chio_appraisal/
types.rs

1//! Wire and data types for runtime attestation appraisal artifacts.
2
3use std::collections::BTreeMap;
4
5use serde::{Deserialize, Serialize};
6use serde_json::Value;
7
8use crate::capability::{
9    runtime_attestation::{RuntimeAssuranceTier, RuntimeAttestationEvidence},
10    trust_policy::AttestationTrustError,
11    workload_identity::{WorkloadIdentity, WorkloadIdentityError},
12};
13use crate::receipt::lineage::SignedExportEnvelope;
14use chio_core_types::runtime_attestation::AttestationVerifierFamily;
15
16pub const AZURE_MAA_ATTESTATION_SCHEMA: &str = "chio.runtime-attestation.azure-maa.jwt.v1";
17pub const AWS_NITRO_ATTESTATION_SCHEMA: &str = "chio.runtime-attestation.aws-nitro-attestation.v1";
18pub const GOOGLE_CONFIDENTIAL_VM_ATTESTATION_SCHEMA: &str =
19    "chio.runtime-attestation.google-confidential-vm.jwt.v1";
20pub const ENTERPRISE_VERIFIER_ATTESTATION_SCHEMA: &str =
21    "chio.runtime-attestation.enterprise-verifier.json.v1";
22pub const AZURE_MAA_VERIFIER_ADAPTER: &str = "azure_maa";
23pub const AWS_NITRO_VERIFIER_ADAPTER: &str = "aws_nitro";
24pub const GOOGLE_CONFIDENTIAL_VM_VERIFIER_ADAPTER: &str = "google_confidential_vm";
25pub const ENTERPRISE_VERIFIER_ADAPTER: &str = "enterprise_verifier";
26
27pub const RUNTIME_ATTESTATION_APPRAISAL_SCHEMA: &str = "chio.runtime-attestation.appraisal.v1";
28pub const RUNTIME_ATTESTATION_APPRAISAL_ARTIFACT_SCHEMA: &str =
29    "chio.runtime-attestation.appraisal-artifact.v1";
30pub const RUNTIME_ATTESTATION_APPRAISAL_REPORT_SCHEMA: &str =
31    "chio.runtime-attestation.appraisal-report.v1";
32pub const RUNTIME_ATTESTATION_APPRAISAL_ARTIFACT_INVENTORY_SCHEMA: &str =
33    "chio.runtime-attestation.appraisal-artifact-inventory.v1";
34pub const RUNTIME_ATTESTATION_NORMALIZED_CLAIM_VOCABULARY_SCHEMA: &str =
35    "chio.runtime-attestation.normalized-claim-vocabulary.v1";
36pub const RUNTIME_ATTESTATION_REASON_TAXONOMY_SCHEMA: &str =
37    "chio.runtime-attestation.reason-taxonomy.v1";
38pub const RUNTIME_ATTESTATION_APPRAISAL_RESULT_SCHEMA: &str =
39    "chio.runtime-attestation.appraisal-result.v1";
40pub const RUNTIME_ATTESTATION_APPRAISAL_IMPORT_REPORT_SCHEMA: &str =
41    "chio.runtime-attestation.appraisal-import-report.v1";
42pub const RUNTIME_ATTESTATION_VERIFIER_DESCRIPTOR_SCHEMA: &str =
43    "chio.runtime-attestation.verifier-descriptor.v1";
44pub const RUNTIME_ATTESTATION_REFERENCE_VALUE_SET_SCHEMA: &str =
45    "chio.runtime-attestation.reference-values.v1";
46pub const RUNTIME_ATTESTATION_TRUST_BUNDLE_SCHEMA: &str =
47    "chio.runtime-attestation.trust-bundle.v1";
48
49#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
50#[serde(rename_all = "snake_case")]
51pub enum RuntimeAttestationAppraisalVerdict {
52    Accepted,
53    Rejected,
54}
55
56#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
57#[serde(rename_all = "snake_case")]
58pub enum RuntimeAttestationAppraisalReasonCode {
59    EvidenceVerified,
60    UnsupportedEvidence,
61    UnsupportedClaimMapping,
62    AmbiguousClaimMapping,
63    PolicyRejected,
64    InvalidClaims,
65    EvidenceStale,
66    MeasurementMismatch,
67    DebugStateUnknown,
68}
69
70#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
71#[serde(rename_all = "snake_case")]
72pub enum RuntimeAttestationNormalizedClaimCode {
73    AttestationType,
74    RuntimeIdentity,
75    WorkloadIdentityScheme,
76    WorkloadIdentityUri,
77    ModuleId,
78    MeasurementDigest,
79    MeasurementRegisters,
80    HardwareModel,
81    SecureBootState,
82}
83
84#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
85#[serde(rename_all = "snake_case")]
86pub enum RuntimeAttestationNormalizedClaimCategory {
87    Identity,
88    Measurement,
89    Platform,
90    Configuration,
91}
92
