Upstreaming Checklist #8

Ideally we wouldn't maintain this fork at all, and everything in here would eventually be upstreamed. This issue is meant as a tracker for each commit, with the work needed to do to upstream it:

• 7d0aab5 Azure platform metadata fallback (/proc/meminfo + /sys/block when SMBIOS is unreadable): needs changes.
  • Move it into easy-tee/attest platform::metadata_for, bump the attest pin, delete it here.
• bdd135d export Azure vTPM root CAs (AZURE_ROOT_CA_PEMS): ready as-is.
• GCP commits. Overall plan: verification core → easy-tee/attest, live check + recording → flashbots; replay and the shared cache stay here unless upstream wants them.
  • 73e113a pin Google's GCE-cc-tcb-root_1 (+32/−2): needs changes.
    • First reshape GCE_CC_TCB_ROOT_DER + GCE_CC_TCB_ROOT_NAME into one (file stem, bytes) constant like AZURE_ROOT_CA_PEMS (separate PR, needs a matching enclave bump).
    • Then move the compiled-in root into easy-tee/attest, which currently fetches it from pki.goog on every call.
  • 724112d check Google's firmware endorsement on every live gcp-tdx verification, incl. strict cert checks (+629/−7): needs changes, two destinations.
    • Verification core + strict cert checks (issuer, key usage, EKU, critical extensions) → easy-tee/attest: expose an offline verify_google_endorsement(bytes, root, at) that DcapFirmware::from_google also uses, and decode the tag-8 TDX measurements so the MRTD can be matched without downloading the firmware. After the attest pin bump, ~200 duplicated lines and the prost/rsa/sha2/rcgen deps go away here.
    • Always checking the endorsement on gcp-tdx (upstream only checks it when a portable-image policy matches), plus fetch and cache → flashbots PR. The fetch/cache code mirrors provenance.rs; upstream can decide whether to dedupe.
  • 20a2bdf record the endorsement in EndorsementSnapshot (+37/−10): ready once 724112d is upstreamable. Ship it in the same flashbots PR (EndorsementSnapshot is upstream since feat!(attestation): report the DCAP collateral a verification consumed flashbots/attested-tls#85).
  • a0c4f62 replay archived gcp-tdx evidence against its recorded endorsement (+276/−28): blocked on an upstream decision. feat(attestation)!: pin verification to archived collateral with VerifyMode flashbots/attested-tls#93 is merged, but upstream refuses archived GCP verification (flashbots@a2898b9) partly because the provenance registry is unsigned and mutable; this commit skips the provenance lookup on replay. Propose it as a follow-up to the flashbots PR above; if refused, it stays fork-only.
  • 9b6f991 share one endorsement cache across verifiers (+21/−7): fork-only. Either drop it (the endorsement is ~5 KB and the provenance lookup already runs per call; enclave's GCP_ENDORSEMENTS LazyLock goes away), or upstream one general hook that shares all of a verifier's caches (provenance, PCCS, endorsement) instead of one per cache.