOkt59+co0O3m3hC+v5Fb00FjYWcgeu3EijOULo5\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgG\nA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0\naW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYT\nAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEC6nEwMDIYZOj/iPWsCzaEKi7\n1OiOSLRFhWGjbnBVJfVnkY4u3IjkDYYL0MxO4mqsyYjlBalTVYxFP2sJBK5zlKOB\nuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBSBgNVHR8ESzBJ\nMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2VydmljZXMuaW50\nZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUImUM1lqdNInzg7SV\nUr9QGzknBqwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwCgYI\nKoZIzj0EAwIDSQAwRgIhAOW/5QkR+S9CiSDcNoowLuPRLsWGf/Yi7GSX94BgwTwg\nAiEA4J0lrHoMs+Xo5o/sX6O9QWxHRAvZUGOdRQ7cvqRXaqI=\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2024-09-18T05:15:56Z\",\"nextUpdate\":\"2024-10-18T05:15:56Z\",\"fmspc\":\"50806f000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":16,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":2},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":2},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":6,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":6,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":2,\"category\":\"BIOS\"},{\"svn\":3,\"category\":\"BIOS\"},{\"svn\":1,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":6,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":5,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":5,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":2,\"category\":\"BIOS\"},{\"svn\":3,\"category\":\"BIOS\"},{\"svn\":1,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":5,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2023-02-15T00:00:00Z\",\"tcbStatus\":\"OutOfDate\",\"advisoryIDs\":[\"INTEL-SA-00837\"]},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":5,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":5,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":2,\"category\":\"BIOS\"},{\"svn\":3,\"category\":\"BIOS\"},{\"svn\":1,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":5,\"tdxtcbcomponents\":[{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":5,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2018-01-04T00:00:00Z\",\"tcbStatus\":\"OutOfDate\",\"advisoryIDs\":[\"INTEL-SA-00106\",\"INTEL-SA-00115\",\"INTEL-SA-00135\",\"INTEL-SA-00203\",\"INTEL-SA-00220\",\"INTEL-SA-00233\",\"INTEL-SA-00270\",\"INTEL-SA-00293\",\"INTEL-SA-00320\",\"INTEL-SA-00329\",\"INTEL-SA-00381\",\"INTEL-SA-00389\",\"INTEL-SA-00477\",\"INTEL-SA-00837\"]}]},\"signature\":\"4daddccfa807a40bc2af47c4255b05536d680dc3647de999e7fe23399b395431403922757a0458019728e7a75ff65cb88515966dbbbee313aee9e9f21b99b2c9\"}"},{"fmspc":"00806F050000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICjTCCAjKgAwIBAgIUfjiC1ftVKUpASY5FhAPpFJG99FUwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTI1MDUwNjA5MjUwMFoXDTMyMDUwNjA5MjUwMFowbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABENFG8xzydWRfK92bmGv\nP+mAh91PEyV7Jh6FGJd5ndE9aBH7R3E4A7ubrlh/zN3C4xvpoouGlirMba+W2lju\nypajgbUwgbIwHwYDVR0jBBgwFoAUImUM1lqdNInzg7SVUr9QGzknBqwwUgYDVR0f\nBEswSTBHoEWgQ4ZBaHR0cHM6Ly9jZXJ0aWZpY2F0ZXMudHJ1c3RlZHNlcnZpY2Vz\nLmludGVsLmNvbS9JbnRlbFNHWFJvb3RDQS5kZXIwHQYDVR0OBBYEFH44gtX7VSlK\nQEmORYQD6RSRvfRVMA4GA1UdDwEB/wQEAwIGwDAMBgNVHRMBAf8EAjAAMAoGCCqG\nSM49BAMCA0kAMEYCIQDdmmRuAo3qCO8TC1IoJMITAoOEw4dlgEBHzSz1TuMSTAIh\nAKVTqOkt59+co0O3m3hC+v5Fb00FjYWcgeu3EijOULo5\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgG\nA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0\naW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYT\nAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEC6nEwMDIYZOj/iPWsCzaEKi7\n1OiOSLRFhWGjbnBVJfVnkY4u3IjkDYYL0MxO4mqsyYjlBalTVYxFP2sJBK5zlKOB\nuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBSBgNVHR8ESzBJ\nMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2VydmljZXMuaW50\nZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUImUM1lqdNInzg7SV\nUr9QGzknBqwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwCgYI\nKoZIzj0EAwIDSQAwRgIhAOW/5QkR+S9CiSDcNoowLuPRLsWGf/Yi7GSX94BgwTwg\nAiEA4J0lrHoMs+Xo5o/sX6O9QWxHRAvZUGOdRQ7cvqRXaqI=\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2024-09-18T05:15:56Z\",\"nextUpdate\":\"2024-10-18T05:15:56Z\",\"fmspc\":\"00806F050000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":16,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":2},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":2},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":6,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":6,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":2,\"category\":\"BIOS\"},{\"svn\":3,\"category\":\"BIOS\"},{\"svn\":1,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":6,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":5,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":5,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":2,\"category\":\"BIOS\"},{\"svn\":3,\"category\":\"BIOS\"},{\"svn\":1,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":11,\"tdxtcbcomponents\":[{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":5,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2023-02-15T00:00:00Z\",\"tcbStatus\":\"OutOfDate\",\"advisoryIDs\":[\"INTEL-SA-00837\"]},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":5,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":5,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":2,\"category\":\"BIOS\"},{\"svn\":3,\"category\":\"BIOS\"},{\"svn\":1,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":5,\"tdxtcbcomponents\":[{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":5,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2018-01-04T00:00:00Z\",\"tcbStatus\":\"OutOfDate\",\"advisoryIDs\":[\"INTEL-SA-00106\",\"INTEL-SA-00115\",\"INTEL-SA-00135\",\"INTEL-SA-00203\",\"INTEL-SA-00220\",\"INTEL-SA-00233\",\"INTEL-SA-00270\",\"INTEL-SA-00293\",\"INTEL-SA-00320\",\"INTEL-SA-00329\",\"INTEL-SA-00381\",\"INTEL-SA-00389\",\"INTEL-SA-00477\",\"INTEL-SA-00837\"]}]},\"signature\":\"a89c562e956b6567cae3782b017d66a62d5c1c172d12412535fc81e5534c8fe0b3dc624eb4613f6667aec9cc8d961658178f72aa8642a56fcddc90a4fd12e3f2\"}"},{"fmspc":"90C06F000000","tcbInfoIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICjTCCAjKgAwIBAgIUfjiC1ftVKUpASY5FhAPpFJG99FUwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTI1MDUwNjA5MjUwMFoXDTMyMDUwNjA5MjUwMFowbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABENFG8xzydWRfK92bmGv\nP+mAh91PEyV7Jh6FGJd5ndE9aBH7R3E4A7ubrlh/zN3C4xvpoouGlirMba+W2lju\nypajgbUwgbIwHwYDVR0jBBgwFoAUImUM1lqdNInzg7SVUr9QGzknBqwwUgYDVR0f\nBEswSTBHoEWgQ4ZBaHR0cHM6Ly9jZXJ0aWZpY2F0ZXMudHJ1c3RlZHNlcnZpY2Vz\nLmludGVsLmNvbS9JbnRlbFNHWFJvb3RDQS5kZXIwHQYDVR0OBBYEFH44gtX7VSlK\nQEmORYQD6RSRvfRVMA4GA1UdDwEB/wQEAwIGwDAMBgNVHRMBAf8EAjAAMAoGCCqG\nSM49BAMCA0kAMEYCIQDdmmRuAo3qCO8TC1IoJMITAoOEw4dlgEBHzSz1TuMSTAIh\nAKVTqOkt59+co0O3m3hC+v5Fb00FjYWcgeu3EijOULo5\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgG\nA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0\naW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYT\nAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEC6nEwMDIYZOj/iPWsCzaEKi7\n1OiOSLRFhWGjbnBVJfVnkY4u3IjkDYYL0MxO4mqsyYjlBalTVYxFP2sJBK5zlKOB\nuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBSBgNVHR8ESzBJ\nMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2VydmljZXMuaW50\nZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUImUM1lqdNInzg7SV\nUr9QGzknBqwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwCgYI\nKoZIzj0EAwIDSQAwRgIhAOW/5QkR+S9CiSDcNoowLuPRLsWGf/Yi7GSX94BgwTwg\nAiEA4J0lrHoMs+Xo5o/sX6O9QWxHRAvZUGOdRQ7cvqRXaqI=\n-----END CERTIFICATE-----\n","tcbInfo":"{\"tcbInfo\":{\"id\":\"TDX\",\"version\":3,\"issueDate\":\"2024-07-15T14:31:12Z\",\"nextUpdate\":\"2024-08-14T14:31:12Z\",\"fmspc\":\"90c06f000000\",\"pceId\":\"0000\",\"tcbType\":0,\"tcbEvaluationDataNumber\":16,\"tdxModule\":{\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\"},\"tdxModuleIdentities\":[{\"id\":\"TDX_03\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":2},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},{\"id\":\"TDX_01\",\"mrsigner\":\"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"attributes\":\"0000000000000000\",\"attributesMask\":\"FFFFFFFFFFFFFFFF\",\"tcbLevels\":[{\"tcb\":{\"isvsvn\":2},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]}],\"tcbLevels\":[{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":2,\"category\":\"BIOS\"},{\"svn\":3,\"category\":\"BIOS\"},{\"svn\":1,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":13,\"tdxtcbcomponents\":[{\"svn\":4,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"},{\"tcb\":{\"sgxtcbcomponents\":[{\"svn\":2,\"category\":\"BIOS\",\"type\":\"Early Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"SGX Late Microcode Update\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TXT SINIT\"},{\"svn\":2,\"category\":\"BIOS\"},{\"svn\":3,\"category\":\"BIOS\"},{\"svn\":1,\"category\":\"BIOS\"},{\"svn\":0},{\"svn\":3,\"category\":\"OS/VMM\",\"type\":\"SEAMLDR ACM\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}],\"pcesvn\":5,\"tdxtcbcomponents\":[{\"svn\":4,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":0,\"category\":\"OS/VMM\",\"type\":\"TDX Module\"},{\"svn\":2,\"category\":\"OS/VMM\",\"type\":\"TDX Late Microcode Update\"},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0},{\"svn\":0}]},\"tcbDate\":\"2018-01-04T00:00:00Z\",\"tcbStatus\":\"OutOfDate\",\"advisoryIDs\":[\"INTEL-SA-00106\",\"INTEL-SA-00115\",\"INTEL-SA-00135\",\"INTEL-SA-00203\",\"INTEL-SA-00220\",\"INTEL-SA-00233\",\"INTEL-SA-00270\",\"INTEL-SA-00293\",\"INTEL-SA-00320\",\"INTEL-SA-00329\",\"INTEL-SA-00381\",\"INTEL-SA-00389\",\"INTEL-SA-00477\",\"INTEL-SA-00837\"]}]},\"signature\":\"e8e15c17e42c84384e3731d2d6d2cdf01cd94b4e1e46fd72328d1f522661c06f7ee69e7c5e8f478bd4a68a230d54120c08fcfbae90684a37223d8580baa0ded5\"}"}],"qeIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICjTCCAjKgAwIBAgIUfjiC1ftVKUpASY5FhAPpFJG99FUwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTI1MDUwNjA5MjUwMFoXDTMyMDUwNjA5MjUwMFowbDEeMBwG\nA1UEAwwVSW50ZWwgU0dYIFRDQiBTaWduaW5nMRowGAYDVQQKDBFJbnRlbCBDb3Jw\nb3JhdGlvbjEUMBIGA1UEBwwLU2FudGEgQ2xhcmExCzAJBgNVBAgMAkNBMQswCQYD\nVQQGEwJVUzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABENFG8xzydWRfK92bmGv\nP+mAh91PEyV7Jh6FGJd5ndE9aBH7R3E4A7ubrlh/zN3C4xvpoouGlirMba+W2lju\nypajgbUwgbIwHwYDVR0jBBgwFoAUImUM1lqdNInzg7SVUr9QGzknBqwwUgYDVR0f\nBEswSTBHoEWgQ4ZBaHR0cHM6Ly9jZXJ0aWZpY2F0ZXMudHJ1c3RlZHNlcnZpY2Vz\nLmludGVsLmNvbS9JbnRlbFNHWFJvb3RDQS5kZXIwHQYDVR0OBBYEFH44gtX7VSlK\nQEmORYQD6RSRvfRVMA4GA1UdDwEB/wQEAwIGwDAMBgNVHRMBAf8EAjAAMAoGCCqG\nSM49BAMCA0kAMEYCIQDdmmRuAo3qCO8TC1IoJMITAoOEw4dlgEBHzSz1TuMSTAIh\nAKVTqOkt59+co0O3m3hC+v5Fb00FjYWcgeu3EijOULo5\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIw\naDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv\ncnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ\nBgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgG\nA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0\naW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYT\nAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEC6nEwMDIYZOj/iPWsCzaEKi7\n1OiOSLRFhWGjbnBVJfVnkY4u3IjkDYYL0MxO4mqsyYjlBalTVYxFP2sJBK5zlKOB\nuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBSBgNVHR8ESzBJ\nMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2VydmljZXMuaW50\nZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUImUM1lqdNInzg7SV\nUr9QGzknBqwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwCgYI\nKoZIzj0EAwIDSQAwRgIhAOW/5QkR+S9CiSDcNoowLuPRLsWGf/Yi7GSX94BgwTwg\nAiEA4J0lrHoMs+Xo5o/sX6O9QWxHRAvZUGOdRQ7cvqRXaqI=\n-----END