93#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
94#[serde(rename_all = "snake_case")]
95pub enum RuntimeAttestationNormalizedClaimConfidence {
96    Verified,
97    Derived,
98}
99
100#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
101#[serde(rename_all = "snake_case")]
102pub enum RuntimeAttestationNormalizedClaimFreshness {
103    EvidenceWindow,
104}
105
106#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
107#[serde(rename_all = "snake_case")]
108pub enum RuntimeAttestationClaimProvenance {
109    EvidenceEnvelope,
110    VendorClaims,
111    WorkloadProjection,
112}
113
114#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
115#[serde(rename_all = "snake_case")]
116pub enum RuntimeAttestationAppraisalReasonGroup {
117    Verification,
118    Compatibility,
119    Freshness,
120    Measurement,
121    DebugPosture,
122    Policy,
123}
124
125#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
126#[serde(rename_all = "snake_case")]
127pub enum RuntimeAttestationAppraisalReasonDisposition {
128    Pass,
129    Warn,
130    Deny,
131    Degrade,
132    Unknown,
133}
134
135#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
136#[serde(rename_all = "camelCase")]
137pub struct RuntimeAttestationNormalizedClaim {
138    pub code: RuntimeAttestationNormalizedClaimCode,
139    pub legacy_assertion_key: String,
140    pub category: RuntimeAttestationNormalizedClaimCategory,
141    pub confidence: RuntimeAttestationNormalizedClaimConfidence,
142    pub freshness: RuntimeAttestationNormalizedClaimFreshness,
143    pub provenance: RuntimeAttestationClaimProvenance,
144    pub value: Value,
145}
146
147#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
148#[serde(rename_all = "camelCase")]
149pub struct RuntimeAttestationNormalizedClaimVocabularyEntry {
150    pub code: RuntimeAttestationNormalizedClaimCode,
151    pub legacy_assertion_key: String,
152    pub category: RuntimeAttestationNormalizedClaimCategory,
153    pub confidence: RuntimeAttestationNormalizedClaimConfidence,
154    pub freshness: RuntimeAttestationNormalizedClaimFreshness,
155    pub description: String,
156    #[serde(default, skip_serializing_if = "Vec::is_empty")]
157    pub supported_verifier_families: Vec<AttestationVerifierFamily>,
158}
159
160#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
161#[serde(rename_all = "camelCase")]
162pub struct RuntimeAttestationNormalizedClaimVocabulary {
163    pub schema: String,
164    #[serde(default, skip_serializing_if = "Vec::is_empty")]
165    pub entries: Vec<RuntimeAttestationNormalizedClaimVocabularyEntry>,
166}
167
168#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
169#[serde(rename_all = "camelCase")]
170pub struct RuntimeAttestationAppraisalReason {
171    pub code: RuntimeAttestationAppraisalReasonCode,
172    pub group: RuntimeAttestationAppraisalReasonGroup,
173    pub disposition: RuntimeAttestationAppraisalReasonDisposition,
174    pub description: String,
175}
176
177#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
178#[serde(rename_all = "camelCase")]
179pub struct RuntimeAttestationReasonTaxonomy {
180    pub schema: String,
181    #[serde(default, skip_serializing_if = "Vec::is_empty")]
182    pub entries: Vec<RuntimeAttestationAppraisalReason>,
183}
184
185#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
186#[serde(rename_all = "camelCase")]
187pub struct RuntimeAttestationAppraisalResultSubject {
188    #[serde(default, skip_serializing_if = "Option::is_none")]
189    pub runtime_identity: Option<String>,
190    #[serde(default, skip_serializing_if = "Option::is_none")]
191    pub workload_identity: Option<WorkloadIdentity>,
192}
193
194#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
195#[serde(rename_all = "camelCase")]
