NOISSUE - Add DisconnectReq message and TTL support for VM creation (#428)

* feat: Add DisconnectReq message and TTL support for VM creation

- Introduced DisconnectReq message in cvms.proto to handle disconnection requests.
- Enhanced CreateReq in manager.proto to include a TTL field for virtual machines.
- Updated CLI to accept TTL as a command-line flag during VM creation.
- Modified manager service to remove VMs after the specified TTL duration.
- Adjusted gRPC client connection handling in agent main.go to support new client structure.
- Added mock implementation for gRPC client to facilitate testing.

Signed-off-by: Sammy Oina <sammyoina@gmail.com>

* fix: Mark server URL flag as required with error handling

Signed-off-by: Sammy Oina <sammyoina@gmail.com>

---------

Signed-off-by: Sammy Oina <sammyoina@gmail.com>

.github/workflows/checkproto.yaml

@@ -33,8 +33,8 @@ jobs:
 
       - name: Set up protoc
         run: |
-          PROTOC_VERSION=29.3
-          PROTOC_GEN_VERSION=v1.36.4
+          PROTOC_VERSION=29.0
+          PROTOC_GEN_VERSION=v1.36.5
           PROTOC_GRPC_VERSION=v1.5.1
 
           # Download and install protoc

.github/workflows/main.yaml

@@ -22,10 +22,11 @@ jobs:
           go-version: 1.23.x
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v7
         with:
-          version: v1.60
+          version: v2.0.2
 
+        
       - name: Build
         run: |
           make

.golangci.yaml

@@ -1,84 +1,100 @@
-run:
-  timeout: 3m
-
-issues:
-  max-issues-per-linter: 10
-  max-same-issues: 10
-  exclude-rules:
-    - linters:
-        - makezero
-      text: "with non-zero initialized length"
-
-linters-settings:
-  importas:
-    no-unaliased: true
-    no-extra-aliases: false
-    alias:
-      - pkg: github.com/absmach/magistrala/logger
-        alias: mglog
-
-  gocritic:
-    enabled-checks:
-      - dupImport
-      - importShadow
-      - httpNoBody
-      - paramTypeCombine
-      - emptyStringTest
-      - builtinShadow
-      - exposedSyncMutex
-    disabled-checks:
-      - appendAssign
-    enabled-tags:
-      - diagnostic
-    disabled-tags:
-      - performance
-      - style
-      - experimental
-      - opinionated
-  stylecheck:
-    checks: ["-ST1000", "-ST1003", "-ST1020", "-ST1021", "-ST1022"]
-  goheader:
-    template: |-
-      Copyright (c) Ultraviolet
-      SPDX-License-Identifier: Apache-2.0
-
+version: "2"
 linters:
-  disable-all: true
+  default: none
   enable:
-    - importas
-    - gocritic
-    - gosimple
-    - errcheck
-    - govet
-    - unused
-    - goconst
-    - godot
-    - godox
-    - ineffassign
-    - misspell
-    - stylecheck
-    - whitespace
-    - gci
-    - gofmt
-    - goimports
-    - loggercheck
-    - goheader
     - asasalint
     - asciicheck
     - bidichk
     - contextcheck
+    - copyloopvar
     - decorder
     - dogsled
+    - dupword
+    - errcheck
     - errchkjson
     - errname
-    - copyloopvar
     - ginkgolinter
     - gocheckcompilerdirectives
-    - gofumpt
+    - goconst
+    - gocritic
+    - godot
+    - godox
+    - goheader
     - goprintffuncname
+    - govet
     - importas
+    - ineffassign
+    - loggercheck
     - makezero
     - mirror
+    - misspell
     - nakedret
-    - dupword
-
+    - staticcheck
+    - unused
+    - whitespace
+  settings:
+    gocritic:
+      enabled-checks:
+        - dupImport
+        - importShadow
+        - httpNoBody
+        - paramTypeCombine
+        - emptyStringTest
+        - builtinShadow
+        - exposedSyncMutex
+      disabled-checks:
+        - appendAssign
+      enabled-tags:
+        - diagnostic
+      disabled-tags:
+        - performance
+        - style
+        - experimental
+        - opinionated
+    goheader:
+      template: |-
+        Copyright (c) Ultraviolet
+        SPDX-License-Identifier: Apache-2.0
+    importas:
+      alias:
+        - pkg: github.com/absmach/magistrala/logger
+          alias: mglog
+      no-unaliased: true
+      no-extra-aliases: false
+    staticcheck:
+      checks:
+        - -ST1000
+        - -ST1003
+        - -ST1020
+        - -ST1021
+        - -ST1022
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - linters:
+          - makezero
+        text: with non-zero initialized length
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+issues:
+  max-issues-per-linter: 10
+  max-same-issues: 10
+formatters:
+  enable:
+    - gci
+    - gofmt
+    - gofumpt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

README.md

@@ -76,3 +76,5 @@ Cocos AI is published under the permissive open-source [Apache-2.0](LICENSE) lic
 - [Official Releases](https://github.com/ultravioletrs/cocos/releases)
 - [Confidential Computing Overview](https://confidentialcomputing.io/white-papers-reports/)
 - [Trusted Execution Environments (TEEs)](https://en.wikipedia.org/wiki/Trusted_execution_environment)
+
+>This work has been partially supported by the ELASTIC project, which received funding from the Smart Networks and Services Joint Undertaking (SNS JU) under the European Union’s Horizon Europe research and innovation programme under Grant Agreement No 101139067. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union. Neither the European Union nor the granting authority can be held responsible for them.

agent/README.md

@@ -6,16 +6,16 @@ Agent service provides a barebones HTTP and gRPC API and Service interface imple
 
 The service is configured using the environment variables from the following table. Note that any unset variables will be replaced with their default values.
 
-| Variable                       | Description                                            | Default                        |
-| ------------------------------ | ------------------------------------------------------ | ------------------------------ |
-| AGENT_LOG_LEVEL                | Log level for agent service (debug, info, warn, error) | debug                          |
-| AGENT_CVM_GRPC_HOST            | Agent service gRPC host                                | ""                             |
-| AGENT_CVM_GRPC_PORT            | Agent service gRPC port                                | 7001                           |
-| AGENT_CVM_GRPC_SERVER_CERT     | Path to gRPC server certificate in pem format          | ""                             |
-| AGENT_CVM_GRPC_SERVER_KEY      | Path to gRPC server key in pem format                  | ""                             |
-| AGENT_CVM_GRPC_SERVER_CA_CERTS | Path to gRPC server CA certificate                     | ""                             |
-| AGENT_CVM_GRPC_CLIENT_CA_CERTS | Path to gRPC client CA certificate                     | ""                             |
-
+| Variable                       | Description                                                                                                   | Default                        |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------------- | ------------------------------ |
+| AGENT_LOG_LEVEL                | Log level for agent service (debug, info, warn, error)                                                        | debug                          |
+| AGENT_CVM_GRPC_HOST            | Agent service gRPC host                                                                                       | ""                             |
+| AGENT_CVM_GRPC_PORT            | Agent service gRPC port                                                                                       | 7001                           |
+| AGENT_CVM_GRPC_SERVER_CERT     | Path to gRPC server certificate in pem format                                                                 | ""                             |
+| AGENT_CVM_GRPC_SERVER_KEY      | Path to gRPC server key in pem format                                                                         | ""                             |
+| AGENT_CVM_GRPC_SERVER_CA_CERTS | Path to gRPC server CA certificate                                                                            | ""                             |
+| AGENT_CVM_GRPC_CLIENT_CA_CERTS | Path to gRPC client CA certificate                                                                            | ""                             |
+| AGENT_CVM_CA_URL               | URL for CA service, if provided it will be used for certificate generation, used only with aTLS at the moment | ""                             |
 
 ## Deployment
 

agent/agent.pb.go

@@ -3,8 +3,8 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.4
-// 	protoc        v5.29.3
+// 	protoc-gen-go v1.36.5
+// 	protoc        v5.29.0
 // source: agent/agent.proto
 
 package agent

agent/agent_grpc.pb.go

@@ -4,7 +4,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.5.1
-// - protoc             v5.29.3
+// - protoc             v5.29.0
 // source: agent/agent.proto
 
 package agent

agent/api/logging.go

@@ -34,7 +34,7 @@ func LoggingMiddleware(svc agent.Service, logger *slog.Logger) agent.Service {
 func (lm *loggingMiddleware) State() (state string) {
 	defer func(begin time.Time) {
 		message := fmt.Sprintf("Method State took %s to complete with state %s", time.Since(begin), state)
-		lm.logger.Info(message)
+		lm.logger.Debug(message)
 	}(time.Now())
 	return lm.svc.State()
 }

agent/auth/mocks/auth.go

@@ -1,7 +1,7 @@
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
 
-// Code generated by mockery v2.43.2. DO NOT EDIT.
+// Code generated by mockery v2.53.3. DO NOT EDIT.
 
 package mocks
 

agent/computations.go

@@ -13,7 +13,6 @@ import (
 var _ fmt.Stringer = (*Datasets)(nil)
 
 type AgentConfig struct {
-	Host         string `json:"host,omitempty"`
 	Port         string `json:"port,omitempty"`
 	CertFile     string `json:"cert_file,omitempty"`
 	KeyFile      string `json:"server_key,omitempty"`

agent/computations_test.go

@@ -106,7 +106,6 @@ func TestDecompressToContext(t *testing.T) {
 
 func TestAgentConfigJSON(t *testing.T) {
 	config := AgentConfig{
-		Host:         "localhost",
 		Port:         "8080",
 		CertFile:     "cert.pem",
 		KeyFile:      "key.pem",

agent/cvms/api/grpc/client.go

@@ -13,6 +13,7 @@ import (
 	"github.com/ultravioletrs/cocos/agent/cvms"
 	"github.com/ultravioletrs/cocos/agent/cvms/api/grpc/storage"
 	"github.com/ultravioletrs/cocos/agent/cvms/server"
+	pkggrpc "github.com/ultravioletrs/cocos/pkg/clients/grpc"
 	"golang.org/x/sync/errgroup"
 	"google.golang.org/protobuf/proto"
 )
@@ -42,11 +43,12 @@ type CVMSClient struct {
 	runReqManager *runRequestManager
 	sp            server.AgentServer
 	storage       storage.Storage
-	reconnectFn   func(context.Context) (cvms.Service_ProcessClient, error)
+	reconnectFn   func(context.Context) (pkggrpc.Client, cvms.Service_ProcessClient, error)
+	grpcClient    pkggrpc.Client
 }
 
