debian forky SEV version 3.0

[markg-github]

Achieved Certification Level 3.0.0-0

Certified level: 3.0.0-0
Max certification level: 3.0.0-0
Started: 2026-09-08T15:59:27.808527+00:00
Completed: 2026-09-08T16:00:24.281082+00:00

Environment

• Host OS: Debian GNU/Linux forky/sid
• Host kernel: 7.1.12+deb14-amd64
• Guest OS: Debian GNU/Linux forky/sid
• QEMU: 11.1.0 (Debian 1:11.1.0+ds-2)
• OVMF: 2026.05-2 (ovmf-amdsev)

Level 3.0.0-0

Test	Description	Result
attestation-test	Launch an SEV-SNP guest and verify attestation report	✅

Level 3.0.0-1

Test	Description	Result
snphost-config-commit	Test SNP_CONFIG and SNP_COMMIT host commands	❌
id-block-test	Verify ID block acceptance, report field binding, and launch rejection	✅

Failure Details

snphost-config-commit (fail)

verify-lowered-report-signature — fail
Duration: 247ms

snpguest fetch vcek failed (KDS rate-limited; re-run in a minute): ERROR: Unable to fetch VCEK from URL: 429
Error: Unable to fetch VCEK from URL: 429

sev-verify output

   Guest:  /usr/local/lib/guest-image/guest.efi
   Host:   Debian GNU/Linux forky/sid
   Kernel: 7.1.12+deb14-amd64
   QEMU:   11.1.0 (Debian 1:11.1.0+ds-2)
   OVMF:   2026.05-2 (ovmf-amdsev)

   Host changes: --allow-host-changes enabled
   Tests that may change host state (boot-session-only, reset on reboot):
     • 3.0.0-1  snphost-config-commit

── Prerequisites ───────────────────────────────────────────────────────────────

   Verify SNP    Verify SEV-SNP is enabled and functional on the host and the right components are present
   Artifacts: artifacts/prereqs/Verify_SNP
   ├─ snphost ok ··················································· 25ms [PASS]
   ├─ snphost show guests ··········································· 8ms [PASS]
   └─ verify OVMF ··················································· 0ms [PASS]
   result:                                                     3/3 passed [PASS]

   Prerequisites:                                              1/1 passed [PASS]

── Certification 3.0 ───────────────────────────────────────────────────────────
   SEV 3.0 Tests (AMD EPYC 7003+)
   Max certification level: 3.0.0-0

   ── 3.0.0-0 ──
   attestation-test        Launch an SEV-SNP guest and verify attestation report
   Artifacts: artifacts/3.0/3.0.0-0/attestation_test
   ├─ Calculate measurement ······································· 157ms [PASS]
   ├─ Launch SEV-SNP guest ········································ 14.8s [PASS]
   ├─ Get attestation report with snpguest ························· 34ms [PASS]
   ├─ Pull report from guest ········································ 9ms [PASS]
   ├─ Pull request file from guest ·································· 4ms [PASS]
   ├─ Fetch certificate chain from kds ···························· 269ms [PASS]
   ├─ Fetch VCEK from kds ········································· 269ms [PASS]
   ├─ Verify certificate chain ······································ 5ms [PASS]
   ├─ Verify report signature and TCB values ························ 5ms [PASS]
   ├─ Verify Request data and Measurement ··························· 5ms [PASS]
   └─ Stop VM ······················································ 1.4s [PASS]
   result:                                                   11/11 passed [PASS]

   ── 3.0.0-1 ──
   snphost-config-commit            Test SNP_CONFIG and SNP_COMMIT host commands
   Artifacts: artifacts/3.0/3.0.0-1/snphost_config_commit
   ├─ show-tcb ······················································ 8ms [PASS]
   ├─ config-set-lower ············································· 68ms [PASS]
   ├─ verify-differ after config-set-lower ························· 10ms [PASS]
   ├─ Launch SEV-SNP guest ········································ 14.1s [PASS]
   ├─ guest-report-after-lower ····································· 23ms [PASS]
   ├─ pull-report-after-lower ······································· 8ms [PASS]
   ├─ verify-guest-report-lowered ·································· 15ms [PASS]
   ├─ verify-lowered-report-signature ····························· 247ms [FAIL]
   │     snpguest fetch vcek failed (KDS rate-limited; re-run in a minute): ERROR: Unable to fetch VCEK from URL: 429
   │     Error: Unable to fetch VCEK from URL: 429
   │     [Hint] Rate limited by KDS, re-run in a minute
   ├─ config-reset ················································· 13ms [PASS]
   ├─ verify-match after config-reset ······························ 13ms [PASS]
   ├─ guest-report-after-reset ····································· 11ms [PASS]
   ├─ pull-report-after-reset ······································· 4ms [PASS]
   ├─ verify-guest-report-restored ································· 14ms [PASS]
   ├─ Stop VM ······················································ 1.6s [PASS]
   ├─ teardown-config-reset ········································ 15ms [PASS]
   ├─ verify-committed-equals-current ······························· 7ms [PASS]
   └─ commit-current-tcb ············································ 8ms [PASS]
   result:                                                    1/17 failed [FAIL]

   id-block-test    Verify ID block acceptance, report field binding, and launch rejection
   Artifacts: artifacts/3.0/3.0.0-1/id_block_test
   ├─ Calculate measurement ······································· 158ms [PASS]
   ├─ Generate ID block ············································ 13ms [PASS]
   ├─ Launch with valid ID block ·································· 14.1s [PASS]
   ├─ Get attestation report ······································· 26ms [PASS]
   ├─ Pull attestation report ······································ 17ms [PASS]
   ├─ Stop VM ····················································· 966ms [PASS]
   ├─ Verify ID block fields in report ······························ 1ms [PASS]
   ├─ Set bad measurement in ID block ······························ 14ms [PASS]
   ├─ Launch with bad measurement (expect rejection) ··············· 4.0s [PASS]
   ├─ Stop VM (after bad measurement) ······························· 0ms [PASS]
   ├─ Set incompatible policy (SMT) ································ 12ms [PASS]
   ├─ Launch with SMT-incompatible policy (expect rejection) ······· 2.0s [PASS]
   ├─ Stop VM (after SMT policy) ···································· 0ms [ERR!]
   │     vm_stop: no running guest (run vm_launch or a guest step first)
   ├─ Set impossible ABI version ··································· 11ms [PASS]
   ├─ Launch with impossible ABI version (expect rejection) ········ 2.0s [PASS]
   └─ Stop VM (after ABI version) ··································· 0ms [ERR!]
         vm_stop: no running guest (run vm_launch or a guest step first)
   result:                                                    2/16 failed [PASS]

   Certification 3.0:                                          2/3 passed [FAIL]

   Wrote /root/results/cert-3.0.json
   Wrote /root/results/cert-3.0.md

── Summary ─────────────────────────────────────────────────────────────────────
   Certification 3.0:                                                  [3.0.0-0]