196pub struct RuntimeAttestationAppraisalResult {
197    pub schema: String,
198    pub result_id: String,
199    pub exported_at: u64,
200    pub issuer: String,
201    pub appraisal: RuntimeAttestationAppraisalArtifact,
202    pub exporter_policy_outcome: RuntimeAttestationPolicyOutcome,
203    pub subject: RuntimeAttestationAppraisalResultSubject,
204}
205
206#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
207#[serde(rename_all = "snake_case")]
208pub enum RuntimeAttestationImportDisposition {
209    Allow,
210    Attenuate,
211    Reject,
212}
213
214#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
215#[serde(rename_all = "snake_case")]
216pub enum RuntimeAttestationImportReasonCode {
217    NoLocalPolicy,
218    InvalidSignature,
219    UnsupportedAppraisalSchema,
220    ResultStale,
221    EvidenceStale,
222    ExporterPolicyRejected,
223    UntrustedIssuer,
224    UntrustedSigner,
225    UnsupportedVerifierFamily,
226    MissingRequiredClaim,
227    ClaimMismatch,
228    TierAttenuated,
229}
230
231#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
232#[serde(rename_all = "camelCase")]
233pub struct RuntimeAttestationImportReason {
234    pub code: RuntimeAttestationImportReasonCode,
235    pub description: String,
236}
237
238#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
239#[serde(rename_all = "camelCase")]
240pub struct RuntimeAttestationImportedAppraisalPolicy {
241    #[serde(default, skip_serializing_if = "Vec::is_empty")]
242    pub trusted_issuers: Vec<String>,
243    #[serde(default, skip_serializing_if = "Vec::is_empty")]
244    pub trusted_signer_keys: Vec<String>,
245    #[serde(default, skip_serializing_if = "Vec::is_empty")]
246    pub allowed_verifier_families: Vec<AttestationVerifierFamily>,
247    #[serde(default, skip_serializing_if = "Option::is_none")]
248    pub max_result_age_seconds: Option<u64>,
249    #[serde(default, skip_serializing_if = "Option::is_none")]
250    pub max_evidence_age_seconds: Option<u64>,
251    #[serde(default, skip_serializing_if = "Option::is_none")]
252    pub maximum_effective_tier: Option<RuntimeAssuranceTier>,
253    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
254    pub required_claims: BTreeMap<RuntimeAttestationNormalizedClaimCode, String>,
255}
256
257#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
258#[serde(rename_all = "camelCase")]
259pub struct RuntimeAttestationAppraisalImportOutcome {
260    pub disposition: RuntimeAttestationImportDisposition,
261    pub effective_tier: RuntimeAssuranceTier,
262    #[serde(default, skip_serializing_if = "Vec::is_empty")]
263    pub reason_codes: Vec<RuntimeAttestationImportReasonCode>,
264    #[serde(default, skip_serializing_if = "Vec::is_empty")]
265    pub reasons: Vec<RuntimeAttestationImportReason>,
266}
267
268#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
269#[serde(rename_all = "camelCase")]
270pub struct RuntimeAttestationAppraisalImportRequest {
271    pub signed_result: SignedRuntimeAttestationAppraisalResult,
272    pub local_policy: RuntimeAttestationImportedAppraisalPolicy,
273}
274
275#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
276#[serde(rename_all = "camelCase")]
277pub struct RuntimeAttestationAppraisalImportReport {
278    pub schema: String,
279    pub evaluated_at: u64,
280    pub signer_key_hex: String,
281    pub result: RuntimeAttestationAppraisalResult,
282    pub local_policy_outcome: RuntimeAttestationAppraisalImportOutcome,
283}
284
285#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
286#[serde(rename_all = "camelCase")]
287pub struct RuntimeAttestationVerifierDescriptorDocument {
288    pub schema: String,
289    pub descriptor_id: String,
290    pub verifier: String,
291    pub verifier_family: AttestationVerifierFamily,