 // NewClient returns new gRPC client instance.
-func NewClient(stream cvms.Service_ProcessClient, svc agent.Service, messageQueue chan *cvms.ClientStreamMessage, logger *slog.Logger, sp server.AgentServer, storageDir string, reconnectFn func(context.Context) (cvms.Service_ProcessClient, error)) (*CVMSClient, error) {
+func NewClient(stream cvms.Service_ProcessClient, svc agent.Service, messageQueue chan *cvms.ClientStreamMessage, logger *slog.Logger, sp server.AgentServer, storageDir string, reconnectFn func(context.Context) (pkggrpc.Client, cvms.Service_ProcessClient, error), grpcClient pkggrpc.Client) (*CVMSClient, error) {
 	store, err := storage.NewFileStorage(storageDir)
 	if err != nil {
 		return nil, err
@@ -61,6 +63,7 @@ func NewClient(stream cvms.Service_ProcessClient, svc agent.Service, messageQueu
 		sp:            sp,
 		storage:       store,
 		reconnectFn:   reconnectFn,
+		grpcClient:    grpcClient,
 	}, nil
 }
 
@@ -74,7 +77,7 @@ func (client *CVMSClient) Process(ctx context.Context, cancel context.CancelFunc
 		client.logger.Info("Connection lost, attempting to reconnect...", "error", err)
 		time.Sleep(reconnectInterval)
 
-		stream, err := client.reconnectFn(ctx)
+		grpcClient, stream, err := client.reconnectFn(ctx)
 		if err != nil {
 			client.logger.Error("Failed to reconnect", "error", err)
 			continue
@@ -82,6 +85,7 @@ func (client *CVMSClient) Process(ctx context.Context, cancel context.CancelFunc
 
 		client.mu.Lock()
 		client.stream = stream
+		client.grpcClient = grpcClient
 		client.mu.Unlock()
 	}
 }
@@ -172,6 +176,13 @@ func (client *CVMSClient) processIncomingMessage(ctx context.Context, req *cvms.
 		go client.handleStopComputation(ctx, mes)
 	case *cvms.ServerStreamMessage_AgentStateReq:
 		client.handleAgentStateReq(mes)
+	case *cvms.ServerStreamMessage_DisconnectReq:
+		client.logger.Info("Received disconnect request")
+		client.mu.Lock()
+		if err := client.grpcClient.Close(); err != nil {
+			client.logger.Error("Failed to close gRPC client", "error", err)
+		}
+		client.mu.Unlock()
 	default:
 		return errUnknonwMessageType
 	}
@@ -253,7 +264,6 @@ func (client *CVMSClient) executeRun(ctx context.Context, runReq *cvms.Computati
 
 	if err := client.sp.Start(agent.AgentConfig{
 		Port:         runReq.AgentConfig.Port,
-		Host:         runReq.AgentConfig.Host,
 		CertFile:     runReq.AgentConfig.CertFile,
 		KeyFile:      runReq.AgentConfig.KeyFile,
 		ServerCAFile: runReq.AgentConfig.ServerCaFile,

agent/cvms/api/grpc/client_test.go

@@ -13,6 +13,8 @@ import (
 	"github.com/ultravioletrs/cocos/agent/cvms"
 	servermocks "github.com/ultravioletrs/cocos/agent/cvms/server/mocks"
 	"github.com/ultravioletrs/cocos/agent/mocks"
+	pkggrpc "github.com/ultravioletrs/cocos/pkg/clients/grpc"
+	clientmocks "github.com/ultravioletrs/cocos/pkg/clients/grpc/mocks"
 	"google.golang.org/grpc"
 	"google.golang.org/protobuf/proto"
 )
@@ -88,7 +90,9 @@ func TestManagerClient_Process(t *testing.T) {
 				<-messageQueue
 			}()
 
-			client, err := NewClient(mockStream, mockSvc, messageQueue, logger, mockServerSvc, t.TempDir(), func(ctx context.Context) (cvms.Service_ProcessClient, error) { return nil, nil })
+			grpcClient := new(clientmocks.Client)
+
+			client, err := NewClient(mockStream, mockSvc, messageQueue, logger, mockServerSvc, t.TempDir(), func(ctx context.Context) (pkggrpc.Client, cvms.Service_ProcessClient, error) { return nil, nil, nil }, grpcClient)
 			assert.NoError(t, err)
 
 			ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
@@ -116,8 +120,9 @@ func TestManagerClient_handleRunReqChunks(t *testing.T) {
 	mockServerSvc := new(servermocks.AgentServer)
 	messageQueue := make(chan *cvms.ClientStreamMessage, 10)
 	logger := mglog.NewMock()
+	grpcClient := new(clientmocks.Client)
 
-	client, err := NewClient(mockStream, mockSvc, messageQueue, logger, mockServerSvc, t.TempDir(), func(ctx context.Context) (cvms.Service_ProcessClient, error) { return nil, nil })
+	client, err := NewClient(mockStream, mockSvc, messageQueue, logger, mockServerSvc, t.TempDir(), func(ctx context.Context) (pkggrpc.Client, cvms.Service_ProcessClient, error) { return nil, nil, nil }, grpcClient)
 	assert.NoError(t, err)
 
 	runReq := &cvms.ComputationRunReq{
@@ -167,8 +172,9 @@ func TestManagerClient_handleStopComputation(t *testing.T) {
 	mockServerSvc := new(servermocks.AgentServer)
 	messageQueue := make(chan *cvms.ClientStreamMessage, 10)
 	logger := mglog.NewMock()
+	grpcClient := new(clientmocks.Client)
 
-	client, err := NewClient(mockStream, mockSvc, messageQueue, logger, mockServerSvc, t.TempDir(), func(ctx context.Context) (cvms.Service_ProcessClient, error) { return nil, nil })
+	client, err := NewClient(mockStream, mockSvc, messageQueue, logger, mockServerSvc, t.TempDir(), func(ctx context.Context) (pkggrpc.Client, cvms.Service_ProcessClient, error) { return nil, nil, nil }, grpcClient)
 	assert.NoError(t, err)
 
 	stopReq := &cvms.ServerStreamMessage_StopComputation{

agent/cvms/api/grpc/storage/mocks/storage.go

@@ -1,7 +1,7 @@
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
 
-// Code generated by mockery v2.43.2. DO NOT EDIT.
+// Code generated by mockery v2.53.3. DO NOT EDIT.
 
 package mocks
 
@@ -71,7 +71,7 @@ func (_c *Storage_Add_Call) RunAndReturn(run func(*cvms.ClientStreamMessage) err
 	return _c
 }
 
-// Clear provides a mock function with given fields:
+// Clear provides a mock function with no fields
 func (_m *Storage) Clear() error {
 	ret := _m.Called()
 
@@ -116,7 +116,7 @@ func (_c *Storage_Clear_Call) RunAndReturn(run func() error) *Storage_Clear_Call
 	return _c
 }
 
-// Load provides a mock function with given fields:
+// Load provides a mock function with no fields
 func (_m *Storage) Load() ([]storage.Message, error) {
 	ret := _m.Called()
 

agent/cvms/cvms.pb.go

@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        v5.29.0
 // source: agent/cvms/cvms.proto
 
@@ -15,6 +15,7 @@ import (
 	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -429,6 +430,7 @@ type ClientStreamMessage struct {
 	//	*ClientStreamMessage_RunRes
 	//	*ClientStreamMessage_StopComputationRes
 	//	*ClientStreamMessage_AgentStateRes
+	//	*ClientStreamMessage_VTPMattestationReport
 	Message       isClientStreamMessage_Message `protobuf_oneof:"message"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -516,6 +518,15 @@ func (x *ClientStreamMessage) GetAgentStateRes() *AgentStateRes {
 	return nil
 }
 
+func (x *ClientStreamMessage) GetVTPMattestationReport() *AttestationResponse {
+	if x != nil {
+		if x, ok := x.Message.(*ClientStreamMessage_VTPMattestationReport); ok {
+			return x.VTPMattestationReport
+		}
+	}
+	return nil
+}
+
 type isClientStreamMessage_Message interface {
 	isClientStreamMessage_Message()
 }
@@ -540,6 +551,10 @@ type ClientStreamMessage_AgentStateRes struct {
 	AgentStateRes *AgentStateRes `protobuf:"bytes,5,opt,name=agentStateRes,proto3,oneof"`
 }
 
+type ClientStreamMessage_VTPMattestationReport struct {
+	VTPMattestationReport *AttestationResponse `protobuf:"bytes,6,opt,name=vTPMattestationReport,proto3,oneof"`
+}
+
 func (*ClientStreamMessage_AgentLog) isClientStreamMessage_Message() {}
 
 func (*ClientStreamMessage_AgentEvent) isClientStreamMessage_Message() {}
@@ -550,6 +565,8 @@ func (*ClientStreamMessage_StopComputationRes) isClientStreamMessage_Message() {
 
 func (*ClientStreamMessage_AgentStateRes) isClientStreamMessage_Message() {}
 
+func (*ClientStreamMessage_VTPMattestationReport) isClientStreamMessage_Message() {}
+
 type ServerStreamMessage struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// Types that are valid to be assigned to Message:
@@ -558,6 +575,7 @@ type ServerStreamMessage struct {
 	//	*ServerStreamMessage_RunReq
 	//	*ServerStreamMessage_StopComputation
 	//	*ServerStreamMessage_AgentStateReq
+	//	*ServerStreamMessage_DisconnectReq
 	Message       isServerStreamMessage_Message `protobuf_oneof:"message"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -636,6 +654,15 @@ func (x *ServerStreamMessage) GetAgentStateReq() *AgentStateReq {
 	return nil
 }
 
+func (x *ServerStreamMessage) GetDisconnectReq() *DisconnectReq {
+	if x != nil {
+		if x, ok := x.Message.(*ServerStreamMessage_DisconnectReq); ok {
+			return x.DisconnectReq
+		}
+	}
+	return nil
+}
+
 type isServerStreamMessage_Message interface {
 	isServerStreamMessage_Message()
 }
@@ -656,6 +683,10 @@ type ServerStreamMessage_AgentStateReq struct {
 	AgentStateReq *AgentStateReq `protobuf:"bytes,4,opt,name=agentStateReq,proto3,oneof"`
 }
 