CERTIFICATE-----\n","qeIdentity":"{\"enclaveIdentity\":{\"id\":\"TD_QE\",\"version\":2,\"issueDate\":\"2024-09-18T04:54:41Z\",\"nextUpdate\":\"2024-10-18T04:54:41Z\",\"tcbEvaluationDataNumber\":16,\"miscselect\":\"00000000\",\"miscselectMask\":\"FFFFFFFF\",\"attributes\":\"11000000000000000000000000000000\",\"attributesMask\":\"FBFFFFFFFFFFFFFF0000000000000000\",\"mrsigner\":\"DC9E2A7C6F948F17474E34A7FC43ED030F7C1563F1BABDDF6340C82E0E54A8C5\",\"isvprodid\":2,\"tcbLevels\":[{\"tcb\":{\"isvsvn\":4},\"tcbDate\":\"2023-08-09T00:00:00Z\",\"tcbStatus\":\"UpToDate\"}]},\"signature\":\"9a55465480464a6f8d234b427e9500019df8947eecb5db37fab5bb27728384d2b1b9b8cf7539321493be71daf4ae932ca80d77dc6794f4efd174105a072c57ae\"}"},"servtdCollateral":{"majorVersion":1,"minorVersion":0,"servtdTcbMapping":{"tdTcbMapping":{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","svnMappings":[{"tdMeasurements":{"tdinfo_hash":"1ADC25055B5188A615FF0A2B4781C0E1F38D4369CA688C775EE321E142FBE4534C14EDE61D9C570967996F6C8E8F5F76"},"isvsvn":1}]},"signature":"3066023100AC9506BE02C2BBD61C4489C35F59C31683DA3274D307DBCDC81FD271C68C8981A9D545A142C9F0E6EF8163ABD4CE4D7C023100B8E4E0BB11A1B21173EB4CFF0685A835A5B5FB3CD0BBEF80D940DC98A092E1F830872E978CBDDD46C3818F38A47B4DE1"},"servtdTcbMappingIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICGDCCAZ6gAwIBAgIUI2qCSZ4o/j7/l/3Nl6Ey59u103swCgYIKoZIzj0EAwMw\nNDEWMBQGA1UEAwwNTWlnVEQgUm9vdCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9y\nYXRpb24wHhcNMjYwNzIxMDIyNjIzWhcNMjcwNzIxMDIyNjIzWjA/MSEwHwYDVQQD\nDBhNaWdURCBUQ0IgTWFwcGluZyBJc3N1ZXIxGjAYBgNVBAoMEUludGVsIENvcnBv\ncmF0aW9uMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE0DLuzrOa8Iwlckmi+q5XRyga\nAOi/KmCuedEcxcIueU6YaG2zFdI/aP5Tg2BW0ibNrlwrIRuFO5yG/kVvLjqzPHXt\neKz6PGUsAzsjO0YO6oVxSehaGoteFOYHeRkzvTceo2YwZDALBgNVHQ8EBAMCB4Aw\nFQYDVR0lBA4wDAYKKwYBBAGB/VkBATAdBgNVHQ4EFgQUb1W97VrkSsQ2DLBf3pIy\nkYybJ9AwHwYDVR0jBBgwFoAUzbjA8WoRclwlFqbtJoFmo8DFKQ4wCgYIKoZIzj0E\nAwMDaAAwZQIxAMrEiV2BRq6Dlyj90ICNOIDGxeJDkgQgdh9QnCKGf4BzEvuM86D9\n/ohPFc+aPPM4ZQIwFRzINodzbocmwhHdY2gnMdBdZYSGcy5Os7k423D9f69HuTok\nWWQgNP2t1A+0CtbU\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIB+jCCAYCgAwIBAgIUMX1+LqRwwfhB6bDtTlX7N4iJhc0wCgYIKoZIzj0EAwMw\nNDEWMBQGA1UEAwwNTWlnVEQgUm9vdCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9y\nYXRpb24wHhcNMjYwNzIxMDIyNjIzWhcNMjcwNzIxMDIyNjIzWjA0MRYwFAYDVQQD\nDA1NaWdURCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3JhdGlvbjB2MBAG\nByqGSM49AgEGBSuBBAAiA2IABBptQ9M3xyA0cohyQFUukjbZhNgjosbK1Z7op9zQ\nu+IcCY58uSUulesJEt3Q5Ki30WQ5ThX8Lwc6CNjqDPNQqXaTyzcwMRAi7evnfsji\nywKjNxPUuDE6MmlTXG9SS3J+w6NTMFEwHQYDVR0OBBYEFM24wPFqEXJcJRam7SaB\nZqPAxSkOMB8GA1UdIwQYMBaAFM24wPFqEXJcJRam7SaBZqPAxSkOMA8GA1UdEwEB\n/wQFMAMBAf8wCgYIKoZIzj0EAwMDaAAwZQIwOtC/ZbeDkk6pjxeW5xb0Er5Vf88J\nB4rC1N27vz8JFEQ1cGVbVktZ1Ngg3C5foD+DAjEAg00nYaIHw1ZE/g/wyQLFfZhN\n07qIK1LbLfTcPDpWtW7UD5FvOAndCHyKTgq9cBbk\n-----END CERTIFICATE-----\n","servtdIdentity":{"tdIdentity":{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}],"xfam":"E718060000000000","attributes":"0000000000000000","mrConfigId":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwnerConfig":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrsigner":"","isvProdId":0},"signature":"3065023100C048747DDE26853EE68CC141DC885422A5431762DCB1D18A4B9EB49CDC2B56201B26B4155CCD2A03D496807CF72ED27902305DE5E032CE3C5CC172BA99163BBBCD2EEBB5B62100BFD3480E88DEA01976978839A28AFF7DEAA4E17F66E6473E8277CB"},"servtdIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICGDCCAZ6gAwIBAgIUI2qCSZ4o/j7/l/3Nl6Ey59u1030wCgYIKoZIzj0EAwMw\nNDEWMBQGA1UEAwwNTWlnVEQgUm9vdCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9y\nYXRpb24wHhcNMjYwNzIxMDIyNjIzWhcNMjcwNzIxMDIyNjIzWjA/MSEwHwYDVQQD\nDBhNaWdURCBUQ0IgTWFwcGluZyBJc3N1ZXIxGjAYBgNVBAoMEUludGVsIENvcnBv\ncmF0aW9uMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAExykffZEMbJoBRF1lBbOEQWIq\n8ugnf+sIW0R0kzgg/hJrzd0Tc/dx56YOMQ8uLajZJc6Uw/VCPTPcWIKNW+qDLq3p\nV/WYCLs2jQIK0Wi2DvXNHbdeRJ8r7m2b4Eet7ATuo2YwZDALBgNVHQ8EBAMCB4Aw\nFQYDVR0lBA4wDAYKKwYBBAGB/VkBATAdBgNVHQ4EFgQUDseXgtURvY6G41eQmO/I\nx/4jiEswHwYDVR0jBBgwFoAUzbjA8WoRclwlFqbtJoFmo8DFKQ4wCgYIKoZIzj0E\nAwMDaAAwZQIwQtZuyECGGaz+YIsK7MtQZs6L0sP0Yrsm84AScFx0gDwBBpbFsHIW\nOkgFBfATYt7yAjEAxg88iDqFGHWGLtS7fPvlmvP2zZIuLR5uSq2SQJu5hPfbZt86\nTAP6RHdEsC3vnTwS\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIB+jCCAYCgAwIBAgIUMX1+LqRwwfhB6bDtTlX7N4iJhc0wCgYIKoZIzj0EAwMw\nNDEWMBQGA1UEAwwNTWlnVEQgUm9vdCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9y\nYXRpb24wHhcNMjYwNzIxMDIyNjIzWhcNMjcwNzIxMDIyNjIzWjA0MRYwFAYDVQQD\nDA1NaWdURCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3JhdGlvbjB2MBAG\nByqGSM49AgEGBSuBBAAiA2IABBptQ9M3xyA0cohyQFUukjbZhNgjosbK1Z7op9zQ\nu+IcCY58uSUulesJEt3Q5Ki30WQ5ThX8Lwc6CNjqDPNQqXaTyzcwMRAi7evnfsji\nywKjNxPUuDE6MmlTXG9SS3J+w6NTMFEwHQYDVR0OBBYEFM24wPFqEXJcJRam7SaB\nZqPAxSkOMB8GA1UdIwQYMBaAFM24wPFqEXJcJRam7SaBZqPAxSkOMA8GA1UdEwEB\n/wQFMAMBAf8wCgYIKoZIzj0EAwMDaAAwZQIwOtC/ZbeDkk6pjxeW5xb0Er5Vf88J\nB4rC1N27vz8JFEQ1cGVbVktZ1Ngg3C5foD+DAjEAg00nYaIHw1ZE/g/wyQLFfZhN\n07qIK1LbLfTcPDpWtW7UD5FvOAndCHyKTgq9cBbk\n-----END CERTIFICATE-----\n","servtdCrl":"-----BEGIN X509 CRL-----\nMIIBFjCBnQIBATAKBggqhkjOPQQDAzA0MRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3JhdGlvbhcNMjYwNzIxMDIyNjIzWhcNMzYw\nNzE4MDIyNjIzWjAnMCUCFCNqgkmeKP4+/5f9zZehMufbtdN7Fw0yNjA3MjEwMjI2\nMjNaoA8wDTALBgNVHRQEBAICEAEwCgYIKoZIzj0EAwMDaAAwZQIxAP2GrM8v0FFl\nF6d3GC+T1CEAeKZ2Z/xM3iB6V3EV6fQn4s/mnMAuu/9KU+C/lbHSewIwfOlLUOLY\nWnt8YNyfwX056p+jkoxCUmEblYuYE51bsRudtPO6hHgUGpkAvgVmCOAz\n-----END X509 CRL-----\n"}},"signature":"306502310099D83914D7E9A875D6DEE09F5ABC0A03F0A13773A81A5B0AE49087C07BDD84AEC66FCDAB1BE952057791C4DE800AF81F02306EC82549F598294BAE7B2595AD66FC97A92CE8C406FFD9167F03F6FAE3B95AE7832F1EB821974103D4D9B2818D4D8142"} \ No newline at end of file diff --git a/src/policy/test/policy_v2/revocation/signer_chain.pem b/src/policy/test/policy_v2/revocation/signer_chain.pem new file mode 100644 index 000000000..8f6ebc20d --- /dev/null +++ b/src/policy/test/policy_v2/revocation/signer_chain.pem @@ -0,0 +1,27 @@ +-----BEGIN CERTIFICATE----- +MIICGDCCAZ6gAwIBAgIUI2qCSZ4o/j7/l/3Nl6Ey59u103swCgYIKoZIzj0EAwMw +NDEWMBQGA1UEAwwNTWlnVEQgUm9vdCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9y +YXRpb24wHhcNMjYwNzIxMDIyNjIzWhcNMjcwNzIxMDIyNjIzWjA/MSEwHwYDVQQD +DBhNaWdURCBUQ0IgTWFwcGluZyBJc3N1ZXIxGjAYBgNVBAoMEUludGVsIENvcnBv +cmF0aW9uMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE0DLuzrOa8Iwlckmi+q5XRyga +AOi/KmCuedEcxcIueU6YaG2zFdI/aP5Tg2BW0ibNrlwrIRuFO5yG/kVvLjqzPHXt +eKz6PGUsAzsjO0YO6oVxSehaGoteFOYHeRkzvTceo2YwZDALBgNVHQ8EBAMCB4Aw +FQYDVR0lBA4wDAYKKwYBBAGB/VkBATAdBgNVHQ4EFgQUb1W97VrkSsQ2DLBf3pIy +kYybJ9AwHwYDVR0jBBgwFoAUzbjA8WoRclwlFqbtJoFmo8DFKQ4wCgYIKoZIzj0E +AwMDaAAwZQIxAMrEiV2BRq6Dlyj90ICNOIDGxeJDkgQgdh9QnCKGf4BzEvuM86D9 +/ohPFc+aPPM4ZQIwFRzINodzbocmwhHdY2gnMdBdZYSGcy5Os7k423D9f69HuTok +WWQgNP2t1A+0CtbU +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIB+jCCAYCgAwIBAgIUMX1+LqRwwfhB6bDtTlX7N4iJhc0wCgYIKoZIzj0EAwMw +NDEWMBQGA1UEAwwNTWlnVEQgUm9vdCBDQTEaMBgGA1UECgwRSW50ZWwgQ29ycG9y +YXRpb24wHhcNMjYwNzIxMDIyNjIzWhcNMjcwNzIxMDIyNjIzWjA0MRYwFAYDVQQD +DA1NaWdURCBSb290IENBMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3JhdGlvbjB2MBAG +ByqGSM49AgEGBSuBBAAiA2IABBptQ9M3xyA0cohyQFUukjbZhNgjosbK1Z7op9zQ +u+IcCY58uSUulesJEt3Q5Ki30WQ5ThX8Lwc6CNjqDPNQqXaTyzcwMRAi7evnfsji +ywKjNxPUuDE6MmlTXG9SS3J+w6NTMFEwHQYDVR0OBBYEFM24wPFqEXJcJRam7SaB +ZqPAxSkOMB8GA1UdIwQYMBaAFM24wPFqEXJcJRam7SaBZqPAxSkOMA8GA1UdEwEB +/wQFMAMBAf8wCgYIKoZIzj0EAwMDaAAwZQIwOtC/ZbeDkk6pjxeW5xb0Er5Vf88J +B4rC1N27vz8JFEQ1cGVbVktZ1Ngg3C5foD+DAjEAg00nYaIHw1ZE/g/wyQLFfZhN +07qIK1LbLfTcPDpWtW7UD5FvOAndCHyKTgq9cBbk +-----END CERTIFICATE----- diff --git a/src/policy/test/policy_v2/servtd_collateral.json b/src/policy/test/policy_v2/servtd_collateral.json index 333e28f3f..fdd106337 100644 --- a/src/policy/test/policy_v2/servtd_collateral.json +++ b/src/policy/test/policy_v2/servtd_collateral.json @@ -1 +1 @@ -{"majorVersion":1,"minorVersion":0,"servtdIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICVzCCAd6gAwIBAgIUVKXleE/7DfWQZ7seyT3TqMXwAqcwCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI1MDkwNTA1NTI1M1oXDTI2MDkwNTA1\nNTI1M1owYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL1rH/Pc4KUchfNLqm2z\nWc1FC7RfBI4xGUSU/hBnRDmEj5HKWdN2p7YIeUn+z0RiYXUxr5nHed+pvaD2CZ1b\ny2wymsVZQpWIwtf8shfePFJcQrHsYsmmvvwi5ocOXe6ZkaNCMEAwHQYDVR0OBBYE\nFHIbR1J8L+HjJNaHdXioZJ5r9zrSMB8GA1UdIwQYMBaAFJYGgWjSezCJ0vsgGDCl\nW1a/KQLdMAoGCCqGSM49BAMDA2cAMGQCMCshcjFfbTVDx6XJL+ERXKqfTJdhK1oH\ntMQ+m74KW6AfKZt0lqZ5eeFXc/RFW8pKpQIwHsObyRhFH6OaFqxw+oItj2qCRUlz\ncCnHD8l/TBHhUoubb2OMLoENlBLECLtFHV2X\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICVDCCAdqgAwIBAgIUY4sE3O7mKGtP/otJ0s4WQtwn4ZswCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI1MDkwNTA1NDQ0M1oXDTMwMDkwNDA1NDQ0M1owdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhf4d4GTrO4NhJ24aG5A3i4Qu\nmwGZ+Jsfo3siVVy1/vke9tN+ylkZlR5M2bl4O4y2eeUMGrzwSu84L/7crgqnnZsH\nXrOQslNsSYJzB+YrbeJ1GBG+oDnCxvYgLTvCDtDio0IwQDAdBgNVHQ4EFgQUlgaB\naNJ7MInS+yAYMKVbVr8pAt0wHwYDVR0jBBgwFoAUpXzUSS/yVomZP8e814EZVbC8\nFY0wCgYIKoZIzj0EAwMDaAAwZQIwHoKqUxUqI2Zw8omp82svEjmN477njoK9YtOU\nXtukW4+7RkU6VqSR6ND/9H83PMrLAjEAkPcCM/8QG3yZL1pxvKv87JwOIMJd5eUu\nQDT7gy1UxPCjOETC2ygJyjJdYxBbXQrr\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUeUyrqFAE0stc3jxOpGo12mTasB0wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI1MDkwNTA1NDIxNVoXDTM1MDkwMzA1NDIxNVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEDnCmBt1r87/4VTwChvkyyrbfL79z5cx0NrVN4Gmp6HvpndL95MCd\nArnSdslXL/WmupFbxzy+a6mP4jdmR3oC7KyEaCKftOAct+Pz/e1KVI+QA3arR3IK\nxW5TYzSQpoMdo1MwUTAdBgNVHQ4EFgQUpXzUSS/yVomZP8e814EZVbC8FY0wHwYD\nVR0jBBgwFoAUpXzUSS/yVomZP8e814EZVbC8FY0wDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjBLN5JiAwPChO4RWfAMy+XjUbllaTFTxRqwCRliwx0v\nf4aNNQ6Vrzv3pYXXmwl0CaoCMGFKKLm6EVwvQcILpSL3JpkfcKMfsUlJgdkVlF/W\nrPSb+wS9KsT0dcF2DU5F12BycQ==\n-----END