Add policy validation tests for RVPS key alignment

.github/workflows/test.yml

@@ -0,0 +1,22 @@
+name: Tests
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install
+        run: pip install -e ".[test]"
+
+      - name: Test
+        run: pytest

.gitignore

@@ -8,3 +8,4 @@ build/
 .venv/
 report.xml
 report.html
+tests/.cache/

TESTING.md

@@ -0,0 +1,12 @@
+# Testing
+
+```
+pip install -e ".[test]"
+pytest
+```
+
+The policy validation tests download the OPA binary and the attestation policy
+from `openshift/trustee-operator` on first run (cached in `tests/.cache/`).
+No cluster needed.
+
+Override the policy URL with `VERITAS_POLICY_URL=https://...`.

pyproject.toml

@@ -15,6 +15,7 @@ veritas = "veritas.__main__:main"
 
 [project.optional-dependencies]
 snp = ["sev-snp-measure"]
+test = ["pytest"]
 
 [tool.pytest.ini_options]
 addopts = "--tb=line --junitxml=report.xml"

src/veritas/platforms/azure.py

@@ -114,6 +114,13 @@ def compute_initdata(self, initdata_paths: list[str]) -> ReferenceValue:
             source=f"computed from {sources}",
         )
 
+    def reference_key_names(self) -> set[str]:
+        keys = {self._rvps_key(pcr) for pcr in self.PCR_DESCRIPTIONS}
+        keys.add(self._rvps_key("pcr08"))
+        if self.tee == "tdx":
+            keys.add("xfam")
+        return keys
+
     def _rvps_key(self, pcr_name: str) -> str:
         """Convert pcr name to RVPS key: pcr03 -> snp_pcr03 or tdx_pcr03."""
         return f"{self.tee}_{pcr_name}"

src/veritas/platforms/baremetal.py

@@ -101,6 +101,12 @@ def platform(self) -> str:
     def evidence_type(self) -> str:
         return self.EVIDENCE_TYPES[self.tee]
 
+    def reference_key_names(self) -> set[str]:
+        if self.tee == "tdx":
+            return {"tdvfkernel", "tdvfkernelparams", "mr_td", "rtmr_1",
+                    "rtmr_2", "init_data", "xfam"}
+        return {"snp_launch_measurement", "init_data"}
+
     CACHE_DIR = Path.home() / ".cache" / "veritas" / "extensions"
 
     def _cache_path(self, image_ref: str) -> Path | None:

src/veritas/platforms/base.py

@@ -16,6 +16,10 @@ def extract(self) -> list[ReferenceValue]:
     def compute_initdata(self, initdata_paths: list[str]) -> ReferenceValue:
         """Compute initdata reference value for this platform."""
 
+    @abstractmethod
+    def reference_key_names(self) -> set[str]:
+        """Return all RVPS key names this extractor can produce."""
+
     @property
     @abstractmethod
     def platform(self) -> str: