From 4f5ca0a0e70970bf7c5dabe11597835a3a1165d4 Mon Sep 17 00:00:00 2001 From: Anthony Ronning <101225832+AnthonyRonning@users.noreply.github.com> Date: Mon, 12 Oct 2026 03:09:41 +0000 Subject: [PATCH] Keep current and rollback PCRs in Research and SDK bundles --- .../src/config/openSecretClientConfig.ts | 53 +++------------- sdk/rust/src/pcr.rs | 49 +++++++-------- sdk/src/lib/pcr.ts | 34 +++------- .../test/integration/liveAttestation.test.ts | 16 +++-- sdk/src/lib/test/integration/pcr.test.ts | 62 ++++++++++++++++++- 5 files changed, 110 insertions(+), 104 deletions(-) diff --git a/apps/maple-research/frontend/src/config/openSecretClientConfig.ts b/apps/maple-research/frontend/src/config/openSecretClientConfig.ts index f6cbbab41..f63243837 100644 --- a/apps/maple-research/frontend/src/config/openSecretClientConfig.ts +++ b/apps/maple-research/frontend/src/config/openSecretClientConfig.ts @@ -3,54 +3,17 @@ import { openSecretPcrEnvironment } from "./openSecretPcrEnvironment"; const DEFAULT_OPEN_SECRET_CLIENT_ID = "ba5a14b5-d915-47b1-b7b1-afda52bc5fc6"; const PCR0_VALUES = [ - // Approved 2026-09-14 (services/opensecret signed history) - "a0ef363874f70bd82af98d8e628bf7f128dfca1f9918e83af494cd17f5d4ff1a0c1b94b235941a6d20138d1152cbe5aa", - // Approved 2026-09-12 (services/opensecret signed history) - "3d2f90b4dac7316e5485e03f4cdf3f2f8ae79fde77442546475eac6c3037916ac54b8bdb26c85a73e9b778a9a5077638", - // Approved 2026-09-05 (services/opensecret signed history) - "a1c09f74133cbcc0e5034b9a8a5ed1a5a567d4922140d69534827b4473c7f385b989ce594e0b11f6b8ec971decb95608", - "ed9109c16f30a470cf0ea2251816789b4ffa510c990118323ce94a2364b9bf05bdb8777959cbac86f5cabc4852e0da71", - "4f2bcdf16c38842e1a45defd944d24ea58bb5bcb76491843223022acfe9eb6f1ff79b2cb9a6b2a9219daf9c7bf40fa37", - "b8ee4b511ef2c9c6ab3e5c0840c5df2218fbb4d9df88254ece7af9462677e55aa5a03838f3ae432d86ca1cb6f992eee7", - "33ffe5cae0f72cfe904bde8019ad98efa0ce5db2800f37c5d4149461023d1f70ea77e4f58ae1327ff46ed6a34045d6e2", - "a1398fa2946b6ed4b96a1a992ee668aef3661329690f87d44cad5b646ce33e3b16a55674b1d6d54d115a5520801b97d6", - "878dc4111e94722f3d33b202dc1368916af2eb486e74b3d94c9dfbcb3d981fa652827ea8e951ddfe06d1cefb482e431c", - "4e242871fecc14933c889908a6a7593de574c2655a47ffa163c5fd7ba41d063152ef441bd555ac7f8569eac4fd7cbc8b", - "095d38ba5c9c7ad1cfe5832d3dd8304b020392867aeef84f47e08b4305b867540b0ff5b2eb7d279de410e19ad937896e", - "72c9a1dc207d919196c78f845c0f5fd4b3b3a690e024a3dd599f160be04875fbe52983773909a9f1584105f7d5103538", - "a5ae21e211fa709dbced7fec7fff0eb86001174365a29271c07d7fb55fd9f37c7e2ddef1b01f39e977ca246277efeef2", - "2520e5067830a34fc457b6360358e3754d53ab855f4a05a81312f2a2ed0bf893c5ec43d1325972efbe3a8f2b79303734", - "a275a3877972c670c4f43e658cc9296838f79a96a26429877f74285c3a088d426583d3e2f6f99cfd96c70fdfa1475266", - "8de5541089649e9edb2cd96fafb90716aa298483447e459708e8840b1f82a557c9d9ff6ae1fd2461b04310e7d9400d7d", - "02a41da2df084fd1dee420d7717bef6dc0120f1d6a0b7fded3f4c7a539be4044b3061c71bc7156731db1fb66494097b0", - "d9638aebacf2bf15ef0ab7d394320a3aa5ebde9f0e8911d2d2a0b49a2792f3825e6f6ca56960a63e91857398125d8038", - "41786ecb8e012b910cd095ad5f8b5acefcaf80df3cf8e909499da45dd594c7c4c28302b5dde551d870555bd389a1e2c4" + // Approved 