sled-agent: add RoT attestation endpoints

Cargo.toml

@@ -458,6 +458,7 @@ debug-ignore = "1.0.5"
 derive_more = "0.99.20"
 derive-where = "1.5.0"
 dev-tools-common = { path = "dev-tools/common" }
+dice-verifier = { git = "https://github.com/oxidecomputer/dice-util", branch = "main", default-features = false }
 # Having the i-implement-... feature here makes diesel go away from the workspace-hack
 diesel = { version = "2.2.12", features = ["i-implement-a-third-party-backend-and-opt-into-breaking-changes", "postgres", "r2d2", "chrono", "serde_json", "network-address", "uuid"] }
 diesel-dtrace = "0.4.2"
@@ -826,6 +827,7 @@ wicket = { path = "wicket" }
 wicket-common = { path = "wicket-common" }
 wicketd-api = { path = "wicketd-api" }
 wicketd-client = { path = "clients/wicketd-client" }
+x509-cert = { version = "0.2.5", default-features = false }
 xshell = "0.2.7"
 zerocopy = "0.8.26"
 zeroize = { version = "1.8.1", features = ["zeroize_derive", "std"] }

clients/sled-agent-client/src/lib.rs

@@ -45,9 +45,11 @@ progenitor::generate_api!(
         "oxnet" = "0.1.0",
     },
     replace = {
+        Attestation = sled_agent_types_versions::latest::rot::Attestation,
         Baseboard = sled_agent_types_versions::latest::inventory::Baseboard,
         BaseboardId = sled_hardware_types::BaseboardId,
         ByteCount = omicron_common::api::external::ByteCount,
+        CertificateChain = sled_agent_types_versions::latest::rot::CertificateChain,
         CommitRequest = trust_quorum_types::messages::CommitRequest,
         CommitStatus = trust_quorum_types::status::CommitStatus,
         CoordinatorStatus = trust_quorum_types::status::CoordinatorStatus,
@@ -71,9 +73,12 @@ progenitor::generate_api!(
         InventoryZpool = sled_agent_types_versions::latest::inventory::InventoryZpool,
         LrtqUpgradeMsg = trust_quorum_types::messages::LrtqUpgradeMsg,
         MacAddr = omicron_common::api::external::MacAddr,
+        Measurement = sled_agent_types_versions::latest::rot::Measurement,
+        MeasurementLog = sled_agent_types_versions::latest::rot::MeasurementLog,
         MupdateOverrideBootInventory = sled_agent_types_versions::latest::inventory::MupdateOverrideBootInventory,
         Name = omicron_common::api::external::Name,
         NetworkInterface = omicron_common::api::internal::shared::NetworkInterface,
+        Nonce = sled_agent_types_versions::latest::rot::Nonce,
         OmicronPhysicalDiskConfig = omicron_common::disk::OmicronPhysicalDiskConfig,
         OmicronPhysicalDisksConfig = omicron_common::disk::OmicronPhysicalDisksConfig,
         OmicronSledConfig = sled_agent_types_versions::latest::inventory::OmicronSledConfig,
@@ -89,9 +94,11 @@ progenitor::generate_api!(
         ResolvedVpcFirewallRule = omicron_common::api::internal::shared::ResolvedVpcFirewallRule,
         ResolvedVpcRoute = omicron_common::api::internal::shared::ResolvedVpcRoute,
         ResolvedVpcRouteSet = omicron_common::api::internal::shared::ResolvedVpcRouteSet,
+        Rot = sled_agent_types_versions::latest::rot::Rot,
         RouterId = omicron_common::api::internal::shared::RouterId,
         RouterTarget = omicron_common::api::internal::shared::RouterTarget,
         RouterVersion = omicron_common::api::internal::shared::RouterVersion,
+        Sha3_256Digest = sled_agent_types_versions::latest::rot::Sha3_256Digest,
         SledRole = sled_agent_types_versions::latest::inventory::SledRole,
         SourceNatConfigGeneric = omicron_common::api::internal::shared::SourceNatConfigGeneric,
         SwitchLocation = omicron_common::api::external::SwitchLocation,

common/src/lib.rs

@@ -93,3 +93,34 @@ pub fn hex_schema<const N: usize>(
     schema.format = Some(format!("hex string ({N} bytes)"));
     schema.into()
 }
+
+/// A simple wrapper around a byte slice that provides a [`std::fmt::Debug`]
+/// impl which writes the bytes as a hex string.
+///
+/// # Example
+///
+/// ```
+/// assert_eq!(
+///     format!("{:?}", BytesToHexDebug(&[1, 234, 56, 255, 11])),
+///     "01ea38ff0b",
+/// );
+/// assert_eq!(
+///     format!("{:?}", BytesToHexDebug("Hello World!".as_bytes())),
+///     "48656c6c6f20576f726c6421",
+/// );
+/// ```
+pub struct BytesToHexDebug<'a>(pub &'a [u8]);
+
+impl std::fmt::Debug for BytesToHexDebug<'_> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        use std::fmt::Write;
+        const HEX_CHARS: &[u8; 16] = b"0123456789abcdef";
+        for b in self.0 {
+            let upper_nib = HEX_CHARS[(b >> 4) as usize] as char;
+            let lower_nib = HEX_CHARS[(b & 0xF) as usize] as char;
+            f.write_char(upper_nib)?;
+            f.write_char(lower_nib)?;
+        }
+        Ok(())
+    }
+}

nexus/mgs-updates/src/test_util/host_phase_2_test_state.rs

@@ -1087,5 +1087,34 @@ mod api_impl {
         ) -> Result<HttpResponseDeleted, HttpError> {
             unimplemented!()
         }
+
+        async fn rot_measurement_log(
+            _request_context: RequestContext<Self::Context>,
+            _path_params: Path<sled_agent_types::rot::RotPathParams>,
+        ) -> Result<
+            HttpResponseOk<sled_agent_types::rot::MeasurementLog>,
+            HttpError,
+        > {
+            unimplemented!()
+        }
+
+        async fn rot_certificate_chain(
+            _request_context: RequestContext<Self::Context>,
+            _path_params: Path<sled_agent_types::rot::RotPathParams>,
+        ) -> Result<
+            HttpResponseOk<sled_agent_types::rot::CertificateChain>,
+            HttpError,
+        > {
+            unimplemented!()
+        }
+
+        async fn rot_attest(
+            _request_context: RequestContext<Self::Context>,
+            _path_params: Path<sled_agent_types::rot::RotPathParams>,
+            _body: TypedBody<sled_agent_types::rot::Nonce>,
+        ) -> Result<HttpResponseOk<sled_agent_types::rot::Attestation>, HttpError>
+        {
+            unimplemented!()
+        }
     }
 }