CERTIFICATE-----\n","servtdIdentity":{"tdIdentity":{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbEvaluationNumber":1,"xfam":"E71A060000000000","attributes":"0000000000000000","mrConfigId":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrOwnerConfig":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","mrsigner":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","isvProdId":1,"tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}]},"signature":"3064023028CAFFB4B83AD5A8E00A2FD7BDA58E176495E5591E1D9EB9FBC80FD0ABFDA06705B316AD2299BFCD07B82524336328A102306A11A93912045B2438FCD719F84F78D0CDB91CCFC9ED55FF49B47C518CC6071D0B5662E3AECAB78E786000C477A18773"},"servtdTcbMappingIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICVzCCAd6gAwIBAgIUVKXleE/7DfWQZ7seyT3TqMXwAqcwCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI1MDkwNTA1NTI1M1oXDTI2MDkwNTA1\nNTI1M1owYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL1rH/Pc4KUchfNLqm2z\nWc1FC7RfBI4xGUSU/hBnRDmEj5HKWdN2p7YIeUn+z0RiYXUxr5nHed+pvaD2CZ1b\ny2wymsVZQpWIwtf8shfePFJcQrHsYsmmvvwi5ocOXe6ZkaNCMEAwHQYDVR0OBBYE\nFHIbR1J8L+HjJNaHdXioZJ5r9zrSMB8GA1UdIwQYMBaAFJYGgWjSezCJ0vsgGDCl\nW1a/KQLdMAoGCCqGSM49BAMDA2cAMGQCMCshcjFfbTVDx6XJL+ERXKqfTJdhK1oH\ntMQ+m74KW6AfKZt0lqZ5eeFXc/RFW8pKpQIwHsObyRhFH6OaFqxw+oItj2qCRUlz\ncCnHD8l/TBHhUoubb2OMLoENlBLECLtFHV2X\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICVDCCAdqgAwIBAgIUY4sE3O7mKGtP/otJ0s4WQtwn4ZswCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI1MDkwNTA1NDQ0M1oXDTMwMDkwNDA1NDQ0M1owdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhf4d4GTrO4NhJ24aG5A3i4Qu\nmwGZ+Jsfo3siVVy1/vke9tN+ylkZlR5M2bl4O4y2eeUMGrzwSu84L/7crgqnnZsH\nXrOQslNsSYJzB+YrbeJ1GBG+oDnCxvYgLTvCDtDio0IwQDAdBgNVHQ4EFgQUlgaB\naNJ7MInS+yAYMKVbVr8pAt0wHwYDVR0jBBgwFoAUpXzUSS/yVomZP8e814EZVbC8\nFY0wCgYIKoZIzj0EAwMDaAAwZQIwHoKqUxUqI2Zw8omp82svEjmN477njoK9YtOU\nXtukW4+7RkU6VqSR6ND/9H83PMrLAjEAkPcCM/8QG3yZL1pxvKv87JwOIMJd5eUu\nQDT7gy1UxPCjOETC2ygJyjJdYxBbXQrr\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUeUyrqFAE0stc3jxOpGo12mTasB0wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI1MDkwNTA1NDIxNVoXDTM1MDkwMzA1NDIxNVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEDnCmBt1r87/4VTwChvkyyrbfL79z5cx0NrVN4Gmp6HvpndL95MCd\nArnSdslXL/WmupFbxzy+a6mP4jdmR3oC7KyEaCKftOAct+Pz/e1KVI+QA3arR3IK\nxW5TYzSQpoMdo1MwUTAdBgNVHQ4EFgQUpXzUSS/yVomZP8e814EZVbC8FY0wHwYD\nVR0jBBgwFoAUpXzUSS/yVomZP8e814EZVbC8FY0wDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjBLN5JiAwPChO4RWfAMy+XjUbllaTFTxRqwCRliwx0v\nf4aNNQ6Vrzv3pYXXmwl0CaoCMGFKKLm6EVwvQcILpSL3JpkfcKMfsUlJgdkVlF/W\nrPSb+wS9KsT0dcF2DU5F12BycQ==\n-----END CERTIFICATE-----\n","servtdTcbMapping":{"tdTcbMapping":{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","mrSigner":"00000000000000000000000000000000","isvProdId":1,"svnMappings":[{"tdMeasurements":{"mrtd":"E2C7DA7CF0D93973480F0A34A6FE52A204EA81B4F1B6CD16018F5B4CAEE7B3B544A9738464A7C95E1705E20687A0ADA6","rtmr0":"518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4","rtmr1":"518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4"},"isvsvn":1}]},"signature":"306602310096D8260507E3F02698895732273709837C0CBF42DA29AA0891A18F8F4FEC648826E1E0DFB5C590B953F65B5EFB77F0B8023100B18CC20F8EF7C1D4E1CBCAEFF17C0722AC6213A0B7E83FDD580CA760BBDA91D25E714CFA2240BCEBDF039646D749ED84"}} \ No newline at end of file +{"majorVersion":1,"minorVersion":0,"servtdTcbMapping":{"tdTcbMapping":{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","svnMappings":[{"tdMeasurements":{"tdinfo_hash":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"},"isvsvn":1}]},"signature":"306502302DF213408E43734941EE22050FB1566E9C3AB600D0C0ADE9EDD99A0C91E2D2E44DD54C6B6658C5C2277BD63EF6EE33B702310092B91C8CDED39E93D0E67B02813388445116123AA2298E956559917FE817B8143CA12A9352DA7CCEC2F6D1F58E025F92"},"servtdTcbMappingIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICfzCCAgWgAwIBAgIUb4Ary1FxNDv2tgK5KjW92D71wx8wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcyMTAyMjIzMVoXDTI3MDcyMTAy\nMjIzMVowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL+t1XLepbWKHwd7iVJl\nUy3P5ZC/XmlelGaGAVHtzT+uyqf95dCdppfmATm5iL6mPCMi/B0EdUVWC8IsRrAb\ntIVKOT+6uQvaqjgBDy8/jpULNFU2amH+tFXaK+3mI3FoXaNpMGcwDgYDVR0PAQH/\nBAQDAgeAMBUGA1UdJQQOMAwGCisGAQQBgf1ZAQEwHQYDVR0OBBYEFAQ3bgBAZVtA\nxB6bSKABbGXJzUg9MB8GA1UdIwQYMBaAFKrpv7T3Goq7ozzv7XybB7KDXfwqMAoG\nCCqGSM49BAMDA2gAMGUCMAC9OBINzzySAY9e6iqUSdueZuL6hNbS7FJjzd4AhLBt\naFDNptrDJzq8QG7TqgDZVAIxAOH/CNjzoJ4Vy/9Wc1gYQvFp/Y8OyIchE+LooQim\n3TOl4G9HofEZt+KxtJ2RtWDESw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUDNYWZVBywkKMCpLBMn/ZrbpVAngwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTMxMDcyMDAyMjIzMVowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhtbR7QbD7v9wmJHiLUdRE9SX\nOeGsIpHD2yVPsKeYthmXkK9URtDY4DoeUIxjTPOvJPuH+oGBxuJoQB1DlHNud1e4\nARK1un5WLqJQAM7YH4MDk4e8IgzildxR68Wf5S4Mo2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUqum/tPcairujPO/tfJsHsoNd\n/CowHwYDVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwCgYIKoZIzj0EAwMD\naAAwZQIwTq/MJUn2EN0Ky18A4BLrKyJvrpozm2JLzPZeMJC7JS8hLCXOtpTF1V9l\ngSKpqbi9AjEAuMTlfVDUvFQGMR6cAOKScwHOJnUMB5eyyIg7AYlY5WcjwLNaV//d\nzw3fC7CR1QR/\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTmEV7kebAA5XSFYNCudbbU/Co8wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTM2MDcxODAyMjIzMVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEKVtiVC3icjTPZ6yEwO46wmbk38a9N5GZEkTnjXypSwTsC/GfXLA4\ne4wvvwZ/1+sGrogN5DBX/auAFeicLw0CMFNiSocyqalh+LNjYB0vkBLqC5+PQoCa\navI9zsLmyJjUo1MwUTAdBgNVHQ4EFgQULZkd6aI5/Xdm7qbmkrf4JOIgdtEwHwYD\nVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjAGWyxXJ4x3oWj1xDkLpcsYCBas0SNIGhXHPQmMbVqM\nmtcDX//3RwD26+yBeZguCIYCMHgCQotN2FZ9PHwcmkA5tQkusL4Ab55d9JfvkjZ7\nHFibzfq7pmApshWt7mQ80fRu/Q==\n-----END CERTIFICATE-----\n","servtdIdentity":{"tdIdentity":{"id":"A0998F0F-B2F3-4872-8138-FBC2B853E8C6","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","tcbLevels":[{"tcb":{"isvsvn":1},"tcbDate":"2024-01-01T00:00:00Z","tcbStatus":"UpToDate"}]},"signature":"3066023100A3895AA95723C3DD3975C55480676494940833B0F9D83F8E7DD8F011DEF212B3326EE32FFA1BDF3C41941FF4D4FD86E6023100A5A52A633A85C39D9FE64516256763ADC84E2D548655935508053FD61AA03DB8CDA1FD5116E5A38CD08DAA2C44FFB42C"},"servtdIdentityIssuerChain":"-----BEGIN CERTIFICATE-----\nMIICfzCCAgWgAwIBAgIUb4Ary1FxNDv2tgK5KjW92D71wx8wCgYIKoZIzj0EAwMw\ndDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEiMCAGA1UECgwZTWlnVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwV\nTWlnVEQgSW50ZXJtZWRpYXRlIENBMB4XDTI2MDcyMTAyMjIzMVoXDTI3MDcyMTAy\nMjIzMVowYzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50\nYSBDbGFyYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRowGAYDVQQDDBFNaWdURCBJ\nbmZvIElzc3VlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABL+t1XLepbWKHwd7iVJl\nUy3P5ZC/XmlelGaGAVHtzT+uyqf95dCdppfmATm5iL6mPCMi/B0EdUVWC8IsRrAb\ntIVKOT+6uQvaqjgBDy8/jpULNFU2amH+tFXaK+3mI3FoXaNpMGcwDgYDVR0PAQH/\nBAQDAgeAMBUGA1UdJQQOMAwGCisGAQQBgf1ZAQEwHQYDVR0OBBYEFAQ3bgBAZVtA\nxB6bSKABbGXJzUg9MB8GA1UdIwQYMBaAFKrpv7T3Goq7ozzv7XybB7KDXfwqMAoG\nCCqGSM49BAMDA2gAMGUCMAC9OBINzzySAY9e6iqUSdueZuL6hNbS7FJjzd4AhLBt\naFDNptrDJzq8QG7TqgDZVAIxAOH/CNjzoJ4Vy/9Wc1gYQvFp/Y8OyIchE+LooQim\n3TOl4G9HofEZt+KxtJ2RtWDESw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICdTCCAfugAwIBAgIUDNYWZVBywkKMCpLBMn/ZrbpVAngwCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTMxMDcyMDAyMjIzMVowdDELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEiMCAGA1UECgwZTWln\nVEQgSW50ZXJtZWRpYXRlIElzc3VlcjEeMBwGA1UEAwwVTWlnVEQgSW50ZXJtZWRp\nYXRlIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhtbR7QbD7v9wmJHiLUdRE9SX\nOeGsIpHD2yVPsKeYthmXkK9URtDY4DoeUIxjTPOvJPuH+oGBxuJoQB1DlHNud1e4\nARK1un5WLqJQAM7YH4MDk4e8IgzildxR68Wf5S4Mo2MwYTAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUqum/tPcairujPO/tfJsHsoNd\n/CowHwYDVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwCgYIKoZIzj0EAwMD\naAAwZQIwTq/MJUn2EN0Ky18A4BLrKyJvrpozm2JLzPZeMJC7JS8hLCXOtpTF1V9l\ngSKpqbi9AjEAuMTlfVDUvFQGMR6cAOKScwHOJnUMB5eyyIg7AYlY5WcjwLNaV//d\nzw3fC7CR1QR/\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICTzCCAdagAwIBAgIUYTmEV7kebAA5XSFYNCudbbU/Co8wCgYIKoZIzj0EAwMw\nXzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFy\nYTEVMBMGA1UECgwMTWlnVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENB\nMB4XDTI2MDcyMTAyMjIzMVoXDTM2MDcxODAyMjIzMVowXzELMAkGA1UEBhMCVVMx\nCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEVMBMGA1UECgwMTWln\nVEQgSXNzdWVyMRYwFAYDVQQDDA1NaWdURCBSb290IENBMHYwEAYHKoZIzj0CAQYF\nK4EEACIDYgAEKVtiVC3icjTPZ6yEwO46wmbk38a9N5GZEkTnjXypSwTsC/GfXLA4\ne4wvvwZ/1+sGrogN5DBX/auAFeicLw0CMFNiSocyqalh+LNjYB0vkBLqC5+PQoCa\navI9zsLmyJjUo1MwUTAdBgNVHQ4EFgQULZkd6aI5/Xdm7qbmkrf4JOIgdtEwHwYD\nVR0jBBgwFoAULZkd6aI5/Xdm7qbmkrf4JOIgdtEwDwYDVR0TAQH/BAUwAwEB/zAK\nBggqhkjOPQQDAwNnADBkAjAGWyxXJ4x3oWj1xDkLpcsYCBas0SNIGhXHPQmMbVqM\nmtcDX//3RwD26+yBeZguCIYCMHgCQotN2FZ9PHwcmkA5tQkusL4Ab55d9JfvkjZ7\nHFibzfq7pmApshWt7mQ80fRu/Q==\n-----END CERTIFICATE-----\n"} \ No newline at end of file diff --git a/src/policy/test/policy_v2/tcb_mapping.json b/src/policy/test/policy_v2/tcb_mapping.json index 3a2a362dd..0c92d8be9 100644 --- a/src/policy/test/policy_v2/tcb_mapping.json +++ b/src/policy/test/policy_v2/tcb_mapping.json @@ -1 +1 @@ -{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","mrSigner":"00000000000000000000000000000000","isvProdId":1,"svnMappings":[{"tdMeasurements":{"mrtd":"E2C7DA7CF0D93973480F0A34A6FE52A204EA81B4F1B6CD16018F5B4CAEE7B3B544A9738464A7C95E1705E20687A0ADA6","rtmr0":"518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4","rtmr1":"518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4", "rtmr3":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"},"isvsvn":1}]} \ No newline at end of file +{"id":"BB9668CA-4EE8-4523-941A-B3B03BE46E03","version":1,"issueDate":"2025-01-01T00:00:00Z","nextUpdate":"2026-01-01T00:00:00Z","svnMappings":[{"tdMeasurements":{"tdinfo_hash":"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"},"isvsvn":1},{"tdMeasurements":{"tdinfo_hash":"111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111"},"isvsvn":2}]} \ No newline at end of file diff --git a/tools/migtd-hash/Cargo.toml b/tools/migtd-hash/Cargo.toml index c918ee0c0..878111f0c 100644 --- a/tools/migtd-hash/Cargo.toml +++ b/tools/migtd-hash/Cargo.toml @@ -10,8 +10,17 @@ anyhow = "1.0" clap = { version = "4.0", features = ["derive"] } crypto = { path = "../../src/crypto" } env_logger = "0.10" +hex = "0.4" log = "0.4" -migtd = { path = "../../src/migtd", default-features = false } +# NOTE: We intentionally do NOT depend on the `migtd` crate here. Depending on +# `migtd` with `policy_v2` enabled drags in `attestation/attest-lib-ext`, which +# in turn builds the SGX `servtd_attest` C library — and that requires a +# special host link step (defining `__ImageBase`) to produce a working host +# binary. migtd-hash only needs a handful of