+type ServerStreamMessage_DisconnectReq struct {
+	DisconnectReq *DisconnectReq `protobuf:"bytes,5,opt,name=disconnectReq,proto3,oneof"`
+}
+
 func (*ServerStreamMessage_RunReqChunks) isServerStreamMessage_Message() {}
 
 func (*ServerStreamMessage_RunReq) isServerStreamMessage_Message() {}
@@ -664,6 +695,52 @@ func (*ServerStreamMessage_StopComputation) isServerStreamMessage_Message() {}
 
 func (*ServerStreamMessage_AgentStateReq) isServerStreamMessage_Message() {}
 
+func (*ServerStreamMessage_DisconnectReq) isServerStreamMessage_Message() {}
+
+type DisconnectReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DisconnectReq) Reset() {
+	*x = DisconnectReq{}
+	mi := &file_agent_cvms_cvms_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DisconnectReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DisconnectReq) ProtoMessage() {}
+
+func (x *DisconnectReq) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_cvms_cvms_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DisconnectReq.ProtoReflect.Descriptor instead.
+func (*DisconnectReq) Descriptor() ([]byte, []int) {
+	return file_agent_cvms_cvms_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *DisconnectReq) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
 type RunReqChunks struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Data          []byte                 `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
@@ -675,7 +752,7 @@ type RunReqChunks struct {
 
 func (x *RunReqChunks) Reset() {
 	*x = RunReqChunks{}
-	mi := &file_agent_cvms_cvms_proto_msgTypes[9]
+	mi := &file_agent_cvms_cvms_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -687,7 +764,7 @@ func (x *RunReqChunks) String() string {
 func (*RunReqChunks) ProtoMessage() {}
 
 func (x *RunReqChunks) ProtoReflect() protoreflect.Message {
-	mi := &file_agent_cvms_cvms_proto_msgTypes[9]
+	mi := &file_agent_cvms_cvms_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -700,7 +777,7 @@ func (x *RunReqChunks) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RunReqChunks.ProtoReflect.Descriptor instead.
 func (*RunReqChunks) Descriptor() ([]byte, []int) {
-	return file_agent_cvms_cvms_proto_rawDescGZIP(), []int{9}
+	return file_agent_cvms_cvms_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *RunReqChunks) GetData() []byte {
@@ -739,7 +816,7 @@ type ComputationRunReq struct {
 
 func (x *ComputationRunReq) Reset() {
 	*x = ComputationRunReq{}
-	mi := &file_agent_cvms_cvms_proto_msgTypes[10]
+	mi := &file_agent_cvms_cvms_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -751,7 +828,7 @@ func (x *ComputationRunReq) String() string {
 func (*ComputationRunReq) ProtoMessage() {}
 
 func (x *ComputationRunReq) ProtoReflect() protoreflect.Message {
-	mi := &file_agent_cvms_cvms_proto_msgTypes[10]
+	mi := &file_agent_cvms_cvms_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -764,7 +841,7 @@ func (x *ComputationRunReq) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ComputationRunReq.ProtoReflect.Descriptor instead.
 func (*ComputationRunReq) Descriptor() ([]byte, []int) {
-	return file_agent_cvms_cvms_proto_rawDescGZIP(), []int{10}
+	return file_agent_cvms_cvms_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *ComputationRunReq) GetId() string {
@@ -825,7 +902,7 @@ type ResultConsumer struct {
 
 func (x *ResultConsumer) Reset() {
 	*x = ResultConsumer{}
-	mi := &file_agent_cvms_cvms_proto_msgTypes[11]
+	mi := &file_agent_cvms_cvms_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -837,7 +914,7 @@ func (x *ResultConsumer) String() string {
 func (*ResultConsumer) ProtoMessage() {}
 
 func (x *ResultConsumer) ProtoReflect() protoreflect.Message {
-	mi := &file_agent_cvms_cvms_proto_msgTypes[11]
+	mi := &file_agent_cvms_cvms_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -850,7 +927,7 @@ func (x *ResultConsumer) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ResultConsumer.ProtoReflect.Descriptor instead.
 func (*ResultConsumer) Descriptor() ([]byte, []int) {
-	return file_agent_cvms_cvms_proto_rawDescGZIP(), []int{11}
+	return file_agent_cvms_cvms_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *ResultConsumer) GetUserKey() []byte {
@@ -871,7 +948,7 @@ type Dataset struct {
 
 func (x *Dataset) Reset() {
 	*x = Dataset{}
-	mi := &file_agent_cvms_cvms_proto_msgTypes[12]
+	mi := &file_agent_cvms_cvms_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -883,7 +960,7 @@ func (x *Dataset) String() string {
 func (*Dataset) ProtoMessage() {}
 
 func (x *Dataset) ProtoReflect() protoreflect.Message {
-	mi := &file_agent_cvms_cvms_proto_msgTypes[12]
+	mi := &file_agent_cvms_cvms_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -896,7 +973,7 @@ func (x *Dataset) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Dataset.ProtoReflect.Descriptor instead.
 func (*Dataset) Descriptor() ([]byte, []int) {
-	return file_agent_cvms_cvms_proto_rawDescGZIP(), []int{12}
+	return file_agent_cvms_cvms_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *Dataset) GetHash() []byte {
@@ -930,7 +1007,7 @@ type Algorithm struct {
 
 func (x *Algorithm) Reset() {
 	*x = Algorithm{}
-	mi := &file_agent_cvms_cvms_proto_msgTypes[13]
+	mi := &file_agent_cvms_cvms_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -942,7 +1019,7 @@ func (x *Algorithm) String() string {
 func (*Algorithm) ProtoMessage() {}
 
 func (x *Algorithm) ProtoReflect() protoreflect.Message {
-	mi := &file_agent_cvms_cvms_proto_msgTypes[13]
+	mi := &file_agent_cvms_cvms_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -955,7 +1032,7 @@ func (x *Algorithm) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Algorithm.ProtoReflect.Descriptor instead.
 func (*Algorithm) Descriptor() ([]byte, []int) {
-	return file_agent_cvms_cvms_proto_rawDescGZIP(), []int{13}
+	return file_agent_cvms_cvms_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *Algorithm) GetHash() []byte {
@@ -975,20 +1052,19 @@ func (x *Algorithm) GetUserKey() []byte {
 type AgentConfig struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Port          string                 `protobuf:"bytes,1,opt,name=port,proto3" json:"port,omitempty"`
-	Host          string                 `protobuf:"bytes,2,opt,name=host,proto3" json:"host,omitempty"`
-	CertFile      string                 `protobuf:"bytes,3,opt,name=cert_file,json=certFile,proto3" json:"cert_file,omitempty"`
-	KeyFile       string                 `protobuf:"bytes,4,opt,name=key_file,json=keyFile,proto3" json:"key_file,omitempty"`
-	ClientCaFile  string                 `protobuf:"bytes,5,opt,name=client_ca_file,json=clientCaFile,proto3" json:"client_ca_file,omitempty"`
-	ServerCaFile  string                 `protobuf:"bytes,6,opt,name=server_ca_file,json=serverCaFile,proto3" json:"server_ca_file,omitempty"`
-	LogLevel      string                 `protobuf:"bytes,7,opt,name=log_level,json=logLevel,proto3" json:"log_level,omitempty"`
-	AttestedTls   bool                   `protobuf:"varint,8,opt,name=attested_tls,json=attestedTls,proto3" json:"attested_tls,omitempty"`
+	CertFile      string                 `protobuf:"bytes,2,opt,name=cert_file,json=certFile,proto3" json:"cert_file,omitempty"`
+	KeyFile       string                 `protobuf:"bytes,3,opt,name=key_file,json=keyFile,proto3" json:"key_file,omitempty"`
+	ClientCaFile  string                 `protobuf:"bytes,4,opt,name=client_ca_file,json=clientCaFile,proto3" json:"client_ca_file,omitempty"`
+	ServerCaFile  string                 `protobuf:"bytes,5,opt,name=server_ca_file,json=serverCaFile,proto3" json:"server_ca_file,omitempty"`
+	LogLevel      string                 `protobuf:"bytes,6,opt,name=log_level,json=logLevel,proto3" json:"log_level,omitempty"`
+	AttestedTls   bool                   `protobuf:"varint,7,opt,name=attested_tls,json=attestedTls,proto3" json:"attested_tls,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
 func (x *AgentConfig) Reset() {
 	*x = AgentConfig{}
-	mi := &file_agent_cvms_cvms_proto_msgTypes[14]
+	mi := &file_agent_cvms_cvms_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1000,7 +1076,7 @@ func (x *AgentConfig) String() string {
 func (*AgentConfig) ProtoMessage() {}
 
 func (x *AgentConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_agent_cvms_cvms_proto_msgTypes[14]
+	mi := &file_agent_cvms_cvms_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1013,7 +1089,7 @@ func (x *AgentConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AgentConfig.ProtoReflect.Descriptor instead.
 func (*AgentConfig) Descriptor() ([]byte, []int) {
-	return file_agent_cvms_cvms_proto_rawDescGZIP(), []int{14}
+	return file_agent_cvms_cvms_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *AgentConfig) GetPort() string {
@@ -1023,13 +1099,6 @@ func (x *AgentConfig) GetPort() string {
 	return ""
 }
 
-func (x *AgentConfig) GetHost() string {
-	if x != nil {
-		return x.Host
-	}
-	return ""
-}
-
 func (x *AgentConfig) GetCertFile() string {
 	if x != nil {
 		return x.CertFile
@@ -1072,9 +1141,61 @@ func (x *AgentConfig) GetAttestedTls() bool {
 	return false
 }
 
+type AttestationResponse struct {
+	state            protoimpl.MessageState `protogen:"open.v1"`
+	File             []byte                 `protobuf:"bytes,1,opt,name=file,proto3" json:"file,omitempty"`
+	CertSerialNumber string                 `protobuf:"bytes,2,opt,name=certSerialNumber,proto3" json:"certSerialNumber,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
+}
+
+func (x *AttestationResponse) Reset() {
+	*x = AttestationResponse{}
+	mi := &file_agent_cvms_cvms_proto_msgTypes[16]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AttestationResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AttestationResponse) ProtoMessage() {}
+
+func (x *AttestationResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_cvms_cvms_proto_msgTypes[16]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AttestationResponse.ProtoReflect.Descriptor instead.
+func (*AttestationResponse) Descriptor() ([]byte, []int) {
+	return file_agent_cvms_cvms_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *AttestationResponse) GetFile() []byte {
+	if x != nil {
+		return x.File
+	}
+	return nil
+}
+
+func (x *AttestationResponse) GetCertSerialNumber() string {
+	if x != nil {
+		return x.CertSerialNumber
+	}
+	return ""
+}
+
 var File_agent_cvms_cvms_proto protoreflect.FileDescriptor
 