292    pub adapter: String,
293    #[serde(default, skip_serializing_if = "Vec::is_empty")]
294    pub attestation_schemas: Vec<String>,
295    pub appraisal_artifact_schema: String,
296    pub appraisal_result_schema: String,
297    #[serde(default, skip_serializing_if = "Vec::is_empty")]
298    pub signing_key_fingerprints: Vec<String>,
299    #[serde(default, skip_serializing_if = "Option::is_none")]
300    pub reference_values_uri: Option<String>,
301    pub issued_at: u64,
302    pub expires_at: u64,
303}
304
305pub type SignedRuntimeAttestationVerifierDescriptor =
306    SignedExportEnvelope<RuntimeAttestationVerifierDescriptorDocument>;
307
308#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
309#[serde(rename_all = "snake_case")]
310pub enum RuntimeAttestationReferenceValueState {
311    Active,
312    Superseded,
313    Revoked,
314}
315
316#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
317#[serde(rename_all = "camelCase")]
318pub struct RuntimeAttestationReferenceValueSet {
319    pub schema: String,
320    pub reference_value_id: String,
321    pub descriptor_id: String,
322    pub verifier_family: AttestationVerifierFamily,
323    pub attestation_schema: String,
324    #[serde(default, skip_serializing_if = "Option::is_none")]
325    pub source_uri: Option<String>,
326    pub issued_at: u64,
327    pub expires_at: u64,
328    pub state: RuntimeAttestationReferenceValueState,
329    #[serde(default, skip_serializing_if = "Option::is_none")]
330    pub superseded_by: Option<String>,
331    #[serde(default, skip_serializing_if = "Option::is_none")]
332    pub revoked_reason: Option<String>,
333    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
334    pub measurements: BTreeMap<String, Value>,
335}
336
337pub type SignedRuntimeAttestationReferenceValueSet =
338    SignedExportEnvelope<RuntimeAttestationReferenceValueSet>;
339
340#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
341#[serde(rename_all = "camelCase")]
342pub struct RuntimeAttestationTrustBundleDocument {
343    pub schema: String,
344    pub bundle_id: String,
345    pub publisher: String,
346    pub version: u64,
347    pub issued_at: u64,
348    pub expires_at: u64,
349    #[serde(default, skip_serializing_if = "Vec::is_empty")]
350    pub descriptors: Vec<SignedRuntimeAttestationVerifierDescriptor>,
351    #[serde(default, skip_serializing_if = "Vec::is_empty")]
352    pub reference_values: Vec<SignedRuntimeAttestationReferenceValueSet>,
353}
354
355pub type SignedRuntimeAttestationTrustBundle =
356    SignedExportEnvelope<RuntimeAttestationTrustBundleDocument>;
357
358#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
359#[serde(rename_all = "camelCase")]
360pub struct RuntimeAttestationTrustBundleVerification {
361    pub schema: String,
362    pub bundle_id: String,
363    pub publisher: String,
364    pub version: u64,
365    pub descriptor_count: usize,
366    pub reference_value_count: usize,
367    #[serde(default, skip_serializing_if = "Vec::is_empty")]
368    pub verifier_families: Vec<AttestationVerifierFamily>,
369    pub verified_at: u64,
370}
371
372#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
373pub enum RuntimeAttestationAppraisalError {
374    #[error("runtime attestation schema `{schema}` is not recognized by the canonical appraisal boundary")]
375    UnsupportedSchema { schema: String },
376}
377
378#[derive(Debug, Clone, thiserror::Error)]
379pub enum RuntimeAttestationVerificationError {
380    #[error("runtime attestation workload identity is invalid: {0}")]
381    InvalidWorkloadIdentity(#[from] WorkloadIdentityError),
382    #[error("runtime attestation evidence is stale at {now} (issued_at={issued_at}, expires_at={expires_at})")]
383    StaleEvidence {
384        now: u64,
