fix(verifier): key the measurement cache on the measured VM shape only - #1334
Merged
Merged
Conversation
kvinwang
force-pushed
the
fix/verifier-measurement-cache
branch
from
September 23, 2026 06:30
6008ff0 to
91f0f49
Compare
kvinwang
changed the title
vm_config_cache_key hashed the whole VmConfig, including fields the full-image measurement never reads: an arbitrary `image` string, and the `tdx_measurement`/`gcp_measurement`/`aws_measurement` documents, each carrying a caller-sized checksum_file and CBOR blob. A cache miss costs a full firmware and kernel hash plus ACPI generation and leaves a file under <cache>/measurements/ that nothing evicts, so one captured quote replayed with a different filler byte per request misses every time and grows the cache without bound. Clear those four before hashing. Clearing rather than listing the fields that matter keeps a VmConfig field added later in the key by default, which is the safe direction: an extra miss, never a stale measurement.
kvinwang
force-pushed
the
fix/verifier-measurement-cache
branch
from
September 23, 2026 06:33
91f0f49 to
b4218e7
Compare
kvinwang
enabled auto-merge
September 23, 2026 06:34
kvinwang
added a commit
that referenced
this pull request
Sep 25, 2026
…bounds #1251 renamed the manifest confinement test the image-download case ran by name. Run its replacement plus the tests that pin the sha256sum grammar, the end-to-end image binding (#1337) and the truncated-download retry (#1388), and extend the measurement cache case with shape-only keying (#1334) and the bounded cache directory (#1369). Signed-off-by: Kevin Wang <wy721@qq.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
vm_config_cache_keyhashes the whole request-suppliedVmConfig, includingimageand the*_measurementdocuments, none of which the measurement reads. Changing one byte in them forces a cache miss: a full firmware/kernel hash, ACPI generation, and a new file under<cache>/measurements/.Clear those fields before hashing. They are cleared rather than allowlisted, so new
VmConfigfields stay in the key by default.Cache eviction is left for a separate change. The
spawn_blockingpart moved to #1336.