-var file_agent_cvms_cvms_proto_rawDesc = []byte{
+var file_agent_cvms_cvms_proto_rawDesc = string([]byte{
 	0x0a, 0x15, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2f, 0x63, 0x76, 0x6d, 0x73, 0x2f, 0x63, 0x76, 0x6d,
 	0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x04, 0x63, 0x76, 0x6d, 0x73, 0x1a, 0x1f, 0x67,
 	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74,
@@ -1122,7 +1243,7 @@ var file_agent_cvms_cvms_proto_rawDesc = []byte{
 	0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b,
 	0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
 	0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x74, 0x69,
-	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x22, 0xc0, 0x02, 0x0a, 0x13, 0x43, 0x6c, 0x69, 0x65,
+	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x22, 0x93, 0x03, 0x0a, 0x13, 0x43, 0x6c, 0x69, 0x65,
 	0x6e, 0x74, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12,
 	0x2d, 0x0a, 0x09, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x6c, 0x6f, 0x67, 0x18, 0x01, 0x20, 0x01,
 	0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x63, 0x76, 0x6d, 0x73, 0x2e, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x4c,
@@ -1141,97 +1262,113 @@ var file_agent_cvms_cvms_proto_rawDesc = []byte{
 	0x65, 0x73, 0x12, 0x3b, 0x0a, 0x0d, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65,
 	0x52, 0x65, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x63, 0x76, 0x6d, 0x73,
 	0x2e, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x48, 0x00,
-	0x52, 0x0d, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x42,
-	0x09, 0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x8d, 0x02, 0x0a, 0x13, 0x53,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x4d, 0x65, 0x73, 0x73, 0x61,
-	0x67, 0x65, 0x12, 0x38, 0x0a, 0x0c, 0x72, 0x75, 0x6e, 0x52, 0x65, 0x71, 0x43, 0x68, 0x75, 0x6e,
-	0x6b, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x63, 0x76, 0x6d, 0x73, 0x2e,
-	0x52, 0x75, 0x6e, 0x52, 0x65, 0x71, 0x43, 0x68, 0x75, 0x6e, 0x6b, 0x73, 0x48, 0x00, 0x52, 0x0c,
-	0x72, 0x75, 0x6e, 0x52, 0x65, 0x71, 0x43, 0x68, 0x75, 0x6e, 0x6b, 0x73, 0x12, 0x31, 0x0a, 0x06,
-	0x72, 0x75, 0x6e, 0x52, 0x65, 0x71, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63,
-	0x76, 0x6d, 0x73, 0x2e, 0x43, 0x6f, 0x6d, 0x70, 0x75, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52,
-	0x75, 0x6e, 0x52, 0x65, 0x71, 0x48, 0x00, 0x52, 0x06, 0x72, 0x75, 0x6e, 0x52, 0x65, 0x71, 0x12,
-	0x41, 0x0a, 0x0f, 0x73, 0x74, 0x6f, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x75, 0x74, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x63, 0x76, 0x6d, 0x73, 0x2e,
-	0x53, 0x74, 0x6f, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x75, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x48,
-	0x00, 0x52, 0x0f, 0x73, 0x74, 0x6f, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x75, 0x74, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x3b, 0x0a, 0x0d, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65,
-	0x52, 0x65, 0x71, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x63, 0x76, 0x6d, 0x73,
-	0x2e, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x48, 0x00,
-	0x52, 0x0d, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x42,
-	0x09, 0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x4b, 0x0a, 0x0c, 0x52, 0x75,
-	0x6e, 0x52, 0x65, 0x71, 0x43, 0x68, 0x75, 0x6e, 0x6b, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x61,
-	0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x12, 0x0e,
-	0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x17,
-	0x0a, 0x07, 0x69, 0x73, 0x5f, 0x6c, 0x61, 0x73, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x06, 0x69, 0x73, 0x4c, 0x61, 0x73, 0x74, 0x22, 0xaa, 0x02, 0x0a, 0x11, 0x43, 0x6f, 0x6d, 0x70,
-	0x75, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x75, 0x6e, 0x52, 0x65, 0x71, 0x12, 0x0e, 0x0a,
-	0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d,
-	0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x12, 0x29, 0x0a, 0x08, 0x64, 0x61, 0x74, 0x61, 0x73, 0x65, 0x74, 0x73, 0x18,
-	0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x63, 0x76, 0x6d, 0x73, 0x2e, 0x44, 0x61, 0x74,
-	0x61, 0x73, 0x65, 0x74, 0x52, 0x08, 0x64, 0x61, 0x74, 0x61, 0x73, 0x65, 0x74, 0x73, 0x12, 0x2d,
-	0x0a, 0x09, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x0f, 0x2e, 0x63, 0x76, 0x6d, 0x73, 0x2e, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74,
-	0x68, 0x6d, 0x52, 0x09, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x12, 0x3f, 0x0a,
-	0x10, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6d, 0x65, 0x72,
-	0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x63, 0x76, 0x6d, 0x73, 0x2e, 0x52,
-	0x65, 0x73, 0x75, 0x6c, 0x74, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6d, 0x65, 0x72, 0x52, 0x0f, 0x72,
-	0x65, 0x73, 0x75, 0x6c, 0x74, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6d, 0x65, 0x72, 0x73, 0x12, 0x34,
-	0x0a, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x07,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x63, 0x76, 0x6d, 0x73, 0x2e, 0x41, 0x67, 0x65, 0x6e,
-	0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0b, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x22, 0x2a, 0x0a, 0x0e, 0x52, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x43, 0x6f,
-	0x6e, 0x73, 0x75, 0x6d, 0x65, 0x72, 0x12, 0x18, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x4b, 0x65,
-	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x75, 0x73, 0x65, 0x72, 0x4b, 0x65, 0x79,
-	0x22, 0x53, 0x0a, 0x07, 0x44, 0x61, 0x74, 0x61, 0x73, 0x65, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x68,
-	0x61, 0x73, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x68, 0x61, 0x73, 0x68, 0x12,
-	0x18, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c,
-	0x52, 0x07, 0x75, 0x73, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x12, 0x1a, 0x0a, 0x08, 0x66, 0x69, 0x6c,
-	0x65, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x66, 0x69, 0x6c,
-	0x65, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x39, 0x0a, 0x09, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74,
-	0x68, 0x6d, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x61, 0x73, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c,
-	0x52, 0x04, 0x68, 0x61, 0x73, 0x68, 0x12, 0x18, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x4b, 0x65,
-	0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x75, 0x73, 0x65, 0x72, 0x4b, 0x65, 0x79,
-	0x22, 0xf9, 0x01, 0x0a, 0x0b, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x12, 0x12, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
-	0x70, 0x6f, 0x72, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x65, 0x72, 0x74,
-	0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x65, 0x72,
-	0x74, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6b, 0x65, 0x79, 0x5f, 0x66, 0x69, 0x6c,
-	0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6b, 0x65, 0x79, 0x46, 0x69, 0x6c, 0x65,
-	0x12, 0x24, 0x0a, 0x0e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x61, 0x5f, 0x66, 0x69,
-	0x6c, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x43, 0x61, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x5f, 0x63, 0x61, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c,
-	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x61, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x1b, 0x0a, 0x09,
-	0x6c, 0x6f, 0x67, 0x5f, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x08, 0x6c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x21, 0x0a, 0x0c, 0x61, 0x74, 0x74,
-	0x65, 0x73, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x6c, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x0b, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x65, 0x64, 0x54, 0x6c, 0x73, 0x32, 0x50, 0x0a, 0x07,
-	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x45, 0x0a, 0x07, 0x50, 0x72, 0x6f, 0x63, 0x65,
-	0x73, 0x73, 0x12, 0x19, 0x2e, 0x63, 0x76, 0x6d, 0x73, 0x2e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x19, 0x2e,
-	0x63, 0x76, 0x6d, 0x73, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x74, 0x72, 0x65, 0x61,
-	0x6d, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x28, 0x01, 0x30, 0x01, 0x42, 0x08,
-	0x5a, 0x06, 0x2e, 0x2f, 0x63, 0x76, 0x6d, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+	0x52, 0x0d, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x12,
+	0x51, 0x0a, 0x15, 0x76, 0x54, 0x50, 0x4d, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19,
+	0x2e, 0x63, 0x76, 0x6d, 0x73, 0x2e, 0x41, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x00, 0x52, 0x15, 0x76, 0x54, 0x50,
+	0x4d, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x70, 0x6f,
+	0x72, 0x74, 0x42, 0x09, 0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0xca, 0x02,
+	0x0a, 0x13, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x4d, 0x65,
+	0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x38, 0x0a, 0x0c, 0x72, 0x75, 0x6e, 0x52, 0x65, 0x71, 0x43,
+	0x68, 0x75, 0x6e, 0x6b, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x63, 0x76,
+	0x6d, 0x73, 0x2e, 0x52, 0x75, 0x6e, 0x52, 0x65, 0x71, 0x43, 0x68, 0x75, 0x6e, 0x6b, 0x73, 0x48,
+	0x00, 0x52, 0x0c, 0x72, 0x75, 0x6e, 0x52, 0x65, 0x71, 0x43, 0x68, 0x75, 0x6e, 0x6b, 0x73, 0x12,
+	0x31, 0x0a, 0x06, 0x72, 0x75, 0x6e, 0x52, 0x65, 0x71, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x17, 0x2e, 0x63, 0x76, 0x6d, 0x73, 0x2e, 0x43, 0x6f, 0x6d, 0x70, 0x75, 0x74, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x75, 0x6e, 0x52, 0x65, 0x71, 0x48, 0x00, 0x52, 0x06, 0x72, 0x75, 0x6e, 0x52,
+	0x65, 0x71, 0x12, 0x41, 0x0a, 0x0f, 0x73, 0x74, 0x6f, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x75, 0x74,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x63, 0x76,
+	0x6d, 0x73, 0x2e, 0x53, 0x74, 0x6f, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x75, 0x74, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x48, 0x00, 0x52, 0x0f, 0x73, 0x74, 0x6f, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x75, 0x74,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3b, 0x0a, 0x0d, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x53, 0x74,
+	0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x63,
+	0x76, 0x6d, 0x73, 0x2e, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65,
+	0x71, 0x48, 0x00, 0x52, 0x0d, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52,
+	0x65, 0x71, 0x12, 0x3b, 0x0a, 0x0d, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
+	0x52, 0x65, 0x71, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x63, 0x76, 0x6d, 0x73,
+	0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x52, 0x65, 0x71, 0x48, 0x00,
+	0x52, 0x0d, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x52, 0x65, 0x71, 0x42,
+	0x09, 0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x1f, 0x0a, 0x0d, 0x44, 0x69,
+	0x73, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x52, 0x65, 0x71, 0x12, 0x0e, 0x0a, 0x02, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0x4b, 0x0a, 0x0c, 0x52,
+	0x75, 0x6e, 0x52, 0x65, 0x71, 0x43, 0x68, 0x75, 0x6e, 0x6b, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x64,
+	0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x12,
+	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
+	0x17, 0x0a, 0x07, 0x69, 0x73, 0x5f, 0x6c, 0x61, 0x73, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x06, 0x69, 0x73, 0x4c, 0x61, 0x73, 0x74, 0x22, 0xaa, 0x02, 0x0a, 0x11, 0x43, 0x6f, 0x6d,
+	0x70, 0x75, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x75, 0x6e, 0x52, 0x65, 0x71, 0x12, 0x0e,
+	0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12,
+	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x29, 0x0a, 0x08, 0x64, 0x61, 0x74, 0x61, 0x73, 0x65, 0x74, 0x73,
+	0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x63, 0x76, 0x6d, 0x73, 0x2e, 0x44, 0x61,
+	0x74, 0x61, 0x73, 0x65, 0x74, 0x52, 0x08, 0x64, 0x61, 0x74, 0x61, 0x73, 0x65, 0x74, 0x73, 0x12,
+	0x2d, 0x0a, 0x09, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x63, 0x76, 0x6d, 0x73, 0x2e, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69,
+	0x74, 0x68, 0x6d, 0x52, 0x09, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x12, 0x3f,
+	0x0a, 0x10, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6d, 0x65,
+	0x72, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x63, 0x76, 0x6d, 0x73, 0x2e,
+	0x52, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6d, 0x65, 0x72, 0x52, 0x0f,
+	0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6d, 0x65, 0x72, 0x73, 0x12,
+	0x34, 0x0a, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x63, 0x76, 0x6d, 0x73, 0x2e, 0x41, 0x67, 0x65,
+	0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0b, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x2a, 0x0a, 0x0e, 0x52, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x43,
+	0x6f, 0x6e, 0x73, 0x75, 0x6d, 0x65, 0x72, 0x12, 0x18, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x4b,
+	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x75, 0x73, 0x65, 0x72, 0x4b, 0x65,
+	0x79, 0x22, 0x53, 0x0a, 0x07, 0x44, 0x61, 0x74, 0x61, 0x73, 0x65, 0x74, 0x12, 0x12, 0x0a, 0x04,
+	0x68, 0x61, 0x73, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x68, 0x61, 0x73, 0x68,
+	0x12, 0x18, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x07, 0x75, 0x73, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x12, 0x1a, 0x0a, 0x08, 0x66, 0x69,
+	0x6c, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x66, 0x69,
+	0x6c, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x39, 0x0a, 0x09, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69,
+	0x74, 0x68, 0x6d, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x61, 0x73, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x04, 0x68, 0x61, 0x73, 0x68, 0x12, 0x18, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x4b,
+	0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x75, 0x73, 0x65, 0x72, 0x4b, 0x65,
+	0x79, 0x22, 0xe5, 0x01, 0x0a, 0x0b, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x65, 0x72, 0x74, 0x5f, 0x66, 0x69,
+	0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x65, 0x72, 0x74, 0x46, 0x69,
+	0x6c, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6b, 0x65, 0x79, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6b, 0x65, 0x79, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x24, 0x0a,
+	0x0e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x61, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x61, 0x46,
+	0x69, 0x6c, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x63, 0x61,
+	0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x72,
+	0x76, 0x65, 0x72, 0x43, 0x61, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x6c, 0x6f, 0x67,
+	0x5f, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6c, 0x6f,
+	0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x21, 0x0a, 0x0c, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74,
+	0x65, 0x64, 0x5f, 0x74, 0x6c, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x61, 0x74,
+	0x74, 0x65, 0x73, 0x74, 0x65, 0x64, 0x54, 0x6c, 0x73, 0x22, 0x55, 0x0a, 0x13, 0x41, 0x74, 0x74,
+	0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x12, 0x0a, 0x04, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04,
+	0x66, 0x69, 0x6c, 0x65, 0x12, 0x2a, 0x0a, 0x10, 0x63, 0x65, 0x72, 0x74, 0x53, 0x65, 0x72, 0x69,
+	0x61, 0x6c, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10,
+	0x63, 0x65, 0x72, 0x74, 0x53, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72,
+	0x32, 0x50, 0x0a, 0x07, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x45, 0x0a, 0x07, 0x50,
+	0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x12, 0x19, 0x2e, 0x63, 0x76, 0x6d, 0x73, 0x2e, 0x43, 0x6c,
+	0x69, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67,
+	0x65, 0x1a, 0x19, 0x2e, 0x63, 0x76, 0x6d, 0x73, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53,
+	0x74, 0x72, 0x65, 0x61, 0x6d, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x28, 0x01,
+	0x30, 0x01, 0x42, 0x08, 0x5a, 0x06, 0x2e, 0x2f, 0x63, 0x76, 0x6d, 0x73, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
+})
 
