Lesson 8.1 · 12 min read
From source code to measurement
The chain of custody from a reviewed commit to the hash in an attestation report.
The gap attestation cannot close by itself
An attestation report says "the TEE is running image with hash H". A relying party then asks: what is H? If nobody can show that H was built from reviewed source with a trusted toolchain, the attestation proves only that some code is running, not that it is the code you meant.
| Platform | What gets measured | Where you get the expected value |
|---|---|---|
| AWS Nitro Enclaves | EIF (PCR0), kernel and boot (PCR1), application (PCR2), signing cert (PCR8) | Output of nitro-cli build-enclave |
| Google Confidential Space | Container image digest, plus the Confidential Space image itself | Registry digest (sha256:...) of the pushed image |
| Confidential VMs (SNP/TDX) | Firmware launch measurement; OS via vTPM PCRs | Vendor or cloud published firmware values; your own measured-boot event log |
Key takeaways
- Attestation proves which bytes run, not that they are the bytes you reviewed.
- Each platform measures different things; know where each expected value comes from.
- Treat the build pipeline as part of the trusted computing base.