AMDEPYC · markg-github · Jul 1, 2026 · Aug 26, 2026 · Sep 3, 2026 · Sep 3, 2026
diff --git a/images/host-centos-10/mkosi.conf b/images/host-centos-10/mkosi.conf
@@ -22,5 +22,6 @@ Packages=
 	xxd
 	python3
 	python3-pip
+	python3-cryptography
 	jq
 	avahi
diff --git a/images/host-debian-13/mkosi.conf b/images/host-debian-13/mkosi.conf
@@ -24,6 +24,7 @@ Packages=
 	xxd
 	python3
 	python3-pip
+	python3-cryptography
 	python3-emoji
 	jq
 	avahi-daemon

diff --git a/images/host-debian-forky/mkosi.conf b/images/host-debian-forky/mkosi.conf
@@ -25,6 +25,7 @@ Packages=
 	python3
 	python3-dev
 	python3-pip
+	python3-cryptography
 	python3-emoji
 	g++
 	jq

diff --git a/images/host-fedora-41/mkosi.conf b/images/host-fedora-41/mkosi.conf
@@ -21,6 +21,7 @@ Packages=
     xxd
     python3
     python3-pip
+    python3-cryptography
     python3-emoji
     jq
     avahi

diff --git a/images/host-opensuse-16.0/mkosi.conf b/images/host-opensuse-16.0/mkosi.conf
@@ -28,6 +28,7 @@ Packages=
         xxd
         python3
         python3-pip
+        python3-cryptography
         python3-emoji
         jq
         avahi

diff --git a/images/host-rocky-10/mkosi.conf b/images/host-rocky-10/mkosi.conf
@@ -20,5 +20,6 @@ Packages=
 	 xxd
 	 python3
 	 python3-pip
+	 python3-cryptography
 	 jq
 	 avahi
diff --git a/images/host-ubuntu-25.04/mkosi.conf b/images/host-ubuntu-25.04/mkosi.conf
@@ -23,6 +23,7 @@ Packages=
 	xxd
 	python3
 	python3-pip
+	python3-cryptography
 	python3-emoji
 	jq
 	apt

diff --git a/images/host-ubuntu-25.10/mkosi.conf b/images/host-ubuntu-25.10/mkosi.conf
@@ -23,6 +23,7 @@ Packages=
 	xxd
 	python3
 	python3-pip
+	python3-cryptography
 	python3-emoji
 	jq
 	apt

diff --git a/images/host-ubuntu-26.04/mkosi.conf b/images/host-ubuntu-26.04/mkosi.conf
@@ -24,6 +24,7 @@ Packages=
 	python3
 	python3-dev
 	python3-pip
+	python3-cryptography
 	python3-emoji
 	jq
 	apt

diff --git a/pyproject.toml b/pyproject.toml
@@ -6,6 +6,13 @@ build-backend = "setuptools.build_meta"
 name = "sev-verify"
 version = "0.1.0"
 requires-python = ">=3.11"
+dependencies = [
+    # Ephemeral P-384 key generation for ID blocks (sev_verify.cvm_props).
+    # snpguest signs the ID block but cannot generate the keys, so this is
+    # needed on the host running the harness.  Host images install the distro
+    # package (python3-cryptography) — see images/host-*/mkosi.conf.
+    "cryptography",
+]
 
 [project.scripts]
 sev-verify = "sev_verify.cli:main"

diff --git a/sev_verify/README.md b/sev_verify/README.md
@@ -32,7 +32,12 @@ python3 -m sev_verify /path/to/guest.efi --output-dir /data/sev-artifacts -v 3.0
 
 ## How it works
 
-1. Discover manifests at `cert_tests/*/manifest.toml`. Each manifest declares test entries (name, scope, module path).
+1. Discover manifests at `cert_tests/*/manifest.toml`. Each manifest declares test entries:
+
+   - **`name`**, **`description`**, **`module`** — identity and the dotted path to the test module.
+   - **`scope`** — `host`, `guest`, or `mixed`. Anything other than `host` causes a `VMProfile` to be built (see step 4).
+   - **`level`** — certification level, e.g. `3.0.0-1`. Several tests may share one level. Also selects the artifacts directory (see [Artifacts directory](#artifacts-directory)).
+   - **`host_changes`** — set `true` when the test may alter host state that outlives it, such as `snphost commit` advancing the committed TCB floor. Such tests are listed at startup and gated on `--allow-host-changes`. Launching a guest does not count; changing platform configuration does.
 
 2. For each test, import its Python module and call `steps()` to get the ordered list of **`BaseStep`** records. Each has a **`kind`** field (`host`, `guest`, `vm_launch`, …). Define steps with **`Step`** either **chained** (``Step(...).host(command=...)``, …) or **in one call** with ``Step.for_host(...)``, ``Step.for_callable(...)``, etc., so your editor shows every required parameter for that shape. Only the fields relevant to ``kind`` may be set; invalid combinations are rejected at construction.
 
@@ -69,6 +74,11 @@ sev_verify/              Harness package
   runner.py              load_test_execution_plan, run_step, run_vm_launch_step, …
   vm_profile.py          VMProfile, QEMU argv, vm_launch / stop_vm
   guest_vsock.py         vsock command channel to the guest
+  attestation_report.py  Parse report.bin; TCB layout varies by CPU generation
+  cvm_props.py           Measurement + ID block generation shared across tests
+  environment.py         Host component versions recorded in the result
+  os_info.py             Host and guest OS identity (guest read over vsock)
+  output.py              JSON and Markdown result writers
   cert_tests/            Certification levels
     common/              Shared test modules
       snp_ok.py      Example host-only test
@@ -81,7 +91,25 @@ results/                 Output (gitignored)
 
 ## Requirements
 
-Python 3.11+ (uses `tomllib` from stdlib). No external packages.
+Python 3.11+ (uses `tomllib` from stdlib).
+
+One external package: **`cryptography`**, used by the ID block tests to generate
+the ephemeral P-384 key pairs that sign an ID block. `snpguest` signs and
+computes key digests but cannot generate keys, so this cannot be delegated to
+the tooling.
+
+Install it from the distribution, not with pip — the harness runs from the
+source tree, so `pyproject.toml`'s dependency list is never consulted unless the
+project is actually installed.
+
+```
+apt install python3-cryptography        # Debian / Ubuntu
+dnf install python3-cryptography        # Fedora / RHEL / CentOS / Rocky
+zypper install python3-cryptography     # openSUSE
+```
+
+Host images install it through `Packages=` in `images/host-*/mkosi.conf`, so a
+freshly built image needs no extra step.
 
 ## Flags
-Original file line number
+Diff line change
@@ Expand Up / @@ -22,5 +22,6 @@ Packages= @@
     	xxd
     	python3
     	python3-pip
+    	python3-cryptography
     	jq
     	avahi