2026-10-11 (services/opensecret signed history) + "21d27bd19cdd02632485a6e8874753e42cf7f098f1335bb62a9c23e7f64da9100c02dba582da17ac68052fa6be16b7a9", + // Approved 2026-10-09 (services/opensecret signed history; rollback) + "643b3c293a4eac11ec14ab405d2405e46cb714263a12da6c62f485a0fa395cb3c3d5ef07b18d39a1f9715f25e7943b66" ]; const PCR0_DEV_VALUES = [ - // Approved 2026-09-14 (services/opensecret signed history) - "61d92c66684de563fbc4ce3ece9680966672a065a65dedfd1dcdab149b2d3d3d725ab853dae6dc251dbb3326ff7d1214", - // Approved 2026-09-12 (services/opensecret signed history) - "c5470ea9d2d8499a65fbb9bc936bd7a62a5ef90b54da1504535cb4384f303fb673369d64f1a43f17c8ed8d2a89f09949", - // Approved 2026-09-05 (services/opensecret signed history) - "831eb975dad0b3f3741612acc92f020c0467bd3ac967ddf925fa60eff9e02cf9239ec50c699715fbf9a35e3448e2a117", - "799600ba64a29e360b1651f4ced6c9ca5323094a45294551327b996062c3f21e6fef651e7e3d97ec8d25be87b9935b4f", - "2fd9d4f716fd28336d96bc1a20b18a727c2d18f292577ba99323acfc8fb08959428a123b7acff478994c4f961247a0c7", - "4292db2a90ce5ea6f6e2766e0238a328c81dc060a1f3175bced2e94a10e0490d3ff9125d774dafdff969ac661778e757", - "f58409ae1bc8600c887fef5cc4055149c88c94b41c2b3e268826af7b43a1cdbacffdb2c96bf5972120c6460ab83fe89e", - "6fcdb8086806a96c421c08eaf67cebf164aa898798b6f91b072c884773bc6ed64fe8f5af644fe35411195167b0e4a5f1", - "0042958bde1fdd1bcbd4085ec94456c49e7bc5d2c3368f6f34edd6f339193cb7b53929d299eaf6a220ed5b7691f8618a", - "583ac140e0454dd4766a07c147cb6d90d5430d6bc9c1571da19c781dea4027e1c434273caba584440180ca42c2db84d5", - "4451e47ddb4be8a63492e62bc400e69d924188040805c658334f708e8682d308af3feb16018e98a5589c345d28437a6b", - "5bc5a32791948dc7e315d01ec787307799bb6f70903d14c20dc47f19bb0ef3830eb3b2c5b04b7ae5b04717046b357a14", - "4243170eeb11d38cf9bbee48b754bccfe97385b4639051efe97cda50086784cd32009dcb89a0fb1098558f22dc55b4e6", - "be3de8fa74f42cc5165823da63aa283f1c8dfedb5e27e0bfa281c6dbd12d5b5bfd9bef591200175c44dbf0c504f5b0a5", - "ab7e90e1894f75fbd423f3d0027973b611beff7402bd224dcd0f162968fb9678f08c92970d16a444edc934aa6ecd7d62", - "8ba003e9d552d262cfd40a77eced199cfd0e776d1fd69d5ed6b7e6c6c92b91a0481e965247502f95a20478fe0a8f3de7", - "2e6e8f86a657f6daed8e699c0b74bf02d6c7d6414638b1032e6addd2bca7d208a0e8aa4961eb8e926c54dc58fd63d401", - "6b15f0571de13a6357e646bbe3772a8fe32fdd85b07ba97b3a6f95bdc43023dd9deb5710c26b75346de90157d9ecdd1f", - "2596e528703abda188de27b6995f8d3cc553502e4acbb4d06db1dc8239b428638447adff38ccce358ef9fe34c2e0bccc", - "e36d72989d89818b77ab1012cf875c46c0d7fb5389fd559b9ea0950231ae1cc17dd222e5d19a84363a27a3cd7f268de6" + // Approved 2026-10-11 (services/opensecret signed history) + "a95956c3fb9457e509be6d614ffefcddf98fe594f77bb6a56891fc1f5bdec41da2add13db22e0908363c8d0929c04def", + // Approved 2026-10-09 (services/opensecret signed history; rollback) + "e573a3ddc8a27f387e24cfb02a8fa594fe782674de6ee1fa9385126b9f8ec38f4a236e91c371bdd2b9444623c1c1cc34" ]; export function openSecretClientConfig() { diff --git a/sdk/rust/src/pcr.rs b/sdk/rust/src/pcr.rs index ce8cb0c8d..f80ca3b31 100644 --- a/sdk/rust/src/pcr.rs +++ b/sdk/rust/src/pcr.rs @@ -28,35 +28,17 @@ pub const OFFICIAL_DEVELOPMENT_PCR_HISTORY_URL: &str = "https://raw.githubusercontent.com/MaplePrivacyLabs/Maple/master/services/opensecret/pcrDevHistory.json"; const OFFICIAL_PRODUCTION_PCR0S: &[&str] = &[ - // Approved 2026-09-14 (services/opensecret signed history) - "a0ef363874f70bd82af98d8e628bf7f128dfca1f9918e83af494cd17f5d4ff1a0c1b94b235941a6d20138d1152cbe5aa", - // Approved 2026-09-12 (services/opensecret signed history) - "3d2f90b4dac7316e5485e03f4cdf3f2f8ae79fde77442546475eac6c3037916ac54b8bdb26c85a73e9b778a9a5077638", - // Approved 2026-09-05 (services/opensecret signed history) - "a1c09f74133cbcc0e5034b9a8a5ed1a5a567d4922140d69534827b4473c7f385b989ce594e0b11f6b8ec971decb95608", - "eeddbb58f57c38894d6d5af5e575fbe791c5bf3bbcfb5df8da8cfcf0c2e1da1913108e6a762112444740b88c163d7f4b", - "74ed417f88cb0ca76c4a3d10f278bd010f1d3f95eafb254d4732511bb50e404507a4049b779c5230137e4091a5582271", - "9043fcab93b972d3c14ad2dc8fa78ca7ad374fc937c02435681772a003f7a72876bc4d578089b5c4cf3fe9b480f1aabb", - "52c3595b151d93d8b159c257301bfd5aa6f49210de0c55a6cd6df5ebeee44e4206cab950500f5d188f7fa14e6d900b75", - "91cb67311e910cce68cd5b7d0de77aa40610d87c6681439b44c46c3ff786ae643956ab2c812478a1da8745b259f07a45", - "859065ac81b81d3735130ba08b8af72a7256b603fefb74faabae25ed28cca6edcaa7c10ea32b5948d675c18a9b0f2b1d", - "acd82a7d3943e23e95a9dc3ce0b0107ea358d6287f9e3afa245622f7c7e3e0a66142a928b6efcc02f594a95366d3a99d", + // Approved 2026-10-11 (services/opensecret signed history) + "21d27bd19cdd02632485a6e8874753e42cf7f098f1335bb62a9c23e7f64da9100c02dba582da17ac68052fa6be16b7a9", + // Approved 2026-10-09 (services/opensecret signed history; rollback) + "643b3c293a4eac11ec14ab405d2405e46cb714263a12da6c62f485a0fa395cb3c3d5ef07b18d39a1f9715f25e7943b66", ]; const OFFICIAL_DEVELOPMENT_PCR0S: &[&str] = &[ - // Approved 2026-09-14 (services/opensecret signed history) - "61d92c66684de563fbc4ce3ece9680966672a065a65dedfd1dcdab149b2d3d3d725ab853dae6dc251dbb3326ff7d1214", - // Approved 2026-09-12 (services/opensecret signed history) - "c5470ea9d2d8499a65fbb9bc936bd7a62a5ef90b54da1504535cb4384f303fb673369d64f1a43f17c8ed8d2a89f09949", - // Approved 2026-09-05 (services/opensecret signed history) - "831eb975dad0b3f3741612acc92f020c0467bd3ac967ddf925fa60eff9e02cf9239ec50c699715fbf9a35e3448e2a117", - "62c0407056217a4c10764ed9045694c29fa93255d3cc04c2f989cdd9a1f8050c8b169714c71f1118ebce2fcc9951d1a9", - "cb95519905443f9f66f05f63c548b61ad1561a27fd5717b69285861aaea3c3063fe12a2571773b67fea3c6c11b4d8ec6", - "deb5895831b5e4286f5a2dcf5e9c27383821446f8df2b465f141d10743599be20ba3bb381ce063bf7139cc89f7f61d4c", - "70ba26c6af1ec3b57ce80e1adcc0ee96d70224d4c7a078f427895cdf68e1c30f09b5ac4c456588d872f3f21ff77c036b", - "669404ea71435b8f498b48db7816a5c2ab1d258b1a77685b11d84d15a73189504d79c4dee13a658de9f4a0cbfc39cfe8", - "a791bf92c25ffdfd372660e460a0e238c6778c090672df6509ae4bc065cf8668b6baac6b6a11d554af53ee0ff0172ad5", - "c4285443b87b9b12a6cea3bef1064ec060f652b235a297095975af8f134e5ed65f92d70d4616fdec80af9dff48bb9f35", + // Approved 2026-10-11 (services/opensecret signed