 var (
 	file_agent_cvms_cvms_proto_rawDescOnce sync.Once
-	file_agent_cvms_cvms_proto_rawDescData = file_agent_cvms_cvms_proto_rawDesc
+	file_agent_cvms_cvms_proto_rawDescData []byte
 )
 
 func file_agent_cvms_cvms_proto_rawDescGZIP() []byte {
 	file_agent_cvms_cvms_proto_rawDescOnce.Do(func() {
-		file_agent_cvms_cvms_proto_rawDescData = protoimpl.X.CompressGZIP(file_agent_cvms_cvms_proto_rawDescData)
+		file_agent_cvms_cvms_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_agent_cvms_cvms_proto_rawDesc), len(file_agent_cvms_cvms_proto_rawDesc)))
 	})
 	return file_agent_cvms_cvms_proto_rawDescData
 }
 
-var file_agent_cvms_cvms_proto_msgTypes = make([]protoimpl.MessageInfo, 15)
+var file_agent_cvms_cvms_proto_msgTypes = make([]protoimpl.MessageInfo, 17)
 var file_agent_cvms_cvms_proto_goTypes = []any{
 	(*AgentStateReq)(nil),           // 0: cvms.AgentStateReq
 	(*AgentStateRes)(nil),           // 1: cvms.AgentStateRes
@@ -1242,37 +1379,41 @@ var file_agent_cvms_cvms_proto_goTypes = []any{
 	(*AgentLog)(nil),                // 6: cvms.AgentLog
 	(*ClientStreamMessage)(nil),     // 7: cvms.ClientStreamMessage
 	(*ServerStreamMessage)(nil),     // 8: cvms.ServerStreamMessage
-	(*RunReqChunks)(nil),            // 9: cvms.RunReqChunks
-	(*ComputationRunReq)(nil),       // 10: cvms.ComputationRunReq
-	(*ResultConsumer)(nil),          // 11: cvms.ResultConsumer
-	(*Dataset)(nil),                 // 12: cvms.Dataset
-	(*Algorithm)(nil),               // 13: cvms.Algorithm
-	(*AgentConfig)(nil),             // 14: cvms.AgentConfig
-	(*timestamppb.Timestamp)(nil),   // 15: google.protobuf.Timestamp
+	(*DisconnectReq)(nil),           // 9: cvms.DisconnectReq
+	(*RunReqChunks)(nil),            // 10: cvms.RunReqChunks
+	(*ComputationRunReq)(nil),       // 11: cvms.ComputationRunReq
+	(*ResultConsumer)(nil),          // 12: cvms.ResultConsumer
+	(*Dataset)(nil),                 // 13: cvms.Dataset
+	(*Algorithm)(nil),               // 14: cvms.Algorithm
+	(*AgentConfig)(nil),             // 15: cvms.AgentConfig
+	(*AttestationResponse)(nil),     // 16: cvms.AttestationResponse
+	(*timestamppb.Timestamp)(nil),   // 17: google.protobuf.Timestamp
 }
 var file_agent_cvms_cvms_proto_depIdxs = []int32{
-	15, // 0: cvms.AgentEvent.timestamp:type_name -> google.protobuf.Timestamp
-	15, // 1: cvms.AgentLog.timestamp:type_name -> google.protobuf.Timestamp
+	17, // 0: cvms.AgentEvent.timestamp:type_name -> google.protobuf.Timestamp
+	17, // 1: cvms.AgentLog.timestamp:type_name -> google.protobuf.Timestamp
 	6,  // 2: cvms.ClientStreamMessage.agent_log:type_name -> cvms.AgentLog
 	5,  // 3: cvms.ClientStreamMessage.agent_event:type_name -> cvms.AgentEvent
 	4,  // 4: cvms.ClientStreamMessage.run_res:type_name -> cvms.RunResponse
 	3,  // 5: cvms.ClientStreamMessage.stopComputationRes:type_name -> cvms.StopComputationResponse
 	1,  // 6: cvms.ClientStreamMessage.agentStateRes:type_name -> cvms.AgentStateRes
-	9,  // 7: cvms.ServerStreamMessage.runReqChunks:type_name -> cvms.RunReqChunks
-	10, // 8: cvms.ServerStreamMessage.runReq:type_name -> cvms.ComputationRunReq
-	2,  // 9: cvms.ServerStreamMessage.stopComputation:type_name -> cvms.StopComputation
-	0,  // 10: cvms.ServerStreamMessage.agentStateReq:type_name -> cvms.AgentStateReq
-	12, // 11: cvms.ComputationRunReq.datasets:type_name -> cvms.Dataset
-	13, // 12: cvms.ComputationRunReq.algorithm:type_name -> cvms.Algorithm
-	11, // 13: cvms.ComputationRunReq.result_consumers:type_name -> cvms.ResultConsumer
-	14, // 14: cvms.ComputationRunReq.agent_config:type_name -> cvms.AgentConfig
-	7,  // 15: cvms.Service.Process:input_type -> cvms.ClientStreamMessage
-	8,  // 16: cvms.Service.Process:output_type -> cvms.ServerStreamMessage
-	16, // [16:17] is the sub-list for method output_type
-	15, // [15:16] is the sub-list for method input_type
-	15, // [15:15] is the sub-list for extension type_name
-	15, // [15:15] is the sub-list for extension extendee
-	0,  // [0:15] is the sub-list for field type_name
+	16, // 7: cvms.ClientStreamMessage.vTPMattestationReport:type_name -> cvms.AttestationResponse
+	10, // 8: cvms.ServerStreamMessage.runReqChunks:type_name -> cvms.RunReqChunks
+	11, // 9: cvms.ServerStreamMessage.runReq:type_name -> cvms.ComputationRunReq
+	2,  // 10: cvms.ServerStreamMessage.stopComputation:type_name -> cvms.StopComputation
+	0,  // 11: cvms.ServerStreamMessage.agentStateReq:type_name -> cvms.AgentStateReq
+	9,  // 12: cvms.ServerStreamMessage.disconnectReq:type_name -> cvms.DisconnectReq
+	13, // 13: cvms.ComputationRunReq.datasets:type_name -> cvms.Dataset
+	14, // 14: cvms.ComputationRunReq.algorithm:type_name -> cvms.Algorithm
+	12, // 15: cvms.ComputationRunReq.result_consumers:type_name -> cvms.ResultConsumer
+	15, // 16: cvms.ComputationRunReq.agent_config:type_name -> cvms.AgentConfig
+	7,  // 17: cvms.Service.Process:input_type -> cvms.ClientStreamMessage
+	8,  // 18: cvms.Service.Process:output_type -> cvms.ServerStreamMessage
+	18, // [18:19] is the sub-list for method output_type
+	17, // [17:18] is the sub-list for method input_type
+	17, // [17:17] is the sub-list for extension type_name
+	17, // [17:17] is the sub-list for extension extendee
+	0,  // [0:17] is the sub-list for field type_name
 }
 
