[Rats] [CoRIM] Initial virtual firmware reference value format to debut on Google Compute Engine

[Dionna Amalie Glaze <[e-mail]>]

Hi y'all, I've talked a fair amount in our weekly meetings about my
work providing signed reference values for SEV-SNP, and I've luckily
had the opportunity to push a big chunk of the technology of our
releasing tools to a public repository.

https://github.com/google/gce-tcb-verifier/blob/main/proto/endorsement.proto

The CA and signing commands are in
https://github.com/google/gce-tcb-verifier/blob/main/testing/nonprod/gcetcb
and please note the nonprod status. I haven't prioritized making a
Cloud KMS backend that connects outside the Google production
environment since this is reference code and not intended for others
to use for their own reference value signing pipeline. We would much
prefer supply chain providers (including ourselves) to target a
standard format.

The endorsement inspection and verification commands are in
https://github.com/google/gce-tcb-verifier/tree/main/gcetcbendorsement

This format was decided back in 2022 after an internal decision to not
chase CoRIM as a moving target. It's not yet available to confidential
VMs, and the GCS bucket referenced in
https://github.com/google/gce-tcb-verifier/blob/main/extract/extract.go
is not yet publicly viewable.

This is an "experimental" release, as we don't really want folks to
develop a strong attachment to this format. I've learned a lot more
about signing envelopes and PKI since the start. The whole signing key
certificate is a part of the signed content rather than the key
identity. So, grain of salt, but here's v0.

There's ongoing work for endorsement extraction to come from UEFI
variables pointed to by tcgSP800155Event3 events in the CCEL/CEL too.

Happy to take bug reports and discuss in the issues tab.

-- 
-Dionna Glaze, PhD, CISSP (she/her)