history) + "a95956c3fb9457e509be6d614ffefcddf98fe594f77bb6a56891fc1f5bdec41da2add13db22e0908363c8d0929c04def", + // Approved 2026-10-09 (services/opensecret signed history; rollback) + "e573a3ddc8a27f387e24cfb02a8fa594fe782674de6ee1fa9385126b9f8ec38f4a236e91c371bdd2b9444623c1c1cc34", ]; /// OpenSecret deployment environment whose PCR0 trust roots should be used. @@ -483,6 +465,21 @@ mod tests { .is_err()); } + #[tokio::test] + async fn older_approvals_require_history_rather_than_bundled_trust() { + let production = Pcr0TrustPolicy::official().without_remote_history(); + let development = + Pcr0TrustPolicy::official_for(Pcr0Environment::Development).without_remote_history(); + assert!(production + .verify_pcr0(&pcr_bytes("eeddbb58f57c38894d6d5af5e575fbe791c5bf3bbcfb5df8da8cfcf0c2e1da1913108e6a762112444740b88c163d7f4b")) + .await + .is_err()); + assert!(development + .verify_pcr0(&pcr_bytes("62c0407056217a4c10764ed9045694c29fa93255d3cc04c2f989cdd9a1f8050c8b169714c71f1118ebce2fcc9951d1a9")) + .await + .is_err()); + } + #[tokio::test] async fn all_zero_pcr0_is_never_trusted() { assert!(Pcr0TrustPolicy::from_static_allowlist([ALL_ZERO_PCR0]).is_err()); diff --git a/sdk/src/lib/pcr.ts b/sdk/src/lib/pcr.ts index 5169d4fee..f0038fd2b 100644 --- a/sdk/src/lib/pcr.ts +++ b/sdk/src/lib/pcr.ts @@ -2,38 +2,20 @@ * Valid PCR0 values for production environments */ const DEFAULT_PCR0_VALUES = [ - // Approved 2026-09-14 (services/opensecret signed history) - "a0ef363874f70bd82af98d8e628bf7f128dfca1f9918e83af494cd17f5d4ff1a0c1b94b235941a6d20138d1152cbe5aa", - // Approved 2026-09-12 (services/opensecret signed history) - "3d2f90b4dac7316e5485e03f4cdf3f2f8ae79fde77442546475eac6c3037916ac54b8bdb26c85a73e9b778a9a5077638", - // Approved 2026-09-05 (services/opensecret signed history) - "a1c09f74133cbcc0e5034b9a8a5ed1a5a567d4922140d69534827b4473c7f385b989ce594e0b11f6b8ec971decb95608", - "eeddbb58f57c38894d6d5af5e575fbe791c5bf3bbcfb5df8da8cfcf0c2e1da1913108e6a762112444740b88c163d7f4b", - "74ed417f88cb0ca76c4a3d10f278bd010f1d3f95eafb254d4732511bb50e404507a4049b779c5230137e4091a5582271", - "9043fcab93b972d3c14ad2dc8fa78ca7ad374fc937c02435681772a003f7a72876bc4d578089b5c4cf3fe9b480f1aabb", - "52c3595b151d93d8b159c257301bfd5aa6f49210de0c55a6cd6df5ebeee44e4206cab950500f5d188f7fa14e6d900b75", - "91cb67311e910cce68cd5b7d0de77aa40610d87c6681439b44c46c3ff786ae643956ab2c812478a1da8745b259f07a45", - "859065ac81b81d3735130ba08b8af72a7256b603fefb74faabae25ed28cca6edcaa7c10ea32b5948d675c18a9b0f2b1d", - "acd82a7d3943e23e95a9dc3ce0b0107ea358d6287f9e3afa245622f7c7e3e0a66142a928b6efcc02f594a95366d3a99d" + // Approved 2026-10-11 (services/opensecret signed history) + "21d27bd19cdd02632485a6e8874753e42cf7f098f1335bb62a9c23e7f64da9100c02dba582da17ac68052fa6be16b7a9", + // Approved 2026-10-09 (services/opensecret signed history; rollback) + "643b3c293a4eac11ec14ab405d2405e46cb714263a12da6c62f485a0fa395cb3c3d5ef07b18d39a1f9715f25e7943b66" ]; /** * Valid PCR0 values for development environments */ const DEFAULT_PCR0_VALUES_DEV = [ - // Approved 2026-09-14 (services/opensecret signed history) - "61d92c66684de563fbc4ce3ece9680966672a065a65dedfd1dcdab149b2d3d3d725ab853dae6dc251dbb3326ff7d1214", - // Approved 