fix(startup): _VALID_PROVIDERS was missing azure-cvm-sev-snp - #564
Open
imran-siddique wants to merge 2 commits into
Open
fix(startup): _VALID_PROVIDERS was missing azure-cvm-sev-snp#564imran-siddique wants to merge 2 commits into
imran-siddique wants to merge 2 commits into
Conversation
The comment above _VALID_PROVIDERS says it mirrors the keys of _PROVIDER_MAP in audit/trace_claim.py. It did not: the map carries azure-cvm-sev-snp and the set did not, so _validate_attestation_report raised ATTESTATION_PROVIDER_INVALID on every Azure confidential-VM report and the gateway exited at startup. Found by @zohebk8s while wiring #552's report_data measurement binding in #563, which applies to azure-cvm-sev-snp and so added behaviour for a provider that path could not select. The test compares the two sets rather than asserting one membership, so the next provider added to either side cannot drift the same way. Signed-off-by: Imran Siddique <imran.siddique@opaque.co>
ruff reads _VALID_PROVIDERS as the constant side because it is uppercase, so the comparison had to put the computed set on the left. Signed-off-by: Imran Siddique <imran.siddique@opaque.co>
zohebk8s
approved these changes
Aug 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #563, from a defect @zohebk8s found and flagged while wiring #552's
report_datameasurement binding.The defect
startup.py:55says:It did not.
_VALID_PROVIDERS(startup.py:57)sev-snp,tdx,opaque,tpm,software-only_PROVIDER_MAP(audit/trace_claim.py:25)azure-cvm-sev-snpSo
_validate_attestation_reportraisedATTESTATION_PROVIDER_INVALIDon every Azure confidential-VM report and the gateway exited at startup. #563 applies the measurement binding toazure-cvm-sev-snp, which meant it added behaviour for a provider this path could not select.The guard
The test compares the two sets rather than asserting that one name is present. Asserting membership fixes today's instance and leaves the class open; comparing the sets means the next provider added to either side cannot drift the same way, which is what the comment already promised.
Proved it fails for the right reason by reverting only the one-line addition and keeping the test:
With the entry restored:
tests/unit/test_startup.pyandtests/unit/test_trace_claim.py, 55 passed.Not covered
Whether an Azure CVM gateway then completes startup end to end on real hardware. This removes a gate that rejected it before anything else ran; it is not a claim that the rest of the path is exercised.