constants (CFV size, FFS GUIDs, +# the test-disable-RA event tag), which are inlined in src/migtd_consts.rs. +policy = { path = "../../src/policy", default-features = false, features = ["policy_v2"] } +r-efi = "3.2.0" serde_json = "1.0" +td-layout = { path = "../../deps/td-shim/td-layout" } td-shim-tools = { path = "../../deps/td-shim/td-shim-tools", default-features = false, features = ["tee"] } -td-shim-interface = { path = "../../deps/td-shim/td-shim-interface" } \ No newline at end of file +td-shim-interface = { path = "../../deps/td-shim/td-shim-interface" } diff --git a/tools/migtd-hash/readme.md b/tools/migtd-hash/readme.md index bcc95d095..2736e9fc9 100644 --- a/tools/migtd-hash/readme.md +++ b/tools/migtd-hash/readme.md @@ -32,11 +32,36 @@ popd ./target/debug/migtd-hash --manifest config/servtd_info.json --image <migtd.bin> --verbose ``` - - Calculate migtd SERVTD_INFO_HASH and update tcb_mapping.json (For policy v2) + - Calculate the current `tdinfo_hash` and add it to a cumulative policy-v2 + TCB mapping: ``` - ./target/debug/migtd-hash --manifest config/servtd_info.json --image <migtd.bin> --update-tcb-mapping <tcb_mapping.json> --policy-v2 --verbose + ./target/debug/migtd-hash \ + --manifest config/servtd_info.json \ + --image <migtd.bin> \ + --policy-v2 \ + --update-tcb-mapping <previous-release-tcb_mapping.json> \ + --output-tcb-mapping <new-release-tcb_mapping.json> \ + --mapping-isvsvn <svn> \ + --verbose ``` + Existing hashes are retained, the current hash is replaced by key, and + entries are sorted by uppercase hash for stable signing input. Conflicting + duplicate hashes are rejected. Use + `config/templates/tcb_mapping_seed.json` only when no prior release exists. + + - Explicitly revoke a historical hash without measuring an image: + ``` + ./target/debug/migtd-hash \ + --policy-v2 \ + --update-tcb-mapping <previous-release-tcb_mapping.json> \ + --output-tcb-mapping <new-release-tcb_mapping.json> \ + --revoke-tdinfo-hash <96-hex-character-hash> + ``` + + Revoking an unknown hash is an error. Omitting a historical entry from a new + release is not a supported removal mechanism. + - Generate migtd SERVTD_HASH with debug infomation: ``` ./target/debug/migtd-hash --manifest config/servtd_info.json --image <migtd.bin> --servtd-attr 0 --calc-servtd-hash --verbose diff --git a/tools/migtd-hash/src/lib.rs b/tools/migtd-hash/src/lib.rs index 61046dbf9..161561738 100644 --- a/tools/migtd-hash/src/lib.rs +++ b/tools/migtd-hash/src/lib.rs @@ -4,14 +4,9 @@ use anyhow::{anyhow, Error, Result}; use crypto::{hash::digest_sha384, SHA384_DIGEST_SIZE}; -use migtd::{ - config::{ - CONFIG_VOLUME_SIZE, MIGTD_POLICY_FFS_GUID, MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID, - MIGTD_ROOT_CA_FFS_GUID, - }, - event_log::TEST_DISABLE_RA_AND_ACCEPT_ALL_EVENT, -}; +use serde_json::{json, Value}; use std::{ + collections::{BTreeMap, BTreeSet}, fs::File, io::{Read, Seek, SeekFrom}, mem::size_of, @@ -19,6 +14,13 @@ use std::{ use td_shim_interface::td_uefi_pi::{fv, pi}; use td_shim_tools::tee_info_hash::{Manifest, TdInfoStruct}; +mod migtd_consts; +use migtd_consts::{ + CONFIG_VOLUME_SIZE, MIGTD_POLICY_FFS_GUID, MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID, + MIGTD_ROOT_CA_FFS_GUID, MIGTD_SERVTD_SIGNER_ANCHOR_FFS_GUID, + TEST_DISABLE_RA_AND_ACCEPT_ALL_EVENT, +}; + const MIGTD_IMAGE_SIZE: u64 = 0x100_0000; pub const SERVTD_TYPE_MIGTD: u16 = 0; @@ -34,16 +36,31 @@ const SERVTD_ATTR_IGNORE_RTMR1: u64 = 0x80_0000_0000; const SERVTD_ATTR_IGNORE_RTMR2: u64 = 0x100_0000_0000; const SERVTD_ATTR_IGNORE_RTMR3: u64 = 0x200_0000_0000; -pub fn build_td_info( +/// Build the unmasked TDINFO_STRUCT from the MigTD image and its manifest. +/// +/// MRTD/RTMR0 are derived from the IGVM image's measured pages alone. +/// RTMR1/RTMR2 are derived from the CFV contents (policy issuer chain + +/// signed policyData fields). The build pipeline produces a base IGVM with +/// dummy CFV contents; the release pipeline injects the production policy + +/// chain into the same base IGVM via `td-shim-enroll` (no Rust rebuild) and +/// then calls this function on the re-enrolled binary to get the production +/// `tdinfo_hash`. There is therefore no projection / override path here: +/// what the IGVM contains is what we measure. +/// +/// This does NOT apply any `servtd_attr` ignore-bit masking. Call +/// [`apply_servtd_attr_masks`] separately if you need a masked copy. The +/// unmasked struct is required for the `tdinfo_hash` field of v2 TCB mappings: +/// `tdinfo_hash = SHA384(unmasked_TDINFO) = init_servtd_info_hash` when +/// `servtd_attr == 0`. +pub fn build_td_info_unmasked( manifest: &[u8], mut image: File, is_ra_disabled: bool, is_policy_v2: bool, - servtd_attr: u64, igvmformat: bool, ) -> Result<TdInfoStruct, Error> { // Initialize the configurable fields of TD info structure. - let manifest = serde_json::from_slice::<Manifest>(&manifest)?; + let manifest = serde_json::from_slice::<Manifest>(manifest)?; let mut td_info = TdInfoStruct { attributes: manifest.attributes, xfam: manifest.xfam, @@ -54,15 +71,12 @@ pub fn build_td_info( }; if igvmformat { - // Calculate the MRTD with MigTD image td_info.build_igvmmrtd(&mut image); } else { - // Calculate the MRTD with MigTD image td_info.build_mrtd(&mut image, MIGTD_IMAGE_SIZE); } - // Calculate RTMR0 and RTMR1 td_info.build_rtmr_with_seperator(0); - // Calculate RTMR2 with CFV + let mut cfv = vec![0u8; CONFIG_VOLUME_SIZE]; image.seek(SeekFrom::Start(0))?; if igvmformat { @@ -77,6 +91,28 @@ pub fn build_td_info( .rtmr2 .copy_from_slice(rtmr2(&cfv, is_ra_disabled, is_policy_v2)?.as_slice()); + Ok(td_info) +} + +/// Field-by-field clone of a [`TdInfoStruct`] (which does not derive [`Clone`]). +pub fn clone_td_info(td: &TdInfoStruct) -> TdInfoStruct { + TdInfoStruct { + attributes: td.attributes, + xfam: td.xfam, + mrtd: td.mrtd, + mrconfig_id: td.mrconfig_id, + mrowner: td.mrowner, + mrownerconfig: td.mrownerconfig, + rtmr0: td.rtmr0, + rtmr1: td.rtmr1, + rtmr2: td.rtmr2, + rtmr3: td.rtmr3, + reserved: td.reserved, + } +} + +/// Apply the `IGNORE_*` masks in `servtd_attr` to `td_info` in place. +pub fn apply_servtd_attr_masks(td_info: &mut TdInfoStruct, servtd_attr: u64) { if (servtd_attr & SERVTD_ATTR_IGNORE_ATTRIBUTES) != 0 { td_info.attributes.fill(0); } @@ -107,7 +143,21 @@ pub fn build_td_info( if (servtd_attr & SERVTD_ATTR_IGNORE_RTMR3) != 0 { td_info.rtmr3.fill(0); } +} +/// Backwards-compatible wrapper that builds the TDINFO_STRUCT and applies the +/// `servtd_attr` ignore-bit masks in one shot. +pub fn build_td_info( + manifest: &[u8], + image: File, + is_ra_disabled: bool, + is_policy_v2: bool, + servtd_attr: u64, + igvmformat: bool, +) -> Result<TdInfoStruct, Error> { + let mut td_info = + build_td_info_unmasked(manifest, image, is_ra_disabled, is_policy_v2, igvmformat)?; + apply_servtd_attr_masks(&mut td_info, servtd_attr); Ok(td_info) } @@ -120,6 +170,131 @@ pub fn calculate_servtd_info_hash(td_info: TdInfoStruct) -> Result<Vec<u8>, Erro digest_sha384(&buffer).map_err(|_| anyhow!("Calculate digest")) } +/// Compute the canonical v2 `tdinfo_hash` for a production MigTD (attr=0). +/// +/// Definition (per TDX module spec and `doc/tcb_mapping_design_proposal.md`): +/// `tdinfo_hash = SHA384(TDINFO_STRUCT_512_bytes)` +/// +/// This equals `init_servtd_info_hash` in SERVTD_EXT_STRUCT when `servtd_attr +/// == 0` (the production profile), enabling direct MAA lookup through +/// `svnMappings[].tdMeasurements.tdinfo_hash`. +pub fn calculate_tdinfo_hash(td_info: TdInfoStruct) -> Result<Vec<u8>, Error> { + calculate_servtd_info_hash(td_info) +} + +fn canonical_tdinfo_hash(hash: &str) -> Result<String> { + let bytes = + hex::decode(hash.trim()).map_err(|_| anyhow!("tdinfo_hash is not valid hexadecimal"))?; + if bytes.len() != SHA384_DIGEST_SIZE { + return Err(anyhow!( + "tdinfo_hash is {} bytes, expected {}", + bytes.len(), + SHA384_DIGEST_SIZE + )); + } + Ok(hex::encode_upper(bytes)) +} + +/// Add, replace, or explicitly revoke entries in a v2 TCB mapping. +/// +/// Existing mappings are retained by default. Duplicate hashes with the same +/// SVN are collapsed, while conflicting duplicate hashes are rejected. The +/// result is sorted by the canonical uppercase hash and serialized without a +/// trailing newline so repeated updates produce stable signing input. +pub fn update_tcb_mapping_v2( + input: &[u8], + current_mapping: Option<(&[u8], u16)>, + revoked_hashes: &[String], +) -> Result<Vec<u8>> { + let mut document: Value = + serde_json::from_slice(input).map_err(|e| anyhow!("invalid TCB mapping JSON: {e}"))?; + let svn_mappings = document + .get_mut("svnMappings") + .and_then(Value::as_array_mut) + .ok_or_else(|| anyhow!("'svnMappings' missing or not an array"))?; + + let mut mappings = BTreeMap::<String, u16>::new(); + for (index, mapping) in svn_mappings.iter().enumerate() { + let hash = mapping + .get("tdMeasurements") + .and_then(|measurements| measurements.get("tdinfo_hash")) + .and_then(Value::as_str) + .ok_or_else(|| { + anyhow!("svnMappings[{index}].tdMeasurements.tdinfo_hash missing or not a string") + })?; + let hash = canonical_tdinfo_hash(hash) + .map_err(|e| anyhow!("invalid svnMappings[{index}] tdinfo_hash: {e}"))?; + let svn = mapping + .get("isvsvn") + .and_then(Value::as_u64) + .and_then(|svn| u16::try_from(svn).ok()) + .ok_or_else(|| anyhow!("svnMappings[{index}].isvsvn missing or outside u16 range"))?; + + if let Some(previous_svn) = mappings.insert(hash.clone(), svn) { + if previous_svn != svn { + return Err(anyhow!( + "conflicting duplicate tdinfo_hash {hash}: SVN {previous_svn} and {svn}" + )); + } + } + } + + let mut revocations = BTreeSet::new(); + for hash in revoked_hashes { + revocations.insert( + canonical_tdinfo_hash(hash) + .map_err(|e| anyhow!("invalid revoked tdinfo_hash '{hash}': {e}"))?, + ); + } + + let current_mapping = current_mapping + .map(|(hash, svn)| { + if hash.len() != SHA384_DIGEST_SIZE { + return Err(anyhow!( + "current tdinfo_hash is {} bytes, expected {}", + hash.len(), + SHA384_DIGEST_SIZE + )); + } + Ok((hex::encode_upper(hash), svn)) + }) + .transpose()?; + + if let Some((hash, _)) = ¤t_mapping { + if revocations.contains(hash) { + return Err(anyhow!( + "tdinfo_hash {hash} cannot be added and revoked in the same update" + )); + } + } + + for hash in revocations { + if mappings.remove(&hash).is_none() { + return Err(anyhow!( + "cannot revoke unknown tdinfo_hash {hash}; no mapping was removed" + )); + } + } + + if let Some((hash, svn)) = current_mapping { + mappings.insert(hash, svn); + } + + *svn_mappings = mappings + .into_iter() + .map(|(hash, svn)| { + json!({ + "tdMeasurements": { + "tdinfo_hash": hash, + }, + "isvsvn": svn, + }) + }) + .collect(); + + serde_json::to_vec(&document).map_err(|e| anyhow!