Add Pluton attestation APIs - #7262
Conversation
|
Thank you for your contribution @nguyenteresaMSFT! We will review the pull request and get back to you soon. |
|
Azure Pipelines: Successfully started running 2 pipeline(s). 8 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
There was a problem hiding this comment.
Pull request overview
This PR adds initial Pluton attestation support to the Azure Security Attestation C++ client library by introducing a new AttestPluton public API and factoring shared TPM/Pluton request/response handling into a common helper.
Changes:
- Added
AttestationClient::AttestPlutonplus correspondingAttestPlutonOptionsandPlutonAttestationResultpublic types. - Refactored TPM attestation implementation to use a shared
AttestBackend<ResultT>helper for both TPM and Pluton. - Generalized the TPM payload (de)serializer naming for reuse across TPM and Pluton.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| sdk/attestation/azure-security-attestation/src/private/attestation_deserializers_private.hpp | Renames the TPM serializer struct for shared TPM/Pluton usage. |
| sdk/attestation/azure-security-attestation/src/private/attestation_deserializers_private.cpp | Updates serializer implementation to match the new shared serializer name. |
| sdk/attestation/azure-security-attestation/src/attestation_client.cpp | Introduces AttestBackend helper and adds AttestPluton implementation. |
| sdk/attestation/azure-security-attestation/inc/azure/attestation/attestation_client.hpp | Exposes AttestPluton publicly and declares the private AttestBackend helper. |
| sdk/attestation/azure-security-attestation/inc/azure/attestation/attestation_client_options.hpp | Adds AttestPlutonOptions. |
| sdk/attestation/azure-security-attestation/inc/azure/attestation/attestation_client_models.hpp | Adds PlutonAttestationResult. |
| */ | ||
| Response<Models::PlutonAttestationResult> AttestPluton( | ||
| std::vector<uint8_t> const& dataToAttest, | ||
| AttestPlutonOptions const& options = AttestPlutonOptions{}, |
There was a problem hiding this comment.
I want to confirm: All the default options in the AttestPlutonOptions are going to be ignored by the client? In other words, there is no semantic difference between an option being empty and the options being not present.
Normally options bags are expressed as azure_core::Nullable<AttestPlutonOptions> to make the difference between "no options specified" and "options were specified and these are the values".
I understand that there are no options today but there may be options in the future and making this field non-Nullable constrains the values that can be put in the Options bag.
There was a problem hiding this comment.
Yes, since this is the same approach used for AttestTpmOptions, I decided to keep this implementation for consistency.
Implementing changes for Pluton attestation support.