[chalabi2]

Why

Kata must fail closed when confidential secret resolution fails and must hand measured persistent-volume descriptors to CDH without exposing keys on the host or kernel command line.

What changed

• propagate sealed environment and sealed-mount failures from container creation
• reject sealed environment values when CDH is unavailable
• materialize a 0600 per-container secure-volume descriptor from measured initdata
• require exact container and reserved OCI Block-device matches
• delegate signed-reference verification and persistent LUKS handling to CDH
• pin guest-components to the crash-safe persistent-volume revision
• package blkid from util-linux in Ubuntu and NVIDIA guest root filesystems
• allow only measured cc_init_data for NVIDIA SNP and TDX confidential runtime entries
• retain both CDI and VFIO devices in two-pGPU regression tests
• preserve ordinary environment values and ordinary mounted files

Dependencies

• cdh: add crash-safe persistent LUKS volumes guest-components#1 owns persistent LUKS and signed references
• feat(provider): add confidential storage and registry references provider#427 creates the measured descriptors
• verifier: add local NVIDIA Blackwell GPU attestation trustee#1 verifies Blackwell evidence locally

Validation

• secure-volume descriptor, exact-device, initdata materialization, and permission tests pass
• missing-CDH sealed-environment regression passes
• Rust formatting and Clippy with warnings denied pass
• focused two-VFIO and two-pGPU Go tests pass
• Helm rendering emits measured initdata for the confidential GPU shims
• current Linux static checks compile the changed agent, runtime, and packaging paths
• shellcheck, spelling, editorconfig, cargo-deny, code generation, and policy coverage checks pass

Live result and limits

This branch was used in the isolated RTX PRO 6000 canary that attached two GPUs to one SNP guest and reopened persistent Block PVCs across fresh Kata VMs.

The newly pinned crash-safety commit still needs its ignored privileged loopback test on disposable Linux storage. B200 and NVSwitch remain separate hardware claims. The QMP pxb-host.addr warnings observed during the canary did not prevent either VFIO device from attaching and are not addressed here.

The PR still has repository-infrastructure failures unrelated to the changed code: the fork lacks the ok-to-test gate, static checks cannot upload an organization ORAS cache, and existing workflow files trigger actionlint/zizmor.