 func init() { file_agent_cvms_cvms_proto_init() }
@@ -1286,20 +1427,22 @@ func file_agent_cvms_cvms_proto_init() {
 		(*ClientStreamMessage_RunRes)(nil),
 		(*ClientStreamMessage_StopComputationRes)(nil),
 		(*ClientStreamMessage_AgentStateRes)(nil),
+		(*ClientStreamMessage_VTPMattestationReport)(nil),
 	}
 	file_agent_cvms_cvms_proto_msgTypes[8].OneofWrappers = []any{
 		(*ServerStreamMessage_RunReqChunks)(nil),
 		(*ServerStreamMessage_RunReq)(nil),
 		(*ServerStreamMessage_StopComputation)(nil),
 		(*ServerStreamMessage_AgentStateReq)(nil),
+		(*ServerStreamMessage_DisconnectReq)(nil),
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_agent_cvms_cvms_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_agent_cvms_cvms_proto_rawDesc), len(file_agent_cvms_cvms_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   15,
+			NumMessages:   17,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
@@ -1308,7 +1451,6 @@ func file_agent_cvms_cvms_proto_init() {
 		MessageInfos:      file_agent_cvms_cvms_proto_msgTypes,
 	}.Build()
 	File_agent_cvms_cvms_proto = out.File
-	file_agent_cvms_cvms_proto_rawDesc = nil
 	file_agent_cvms_cvms_proto_goTypes = nil
 	file_agent_cvms_cvms_proto_depIdxs = nil
 }

agent/cvms/cvms.proto

@@ -59,6 +59,7 @@ message ClientStreamMessage {
     RunResponse run_res = 3;
     StopComputationResponse stopComputationRes = 4;
     AgentStateRes agentStateRes = 5;
+    AttestationResponse vTPMattestationReport = 6;
   }
 }
 
@@ -68,9 +69,14 @@ message ServerStreamMessage {
     ComputationRunReq runReq = 2;
     StopComputation stopComputation = 3;
     AgentStateReq agentStateReq = 4;
+    DisconnectReq disconnectReq = 5;
   }
 }
 
+message DisconnectReq {
+  string id = 1;
+}
+
 message RunReqChunks {
   bytes data = 1;
   string id = 2;
@@ -104,11 +110,15 @@ message Algorithm {
 
 message AgentConfig {
   string port = 1;
-  string host = 2;
-  string cert_file = 3;
-  string key_file = 4;
-  string client_ca_file = 5;
-  string server_ca_file = 6;
-  string log_level = 7;
-  bool   attested_tls = 8;
+  string cert_file = 2;
+  string key_file = 3;
+  string client_ca_file = 4;
+  string server_ca_file = 5;
+  string log_level = 6;
+  bool   attested_tls = 7;
+}
+
+message AttestationResponse {
+  bytes file = 1;
+  string certSerialNumber = 2;
 }

agent/cvms/server/cvm.go

@@ -8,12 +8,12 @@ import (
 	"fmt"
 	"log/slog"
 
+	"github.com/google/go-sev-guest/client"
 	"github.com/ultravioletrs/cocos/agent"
 	agentgrpc "github.com/ultravioletrs/cocos/agent/api/grpc"
 	"github.com/ultravioletrs/cocos/agent/auth"
 	"github.com/ultravioletrs/cocos/internal/server"
 	grpcserver "github.com/ultravioletrs/cocos/internal/server/grpc"
-	"github.com/ultravioletrs/cocos/pkg/attestation/quoteprovider"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/reflection"
 )
@@ -32,12 +32,20 @@ type agentServer struct {
 	gs     server.Server
 	logger *slog.Logger
 	svc    agent.Service
+	host   string
+	qp     client.LeveledQuoteProvider
+	caUrl  string
+	cvmId  string
 }
 
-func NewServer(logger *slog.Logger, svc agent.Service) AgentServer {
+func NewServer(logger *slog.Logger, svc agent.Service, host string, qp client.LeveledQuoteProvider, caUrl string, cvmId string) AgentServer {
 	return &agentServer{
 		logger: logger,
 		svc:    svc,
+		host:   host,
+		qp:     qp,
+		caUrl:  caUrl,
+		cvmId:  cvmId,
 	}
 }
 
@@ -49,7 +57,7 @@ func (as *agentServer) Start(cfg agent.AgentConfig, cmp agent.Computation) error
 	agentGrpcServerConfig := server.AgentConfig{
 		ServerConfig: server.ServerConfig{
 			BaseConfig: server.BaseConfig{
-				Host:         cfg.Host,
+				Host:         as.host,
 				Port:         cfg.Port,
 				CertFile:     cfg.CertFile,
 				KeyFile:      cfg.KeyFile,
@@ -71,15 +79,9 @@ func (as *agentServer) Start(cfg agent.AgentConfig, cmp agent.Computation) error
 		return err
 	}
 
-	qp, err := quoteprovider.GetLeveledQuoteProvider()
-	if err != nil {
-		as.logger.Error(fmt.Sprintf("failed to create quote provider %s", err.Error()))
-		return err
-	}
-
 	ctx, cancel := context.WithCancel(context.Background())
 
-	as.gs = grpcserver.New(ctx, cancel, svcName, agentGrpcServerConfig, registerAgentServiceServer, as.logger, qp, authSvc)
+	as.gs = grpcserver.New(ctx, cancel, svcName, agentGrpcServerConfig, registerAgentServiceServer, as.logger, as.qp, authSvc, as.caUrl, as.cvmId)
 
 	go func() {
 		err := as.gs.Start()
@@ -92,5 +94,8 @@ func (as *agentServer) Start(cfg agent.AgentConfig, cmp agent.Computation) error
 }
 
 func (as *agentServer) Stop() error {
+	if as.gs == nil {
+		return nil
+	}
 	return as.gs.Stop()
 }

agent/cvms/server/mocks/server.go

@@ -1,7 +1,7 @@
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
 
-// Code generated by mockery v2.43.2. DO NOT EDIT.
+// Code generated by mockery v2.53.3. DO NOT EDIT.
 
 package mocks
 
@@ -70,7 +70,7 @@ func (_c *AgentServer_Start_Call) RunAndReturn(run func(agent.AgentConfig, agent
 	return _c
 }
 
-// Stop provides a mock function with given fields:
+// Stop provides a mock function with no fields
 func (_m *AgentServer) Stop() error {
 	ret := _m.Called()
 

agent/events/events.pb.go

@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        v5.29.0
 // source: agent/events/events.proto
 
@@ -15,6 +15,7 @@ import (
 	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -260,7 +261,7 @@ func (*EventsLogs_AgentEvent) isEventsLogs_Message() {}
 
 var File_agent_events_events_proto protoreflect.FileDescriptor
 
-var file_agent_events_events_proto_rawDesc = []byte{
+var file_agent_events_events_proto_rawDesc = string([]byte{
 	0x0a, 0x19, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2f, 0x65,
 	0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x06, 0x65, 0x76, 0x65,
 	0x6e, 0x74, 0x73, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74,
@@ -299,16 +300,16 @@ var file_agent_events_events_proto_rawDesc = []byte{
 	0x67, 0x65, 0x6e, 0x74, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x42, 0x09, 0x0a, 0x07, 0x6d, 0x65, 0x73,
 	0x73, 0x61, 0x67, 0x65, 0x42, 0x0a, 0x5a, 0x08, 0x2e, 0x2f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73,
 	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+})
 
 var (
 	file_agent_events_events_proto_rawDescOnce sync.Once
-	file_agent_events_events_proto_rawDescData = file_agent_events_events_proto_rawDesc
+	file_agent_events_events_proto_rawDescData []byte
 )
 
 func file_agent_events_events_proto_rawDescGZIP() []byte {
 	file_agent_events_events_proto_rawDescOnce.Do(func() {
-		file_agent_events_events_proto_rawDescData = protoimpl.X.CompressGZIP(file_agent_events_events_proto_rawDescData)
+		file_agent_events_events_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_agent_events_events_proto_rawDesc), len(file_agent_events_events_proto_rawDesc)))
 	})
 	return file_agent_events_events_proto_rawDescData
 }
@@ -345,7 +346,7 @@ func file_agent_events_events_proto_init() {
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_agent_events_events_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_agent_events_events_proto_rawDesc), len(file_agent_events_events_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   3,
 			NumExtensions: 0,
@@ -356,7 +357,6 @@ func file_agent_events_events_proto_init() {
 		MessageInfos:      file_agent_events_events_proto_msgTypes,
 	}.Build()
 	File_agent_events_events_proto = out.File
-	file_agent_events_events_proto_rawDesc = nil
 	file_agent_events_events_proto_goTypes = nil
 	file_agent_events_events_proto_depIdxs = nil
 }

agent/events/mocks/events.go

@@ -1,7 +1,7 @@
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
 
-// Code generated by mockery v2.43.2. DO NOT EDIT.
+// Code generated by mockery v2.53.3. DO NOT EDIT.
 
 package mocks
 
@@ -56,7 +56,7 @@ func (_c *Service_SendEvent_Call) Return() *Service_SendEvent_Call {
 }
 
 func (_c *Service_SendEvent_Call) RunAndReturn(run func(string, string, string, json.RawMessage)) *Service_SendEvent_Call {
-	_c.Call.Return(run)
+	_c.Run(run)
 	return _c
 }
 

agent/mocks/agent.go

@@ -1,7 +1,7 @@
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
 
-// Code generated by mockery v2.43.2. DO NOT EDIT.
+// Code generated by mockery v2.53.3. DO NOT EDIT.
 
 package mocks
 
@@ -287,7 +287,7 @@ func (_c *Service_Result_Call) RunAndReturn(run func(context.Context) ([]byte, e
 	return _c
 }
 
-// State provides a mock function with given fields:
+// State provides a mock function with no fields
 func (_m *Service) State() string {
 	ret := _m.Called()
 

agent/mocks/agent_grpc_algo.go

@@ -1,8 +1,8 @@
-// Code generated by mockery v2.43.2. DO NOT EDIT.
-
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
 
+// Code generated by mockery v2.53.3. DO NOT EDIT.
+
 package mocks
 
 import (
@@ -16,12 +16,20 @@ import (
 )
 
 // AgentService_AlgoClient is an autogenerated mock type for the AgentService_AlgoClient type
-type AgentService_AlgoClient struct {
+type AgentService_AlgoClient[Req interface{}, Res interface{}] struct {
 	mock.Mock
 }
 
