feat(fde): support multiple hash algorithms in show-reference-value

The `show-reference-value` command now supports multiple hash algorithms: sha1, sha256, sha384, and sm3.
You can specify them using `--hash-algo`, for example:

    --hash-algo sha256 --hash-algo sm3

Multiple values are allowed; defaults to sha384 and sm3.
Added SHA-1 support via the `sha1` crate.

Improved CLI documentation to clearly explain which boot components are measured and how the `stage` parameter works.
Also added validation to ensure at least one hash algorithm is provided.

Signed-off-by: Kun Lai <laikun@linux.alibaba.com>

Author: imlk0

Cargo.lock

@@ -42,6 +42,7 @@ scopeguard = "1.2.0"
 serde = {version = "1.0", features = ["derive"]}
 serde_json = {version = "1", features = ["preserve_order"]}
 serde_variant = "0.1.3"
+sha1 = "0.10.6"
 sha2 = {version = "0.10.8"}
 shadow-rs = {version = "0.35.2", default-features = false}
 sm3 = "0.4.2"

Cargo.toml

@@ -116,9 +116,33 @@ pub struct FdeOptions {
 
 #[derive(Subcommand, Debug)]
 pub enum FdeSubcommand {
-    /// Show claims related to FDE.
+    /// Display cryptographic reference values (e.g., hashes) of boot-related components for attestation.
+    ///
+    /// This includes artifacts such as:
+    /// - GRUB configuration and binaries
+    /// - Shim and bootloader
+    /// - Initrd and kernel images
+    /// - Kernel command line
+    ///
+    /// For encrypted (FDE) disks, additional values are included:
+    /// - Root filesystem hash (integrity measurement)
+    /// - Cryptpilot configuration bundle hash
+    ///
+    /// Supports both encrypted (FDE) and plain disks. Optionally filtered by stage.
     #[command(name = "show-reference-value")]
     ShowReferenceValue {
+        /// Specify one or more hash algorithms to use.
+        /// Multiple algorithms can be provided (e.g., --hash-algo sha384 --hash-algo sm3).
+        #[clap(long = "hash-algo", default_value = "sha384,sm3")]
+        hash_algos: Vec<ShowReferenceValueHashAlgo>,
+        /// Optional stage filter (e.g., initrd, system). If not provided, all stages are included.
+        ///
+        /// Used to inject additional reference values for specific boot stages. For example:
+        /// - When `--stage system` is specified, an extra claim is added:
+        ///   `cryptpilot.alibabacloud.com initrd_switch_root {}`
+        ///   indicating that the system has switched to the new root filesystem (sysroot).
+        ///
+        /// If omitted, no additional stage-specific claims are generated.
         #[clap(long)]
         stage: Option<ShowReferenceValueStage>,
     },
@@ -128,6 +152,21 @@ pub enum FdeSubcommand {
     DumpConfig,
 }
 
+#[derive(ValueEnum, Clone, Debug)]
+pub enum ShowReferenceValueHashAlgo {
+    #[clap(name = "sha1")]
+    Sha1,
+
+    #[clap(name = "sha256")]
+    Sha256,
+
+    #[clap(name = "sha384")]
+    Sha384,
+
+    #[clap(name = "sm3")]
+    Sm3,
+}
+
 #[derive(ValueEnum, Clone, Debug)]
 pub enum ShowReferenceValueStage {
     #[clap(name = "initrd")]

src/cli.rs

@@ -10,10 +10,11 @@ impl IntoCommand for crate::cli::FdeOptions {
             crate::cli::FdeSubcommand::DumpConfig => {
                 Box::new(dump_config::ConfigDumpCommand { disk: self.disk })
             }
-            crate::cli::FdeSubcommand::ShowReferenceValue { stage } => {
+            crate::cli::FdeSubcommand::ShowReferenceValue { stage, hash_algos } => {
                 Box::new(show_reference_value::ShowReferenceValueCommand {
                     disk: self.disk,
                     stage,
+                    hash_algos,
                 })
             }
         }

src/cmd/fde/mod.rs

@@ -1,11 +1,11 @@
 use std::path::PathBuf;
 
-use anyhow::Result;
+use anyhow::{bail, Result};
 use async_trait::async_trait;
 use indexmap::IndexMap;
 
 use crate::{
-    cli::ShowReferenceValueStage,
+    cli::{ShowReferenceValueHashAlgo, ShowReferenceValueStage},
     cmd::fde::disk::MeasurementedBootComponents,
     measure::{
         attestation_agent::AAEL_DOMAIN, OPERATION_NAME_FDE_ROOTFS_HASH,
@@ -18,11 +18,16 @@ use super::disk::{FdeDisk, OnCurrentSystemFdeDisk, OnExternalFdeDisk};
 pub struct ShowReferenceValueCommand {
     pub disk: Option<PathBuf>,
     pub stage: Option<ShowReferenceValueStage>,
+    pub hash_algos: Vec<ShowReferenceValueHashAlgo>,
 }
 
 #[async_trait]
 impl super::super::Command for ShowReferenceValueCommand {
     async fn run(&self) -> Result<()> {
+        if self.hash_algos.is_empty() {
+            bail!("No hash algorithm specified");
+        }
+
         tracing::debug!("Get rootfs reference value");
         let mut map = IndexMap::new();
 
@@ -39,7 +44,10 @@ impl super::super::Command for ShowReferenceValueCommand {
                     map.insert(aael_key, vec![hash_hex]);
                 }
                 Err(error) => {
-                    tracing::warn!(?error, "Failed to load fde config bundle, skip \"{aael_key}\"");
+                    tracing::warn!(
+                        ?error,
+                        "Failed to load fde config bundle, skip \"{aael_key}\""
+                    );
                 }
             };
         }
@@ -69,8 +77,22 @@ impl super::super::Command for ShowReferenceValueCommand {
         let boot_components = fde_disk.get_boot_components().await?;
         tracing::debug!("Starting to calculate reference values for boot components");
 
-        inseart_with_hash::<sha2::Sha384>(&boot_components, &mut map, "SHA-384")?;
-        inseart_with_hash::<sm3::Sm3>(&boot_components, &mut map, "SM3")?;
+        for hash_algo in &self.hash_algos {
+            match hash_algo {
+                ShowReferenceValueHashAlgo::Sha1 => {
+                    inseart_with_hash::<sha1::Sha1>(&boot_components, &mut map, "SHA-1")?
+                }
+                ShowReferenceValueHashAlgo::Sha256 => {
+                    inseart_with_hash::<sha2::Sha256>(&boot_components, &mut map, "SHA-256")?
+                }
+                ShowReferenceValueHashAlgo::Sha384 => {
+                    inseart_with_hash::<sha2::Sha384>(&boot_components, &mut map, "SHA-384")?
+                }
+                ShowReferenceValueHashAlgo::Sm3 => {
+                    inseart_with_hash::<sm3::Sm3>(&boot_components, &mut map, "SM3")?
+                }
+            }
+        }
 
         map.insert(
             "kernel_cmdline".to_string(),