commit 8f7fc1a0f1b99e8e4b3ed66d627174f6ff7e319c
author Shikha Panwar <shikhapanwar@google.com> Wed Apr 10 10:41:34 2024 +0000
committer Shikha Panwar <shikhapanwar@google.com> Thu May 23 11:49:49 2024 +0000
tree 4535674876c8210022e4abb138de985bc156adad
parent 1cba46d4b5dbec9fe131fb4102601416317317db

Include instance-hash in DICE chain

In order to limit access to a particular VM instance, local verifiers of
DICE chains (such as Secretkeeper) require instance-hash to be part DICE
chains. Let this be part of DICE chain of VM (specifically, part of
vm_entry certificate).

Test: #config_descriptor_with_instance_hash & #config_descriptor_without_instance_hash
Bug: 291245237
Change-Id: Ib5666dfbd9ed32250bc37903c134e806db6ddf9c

pvmfw/Android.bp

diff --git a/pvmfw/Android.bp b/pvmfw/Android.bp
index 4ee02c1..614ca08 100644
--- a/pvmfw/Android.bp
+++ b/pvmfw/Android.bp
@@ -14,6 +14,7 @@
         "libaarch64_paging",
         "libbssl_avf_nostd",
         "libbssl_sys_nostd",
+        "libcbor_util_nostd",
         "libciborium_nostd",
         "libciborium_io_nostd",
         "libcstr",