-// CloseAndRecv provides a mock function with given fields:
-func (_m *AgentService_AlgoClient) CloseAndRecv() (*agent.AlgoResponse, error) {
+type AgentService_AlgoClient_Expecter[Req interface{}, Res interface{}] struct {
+	mock *mock.Mock
+}
+
+func (_m *AgentService_AlgoClient[Req, Res]) EXPECT() *AgentService_AlgoClient_Expecter[Req, Res] {
+	return &AgentService_AlgoClient_Expecter[Req, Res]{mock: &_m.Mock}
+}
+
+// CloseAndRecv provides a mock function with no fields
+func (_m *AgentService_AlgoClient[Req, Res]) CloseAndRecv() (*agent.AlgoResponse, error) {
 	ret := _m.Called()
 
 	if len(ret) == 0 {
@@ -50,8 +58,35 @@ func (_m *AgentService_AlgoClient) CloseAndRecv() (*agent.AlgoResponse, error) {
 	return r0, r1
 }
 
-// CloseSend provides a mock function with given fields:
-func (_m *AgentService_AlgoClient) CloseSend() error {
+// AgentService_AlgoClient_CloseAndRecv_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'CloseAndRecv'
+type AgentService_AlgoClient_CloseAndRecv_Call[Req interface{}, Res interface{}] struct {
+	*mock.Call
+}
+
+// CloseAndRecv is a helper method to define mock.On call
+func (_e *AgentService_AlgoClient_Expecter[Req, Res]) CloseAndRecv() *AgentService_AlgoClient_CloseAndRecv_Call[Req, Res] {
+	return &AgentService_AlgoClient_CloseAndRecv_Call[Req, Res]{Call: _e.mock.On("CloseAndRecv")}
+}
+
+func (_c *AgentService_AlgoClient_CloseAndRecv_Call[Req, Res]) Run(run func()) *AgentService_AlgoClient_CloseAndRecv_Call[Req, Res] {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *AgentService_AlgoClient_CloseAndRecv_Call[Req, Res]) Return(_a0 *agent.AlgoResponse, _a1 error) *AgentService_AlgoClient_CloseAndRecv_Call[Req, Res] {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *AgentService_AlgoClient_CloseAndRecv_Call[Req, Res]) RunAndReturn(run func() (*agent.AlgoResponse, error)) *AgentService_AlgoClient_CloseAndRecv_Call[Req, Res] {
+	_c.Call.Return(run)
+	return _c
+}
+
+// CloseSend provides a mock function with no fields
+func (_m *AgentService_AlgoClient[Req, Res]) CloseSend() error {
 	ret := _m.Called()
 
 	if len(ret) == 0 {
@@ -68,8 +103,35 @@ func (_m *AgentService_AlgoClient) CloseSend() error {
 	return r0
 }
 
-// Context provides a mock function with given fields:
-func (_m *AgentService_AlgoClient) Context() context.Context {
+// AgentService_AlgoClient_CloseSend_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'CloseSend'
+type AgentService_AlgoClient_CloseSend_Call[Req interface{}, Res interface{}] struct {
+	*mock.Call
+}
+
+// CloseSend is a helper method to define mock.On call
+func (_e *AgentService_AlgoClient_Expecter[Req, Res]) CloseSend() *AgentService_AlgoClient_CloseSend_Call[Req, Res] {
+	return &AgentService_AlgoClient_CloseSend_Call[Req, Res]{Call: _e.mock.On("CloseSend")}
+}
+
+func (_c *AgentService_AlgoClient_CloseSend_Call[Req, Res]) Run(run func()) *AgentService_AlgoClient_CloseSend_Call[Req, Res] {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *AgentService_AlgoClient_CloseSend_Call[Req, Res]) Return(_a0 error) *AgentService_AlgoClient_CloseSend_Call[Req, Res] {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *AgentService_AlgoClient_CloseSend_Call[Req, Res]) RunAndReturn(run func() error) *AgentService_AlgoClient_CloseSend_Call[Req, Res] {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Context provides a mock function with no fields
+func (_m *AgentService_AlgoClient[Req, Res]) Context() context.Context {
 	ret := _m.Called()
 
 	if len(ret) == 0 {
@@ -88,8 +150,35 @@ func (_m *AgentService_AlgoClient) Context() context.Context {
 	return r0
 }
 
-// Header provides a mock function with given fields:
-func (_m *AgentService_AlgoClient) Header() (metadata.MD, error) {
+// AgentService_AlgoClient_Context_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Context'
+type AgentService_AlgoClient_Context_Call[Req interface{}, Res interface{}] struct {
+	*mock.Call
+}
+
+// Context is a helper method to define mock.On call
+func (_e *AgentService_AlgoClient_Expecter[Req, Res]) Context() *AgentService_AlgoClient_Context_Call[Req, Res] {
+	return &AgentService_AlgoClient_Context_Call[Req, Res]{Call: _e.mock.On("Context")}
+}
+
+func (_c *AgentService_AlgoClient_Context_Call[Req, Res]) Run(run func()) *AgentService_AlgoClient_Context_Call[Req, Res] {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *AgentService_AlgoClient_Context_Call[Req, Res]) Return(_a0 context.Context) *AgentService_AlgoClient_Context_Call[Req, Res] {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *AgentService_AlgoClient_Context_Call[Req, Res]) RunAndReturn(run func() context.Context) *AgentService_AlgoClient_Context_Call[Req, Res] {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Header provides a mock function with no fields
+func (_m *AgentService_AlgoClient[Req, Res]) Header() (metadata.MD, error) {
 	ret := _m.Called()
 
 	if len(ret) == 0 {
@@ -118,8 +207,35 @@ func (_m *AgentService_AlgoClient) Header() (metadata.MD, error) {
 	return r0, r1
 }
 
+// AgentService_AlgoClient_Header_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Header'
+type AgentService_AlgoClient_Header_Call[Req interface{}, Res interface{}] struct {
+	*mock.Call
+}
+
+// Header is a helper method to define mock.On call
+func (_e *AgentService_AlgoClient_Expecter[Req, Res]) Header() *AgentService_AlgoClient_Header_Call[Req, Res] {
+	return &AgentService_AlgoClient_Header_Call[Req, Res]{Call: _e.mock.On("Header")}
+}
+
+func (_c *AgentService_AlgoClient_Header_Call[Req, Res]) Run(run func()) *AgentService_AlgoClient_Header_Call[Req, Res] {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *AgentService_AlgoClient_Header_Call[Req, Res]) Return(_a0 metadata.MD, _a1 error) *AgentService_AlgoClient_Header_Call[Req, Res] {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *AgentService_AlgoClient_Header_Call[Req, Res]) RunAndReturn(run func() (metadata.MD, error)) *AgentService_AlgoClient_Header_Call[Req, Res] {
+	_c.Call.Return(run)
+	return _c
+}
+
 // RecvMsg provides a mock function with given fields: m
-func (_m *AgentService_AlgoClient) RecvMsg(m interface{}) error {
+func (_m *AgentService_AlgoClient[Req, Res]) RecvMsg(m interface{}) error {
 	ret := _m.Called(m)
 
 	if len(ret) == 0 {
@@ -136,8 +252,36 @@ func (_m *AgentService_AlgoClient) RecvMsg(m interface{}) error {
 	return r0
 }
 
+// AgentService_AlgoClient_RecvMsg_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'RecvMsg'
+type AgentService_AlgoClient_RecvMsg_Call[Req interface{}, Res interface{}] struct {
+	*mock.Call
+}
+
+// RecvMsg is a helper method to define mock.On call
+//   - m interface{}
+func (_e *AgentService_AlgoClient_Expecter[Req, Res]) RecvMsg(m interface{}) *AgentService_AlgoClient_RecvMsg_Call[Req, Res] {
+	return &AgentService_AlgoClient_RecvMsg_Call[Req, Res]{Call: _e.mock.On("RecvMsg", m)}
+}
+
+func (_c *AgentService_AlgoClient_RecvMsg_Call[Req, Res]) Run(run func(m interface{})) *AgentService_AlgoClient_RecvMsg_Call[Req, Res] {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(interface{}))
+	})
+	return _c
+}
+
+func (_c *AgentService_AlgoClient_RecvMsg_Call[Req, Res]) Return(_a0 error) *AgentService_AlgoClient_RecvMsg_Call[Req, Res] {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *AgentService_AlgoClient_RecvMsg_Call[Req, Res]) RunAndReturn(run func(interface{}) error) *AgentService_AlgoClient_RecvMsg_Call[Req, Res] {
+	_c.Call.Return(run)
+	return _c
+}
+
 // Send provides a mock function with given fields: _a0
-func (_m *AgentService_AlgoClient) Send(_a0 *agent.AlgoRequest) error {
+func (_m *AgentService_AlgoClient[Req, Res]) Send(_a0 *agent.AlgoRequest) error {
 	ret := _m.Called(_a0)
 
 	if len(ret) == 0 {
@@ -154,8 +298,36 @@ func (_m *AgentService_AlgoClient) Send(_a0 *agent.AlgoRequest) error {
 	return r0
 }
 
+// AgentService_AlgoClient_Send_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Send'
+type AgentService_AlgoClient_Send_Call[Req interface{}, Res interface{}] struct {
+	*mock.Call
+}
+
+// Send is a helper method to define mock.On call
+//   - _a0 *agent.AlgoRequest
+func (_e *AgentService_AlgoClient_Expecter[Req, Res]) Send(_a0 interface{}) *AgentService_AlgoClient_Send_Call[Req, Res] {
+	return &AgentService_AlgoClient_Send_Call[Req, Res]{Call: _e.mock.On("Send", _a0)}
+}
+
+func (_c *AgentService_AlgoClient_Send_Call[Req, Res]) Run(run func(_a0 *agent.AlgoRequest)) *AgentService_AlgoClient_Send_Call[Req, Res] {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(*agent.AlgoRequest))
+	})
+	return _c
+}
+
+func (_c *AgentService_AlgoClient_Send_Call[Req, Res]) Return(_a0 error) *AgentService_AlgoClient_Send_Call[Req, Res] {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *AgentService_AlgoClient_Send_Call[Req, Res]) RunAndReturn(run func(*agent.AlgoRequest) error) *AgentService_AlgoClient_Send_Call[Req, Res] {
+	_c.Call.Return(run)
+	return _c
+}
+
 // SendMsg provides a mock function with given fields: m
-func (_m *AgentService_AlgoClient) SendMsg(m interface{}) error {
+func (_m *AgentService_AlgoClient[Req, Res]) SendMsg(m interface{}) error {
 	ret := _m.Called(m)
 
 	if len(ret) == 0 {
@@ -172,8 +344,36 @@ func (_m *AgentService_AlgoClient) SendMsg(m interface{}) error {
 	return r0
 }
 