("failed to serialize TCB mapping: {e}")) +} + fn rtmr1( cfv: &[u8], rtmr1: &[u8; SHA384_DIGEST_SIZE], @@ -127,13 +302,31 @@ fn rtmr1( ) -> Result<Vec<u8>, Error> { let mut rtmr1 = Rtmr::new_with_value(rtmr1); if is_policy_v2 { - let policy_issuer_chain = fv::get_file_from_fv( + // Prefer the 48-byte signer-anchor slot (CoRIM-only enrollment); fall + // back to the policy issuer chain PEM (legacy JSON enrollment). Both + // resolve to the same RTMR1 anchor via `resolve_signer_anchor`. + let anchor_source = fv::get_file_from_fv( cfv, pi::fv::FV_FILETYPE_RAW, - MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID, + MIGTD_SERVTD_SIGNER_ANCHOR_FFS_GUID, ) - .ok_or(anyhow!("Unable to get policy issuer chain from image"))?; - rtmr1.extend_with_raw_data(policy_issuer_chain)?; + .or_else(|| { + fv::get_file_from_fv( + cfv, + pi::fv::FV_FILETYPE_RAW, + MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID, + ) + }) + .ok_or(anyhow!( + "Unable to get signer anchor / policy issuer chain from image" + ))?; + + // v2: extend with SHA384(signer_anchor) where + // signer_anchor = SHA384("MIGTD-RTMR1-ANCHOR-V1" || 0x00 || + // SHA384(root_der) || 0x00 || leaf_eku_oid_der) + let anchor = policy::resolve_signer_anchor(anchor_source) + .map_err(|e| anyhow!("Failed to resolve signer anchor: {:?}", e))?; + rtmr1.extend_with_raw_data(&anchor)?; } Ok(rtmr1.as_bytes().to_vec()) @@ -144,9 +337,25 @@ fn rtmr2(cfv: &[u8], is_ra_disabled: bool, is_policy_v2: bool) -> Result<Vec<u8> if !is_ra_disabled { let policy = fv::get_file_from_fv(cfv, pi::fv::FV_FILETYPE_RAW, MIGTD_POLICY_FFS_GUID) .ok_or(anyhow!("Unable to get policy from image"))?; - rtmr2.extend_with_raw_data(policy)?; - if !is_policy_v2 { + if is_policy_v2 { + // v2 (single-extend RTMR2): one extend over the canonical bytes + // of `policyData` with `servtdCollateral.servtdTcbMapping` + // removed. See doc/tcb_mapping_design_proposal.md. The exact same + // helper is used by the runtime (`get_policy_and_measure`) and + // the integrity verifier (`check_policy_integrity`), so a + // mismatch here would also break runtime attestation — there is + // no separate "offline format". + // + // The bytes are taken straight from the CFV's enrolled policy; + // the release pipeline injects the production-signed policy via + // `td-shim-enroll` before this function is called, so what we + // measure here is what the shipped IGVM will produce at runtime. + let policy_data_bytes = policy::extract_canonical_policy_data_bytes(policy) + .map_err(|e| anyhow!("Failed to extract canonical policyData bytes: {:?}", e))?; + rtmr2.extend_with_raw_data(&policy_data_bytes)?; + } else { + rtmr2.extend_with_raw_data(policy)?; let root_ca = fv::get_file_from_fv(cfv, pi::fv::FV_FILETYPE_RAW, MIGTD_ROOT_CA_FFS_GUID) .ok_or(anyhow!("Unable to get root CA from image"))?; @@ -220,3 +429,185 @@ fn calculate_digest(data: &[u8]) -> Result<Vec<u8>, Error> { Ok(digest) } + +#[cfg(test)] +mod tests { + use super::migtd_consts::{ + CONFIG_VOLUME_SIZE, MIGTD_POLICY_FFS_GUID, MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID, + MIGTD_ROOT_CA_FFS_GUID, TEST_DISABLE_RA_AND_ACCEPT_ALL_EVENT, + }; + use super::update_tcb_mapping_v2; + use r_efi::efi::Guid; + use serde_json::Value; + use td_layout::build_time::TD_SHIM_CONFIG_SIZE; + + const HASH_11: &str = + "111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111"; + const HASH_AA: &str = + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; + + // Drift-guards: these constants are duplicated from the `migtd` crate so + // this tool does not transitively pull in the SGX attestation static lib. + // If `migtd::config::*` or `migtd::event_log::*` ever change, the + // upstream values must be updated here AND below to keep them in sync. + + #[test] + fn config_volume_size_matches_td_layout() { + assert_eq!(CONFIG_VOLUME_SIZE, TD_SHIM_CONFIG_SIZE as usize); + } + + #[test] + fn migtd_policy_ffs_guid_matches_upstream() { + let expected = Guid::from_fields( + 0x0BE92DC3, + 0x6221, + 0x4C98, + 0x87, + 0xC1, + &[0x8E, 0xEF, 0xFD, 0x70, 0xDE, 0x5A], + ); + assert_eq!(MIGTD_POLICY_FFS_GUID.as_bytes(), expected.as_bytes()); + } + + #[test] + fn migtd_root_ca_ffs_guid_matches_upstream() { + let expected = Guid::from_fields( + 0xCA437832, + 0x4C51, + 0x4322, + 0xB1, + 0x3D, + &[0xA2, 0x1B, 0xD0, 0xC8, 0xFF, 0xF6], + ); + assert_eq!(MIGTD_ROOT_CA_FFS_GUID.as_bytes(), expected.as_bytes()); + } + + #[test] + fn migtd_policy_issuer_chain_ffs_guid_matches_upstream() { + let expected = Guid::from_fields( + 0x3F2FB27A, + 0x9596, + 0x431C, + 0xA6, + 0x8D, + &[0xD3, 0xEA, 0xB3, 0x9F, 0x8A, 0xEB], + ); + assert_eq!( + MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID.as_bytes(), + expected.as_bytes() + ); + } + + #[test] + fn test_disable_ra_event_matches_upstream() { + assert_eq!( + TEST_DISABLE_RA_AND_ACCEPT_ALL_EVENT, + b"test_disable_ra_and_accept_all" + ); + } + + #[test] + fn tcb_mapping_add_retains_historical_releases() { + let input = format!( + r#"{{"id":"mapping","svnMappings":[{{"tdMeasurements":{{"tdinfo_hash":"{HASH_AA}"}},"isvsvn":1}}]}}"# + ); + let current = [0x11u8; 48]; + + let output = update_tcb_mapping_v2(input.as_bytes(), Some((¤t, 2)), &[]).unwrap(); + let value: Value = serde_json::from_slice(&output).unwrap(); + let mappings = value["svnMappings"].as_array().unwrap(); + + assert_eq!(mappings.len(), 2); + assert_eq!(mappings[0]["tdMeasurements"]["tdinfo_hash"], HASH_11); + assert_eq!(mappings[0]["isvsvn"], 2); + assert_eq!(mappings[1]["tdMeasurements"]["tdinfo_hash"], HASH_AA); + assert_eq!(mappings[1]["isvsvn"], 1); + } + + #[test] + fn tcb_mapping_two_phase_uses_authority_history_not_mock_output() { + let historical_hash = "22".repeat(48); + let authority = format!( + r#"{{"svnMappings":[{{"tdMeasurements":{{"tdinfo_hash":"{historical_hash}"}},"isvsvn":1}}]}}"# + ); + let mock_hash = [0x33u8; 48]; + let real_hash = [0x44u8; 48]; + + let phase_one = + update_tcb_mapping_v2(authority.as_bytes(), Some((&mock_hash, 2)), &[]).unwrap(); + let phase_one: Value = serde_json::from_slice(&phase_one).unwrap(); + assert!(phase_one["svnMappings"] + .as_array() + .unwrap() + .iter() + .any(|mapping| mapping["tdMeasurements"]["tdinfo_hash"] == "33".repeat(48))); + + // The measured-image phase must restart from the authority input, not + // from phase one's generated output containing the transient mock hash. + let final_mapping = + update_tcb_mapping_v2(authority.as_bytes(), Some((&real_hash, 2)), &[]).unwrap(); + let final_mapping: Value = serde_json::from_slice(&final_mapping).unwrap(); + let mappings = final_mapping["svnMappings"].as_array().unwrap(); + + assert_eq!(mappings.len(), 2); + assert!(mappings + .iter() + .any(|mapping| mapping["tdMeasurements"]["tdinfo_hash"] == historical_hash)); + assert!(mappings + .iter() + .any(|mapping| mapping["tdMeasurements"]["tdinfo_hash"] == "44".repeat(48))); + assert!(!mappings + .iter() + .any(|mapping| mapping["tdMeasurements"]["tdinfo_hash"] == "33".repeat(48))); + } + + #[test] + fn tcb_mapping_replace_same_hash_is_deterministic() { + let input = format!( + r#"{{"svnMappings":[{{"isvsvn":1,"tdMeasurements":{{"tdinfo_hash":"{}"}}}}]}}"#, + HASH_AA.to_ascii_lowercase() + ); + let current = [0xAAu8; 48]; + + let first = update_tcb_mapping_v2(input.as_bytes(), Some((¤t, 7)), &[]).unwrap(); + let second = update_tcb_mapping_v2(&first, Some((¤t, 7)), &[]).unwrap(); + let value: Value = serde_json::from_slice(&first).unwrap(); + + assert_eq!(first, second); + assert_eq!(value["svnMappings"].as_array().unwrap().len(), 1); + assert_eq!( + value["svnMappings"][0]["tdMeasurements"]["tdinfo_hash"], + HASH_AA + ); + assert_eq!(value["svnMappings"][0]["isvsvn"], 7); + } + + #[test] + fn tcb_mapping_rejects_conflicting_duplicate_hashes() { + let input = format!( + r#"{{"svnMappings":[ + {{"tdMeasurements":{{"tdinfo_hash":"{HASH_AA}"}},"isvsvn":1}}, + {{"tdMeasurements":{{"tdinfo_hash":"{}"}},"isvsvn":2}} + ]}}"#, + HASH_AA.to_ascii_lowercase() + ); + + let error = update_tcb_mapping_v2(input.as_bytes(), None, &[]).unwrap_err(); + assert!(error + .to_string() + .contains("conflicting duplicate tdinfo_hash")); + } + + #[test] + fn tcb_mapping_revocation_must_be_explicit_and_match() { + let input = format!( + r#"{{"svnMappings":[{{"tdMeasurements":{{"tdinfo_hash":"{HASH_AA}"}},"isvsvn":1}}]}}"# + ); + + let output = update_tcb_mapping_v2(input.as_bytes(), None, &[HASH_AA.to_string()]).unwrap(); + let value: Value = serde_json::from_slice(&output).unwrap(); + assert!(value["svnMappings"].as_array().unwrap().is_empty()); + + assert!(update_tcb_mapping_v2(input.as_bytes(), None, &[HASH_11.to_string()]).is_err()); + } +} diff --git a/tools/migtd-hash/src/main.rs b/tools/migtd-hash/src/main.rs index 9a2b24fec..63b1d2968 100644 --- a/tools/migtd-hash/src/main.rs +++ b/tools/migtd-hash/src/main.rs @@ -6,7 +6,9 @@ use anyhow::{anyhow, Context}; use clap::Parser; use log::debug; use migtd_hash::{ - build_td_info, calculate_servtd_hash, calculate_servtd_info_hash, SERVTD_TYPE_MIGTD, + apply_servtd_attr_masks, build_td_info_unmasked, calculate_servtd_hash, + calculate_servtd_info_hash, calculate_tdinfo_hash, clone_td_info, update_tcb_mapping_v2, + SERVTD_TYPE_MIGTD, }; use serde_json::{json, Value}; use std::{ @@ -14,6 +16,7 @@ use std::{ path::{Path, PathBuf}, process::exit, }; +use td_shim_tools::tee_info_hash::TdInfoStruct; const SERVTD_HASH_KEY: &str = "servtdHash"; const SERVTD_INFO_HASH_KEY: &str = "servtdInfoHash"; @@ -22,16 +25,89 @@ fn bytes_to_hex(bytes: &[u8]) -> String { bytes.iter().map(|byte| format!("{:02x}", byte)).collect() } -fn update_tcb_mapping_file( - path: &Path, +/// Decode `field` from a hex string in `value`, expecting `expected_len` bytes. +fn decode_hex_field(value: &Value, field: &str, expected_len: usize) -> anyhow::Result<Vec<u8>> { + let s = value + .get(field) + .and_then(Value::as_str) + .ok_or_else(|| anyhow!("'{}' missing or not a string in report JSON", field))?; + let bytes = hex::decode(s.trim()) + .with_context(|| format!("Failed to hex-decode '{}': {}", field, s))?; + if bytes.len() != expected_len { + return Err(anyhow!( + "'{}' is {} bytes, expected {}", + field, + bytes.len(), + expected_len + )); + } + Ok(bytes) +} + +/// Build an unmasked TdInfoStruct directly from an azcvm-extract-report JSON +/// dump. The report's RTMR2 value is taken verbatim (it is already the +/// runtime measurement extended by the live MigTD; no offline recomputation +/// is needed or possible without the matching IGVM + policy). +fn build_td_info_from_report(report_path: &Path) -> anyhow::Result<TdInfoStruct> { + let raw = fs::read(report_path) + .with_context(|| format!("Failed to read {}", report_path.display()))?; + let v: Value = serde_json::from_slice(&raw) + .with_context(|| format!