feat(seismic-tee): init --attestation-type picks the image's measurements asset

tee/cli/Cargo.toml

@@ -65,13 +65,13 @@ seismic-tee-admission = { path = "admission" }
 # seismic-crypto. Every rule the network's identity depends on has exactly one
 # implementation, and linking it rather than reimplementing it is what keeps
 # the CLI's answer and a node's answer the same answer.
-seismic-network-manifest = { git = "https://github.com/SeismicSystems/enclave.git", rev = "d977a2dbfb3f7b5bb73d4d8b1f2b1e806738b564" }
-seismic-manifest = { git = "https://github.com/SeismicSystems/enclave.git", rev = "d977a2dbfb3f7b5bb73d4d8b1f2b1e806738b564" }
-seismic-measurement-admission = { git = "https://github.com/SeismicSystems/enclave.git", rev = "d977a2dbfb3f7b5bb73d4d8b1f2b1e806738b564" }
-seismic-verify-quote = { git = "https://github.com/SeismicSystems/enclave.git", rev = "d977a2dbfb3f7b5bb73d4d8b1f2b1e806738b564" }
+seismic-network-manifest = { git = "https://github.com/SeismicSystems/enclave.git", rev = "d4103510b080c71de8610210f6ad7a765e48b41d" }
+seismic-manifest = { git = "https://github.com/SeismicSystems/enclave.git", rev = "d4103510b080c71de8610210f6ad7a765e48b41d" }
+seismic-measurement-admission = { git = "https://github.com/SeismicSystems/enclave.git", rev = "d4103510b080c71de8610210f6ad7a765e48b41d" }
+seismic-verify-quote = { git = "https://github.com/SeismicSystems/enclave.git", rev = "d4103510b080c71de8610210f6ad7a765e48b41d" }
 # The schema of the config POSTed to tdx-init, as the type tdx-init itself
 # deserializes: a field it would reject fails to compile here.
-tdx-init-config = { git = "https://github.com/SeismicSystems/enclave.git", rev = "d977a2dbfb3f7b5bb73d4d8b1f2b1e806738b564" }
+tdx-init-config = { git = "https://github.com/SeismicSystems/enclave.git", rev = "d4103510b080c71de8610210f6ad7a765e48b41d" }
 
 # The 20- and 32-byte words the registry gate compares — genesis storage
 # slots and the compile report's — and keccak256 over the registry's runtime

tee/cli/network/src/assemble.rs

@@ -950,6 +950,7 @@ pub(crate) mod tests {
             &crate::init::fetch_client().unwrap(),
             &net,
             &crate::init::InitInputs {
+                attestation_type: DEFAULT_ATTESTATION_TYPE,
                 name: "testnet-1",
                 image,
                 measurements: Some(raw.to_str().unwrap()),

tee/cli/network/src/image.rs

@@ -257,6 +257,16 @@ impl ImageRecord {
         format!("{}.vhd", self.image)
     }
 
+    /// The artifact `attestation_type`'s measurements are stamped with: the
+    /// VHD for `azure-tdx`, the tarball for `gcp-tdx`.
+    pub fn artifact(&self, attestation_type: &str) -> anyhow::Result<String> {
+        match attestation_type {
+            "azure-tdx" => Ok(self.vhd()),
+            "gcp-tdx" => Ok(format!("{}.tar.gz", self.image)),
+            other => bail!("attestation type {other:?} is not azure-tdx or gcp-tdx"),
+        }
+    }
+
     /// The measurements asset for `target` (an attestation type, `azure-tdx`).
     pub fn measurements_asset(&self, target: &str) -> anyhow::Result<&str> {
         match self.targets.get(target) {

tee/cli/network/src/init.rs

@@ -256,6 +256,8 @@ pub fn require_measurement_of(raw: &[u8], vhd: &str, source: &str) -> anyhow::Re
 pub struct InitInputs<'a> {
     pub name: &'a str,
     pub image: ImageRelease,
+    /// Which of the image's measurements assets is copied in, `azure-tdx` or `gcp-tdx`.
+    pub attestation_type: &'a str,
     pub measurements: Option<&'a str>,
     pub reth_genesis: Option<&'a str>,
     pub summit_genesis: Option<&'a str>,
@@ -349,11 +351,15 @@ pub async fn init_network_dir(
 ) -> anyhow::Result<Vec<PathBuf>> {
     let opened = OpenedRelease::open(inputs.image.clone()).await?;
 
-    let measurements_asset = opened.record.measurements_asset(DEFAULT_ATTESTATION_TYPE)?;
+    let measurements_asset = opened.record.measurements_asset(inputs.attestation_type)?;
     let (measurements, measurements_source) =
         input_from(client, &opened, inputs.measurements, measurements_asset).await?;
     require_measurement_id(&measurements, &measurements_source)?;
-    require_measurement_of(&measurements, &opened.record.vhd(), &measurements_source)?;
+    require_measurement_of(
+        &measurements,
+        &opened.record.artifact(inputs.attestation_type)?,
+        &measurements_source,
+    )?;
     let (reth_genesis, reth_source) = input_from(
         client,
         &opened,
@@ -476,10 +482,16 @@ pub struct InitArgs {
     /// The image's measurements (or a promoted policy; local path or https://
     /// URL), copied in as inputs/measurements.json — the PCRs of a real
     /// image, never generated, and stamped for the image --image-json names.
-    /// Default: the image's measurements asset.
+    /// Default: the image's measurements asset for --attestation-type.
     #[arg(long, value_name = "PATH_OR_URL")]
     pub measurements: Option<String>,
 
+    /// Platform the nodes attest on, azure-tdx or gcp-tdx: which of the
+    /// image's measurements assets is copied in, and whether they must be
+    /// stamped for its VHD or its tarball.
+    #[arg(long, value_name = "TYPE", default_value = DEFAULT_ATTESTATION_TYPE)]
+    pub attestation_type: String,
+
     /// Authored summit genesis (local path or https:// URL), copied in
     /// verbatim except that an empty namespace is filled with <name>. Every
     /// value in it is a per-network choice to review. Default: the image's
@@ -538,6 +550,7 @@ pub async fn run(args: InitArgs) -> anyhow::Result<ExitCode> {
         &InitInputs {
             name: &name,
             image,
+            attestation_type: &args.attestation_type,
             measurements: args.measurements.as_deref(),
             reth_genesis: args.reth_genesis.as_deref(),
             summit_genesis: args.summit_genesis.as_deref(),
@@ -656,6 +669,7 @@ mod tests {
             &fetch_client().unwrap(),
             &loose.out,
             &InitInputs {
+                attestation_type: DEFAULT_ATTESTATION_TYPE,
                 name: "testnet-1",
                 image: loose.image.clone(),
                 measurements: None,
@@ -679,6 +693,7 @@ mod tests {
             &fetch_client().unwrap(),
             out,
             &InitInputs {
+                attestation_type: DEFAULT_ATTESTATION_TYPE,
                 name: "testnet-1",
                 image: release,
                 measurements,