Add Tinfoil conformance testing - #93

Open

lsd-cat wants to merge 28 commits into

mainfrom

feat/tinfoil-conformance

Commits on Jul 15, 2026

feat(sigstore): extract verify_sigstore_bundle_with_policy + add tinfoil-conformance binary

lsd-cat
and
claude
committed
c0aa0cb
chore(conformance): declare 3 new capability flags

lsd-cat
and
claude
committed
f9aa12e
feat(conformance): add verify-measurement subcommand (SPEC §7)

lsd-cat
and
claude
committed
db9e8e8
feat(conformance): add verify-hardware-measurements subcommand (SPEC §6)

lsd-cat
and
claude
committed
f86c9ec
chore(conformance): repoint to tinfoilsh/tinfoil-conformance

lsd-cat
and
claude
committed
b8553a2
chore(conformance): declare attestation_tdx capability (Phase 1, false)

lsd-cat
and
claude
committed
9b74046
feat(conformance): wire verify-attestation-tdx — structural path (Phase 1.5)

lsd-cat
and
claude
committed
d4d5cd1
feat(conformance): tdx error classifier for Phase 2A fixtures

lsd-cat
and
claude
committed
4d161cb
chore(conformance): declare attestation_tdx.tcb_evaluation_supported = false

lsd-cat
and
claude
committed
8dc57f9
feat(conformance): tdx Phase 4 — SPEC §4.8 extended-TD policy enforcement

lsd-cat
and
claude
committed
9134909
feat(conformance): wire full §4.7 TCB evaluation path for tinfoil-python

lsd-cat
and
claude
committed
eb6a4d3
feat(conformance): SPEC §4.8.1/§4.8.2 normative enforcement (Phase 4B)

lsd-cat
and
claude
committed
23e393d
feat(conformance): verify-attestation-sev subcommand (SPEC §3)

lsd-cat
and
claude
committed
a5dd51f
feat(conformance): verify-full subcommand (SPEC §11)

lsd-cat
and
claude
committed
02f0f0c
Improve TDX conformance classifications
lsd-cat
committed
6978f10
Add TDX public API conformance path
lsd-cat
committed
ebdfdf1
chore(conformance): isolate Python sigstore hooks
lsd-cat
committed
7032273
chore(conformance): declare ehbp transport + bundle flow capability

lsd-cat
and
claude
committed
c5977df
feat(conformance): verify-ehbp-key-binding handler (SPEC §14.2)

lsd-cat
and
claude
committed
48f601c
feat(conformance): SEV public-api execution mode (SPEC §3)

lsd-cat
and
claude
committed
2ea374d
fix(conformance): apply SEV §3.7 policy pins in the public-api path

lsd-cat
and
claude
committed
33206c6
feat(conformance): TDX public-api full-flow path (50/65 fixtures)

lsd-cat
and
claude
committed
f591722
conformance: V2-preferred OIDC issuer + homogenize 069

lsd-cat
and
claude
committed
29cc0f3
conformance: reject duplicate-log SCTs (SPEC §5.2)

lsd-cat
and
claude
committed
6bc46b3
conformance: fix stale scts_count_distinguish_missing_vs_duplicate (py)

lsd-cat
and
claude
committed
69af9c3
conformance: reject legacy x509CertificateChain bundle format (SPEC §5.2)

lsd-cat
and
claude
committed
6c7e3b7
conformance: reject in-toto statements with unknown top-level fields (SPEC §5.4)

lsd-cat
and
claude
committed
361123d
conformance: wire the TDX path in verify-full (was a stub)
lsd-cat
committed
9a96724

Navigation Menu

Uh oh!

Add Tinfoil conformance testing - #93

Add Tinfoil conformance testing#93
lsd-cat wants to merge 28 commits into
mainfrom
feat/tinfoil-conformance

Commits on Jul 15, 2026

feat(sigstore): extract verify_sigstore_bundle_with_policy + add tinfoil-conformance binary

chore(conformance): declare 3 new capability flags

feat(conformance): add verify-measurement subcommand (SPEC §7)

feat(conformance): add verify-hardware-measurements subcommand (SPEC §6)

chore(conformance): repoint to tinfoilsh/tinfoil-conformance

chore(conformance): declare attestation_tdx capability (Phase 1, false)

feat(conformance): wire verify-attestation-tdx — structural path (Phase 1.5)

feat(conformance): tdx error classifier for Phase 2A fixtures

chore(conformance): declare attestation_tdx.tcb_evaluation_supported = false

feat(conformance): tdx Phase 4 — SPEC §4.8 extended-TD policy enforcement

feat(conformance): wire full §4.7 TCB evaluation path for tinfoil-python

feat(conformance): SPEC §4.8.1/§4.8.2 normative enforcement (Phase 4B)

feat(conformance): verify-attestation-sev subcommand (SPEC §3)

feat(conformance): verify-full subcommand (SPEC §11)

Improve TDX conformance classifications

Add TDX public API conformance path

chore(conformance): isolate Python sigstore hooks

chore(conformance): declare ehbp transport + bundle flow capability

feat(conformance): verify-ehbp-key-binding handler (SPEC §14.2)

feat(conformance): SEV public-api execution mode (SPEC §3)

fix(conformance): apply SEV §3.7 policy pins in the public-api path

feat(conformance): TDX public-api full-flow path (50/65 fixtures)

conformance: V2-preferred OIDC issuer + homogenize 069

conformance: reject duplicate-log SCTs (SPEC §5.2)

conformance: fix stale scts_count_distinguish_missing_vs_duplicate (py)

conformance: reject legacy x509CertificateChain bundle format (SPEC §5.2)

conformance: reject in-toto statements with unknown top-level fields (SPEC §5.4)

conformance: wire the TDX path in verify-full (was a stub)