2026-09-12 (services/opensecret signed history) - "c5470ea9d2d8499a65fbb9bc936bd7a62a5ef90b54da1504535cb4384f303fb673369d64f1a43f17c8ed8d2a89f09949", - // Approved 2026-09-05 (services/opensecret signed history) - "831eb975dad0b3f3741612acc92f020c0467bd3ac967ddf925fa60eff9e02cf9239ec50c699715fbf9a35e3448e2a117", - "62c0407056217a4c10764ed9045694c29fa93255d3cc04c2f989cdd9a1f8050c8b169714c71f1118ebce2fcc9951d1a9", - "cb95519905443f9f66f05f63c548b61ad1561a27fd5717b69285861aaea3c3063fe12a2571773b67fea3c6c11b4d8ec6", - "deb5895831b5e4286f5a2dcf5e9c27383821446f8df2b465f141d10743599be20ba3bb381ce063bf7139cc89f7f61d4c", - "70ba26c6af1ec3b57ce80e1adcc0ee96d70224d4c7a078f427895cdf68e1c30f09b5ac4c456588d872f3f21ff77c036b", - "669404ea71435b8f498b48db7816a5c2ab1d258b1a77685b11d84d15a73189504d79c4dee13a658de9f4a0cbfc39cfe8", - "a791bf92c25ffdfd372660e460a0e238c6778c090672df6509ae4bc065cf8668b6baac6b6a11d554af53ee0ff0172ad5", - "c4285443b87b9b12a6cea3bef1064ec060f652b235a297095975af8f134e5ed65f92d70d4616fdec80af9dff48bb9f35" + // Approved 2026-10-11 (services/opensecret signed history) + "a95956c3fb9457e509be6d614ffefcddf98fe594f77bb6a56891fc1f5bdec41da2add13db22e0908363c8d0929c04def", + // Approved 2026-10-09 (services/opensecret signed history; rollback) + "e573a3ddc8a27f387e24cfb02a8fa594fe782674de6ee1fa9385126b9f8ec38f4a236e91c371bdd2b9444623c1c1cc34" ]; /** diff --git a/sdk/src/lib/test/integration/liveAttestation.test.ts b/sdk/src/lib/test/integration/liveAttestation.test.ts index 60d6fac6b..16f04df7b 100644 --- a/sdk/src/lib/test/integration/liveAttestation.test.ts +++ b/sdk/src/lib/test/integration/liveAttestation.test.ts @@ -19,7 +19,7 @@ afterEach(() => { }); test.skipIf(!runLive)( - "hosted enclave establishes a session only after signed-history PCR0 validation", + "hosted enclave establishes a session only after environment-scoped PCR0 validation", async () => { const requests: string[] = []; globalThis.fetch = async (input, init) => { @@ -41,13 +41,19 @@ test.skipIf(!runLive)( expect(attestationIndex).toBeGreaterThanOrEqual(0); expect(prodHistoryIndex).toBe(-1); - expect(devHistoryIndex).toBeGreaterThan(attestationIndex); - expect(keyExchangeIndex).toBeGreaterThan(devHistoryIndex); + // A current bundled root needs no history fetch; future approved images + // still fetch and verify their signed development history before exchange. + if (devHistoryIndex >= 0) { + expect(devHistoryIndex).toBeGreaterThan(attestationIndex); + expect(keyExchangeIndex).toBeGreaterThan(devHistoryIndex); + } else { + expect(keyExchangeIndex).toBeGreaterThan(attestationIndex); + } } ); test.skipIf(!runLive)( - "hosted enclave cannot reach key exchange when its PCR0 policy is deliberately unknown", + "hosted development enclave cannot reach key exchange under production bundled trust", async () => { const requests: string[] = []; globalThis.fetch = async (input, init) => { @@ -57,7 +63,7 @@ test.skipIf(!runLive)( await expect( getAttestation(true, liveApiUrl, { - environment: "development", + environment: "production", remoteAttestation: false }) ).rejects.toThrow(/PCR0/i); diff --git a/sdk/src/lib/test/integration/pcr.test.ts b/sdk/src/lib/test/integration/pcr.test.ts index 86c17215b..1842c5c54 100644 --- a/sdk/src/lib/test/integration/pcr.test.ts +++ b/sdk/src/lib/test/integration/pcr.test.ts @@ -26,9 +26,9 @@ global.sessionStorage = storageMock(); // Sample PCR0 values for testing const VALID_PCR0_PROD = - "eeddbb58f57c38894d6d5af5e575fbe791c5bf3bbcfb5df8da8cfcf0c2e1da1913108e6a762112444740b88c163d7f4b"; + "21d27bd19cdd02632485a6e8874753e42cf7f098f1335bb62a9c23e7f64da9100c02dba582da17ac68052fa6be16b7a9"; const VALID_PCR0_DEV = - "62c0407056217a4c10764ed9045694c29fa93255d3cc04c2f989cdd9a1f8050c8b169714c71f1118ebce2fcc9951d1a9"; + "a95956c3fb9457e509be6d614ffefcddf98fe594f77bb6a56891fc1f5bdec41da2add13db22e0908363c8d0929c04def"; const CUSTOM_PCR0 = "11".repeat(48); const CUSTOM_PCR0_DEV = "22".repeat(48); @@ -116,6 +116,61 @@ test("development rejects production PCR0 values", async () => { expect(result.isMatch).toBe(false); }); +test("current and rollback approvals remain trusted without history only in their environment", async () => { + const approvals = [ + { + environment: "production", + pcr0s: [ + "21d27bd19cdd02632485a6e8874753e42cf7f098f1335bb62a9c23e7f64da9100c02dba582da17ac68052fa6be16b7a9", + "643b3c293a4eac11ec14ab405d2405e46cb714263a12da6c62f485a0fa395cb3c3d5ef07b18d39a1f9715f25e7943b66" + ] + }, + { + environment: "development", + pcr0s: [ + "a95956c3fb9457e509be6d614ffefcddf98fe594f77bb6a56891fc1f5bdec41da2add13db22e0908363c8d0929c04def", + "e573a3ddc8a27f387e24cfb02a8fa594fe782674de6ee1fa9385126b9f8ec38f4a236e91c371bdd2b9444623c1c1cc34" + ] + } + ] as const; + + for (const { environment, pcr0s } of approvals) { + for (const pcr0 of pcr0s) { + expect( + (await validatePcr0Hash(pcr0, { environment, remoteAttestation: false })).isMatch + ).toBe(true); + const oppositeEnvironment = environment === "production" ? "development" : "production"; + expect( + ( + await validatePcr0Hash(pcr0, { + environment: oppositeEnvironment, + remoteAttestation: false + }) + ).isMatch + ).toBe(false); + } + } +}); + +test("older approvals require signed history rather than bundled trust", async () => { + expect( + ( + await validatePcr0Hash( + "eeddbb58f57c38894d6d5af5e575fbe791c5bf3bbcfb5df8da8cfcf0c2e1da1913108e6a762112444740b88c163d7f4b", + { remoteAttestation: false } + ) + ).isMatch + ).toBe(false); + expect( + ( + await validatePcr0Hash( + "62c0407056217a4c10764ed9045694c29fa93255d3cc04c2f989cdd9a1f8050c8b169714c71f1118ebce2fcc9951d1a9", + { environment: "development", remoteAttestation: false } + ) + ).isMatch + ).toBe(false); +}); + test("validates custom PCR0 values", async () => { const config: PcrConfig = { pcr0Values: [CUSTOM_PCR0] @@ -179,6 +234,9 @@ test("rejects unknown PCR0 values when remote attestation is disabled", async () }; const result = await validatePcr0Hash(VERIFIED_PCR0, config); expect(result.isMatch).toBe(false); + expect( + (await validatePcr0Hash(VERIFIED_PCR0, { ...config, environment: "development" })).isMatch + ).toBe(false); }); test("validates PCR0 from only the selected production history by default", async () => {