Repository navigation
securitypolicy: honor LCOW AMD certificate annotation - #2962
Open
Emanuel Oprea (EmanuelOprea) wants to merge 2 commits into
Open
Emanuel Oprea (EmanuelOprea) wants to merge 2 commits into
Emanuel Oprea (EmanuelOprea) wants to merge 2 commits into
Conversation
Read the LCOW AMD certificate annotation when writing the shared security context, while retaining the WCOW annotation as a fallback for existing callers. The deprecated generic annotation already aliases the LCOW key. Add cross-platform regression coverage for certificate selection, empty inputs, and preservation of the other context files and environment. Validation: reproduced the regression before the fix on Windows and Linux; the targeted tests and Rego securitypolicy suites pass on both platforms, and the Windows GCS sidecar and Linux GCS build successfully with Go 1.26.8. Signed-off-by: Emanuel Oprea <[email protected]>
Keep the deprecated alias compatibility case and scope the staticcheck SA1019 exception to its intentional use. This follows existing repository lint conventions without weakening checks for the rest of the test or changing runtime behavior. Validation: the targeted certificate regression test passes, and golangci-lint 2.11.4 reports zero issues for pkg/securitypolicy on Windows default, LCOW and WCOW tags and Linux default tags. Signed-off-by: Emanuel Oprea <[email protected]>
Emanuel Oprea (EmanuelOprea)
force-pushed
the
dev/emanueloprea/lcow-amd-cert-annotation-upstream
branch
from
October 13, 2026 10:05
1910374 to
21489bd
Compare
Emanuel Oprea (EmanuelOprea)
marked this pull request as ready for review
October 14, 2026 14:00
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
SecurityOptions.WriteSecurityContextDiris shared by the LCOW guest and the WCOW GCS sidecar, but currently reads the host AMD certificate only fromannotations.WCOWHostAMDCertificate. A certificate supplied underannotations.LCOWHostAMDCertificateis silently omitted fromhost-amd-cert-base64. If the certificate is the only security-context input, no directory orUVM_SECURITY_CONTEXT_DIRenvironment variable is created.Change and compatibility
Read
LCOWHostAMDCertificatefirst and fall back toWCOWHostAMDCertificatewhen the LCOW value is missing or empty.This ports the downstream LCOW annotation fix with one deliberate upstream compatibility adjustment: retain the existing WCOW lookup as a fallback rather than removing it.
HostAMDCertificateis a deprecated alias ofLCOWHostAMDCertificate, not a separate annotation key, so no additional generic-key fallback is needed. When both keys are non-empty, LCOW takes precedence.The existing policy, UVM reference information, hash-envelope reference information, TCB/platform reference information, directory handling, and environment injection remain unchanged. No caller, annotation definition, dependency, or file-permission changes are included.
Regression coverage
A platform-neutral table-driven test covers LCOW, the deprecated generic alias, WCOW-only inputs, conflicting values, empty LCOW fallback, nil/empty annotations, and empty certificate values. Each case runs both with the certificate alone and alongside the other security-context inputs, checking exact file contents, directory creation/no-op behavior, and environment preservation.
Before the fix, the LCOW, generic-alias, and conflicting-value cases failed on both Windows and Linux. All 16 leaf cases pass after the fix.
Validation
Validated with Go 1.26.8 on Windows/amd64 and Linux/amd64:
go test -v ./pkg/securitypolicy -run '^TestWriteSecurityContextDirAMDCertificate$' -count=1go test -tags=rego -timeout=30m ./pkg/securitypolicy/...go build -tags=rego ./cmd/gcs-sidecargo build -tags=rego ./cmd/gcsgofmtandgit diff --checkNo live SEV-SNP workload or attestation end-to-end validation was performed for this upstream port. This PR is intentionally opened as a draft for review.