385        issued_at: u64,
386        expires_at: u64,
387    },
388    #[error(transparent)]
389    Appraisal(#[from] RuntimeAttestationAppraisalError),
390    #[error("runtime attestation evidence rejected by local trust policy: {0}")]
391    TrustPolicy(#[from] AttestationTrustError),
392}
393
394#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
395#[serde(rename_all = "camelCase")]
396pub struct RuntimeAttestationVerifierDescriptor {
397    pub adapter: String,
398    pub verifier_family: AttestationVerifierFamily,
399}
400
401#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
402#[serde(rename_all = "camelCase")]
403pub struct RuntimeAttestationClaimSets {
404    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
405    pub normalized_assertions: BTreeMap<String, Value>,
406    #[serde(default, skip_serializing_if = "Vec::is_empty")]
407    pub normalized_claims: Vec<RuntimeAttestationNormalizedClaim>,
408    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
409    pub vendor_claims: BTreeMap<String, Value>,
410}
411
412#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
413#[serde(rename_all = "camelCase")]
414pub struct RuntimeAttestationPolicyProjection {
415    pub verdict: RuntimeAttestationAppraisalVerdict,
416    pub effective_tier: RuntimeAssuranceTier,
417    #[serde(default, skip_serializing_if = "Vec::is_empty")]
418    pub reason_codes: Vec<RuntimeAttestationAppraisalReasonCode>,
419    #[serde(default, skip_serializing_if = "Vec::is_empty")]
420    pub reasons: Vec<RuntimeAttestationAppraisalReason>,
421}
422
423#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
424#[serde(rename_all = "camelCase")]
425pub struct RuntimeAttestationAppraisalArtifact {
426    pub schema: String,
427    pub evidence: RuntimeAttestationEvidenceDescriptor,
428    pub verifier: RuntimeAttestationVerifierDescriptor,
429    pub claims: RuntimeAttestationClaimSets,
430    pub policy: RuntimeAttestationPolicyProjection,
431    #[serde(default, skip_serializing_if = "Option::is_none")]
432    pub workload_identity: Option<WorkloadIdentity>,
433}
434
435#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
436#[serde(rename_all = "camelCase")]
437pub struct RuntimeAttestationAppraisalArtifactInventoryEntry {
438    pub attestation_schema: String,
439    pub artifact_schema: String,
440    pub verifier_family: AttestationVerifierFamily,
441    pub adapter: String,
442    pub vendor_claim_namespace: String,
443    #[serde(default, skip_serializing_if = "Vec::is_empty")]
444    pub normalized_assertion_keys: Vec<String>,
445    #[serde(default, skip_serializing_if = "Vec::is_empty")]
446    pub normalized_claim_codes: Vec<RuntimeAttestationNormalizedClaimCode>,
447    #[serde(default, skip_serializing_if = "Vec::is_empty")]
448    pub default_reason_codes: Vec<RuntimeAttestationAppraisalReasonCode>,
449}
450
451#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
452#[serde(rename_all = "camelCase")]
453pub struct RuntimeAttestationAppraisalArtifactInventory {
454    pub schema: String,
455    #[serde(default, skip_serializing_if = "Vec::is_empty")]
456    pub entries: Vec<RuntimeAttestationAppraisalArtifactInventoryEntry>,
457}
458
459#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
460#[serde(rename_all = "camelCase")]
461pub struct RuntimeAttestationEvidenceDescriptor {
462    pub schema: String,
463    pub verifier: String,
464    pub issued_at: u64,
465    pub expires_at: u64,
466    pub evidence_sha256: String,
467}
468
469impl From<&RuntimeAttestationEvidence> for RuntimeAttestationEvidenceDescriptor {
470    fn from(value: &RuntimeAttestationEvidence) -> Self {
471        Self {
472            schema: value.schema.clone(),
473            verifier: value.verifier.clone(),
