Run on aws sev-snp which uses vlek

[Ivar (aɪvɑr) (ivarprudnikov)]

Opening this so not to lose the work after trying to run CCF on AWS SEV-SNP. Not sure if you want to support it or if there is anyone waiting for it.

On shared-tenancy SEV-SNP hosts (AWS m6a/c6a), reports are signed by a VLEK and the chip ID is all zeros. CCF assumed VCEK, so it requested  /vcek/v1/Milan/000...  from AMD KDS and failed to start. It seemed like a low hanging fruit to try and extend the logic and to expand the reach of the framework.

The implementation:

• allows any platform using VLEK to boot as VLEK's CSP identity is not pinned (tested on AWS only)
• CCF now selects the collateral flow from the  signing_key  flag in the signed report, not from cloud-provider detection
• snp_ioctl6.h : retrieve the host certificate table via  SNP_GET_EXT_REPORT  and extract the VLEK leaf. Accepts the VLEK or VCEK GUID slot, in big-endian or mixed-endian order, as hosts differ (AWS emitted big-endian)
• attestation_sev_snp{,_endorsements}.h : VLEK reports use  /vlek/v1/<product>/cert_chain ; chip ID becomes optional; Azure/THIM endorsement types reject VLEK
• attestation.cpp : verification accepts either signer. VCEK keeps chip-ID matching; VLEK requires no chip-ID extension and an all-zero report chip ID
• quote_generation.h ,  node_state.h ,  quote_endorsements_client.h : seed the fetch pipeline with the host-supplied leaf

How it was tested:

• built the ccf rpm locally
• cloned scitt-ccf-ledger and built it by also referencing this new rpm
• spun up an c6a.large instance on AWS with AMD SEV-SNP enabled, using Ubuntu 24.04
  • installed ca-certificates curl docker-ce docker-ce-cli docker-buildx-plugin
• copied over the scitt ccf docker image and launched it in the AWS instance docker run --rm -it --network=host --device=/dev/sev-guest -v $(pwd)/workspace:/host --entrypoint cchost scitt-snp:vlek --config /host/dev-config.json
  • scitt-snp:vlek was just an imported docker image tag