("Failed to parse {}", report_path.display()))?; + + let mut td = TdInfoStruct::default(); + td.attributes + .copy_from_slice(&decode_hex_field(&v, "attributes", 8)?); + td.xfam.copy_from_slice(&decode_hex_field(&v, "xfam", 8)?); + td.mrtd.copy_from_slice(&decode_hex_field(&v, "mrtd", 48)?); + td.mrconfig_id + .copy_from_slice(&decode_hex_field(&v, "mrConfigId", 48)?); + td.mrowner + .copy_from_slice(&decode_hex_field(&v, "mrOwner", 48)?); + td.mrownerconfig + .copy_from_slice(&decode_hex_field(&v, "mrOwnerConfig", 48)?); + td.rtmr0 + .copy_from_slice(&decode_hex_field(&v, "rtmr0", 48)?); + td.rtmr1 + .copy_from_slice(&decode_hex_field(&v, "rtmr1", 48)?); + td.rtmr2 + .copy_from_slice(&decode_hex_field(&v, "rtmr2", 48)?); + td.rtmr3 + .copy_from_slice(&decode_hex_field(&v, "rtmr3", 48)?); + Ok(td) +} + +fn update_tcb_mapping_file_v2( + input_path: &Path, + output_path: &Path, + current_mapping: Option<(&[u8], u16)>, + revoked_hashes: &[String], +) -> anyhow::Result<()> { + let manifest = + fs::read(input_path).with_context(|| format!("Failed to read {}", input_path.display()))?; + let serialized = update_tcb_mapping_v2(&manifest, current_mapping, revoked_hashes) + .with_context(|| format!("Failed to update {}", input_path.display()))?; + fs::write(output_path, serialized).with_context(|| { + format!( + "Failed to write updated tcb mapping to {}", + output_path.display() + ) + })?; + println!("Updated {} successfully.", output_path.display()); + Ok(()) +} + +/// Legacy v1 writer: writes mrtd/rtmr0/rtmr1 into the TCB mapping file. +fn update_tcb_mapping_file_v1( + input_path: &Path, + output_path: &Path, mrtd: &[u8], rtmr0: &[u8], rtmr1: &[u8], ) -> anyhow::Result<()> { - let manifest = - fs::read_to_string(path).with_context(|| format!("Failed to read {}", path.display()))?; + let manifest = fs::read_to_string(input_path) + .with_context(|| format!("Failed to read {}", input_path.display()))?; let mut tcb_mapping: Value = serde_json::from_str(&manifest) - .with_context(|| format!("Failed to parse {}", path.display()))?; + .with_context(|| format!("Failed to parse {}", input_path.display()))?; let svn_mappings = tcb_mapping .get_mut("svnMappings") @@ -39,18 +115,18 @@ fn update_tcb_mapping_file( .ok_or_else(|| { anyhow!( "'svnMappings' missing or not an array in {}", - path.display() + input_path.display() ) })?; let td_measurements = svn_mappings .get_mut(0) - .ok_or_else(|| anyhow!("'svnMappings' array is empty in {}", path.display()))? + .ok_or_else(|| anyhow!("'svnMappings' array is empty in {}", input_path.display()))? .get_mut("tdMeasurements") .and_then(Value::as_object_mut) .ok_or_else(|| { anyhow!( "'tdMeasurements' missing or not an object in {}", - path.display() + input_path.display() ) })?; @@ -67,22 +143,37 @@ fn update_tcb_mapping_file( let serialized = serde_json::to_string(&tcb_mapping).with_context(|| { format!( "Failed to serialize updated tcb mapping for {}", - path.display() + input_path.display() ) })?; - fs::write(path, serialized) - .with_context(|| format!("Failed to write updated tcb mapping to {}", path.display()))?; - println!("Updated {} successfully.", path.display()); + fs::write(output_path, serialized).with_context(|| { + format!( + "Failed to write updated tcb mapping to {}", + output_path.display() + ) + })?; + println!("Updated {} successfully.", output_path.display()); Ok(()) } #[derive(Clone, Parser)] struct Config { - /// A json format manifest that contains values of TD info fields + /// A json format manifest that contains values of TD info fields. + /// Required when using `--image`; ignored with `--from-report`. #[clap(short, long)] - pub manifest: String, - /// Path of MigTD image file + pub manifest: Option<String>, + /// Path of MigTD image file. + /// Required when computing measurements from a build artifact; mutually + /// exclusive with `--from-report`. #[clap(short, long)] - pub image: String, + pub image: Option<String>, + /// Path of a `migtd_report_data.json` produced by `azcvm-extract-report` + /// (camelCase fields: mrtd, rtmr0..3, attributes, xfam, mrConfigId, + /// mrOwner, mrOwnerConfig — all hex). When set, the TDINFO_STRUCT is + /// taken verbatim from the report and `--image`/`--manifest` are not + /// needed. Intended for the AzCVMEmu mock-report flow where no IGVM is + /// available. Requires `--policy-v2`. + #[clap(long, conflicts_with_all = ["image", "manifest"])] + pub from_report: Option<PathBuf>, /// Output binary of tee info hash #[clap(short, long)] pub output_file: Option<PathBuf>, @@ -104,12 +195,32 @@ struct Config { /// Output in TD Info in JSON format #[clap(long)] pub output_td_info: Option<PathBuf>, + /// Output the v2-style `tdinfo_hash` (= SHA384(TDINFO_STRUCT), equals + /// `init_servtd_info_hash` for attr=0) as a hex-encoded text file. + /// ALWAYS uses unmasked TDINFO regardless of `--servtd-attr`. + #[clap(long)] + pub output_tdinfo_hash: Option<PathBuf>, /// Enable verbose logging #[clap(short, long)] pub verbose: bool, - /// Update the provided tcb_mapping JSON with the generated TD measurements + /// Update the provided tcb_mapping JSON with the generated TD measurements. + /// For v2 (`--policy-v2`), writes `tdinfo_hash` to `tdMeasurements`. + /// For v1, writes `mrtd`/`rtmr0`/`rtmr1`. #[clap(long)] pub update_tcb_mapping: Option<PathBuf>, + /// Write the updated TCB mapping to a separate path instead of replacing + /// `--update-tcb-mapping`. This preserves the previous signed release + /// artifact as the input history. + #[clap(long, requires = "update_tcb_mapping")] + pub output_tcb_mapping: Option<PathBuf>, + /// ISV SVN assigned to the generated v2 `tdinfo_hash`. Required when + /// `--policy-v2` updates a mapping from an image or report. + #[clap(long, requires = "update_tcb_mapping")] + pub mapping_isvsvn: Option<u16>, + /// Explicitly remove a previously supported v2 `tdinfo_hash`. May be + /// repeated. Revoking an unknown hash is an error. + #[clap(long, requires = "update_tcb_mapping")] + pub revoke_tdinfo_hash: Vec<String>, } fn main() { @@ -127,93 +238,165 @@ fn main() { } debug!("Starting migtd-hash tool"); - debug!("Image: {}", config.image); - debug!("Manifest: {}", config.manifest); - let imagename = config.image.clone(); - let mut igvmformat = false; - - debug!("Opening image file: {}", config.image); - let image = File::open(config.image).unwrap_or_else(|e| { - eprintln!("Failed to open MigTD image: {}", e); - exit(1); - }); - debug!("Reading manifest file: {}", config.manifest); - let manifest = fs::read(config.manifest).unwrap_or_else(|e| { - eprintln!("Failed to open manifest file: {}", e); + let servtd_attr = config.servtd_attr.unwrap_or(0); + debug!("ServTD attributes: {:#x}", servtd_attr); + + if !config.policy_v2 + && (config.mapping_isvsvn.is_some() || !config.revoke_tdinfo_hash.is_empty()) + { + eprintln!("mapping SVN and revocation options require --policy-v2"); exit(1); - }); + } + + let has_measurement_input = config.from_report.is_some() || config.image.is_some(); + if !has_measurement_input + && config.policy_v2 + && config.update_tcb_mapping.is_some() + && !config.revoke_tdinfo_hash.is_empty() + { + if config.mapping_isvsvn.is_some() { + eprintln!("--mapping-isvsvn requires --image or --from-report"); + exit(1); + } + if config.manifest.is_some() + || config.output_file.is_some() + || config.output_td_info.is_some() + || config.output_tdinfo_hash.is_some() + || config.servtd_attr.is_some() + || config.calc_servtd_hash + || config.json + || config.test_disable_ra_and_accept_all + { + eprintln!("measurement and hash options require --image or --from-report"); + exit(1); + } + + let input_path = config.update_tcb_mapping.as_ref().unwrap(); + let output_path = config + .output_tcb_mapping + .as_deref() + .unwrap_or(input_path.as_path()); + if let Err(e) = + update_tcb_mapping_file_v2(input_path, output_path, None, &config.revoke_tdinfo_hash) + { + eprintln!("Failed to update tcb_mapping file: {}", e); + exit(1); + } + return; + } + + // Branch 1: --from-report mode. Build TDINFO from the saved report JSON + // directly. RTMR2 is taken verbatim from the report (it was extended at + // runtime by the live MigTD). --image / --manifest are rejected by clap, + // so we only need to honor the output flags. + let unmasked_td_info = if let Some(report_path) = &config.from_report { + if !config.policy_v2 { + eprintln!("--from-report requires --policy-v2"); + exit(1); + } + debug!("Loading TDINFO from report JSON: {}", report_path.display()); + build_td_info_from_report(report_path).unwrap_or_else(|e| { + eprintln!("Failed to build TD info from report: {:?}", e); + exit(1); + }) + } else { + // Branch 2: image+manifest mode (original behavior). What we measure + // is what the IGVM's CFV contains; the release pipeline uses + // `td-shim-enroll` (no Rust rebuild) to inject the production policy + // and issuer chain into the base IGVM before calling this tool. + let image_path = config.image.as_deref().unwrap_or_else(|| { + eprintln!("Either --image (with --manifest) or --from-report must be supplied"); + exit(1); + }); + let manifest_path = config.manifest.as_deref().unwrap_or_else(|| { + eprintln!("--image requires --manifest"); + exit(1); + }); + + debug!("Image: {}", image_path); + debug!("Manifest: {}", manifest_path); + let imagename = image_path.to_string(); + let mut igvmformat = false; + + debug!("Opening image file: {}", image_path); + let image = File::open(image_path).unwrap_or_else(|e| { + eprintln!("Failed to open MigTD image: {}", e); + exit(1); + }); - assert_eq!( - imagename.contains(".igvm") || imagename.contains(".bin"), - true - ); + debug!("Reading manifest file: {}", manifest_path); + let manifest = fs::read(manifest_path).unwrap_or_else(|e| { + eprintln!("Failed to open manifest file: {}", e); + exit(1); + }); + + assert_eq!( + imagename.contains(".igvm") || imagename.contains(".bin"), + true + ); + + if imagename.contains(".igvm") { + igvmformat = true; + debug!("Detected IGVM format"); + } else { + debug!("Detected BIN format"); + } + + debug!("Building TD info structure (unmasked)..."); + build_td_info_unmasked( + &manifest, + image, + config.test_disable_ra_and_accept_all, + config.policy_v2, + igvmformat, + ) + .unwrap_or_else(|e| { + eprintln!("Failed to build TD info: {:?}", e); + exit(1); + }) + }; - if imagename.contains(".igvm") { - igvmformat = true; - debug!("Detected IGVM format"); + // Compute the canonical v2 tdinfo_hash from the UNMASKED TDINFO. This is + // what gets written into the TCB mapping and equals `init_servtd_info_hash` + // for an attr=0 MigTD (tdinfo_hash = SHA384(TDINFO_STRUCT)). + let tdinfo_hash_v2 = if config.policy_v2 { + Some( + calculate_tdinfo_hash(clone_td_info(&unmasked_td_info)).unwrap_or_else(|e| { + eprintln!("Failed to calculate tdinfo_hash: {:?}", e); + exit(1); + }), + ) } else { - debug!("Detected BIN format"); + None + }; + + if let Some(ref hash) = tdinfo_hash_v2 { + debug!