474            issued_at: value.issued_at,
475            expires_at: value.expires_at,
476            evidence_sha256: value.evidence_sha256.clone(),
477        }
478    }
479}
480
481#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
482#[serde(rename_all = "camelCase")]
483pub struct RuntimeAttestationAppraisal {
484    pub schema: String,
485    pub adapter: String,
486    pub verifier_family: AttestationVerifierFamily,
487    pub evidence: RuntimeAttestationEvidenceDescriptor,
488    pub verdict: RuntimeAttestationAppraisalVerdict,
489    pub effective_tier: RuntimeAssuranceTier,
490    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
491    pub normalized_assertions: BTreeMap<String, Value>,
492    #[serde(default, skip_serializing_if = "Vec::is_empty")]
493    pub normalized_claims: Vec<RuntimeAttestationNormalizedClaim>,
494    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
495    pub vendor_claims: BTreeMap<String, Value>,
496    #[serde(default, skip_serializing_if = "Vec::is_empty")]
497    pub reason_codes: Vec<RuntimeAttestationAppraisalReasonCode>,
498    #[serde(default, skip_serializing_if = "Vec::is_empty")]
499    pub reasons: Vec<RuntimeAttestationAppraisalReason>,
500    #[serde(default, skip_serializing_if = "Option::is_none")]
501    pub workload_identity: Option<WorkloadIdentity>,
502    #[serde(default, skip_serializing_if = "Option::is_none")]
503    pub artifact: Option<RuntimeAttestationAppraisalArtifact>,
504}
505
506#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
507#[serde(rename_all = "camelCase")]
508pub struct RuntimeAttestationAppraisalRequest {
509    pub runtime_attestation: RuntimeAttestationEvidence,
510}
511
512#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
513#[serde(rename_all = "camelCase")]
514pub struct RuntimeAttestationAppraisalResultExportRequest {
515    pub issuer: String,
516    pub runtime_attestation: RuntimeAttestationEvidence,
517}
518
519#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
520#[serde(rename_all = "camelCase")]
521pub struct RuntimeAttestationPolicyOutcome {
522    pub trust_policy_configured: bool,
523    pub accepted: bool,
524    pub effective_tier: RuntimeAssuranceTier,
525    #[serde(default, skip_serializing_if = "Option::is_none")]
526    pub reason: Option<String>,
527}
528
529#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
530#[serde(rename_all = "camelCase")]
531pub struct VerifiedRuntimeAttestationProvenance {
532    pub verifier_family: AttestationVerifierFamily,
533    pub verifier_adapter: String,
534    pub canonical_verifier: String,
535    #[serde(default, skip_serializing_if = "Option::is_none")]
536    pub matched_trust_rule: Option<String>,
537}
538
539#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
540#[serde(rename_all = "camelCase")]
541pub struct VerifiedRuntimeAttestationRecord {
542    pub evidence: RuntimeAttestationEvidence,
543    pub appraisal: RuntimeAttestationAppraisal,
544    pub policy_outcome: RuntimeAttestationPolicyOutcome,
545    pub subject: RuntimeAttestationAppraisalResultSubject,
546    pub provenance: VerifiedRuntimeAttestationProvenance,
547    pub verified_at: u64,
548}
549
550#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
551#[serde(rename_all = "camelCase")]
552pub struct RuntimeAttestationAppraisalReport {
553    pub schema: String,
554    pub generated_at: u64,
555    pub appraisal: RuntimeAttestationAppraisal,
556    pub policy_outcome: RuntimeAttestationPolicyOutcome,
557}
558
559pub type SignedRuntimeAttestationAppraisalReport =
560    SignedExportEnvelope<RuntimeAttestationAppraisalReport>;
561pub type SignedRuntimeAttestationAppraisalResult =
562    SignedExportEnvelope<RuntimeAttestationAppraisalResult>;
chio_appraisal/types.rs

chio_appraisal/
types.rs
