fix(scripts): extract-nitro-pcrs.sh buildx OCI export + --expected-kernel-hash#411
Merged
Conversation
…rnel-hash The default `docker` buildx driver can't produce qos's `--output type=oci`, so the script now provisions a scoped `docker-container` driver builder on demand (no host daemon.json changes, no touching the default builder) and points the qos build at it via BUILDX_BUILDER. Also adds --expected-kernel-hash to assert the reproduced PCR0/PCR1 against a value pulled from a live attestation, so an operator can rebuild locally and confirm a deployment's kernel measurement without eyeballing hex.
Contributor
There was a problem hiding this comment.
Pull request overview
Updates scripts/extract-nitro-pcrs.sh to make local PCR reproduction more reliable across different Docker buildx configurations, and adds an optional assertion to verify reproduced PCRs against an expected attestation-derived value.
Changes:
- Provision and use a dedicated
docker-containerbuildx builder (qos-oci-builder) so QoS’s--output type=ocibuild succeeds even when the host’s default driver doesn’t support OCI export. - Add
--expected-kernel-hash <hex>to assert the reproduced PCR0 and PCR1 match a supplied hex digest, failing with a non-zero exit on mismatch. - Introduce helper functions for PCR extraction and expected-hash checking.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+147
to
+153
| ensure_buildx_builder() { | ||
| if ! docker buildx inspect "$BUILDX_BUILDER_NAME" >/dev/null 2>&1; then | ||
| echo "Creating buildx builder '$BUILDX_BUILDER_NAME' (docker-container driver, supports OCI export)..." >&2 | ||
| docker buildx create --name "$BUILDX_BUILDER_NAME" --driver docker-container >/dev/null | ||
| fi | ||
| export BUILDX_BUILDER="$BUILDX_BUILDER_NAME" | ||
| } |
…eo digest The fresh-clone path in ensure_qos_checkout checked out $REV without first fetching it, failing whenever the rev isn't reachable from a branch tip the clone fetched (e.g. a superseded/rebased PR commit) even though it's still directly fetchable by SHA. Also refresh SKOPEO_IMAGE: the pinned digest had gone dead (manifest fully GC'd from quay.io), breaking extraction outright. Verified end-to-end against rev f0a18a089e70cc6d51b819b4f7f277a1e15512e5: reproduces PCR0/PCR1 1e7e8ca79c2a...053b04c, matching the Turnkey attestation. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
shahan-khatchadourian-anchorage
approved these changes
Jul 7, 2026
Contributor
There was a problem hiding this comment.
Validated manually succesfully against the git rev provided in #408
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
scripts/extract-nitro-pcrs.shfailing on hosts whose defaultdockerbuildx driver can't produce qos's--output type=ocibuild ("OCI exporter is not supported for the docker driver"). The script now provisions a scopeddocker-containerdriver builder (qos-oci-builder) on demand and points the build at it viaBUILDX_BUILDER, without touching the host's default builder ordaemon.json.--expected-kernel-hash <hex>to assert the reproduced PCR0 and PCR1 both equal a given value (e.g. pulled from a live attestation), so this can be used to verify a deployment by rebuilding locally instead of eyeballing hex diffs. Exits non-zero on mismatch.Context
Related to PR #408, which bumps the
# qos-deployment-revmarker for thev2026.6.11QoS release. That PR's chosen rev doesn't reproduce Turnkey's attested PCR0/PCR1 (verified independently) — this tool is what's needed to audit candidate revs against a real attestation value going forward.Test plan
bash -n scripts/extract-nitro-pcrs.shd866f2c6cbc58cc08c24eab4828f0824ad16a226, PCR0/1d787eb65...22253ab, matching the value documented in the original PR feat: scripts/extract-nitro-pcrs.sh + self-hosted-tee docs #300 commit message)check_expected_kernel_hashagainst a sample.pcrsfile: exits 0 on match, exits 1 with a clear mismatch message on mismatch