("tdinfo_hash (unmasked, attr=0): {}", bytes_to_hex(hash)); } - let servtd_attr = config.servtd_attr.unwrap_or(0); - debug!("ServTD attributes: {:#x}", servtd_attr); + if let Some(output_tdinfo_hash) = &config.output_tdinfo_hash { + let hash = tdinfo_hash_v2 + .as_ref() + .expect("--output-tdinfo-hash requires --policy-v2"); + debug!("Writing tdinfo_hash to: {:?}", output_tdinfo_hash); + fs::write(output_tdinfo_hash, bytes_to_hex(hash)).unwrap_or_else(|e| { + eprintln!("Failed to write tdinfo_hash file: {}", e); + exit(1); + }); + } - debug!("Building TD info structure..."); - let td_info = build_td_info( - &manifest, - image, - config.test_disable_ra_and_accept_all, - config.policy_v2, - servtd_attr, - igvmformat, - ) - .unwrap_or_else(|e| { - eprintln!("Failed to build TD info: {:?}", e); - exit(1); - }); + // Apply the (possibly masked) servtd_attr to produce the td_info used for + // the remaining outputs (`--output-file`, `--output-td-info`). + let mut td_info = clone_td_info(&unmasked_td_info); + apply_servtd_attr_masks(&mut td_info, servtd_attr); debug!("td_info: {:?}", td_info); - debug!( - "MRTD: {}", - td_info - .mrtd - .iter() - .map(|b| format!("{:02x}", b)) - .collect::<String>() - ); - debug!( - "RTMR0: {}", - td_info - .rtmr0 - .iter() - .map(|b| format!("{:02x}", b)) - .collect::<String>() - ); - debug!( - "RTMR1: {}", - td_info - .rtmr1 - .iter() - .map(|b| format!("{:02x}", b)) - .collect::<String>() - ); - debug!( - "RTMR2: {}", - td_info - .rtmr2 - .iter() - .map(|b| format!("{:02x}", b)) - .collect::<String>() - ); - debug!( - "RTMR3: {}", - td_info - .rtmr3 - .iter() - .map(|b| format!("{:02x}", b)) - .collect::<String>() - ); + debug!("MRTD: {}", bytes_to_hex(&td_info.mrtd)); + debug!("RTMR0: {}", bytes_to_hex(&td_info.rtmr0)); + debug!("RTMR1: {}", bytes_to_hex(&td_info.rtmr1)); + debug!("RTMR2: {}", bytes_to_hex(&td_info.rtmr2)); + debug!("RTMR3: {}", bytes_to_hex(&td_info.rtmr3)); if let Some(output_td_info) = config.output_td_info { debug!("Writing TD Info to: {:?}", output_td_info); @@ -237,12 +420,34 @@ fn main() { debug!("Updating tcb_mapping file..."); if let Some(tcb_mapping_path) = &config.update_tcb_mapping { - if let Err(e) = update_tcb_mapping_file( - tcb_mapping_path, - &td_info.mrtd, - &td_info.rtmr0, - &td_info.rtmr1, - ) { + let output_path = config + .output_tcb_mapping + .as_deref() + .unwrap_or(tcb_mapping_path.as_path()); + let result = if config.policy_v2 { + let hash = tdinfo_hash_v2 + .as_ref() + .expect("v2 tcb-mapping update requires tdinfo_hash to be computed"); + let isvsvn = config.mapping_isvsvn.unwrap_or_else(|| { + eprintln!("--mapping-isvsvn is required with --policy-v2 --update-tcb-mapping"); + exit(1); + }); + update_tcb_mapping_file_v2( + tcb_mapping_path, + output_path, + Some((hash, isvsvn)), + &config.revoke_tdinfo_hash, + ) + } else { + update_tcb_mapping_file_v1( + tcb_mapping_path, + output_path, + &td_info.mrtd, + &td_info.rtmr0, + &td_info.rtmr1, + ) + }; + if let Err(e) = result { eprintln!("Failed to update tcb_mapping file: {}", e); exit(1); } @@ -253,13 +458,7 @@ fn main() { eprintln!("Failed to calculate hash: {:?}", e); exit(1); }); - debug!( - "servtd_info_hash: {}", - servtd_info_hash - .iter() - .map(|b| format!("{:02x}", b)) - .collect::<String>() - ); + debug!("servtd_info_hash: {}", bytes_to_hex(&servtd_info_hash)); debug!("Calculating servtd_hash..."); let servtd_hash = calculate_servtd_hash(&servtd_info_hash, SERVTD_TYPE_MIGTD, servtd_attr) @@ -267,13 +466,7 @@ fn main() { eprintln!("Failed to calculate hash: {:?}", e); exit(1); }); - debug!( - "servtd_hash: {}", - servtd_hash - .iter() - .map(|b| format!("{:02x}", b)) - .collect::<String>() - ); + debug!("servtd_hash: {}", bytes_to_hex(&servtd_hash)); let (hash, key) = if config.calc_servtd_hash { debug!("Using servtd_hash (final hash)"); @@ -287,7 +480,7 @@ fn main() { debug!("Writing hash to file: {:?}", output_file); if config.json { let json = json!({ - key: hash.iter().map(|b| format!("{:02x}", b)).collect::<String>(), + key: bytes_to_hex(&hash), }); fs::write(output_file, serde_json::to_string(&json).unwrap()).unwrap_or_else(|e| { eprintln!("Failed to write output file: {}", e); @@ -303,16 +496,11 @@ fn main() { debug!("Hash calculation complete"); if config.json { let json = json!({ - key: hash.iter().map(|b| format!("{:02x}", b)).collect::<String>(), + key: bytes_to_hex(&hash), }); println!("{}", serde_json::to_string_pretty(&json).unwrap()) } else { - println!( - "{}", - hash.iter() - .map(|byte| format!("{:02x}", byte)) - .collect::<String>() - ) + println!("{}", bytes_to_hex(&hash)) } } } diff --git a/tools/migtd-hash/src/migtd_consts.rs b/tools/migtd-hash/src/migtd_consts.rs new file mode 100644 index 000000000..f42f35805 --- /dev/null +++ b/tools/migtd-hash/src/migtd_consts.rs @@ -0,0 +1,69 @@ +// Copyright (c) 2025 Intel Corporation / Microsoft +// +// SPDX-License-Identifier: BSD-2-Clause-Patent + +//! Constants duplicated from the `migtd` crate so this offline tool does not +//! have to depend on `migtd`. Depending on `migtd` with `policy_v2` enabled +//! transitively activates `attestation/attest-lib-ext`, which builds the SGX +//! `servtd_attest` C library and produces an unresolved `__ImageBase` symbol +//! when linking a normal host binary. +//! +//! The values here MUST stay in sync with `src/migtd/src/config.rs` and +//! `src/migtd/src/event_log.rs`. A test below pins each constant to its +//! upstream byte pattern so any drift fails at `cargo test -p migtd-hash`. + +use r_efi::efi::Guid; +use td_layout::build_time::TD_SHIM_CONFIG_SIZE; + +/// Size (in bytes) of the Configuration Firmware Volume (CFV) section of the +/// MigTD IGVM/binary image. +pub const CONFIG_VOLUME_SIZE: usize = TD_SHIM_CONFIG_SIZE as usize; + +/// FFS GUID of the migration policy file embedded in CFV. +/// Mirrors `migtd::config::MIGTD_POLICY_FFS_GUID`. +pub const MIGTD_POLICY_FFS_GUID: Guid = Guid::from_fields( + 0x0BE92DC3, + 0x6221, + 0x4C98, + 0x87, + 0xC1, + &[0x8E, 0xEF, 0xFD, 0x70, 0xDE, 0x5A], +); + +/// FFS GUID of the root CA file embedded in CFV. +/// Mirrors `migtd::config::MIGTD_ROOT_CA_FFS_GUID`. +pub const MIGTD_ROOT_CA_FFS_GUID: Guid = Guid::from_fields( + 0xCA437832, + 0x4C51, + 0x4322, + 0xB1, + 0x3D, + &[0xA2, 0x1B, 0xD0, 0xC8, 0xFF, 0xF6], +); + +/// FFS GUID of the policy-issuer certificate chain file embedded in CFV. +/// Mirrors `migtd::config::MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID`. +pub const MIGTD_POLICY_ISSUER_CHAIN_FFS_GUID: Guid = Guid::from_fields( + 0x3F2FB27A, + 0x9596, + 0x431C, + 0xA6, + 0x8D, + &[0xD3, 0xEA, 0xB3, 0x9F, 0x8A, 0xEB], +); + +/// FFS GUID of the 48-byte RTMR1 signer anchor (CoRIM-only enrollment form). +/// Mirrors `migtd::config::MIGTD_SERVTD_SIGNER_ANCHOR_FFS_GUID`. +pub const MIGTD_SERVTD_SIGNER_ANCHOR_FFS_GUID: Guid = Guid::from_fields( + 0x2B9D5A84, + 0x6F3C, + 0x4E71, + 0x8A, + 0x2D, + &[0x0C, 0x7E, 0x1F, 0x4B, 0x6A, 0x93], +); + +/// Marker event written into the event log when MigTD is built with the +/// `test_disable_ra_and_accept_all` feature. +/// Mirrors `migtd::event_log::TEST_DISABLE_RA_AND_ACCEPT_ALL_EVENT`. +pub const TEST_DISABLE_RA_AND_ACCEPT_ALL_EVENT: &[u8] = b"test_disable_ra_and_accept_all"; diff --git a/tools/migtd-policy-generator/readme.md b/tools/migtd-policy-generator/readme.md index a176a70ed..e10d41b2a 100644 --- a/tools/migtd-policy-generator/readme.md +++ b/tools/migtd-policy-generator/readme.md @@ -30,4 +30,9 @@ popd - Package a v2 policy data without signature: ``` ./target/debug/migtd-policy-generator v2 --policy-data /path/to/policy_data.json --collaterals config/collateral_pre_production_fmspc.json --servtd-collateral /path/to/servtd_collateral.json -o policy_data_full.json + ``` + +- Package CoRIM-only policy data with the authoritative signer CRL: + ``` + ./target/debug/migtd-policy-generator v2 --policy-data /path/to/policy_data.json --collaterals config/collateral_pre_production_fmspc.json --servtd-crl /path/to/servtd_crl.pem -o policy_data_full.json ``` \ No newline at end of file diff --git a/tools/migtd-policy-generator/src/main.rs b/tools/migtd-policy-generator/src/main.rs index eb2929c21..6b14540f6 100644 --- a/tools/migtd-policy-generator/src/main.rs +++ b/tools/migtd-policy-generator/src/main.rs @@ -47,6 +47,11 @@ struct V2Command { #[arg(long, value_name = "FILE")] servtd_collateral: Option<PathBuf>, + /// Locally-authoritative PEM CRL for servTD signer chains. This can be + /// supplied without --servtd-collateral for CoRIM-only policies. + #[arg(long, value_name = "FILE")] + servtd_crl: Option<PathBuf>, + /// Output file path #[arg(long, short, value_name = "FILE")] output: PathBuf, @@ -79,18 +84,19 @@ async fn main() { eprintln!("error: the required arguments were not provided: --collaterals <FILE>"); exit(1); }); - let servtd_collateral_path = cmd.servtd_collateral.as_ref().unwrap_or_else(|| { - eprintln!( - "error: the required arguments were not provided: --servtd-collateral <FILE>" - ); + // `--servtd-collateral` is optional: when omitted, a CoRIM-only + // policy (no `servtdCollateral`) is produced and the servtd + // endorsement is delivered as a separately-enrolled CoRIM. + let merged = build_v2_policy_data( + &cmd.policy_data, + collateral_path, + cmd.servtd_collateral.as_deref(), + cmd.servtd_crl.as_deref(), + ) + .unwrap_or_else(|e| { + eprintln!("Failed to generate v2 policy data: {}", e); exit(1); }); - let merged = - build_v2_policy_data(&cmd.policy_data, collateral_path, servtd_collateral_path) - .unwrap_or_else(|e| { - eprintln!("Failed to generate v2 policy data: {}", e); - exit(1); - }); if let Err(e) = fs::write(&cmd.output, merged) { eprintln!