verify: temporarily disable id block verification

Since we currently cannot control when idkeys / igvm files are updated, a working contrast deployment can break at any time. Disable the validation for now to improve UX. (cherry picked from commit 8e0412b)
edgelesssys · Mar 12, 2024 · 00b35ce · 00b35ce
1 parent 724711a
commit 00b35ce
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/cli/cmd/verify.go b/cli/cmd/verify.go
@@ -168,7 +168,7 @@ func newCoordinatorValidateOptsGen(hostData []byte) *snp.StaticValidateOptsGener
 			},
 			PermitProvisionalFirmware: true,
 			TrustedIDKeyHashes:        trustedIDKeyDigests,
-			RequireIDBlock:            true,
+			RequireIDBlock:            false, // TODO(malt3): re-enable once we control the full boot (including the id block)
 		},
 	}
 }

diff --git a/coordinator/mesh.go b/coordinator/mesh.go
@@ -73,7 +73,7 @@ func (m *meshAuthority) SNPValidateOpts(report *sevsnp.Report) (*validate.Option
 		},
 		PermitProvisionalFirmware: true,
 		TrustedIDKeyHashes:        trustedIDKeyDigestHashes,
-		RequireIDBlock:            true,
+		RequireIDBlock:            false, // TODO(malt3): re-enable once we control the full boot (including the id block)
 	}, nil
 }