("Failed to write output file: {}", e); exit(1); diff --git a/tools/migtd-policy-generator/src/policy_v2.rs b/tools/migtd-policy-generator/src/policy_v2.rs index b91bf71a4..75610e192 100644 --- a/tools/migtd-policy-generator/src/policy_v2.rs +++ b/tools/migtd-policy-generator/src/policy_v2.rs @@ -9,11 +9,11 @@ use std::{fs, path::Path}; pub fn build_v2_policy_data( base_policy_data: &Path, collaterals: &Path, - servtd_collateral: &Path, + servtd_collateral: Option<&Path>, + servtd_crl: Option<&Path>, ) -> Result<Vec<u8>> { let policy_data_bytes = read_file(base_policy_data)?; let collateral_bytes = read_file(collaterals)?; - let servtd_collateral_bytes = read_file(servtd_collateral)?; let mut base: Value = serde_json::from_slice(&policy_data_bytes) .with_context(|| "Failed to parse base policy JSON")?; @@ -22,12 +22,23 @@ pub fn build_v2_policy_data( } let collaterals_val: Value = serde_json::from_slice(&collateral_bytes) .with_context(|| "Failed to parse collaterals JSON")?; - let servtd_val: Value = serde_json::from_slice(&servtd_collateral_bytes) - .with_context(|| "Failed to parse servtd_collaterals JSON")?; if let Some(map) = base.as_object_mut() { map.insert("collaterals".to_string(), collaterals_val); - map.insert("servtdCollateral".to_string(), servtd_val); + // Insert `servtdCollateral` only when provided. Omitting it yields a + // CoRIM-only policy; MigTD then resolves servtd lookups through the + // separately-enrolled CoRIM. + if let Some(servtd_path) = servtd_collateral { + let servtd_collateral_bytes = read_file(servtd_path)?; + let servtd_val: Value = serde_json::from_slice(&servtd_collateral_bytes) + .with_context(|| "Failed to parse servtd_collaterals JSON")?; + map.insert("servtdCollateral".to_string(), servtd_val); + } + if let Some(servtd_crl_path) = servtd_crl { + let servtd_crl = String::from_utf8(read_file(servtd_crl_path)?) + .with_context(|| "servtd CRL is not UTF-8 PEM")?; + map.insert("servtdCrl".to_string(), Value::String(servtd_crl)); + } } let out = serde_json::to_vec(&base)?; diff --git a/tools/servtd-collateral-generator/src/build.rs b/tools/servtd-collateral-generator/src/build.rs index cae439077..90f3fb1cf 100644 --- a/tools/servtd-collateral-generator/src/build.rs +++ b/tools/servtd-collateral-generator/src/build.rs @@ -12,37 +12,56 @@ use std::{fs, path::Path}; struct ServtdCollateral<'a> { major_version: u32, minor_version: u32, - servtd_identity: &'a RawValue, - servtd_identity_issuer_chain: String, servtd_tcb_mapping: &'a RawValue, servtd_tcb_mapping_issuer_chain: String, + #[serde(skip_serializing_if = "Option::is_none")] + servtd_identity: Option<&'a RawValue>, + #[serde(skip_serializing_if = "Option::is_none")] + servtd_identity_issuer_chain: Option<String>, + #[serde(skip_serializing_if = "Option::is_none")] + servtd_crl: Option<String>, } pub fn build_servtd_collateral( - identity_path: &Path, - identity_chain_path: &Path, + identity_path: Option<&Path>, + identity_chain_path: Option<&Path>, mapping_path: &Path, mapping_chain_path: &Path, + servtd_crl_path: Option<&Path>, ) -> Result<Vec<u8>> { - let identity_bytes = read_file(identity_path)?; let mapping_bytes = read_file(mapping_path)?; - let identity_val: &RawValue = serde_json::from_slice(&identity_bytes) - .context("Failed to parse identity JSON (expected signed identity JSON)")?; let mapping_val: &RawValue = serde_json::from_slice(&mapping_bytes) .context("Failed to parse mapping JSON (expected signed mapping JSON)")?; - let identity_chain = String::from_utf8(read_file(identity_chain_path)?) - .context("Identity issuer chain not UTF-8")?; let mapping_chain = String::from_utf8(read_file(mapping_chain_path)?) .context("Mapping issuer chain not UTF-8")?; + // The TD Identity is optional; when present it must come with its chain + // (enforced at the CLI via clap `requires`). + let identity_bytes = identity_path.map(read_file).transpose()?; + let identity_val: Option<&RawValue> = identity_bytes + .as_deref() + .map(|b| { + serde_json::from_slice(b) + .context("Failed to parse identity JSON (expected signed identity JSON)") + }) + .transpose()?; + let identity_chain = identity_chain_path + .map(|path| String::from_utf8(read_file(path)?).context("Identity issuer chain not UTF-8")) + .transpose()?; + + let servtd_crl = servtd_crl_path + .map(|path| String::from_utf8(read_file(path)?).context("servtd CRL not UTF-8")) + .transpose()?; + let servtd_collateral = ServtdCollateral { major_version: 1, minor_version: 0, - servtd_identity: identity_val, - servtd_identity_issuer_chain: identity_chain, servtd_tcb_mapping: mapping_val, servtd_tcb_mapping_issuer_chain: mapping_chain, + servtd_identity: identity_val, + servtd_identity_issuer_chain: identity_chain, + servtd_crl, }; Ok(serde_json::to_vec(&servtd_collateral)?) diff --git a/tools/servtd-collateral-generator/src/main.rs b/tools/servtd-collateral-generator/src/main.rs index 29c86eac1..62a9563a4 100644 --- a/tools/servtd-collateral-generator/src/main.rs +++ b/tools/servtd-collateral-generator/src/main.rs @@ -17,18 +17,23 @@ use build::build_servtd_collateral; propagate_version = true )] struct Cli { - /// Signed ServTD identity JSON file (contains identity and signature) - #[arg(long, value_name = "FILE")] - identity: PathBuf, - /// PEM issuer chain for identity - #[arg(long, value_name = "FILE")] - identity_chain: PathBuf, + /// Optional signed ServTD identity JSON file (contains identity and + /// signature). The TD Identity is optional; omit it (together with + /// `--identity-chain`) to produce SVN-only collateral. + #[arg(long, value_name = "FILE", requires = "identity_chain")] + identity: Option<PathBuf>, + /// PEM issuer chain for identity (required iff `--identity` is given) + #[arg(long, value_name = "FILE", requires = "identity")] + identity_chain: Option<PathBuf>, /// Signed ServTD TCB mapping JSON file (contains tcb mapping and signature) #[arg(long, value_name = "FILE")] mapping: PathBuf, /// PEM issuer chain for mapping #[arg(long, value_name = "FILE")] mapping_chain: PathBuf, + /// Optional PEM CRL for the servTD signer chain (embedded as `servtdCrl`) + #[arg(long, value_name = "FILE")] + servtd_crl: Option<PathBuf>, /// Where to write the generated file #[arg(long, short, value_name = "FILE")] output: PathBuf, @@ -38,10 +43,11 @@ fn main() { let cli = Cli::parse(); let bytes = build_servtd_collateral( - &cli.identity, - &cli.identity_chain, + cli.identity.as_deref(), + cli.identity_chain.as_deref(), &cli.mapping, &cli.mapping_chain, + cli.servtd_crl.as_deref(), ) .unwrap_or_else(|e| { eprintln!("Failed to build ServTD collateral: {}", e); diff --git a/xtask/src/build.rs b/xtask/src/build.rs index 9f3237f09..3a219371f 100644 --- a/xtask/src/build.rs +++ b/xtask/src/build.rs @@ -79,9 +79,23 @@ pub(crate) struct BuildArgs { /// Use migration policy v2 #[clap(long)] policy_v2: bool, - /// Issuer chain of migration policy v2, required if `policy_v2` is set + /// Issuer chain of migration policy v2. Provide this OR `--signer-anchor` + /// (at least one is required when `policy_v2` is set). #[clap(long)] policy_issuer_chain: Option<PathBuf>, + /// Path of the 48-byte RTMR1 signer anchor to enroll (CoRIM-only form), + /// as an alternative to `--policy-issuer-chain`. The full PEM chain is not + /// carried in the image; the anchor is measured into RTMR1 identically. + /// Requires `policy_v2`. + #[clap(long)] + signer_anchor: Option<PathBuf>, + /// Path of the signed ServTD TCB-mapping CoRIM (`COSE_Sign1`, `.cose`). + /// When provided, it is enrolled into the CFV and the `servtd_corim` + /// feature is activated so the runtime resolves `hash -> SVN` through the + /// CoRIM. Requires `policy_v2`. The CoRIM is not measured, so enrolling it + /// does not change the image `tdinfo_hash`. + #[clap(long)] + servtd_corim: Option<PathBuf>, } #[derive(Copy, Clone, PartialEq, Eq, PartialOrd, Ord, ValueEnum)] @@ -145,11 +159,13 @@ impl BuildArgs { "policy_v2 is enabled but no policy file is provided" )); } - if self.policy_issuer_chain.is_none() { + if self.policy_issuer_chain.is_none() && self.signer_anchor.is_none() { return Err(anyhow::anyhow!( - "policy_v2 is enabled but no policy_issuer_chain file is provided" + "policy_v2 is enabled but neither --policy-issuer-chain nor --signer-anchor was provided" )); } + } else if self.servtd_corim.is_some() { + return Err(anyhow::anyhow!("--servtd-corim requires --policy-v2")); } Ok(()) } @@ -158,6 +174,7 @@ impl BuildArgs { self.build_shim_layout()?; let sh = Shell::new()?; + sh.set_var("RUSTFLAGS", Self::remap_rustflags()); sh.change_dir(SHIM_FOLDER.as_path()); if self.profile() == "release" { cmd!(sh, "cargo build -p td-shim --target x86_64-unknown-none --features=main,tdx,log/max_level_off --no-default-features --release") @@ -221,6 +238,7 @@ impl BuildArgs { let sh = Shell::new()?; sh.set_var("CC_x86_64_unknown_none", "clang"); sh.set_var("AR_x86_64_unknown_none", "llvm-ar"); + sh.set_var("RUSTFLAGS", Self::remap_rustflags()); sh.set_var( "SPDM_CONFIG", PROJECT_ROOT @@ -282,10 +300,21 @@ impl BuildArgs { ]); let cmd = if self.policy_v2 { - cmd.args(&[ - "3F2FB27A-9596-431C-A68D-D3EAB39F8AEB", - self.policy_issuer_chain()?.to_str().unwrap(), - ]) + // Enroll the RTMR1 signer anchor: prefer the 48-byte anchor slot + // (CoRIM-only form) when `--signer-anchor` is given, else the + // legacy policy issuer chain PEM. + if let Some(anchor) = &self.signer_anchor { + let anchor = fs::canonicalize(anchor)?; + cmd.args(&[ + "2B9D5A84-6F3C-4E71-8A2D-0C7E1F4B6A93", + anchor.to_str().unwrap(), + ]) + } else { + cmd.args(&[ + "3F2FB27A-9596-431C-A68D-D3EAB39F8AEB", + self.policy_issuer_chain()?.to_str().unwrap(), + ]) + } } else { cmd.args(&[ "CA437832-4C51-4322-B13D-A21BD0C8FFF6", @@ -293,6 +322,19 @@ impl BuildArgs { ]) }; + // Enroll the signed ServTD TCB-mapping CoRIM under its own FFS GUID. + // This file is not measured (see config::MIGTD_SERVTD_CORIM_FFS_GUID), + // so it does not affect the image tdinfo_hash. + let corim_path = self.servtd_corim()?; + let cmd = if let Some(corim) = &corim_path { + cmd.args(&[ + "7E5B9C11-2D4A-4F6E-9B3C-1A2B3C4D5E6F", + corim.to_str().unwrap(), + ]) + } else { + cmd + }; + cmd.args(&["-o", bin.to_str().unwrap()]).run()?; Ok(()) @@ -314,6 +356,24 @@ impl BuildArgs { } } + /// Build `--remap-path-prefix` flags so the project root, `CARGO_HOME`, and + /// `RUSTUP_HOME` map to fixed tokens. This makes the compiled bytes (and thus + /// MRTD) independent of the build path/user, enabling reproducible native + /// builds without the fixed-path build container. + fn remap_rustflags() -> String { + let project = PROJECT_ROOT.to_str().unwrap_or_default().to_string(); + let home = env::var("HOME").unwrap_or_default(); + let cargo_home = env::var("CARGO_HOME").unwrap_or_else(|_| format!("{home}/.cargo")); + let rustup_home = env::var("RUSTUP_HOME").unwrap_or_else(|_| format!("{home}/.rustup")); + let mut flags = env::var("RUSTFLAGS").map(|f| f + " ").unwrap_or_default(); + flags.push_str(&format!( + "--remap-path-prefix={cargo_home}=/cargo \ + --remap-path-prefix={rustup_home}=/rustup \ + --remap-path-prefix={project}=/migtd" + )); + flags + } + fn features(&self) -> String { let mut features = String::new(); features.push_str("main"); @@ -333,6 +393,10 @@ impl BuildArgs { features.push_str(",policy_v2"); } + if self.servtd_corim.is_some() { + features.push_str(",servtd_corim"); + } + if let Some(selected) = &self.features { features.push_str(","); features.push_str(selected); @@ -464,6 +528,14 @@ impl BuildArgs { fs::canonicalize(path).map_err(|e| e.into()) } + /// Canonicalized path of the signed ServTD TCB-mapping CoRIM, if provided. + fn servtd_corim(&self) -> Result<Option<PathBuf>> { + match self.servtd_corim.as_ref() { + Some(path) => Ok(Some(fs::canonicalize(path)?)), + None => Ok(None), + } + } + fn root_ca(&self) -> Result<PathBuf> { let path = self.root_ca.as_ref().unwrap_or(&DEFAULT_CA); fs::canonicalize(path).map_err(|e| e.into())