-// Trailer provides a mock function with given fields:
-func (_m *AgentService_AlgoClient) Trailer() metadata.MD {
+// AgentService_AlgoClient_SendMsg_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'SendMsg'
+type AgentService_AlgoClient_SendMsg_Call[Req interface{}, Res interface{}] struct {
+	*mock.Call
+}
+
+// SendMsg is a helper method to define mock.On call
+//   - m interface{}
+func (_e *AgentService_AlgoClient_Expecter[Req, Res]) SendMsg(m interface{}) *AgentService_AlgoClient_SendMsg_Call[Req, Res] {
+	return &AgentService_AlgoClient_SendMsg_Call[Req, Res]{Call: _e.mock.On("SendMsg", m)}
+}
+
+func (_c *AgentService_AlgoClient_SendMsg_Call[Req, Res]) Run(run func(m interface{})) *AgentService_AlgoClient_SendMsg_Call[Req, Res] {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(interface{}))
+	})
+	return _c
+}
+
+func (_c *AgentService_AlgoClient_SendMsg_Call[Req, Res]) Return(_a0 error) *AgentService_AlgoClient_SendMsg_Call[Req, Res] {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *AgentService_AlgoClient_SendMsg_Call[Req, Res]) RunAndReturn(run func(interface{}) error) *AgentService_AlgoClient_SendMsg_Call[Req, Res] {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Trailer provides a mock function with no fields
+func (_m *AgentService_AlgoClient[Req, Res]) Trailer() metadata.MD {
 	ret := _m.Called()
 
 	if len(ret) == 0 {
@@ -192,13 +392,40 @@ func (_m *AgentService_AlgoClient) Trailer() metadata.MD {
 	return r0
 }
 
+// AgentService_AlgoClient_Trailer_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Trailer'
+type AgentService_AlgoClient_Trailer_Call[Req interface{}, Res interface{}] struct {
+	*mock.Call
+}
+
+// Trailer is a helper method to define mock.On call
+func (_e *AgentService_AlgoClient_Expecter[Req, Res]) Trailer() *AgentService_AlgoClient_Trailer_Call[Req, Res] {
+	return &AgentService_AlgoClient_Trailer_Call[Req, Res]{Call: _e.mock.On("Trailer")}
+}
+
+func (_c *AgentService_AlgoClient_Trailer_Call[Req, Res]) Run(run func()) *AgentService_AlgoClient_Trailer_Call[Req, Res] {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *AgentService_AlgoClient_Trailer_Call[Req, Res]) Return(_a0 metadata.MD) *AgentService_AlgoClient_Trailer_Call[Req, Res] {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *AgentService_AlgoClient_Trailer_Call[Req, Res]) RunAndReturn(run func() metadata.MD) *AgentService_AlgoClient_Trailer_Call[Req, Res] {
+	_c.Call.Return(run)
+	return _c
+}
+
 // NewAgentService_AlgoClient creates a new instance of AgentService_AlgoClient. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
 // The first argument is typically a *testing.T value.
-func NewAgentService_AlgoClient(t interface {
+func NewAgentService_AlgoClient[Req interface{}, Res interface{}](t interface {
 	mock.TestingT
 	Cleanup(func())
-}) *AgentService_AlgoClient {
-	mock := &AgentService_AlgoClient{}
+}) *AgentService_AlgoClient[Req, Res] {
+	mock := &AgentService_AlgoClient[Req, Res]{}
 	mock.Mock.Test(t)
 
 	t.Cleanup(func() { mock.AssertExpectations(t) })

agent/mocks/agent_grpc_data.go

@@ -1,8 +1,8 @@
-// Code generated by mockery v2.43.2. DO NOT EDIT.
-
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
 
+// Code generated by mockery v2.53.3. DO NOT EDIT.
+
 package mocks
 
 import (
@@ -16,12 +16,20 @@ import (
 )
 
 // AgentService_DataClient is an autogenerated mock type for the AgentService_DataClient type
-type AgentService_DataClient struct {
+type AgentService_DataClient[Req interface{}, Res interface{}] struct {
 	mock.Mock
 }
 
-// CloseAndRecv provides a mock function with given fields:
-func (_m *AgentService_DataClient) CloseAndRecv() (*agent.DataResponse, error) {
+type AgentService_DataClient_Expecter[Req interface{}, Res interface{}] struct {
+	mock *mock.Mock
+}
+
+func (_m *AgentService_DataClient[Req, Res]) EXPECT() *AgentService_DataClient_Expecter[Req, Res] {
+	return &AgentService_DataClient_Expecter[Req, Res]{mock: &_m.Mock}
+}
+
+// CloseAndRecv provides a mock function with no fields
+func (_m *AgentService_DataClient[Req, Res]) CloseAndRecv() (*agent.DataResponse, error) {
 	ret := _m.Called()
 
 	if len(ret) == 0 {
@@ -50,8 +58,35 @@ func (_m *AgentService_DataClient) CloseAndRecv() (*agent.DataResponse, error) {
 	return r0, r1
 }
 
-// CloseSend provides a mock function with given fields:
-func (_m *AgentService_DataClient) CloseSend() error {
+// AgentService_DataClient_CloseAndRecv_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'CloseAndRecv'
+type AgentService_DataClient_CloseAndRecv_Call[Req interface{}, Res interface{}] struct {
+	*mock.Call
+}
+
+// CloseAndRecv is a helper method to define mock.On call
+func (_e *AgentService_DataClient_Expecter[Req, Res]) CloseAndRecv() *AgentService_DataClient_CloseAndRecv_Call[Req, Res] {
+	return &AgentService_DataClient_CloseAndRecv_Call[Req, Res]{Call: _e.mock.On("CloseAndRecv")}
+}
+
+func (_c *AgentService_DataClient_CloseAndRecv_Call[Req, Res]) Run(run func()) *AgentService_DataClient_CloseAndRecv_Call[Req, Res] {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *AgentService_DataClient_CloseAndRecv_Call[Req, Res]) Return(_a0 *agent.DataResponse, _a1 error) *AgentService_DataClient_CloseAndRecv_Call[Req, Res] {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *AgentService_DataClient_CloseAndRecv_Call[Req, Res]) RunAndReturn(run func() (*agent.DataResponse, error)) *AgentService_DataClient_CloseAndRecv_Call[Req, Res] {
+	_c.Call.Return(run)
+	return _c
+}
+
+// CloseSend provides a mock function with no fields
+func (_m *AgentService_DataClient[Req, Res]) CloseSend() error {
 	ret := _m.Called()
 
 	if len(ret) == 0 {
@@ -68,8 +103,35 @@ func (_m *AgentService_DataClient) CloseSend() error {
 	return r0
 }
 
-// Context provides a mock function with given fields:
-func (_m *AgentService_DataClient) Context() context.Context {
+// AgentService_DataClient_CloseSend_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'CloseSend'
+type AgentService_DataClient_CloseSend_Call[Req interface{}, Res interface{}] struct {
+	*mock.Call
+}
+
+// CloseSend is a helper method to define mock.On call
+func (_e *AgentService_DataClient_Expecter[Req, Res]) CloseSend() *AgentService_DataClient_CloseSend_Call[Req, Res] {
+	return &AgentService_DataClient_CloseSend_Call[Req, Res]{Call: _e.mock.On("CloseSend")}
+}
+
+func (_c *AgentService_DataClient_CloseSend_Call[Req, Res]) Run(run func()) *AgentService_DataClient_CloseSend_Call[Req, Res] {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *AgentService_DataClient_CloseSend_Call[Req, Res]) Return(_a0 error) *AgentService_DataClient_CloseSend_Call[Req, Res] {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *AgentService_DataClient_CloseSend_Call[Req, Res]) RunAndReturn(run func() error) *AgentService_DataClient_CloseSend_Call[Req, Res] {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Context provides a mock function with no fields
+func (_m *AgentService_DataClient[Req, Res]) Context() context.Context {
 	ret := _m.Called()
 
 	if len(ret) == 0 {
@@ -88,8 +150,35 @@ func (_m *AgentService_DataClient) Context() context.Context {
 	return r0
 }
 
-// Header provides a mock function with given fields:
-func (_m *AgentService_DataClient) Header() (metadata.MD, error) {
+// AgentService_DataClient_Context_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Context'
+type AgentService_DataClient_Context_Call[Req interface{}, Res interface{}] struct {
+	*mock.Call
+}
+
+// Context is a helper method to define mock.On call
+func (_e *AgentService_DataClient_Expecter[Req, Res]) Context() *AgentService_DataClient_Context_Call[Req, Res] {
+	return &AgentService_DataClient_Context_Call[Req, Res]{Call: _e.mock.On("Context")}
+}
+
+func (_c *AgentService_DataClient_Context_Call[Req, Res]) Run(run func()) *AgentService_DataClient_Context_Call[Req, Res] {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *AgentService_DataClient_Context_Call[Req, Res]) Return(_a0 context.Context) *AgentService_DataClient_Context_Call[Req, Res] {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *AgentService_DataClient_Context_Call[Req, Res]) RunAndReturn(run func() context.Context) *AgentService_DataClient_Context_Call[Req, Res] {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Header provides a mock function with no fields
+func (_m *AgentService_DataClient[Req, Res]) Header() (metadata.MD, error) {
 	ret := _m.Called()
 
 	if len(ret) == 0 {
@@ -118,8 +207,35 @@ func (_m *AgentService_DataClient) Header() (metadata.MD, error) {
 	return r0, r1
 }
 
+// AgentService_DataClient_Header_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Header'
+type AgentService_DataClient_Header_Call[Req interface{}, Res interface{}] struct {
+	*mock.Call
+}
+
+// Header is a helper method to define mock.On call
+func (_e *AgentService_DataClient_Expecter[Req, Res]) Header() *AgentService_DataClient_Header_Call[Req, Res] {
+	return &AgentService_DataClient_Header_Call[Req, Res]{Call: _e.mock.On("Header")}
+}
+
+func (_c *AgentService_DataClient_Header_Call[Req, Res]) Run(run func()) *AgentService_DataClient_Header_Call[Req, Res] {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *AgentService_DataClient_Header_Call[Req, Res]) Return(_a0 metadata.MD, _a1 error) *AgentService_DataClient_Header_Call[Req, Res] {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *AgentService_DataClient_Header_Call[Req, Res]) RunAndReturn(run func() (metadata.MD, error)) *AgentService_DataClient_Header_Call[Req, Res] {
+	_c.Call.Return(run)
+	return _c
+}
+
 // RecvMsg provides a mock function with given fields: m
-func (_m *AgentService_DataClient) RecvMsg(m interface{}) error {
+func (_m *AgentService_DataClient[Req, Res]) RecvMsg(m interface{}) error {
 	ret := _m.Called(m)
 
 	if len(ret) == 0 {
@@ -136,8 +252,36 @@ func (_m *AgentService_DataClient) RecvMsg(m interface{}) error {
 	return r0
 }
 
+// AgentService_DataClient_RecvMsg_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'RecvMsg'
+type AgentService_DataClient_RecvMsg_Call[Req interface{}, Res interface{}] struct {
+	*mock.Call
+}
+
+// RecvMsg is a helper method to define mock.On call
+//   - m interface{}
+func (_e *AgentService_DataClient_Expecter[Req, Res]) RecvMsg(m interface{}) *AgentService_DataClient_RecvMsg_Call[Req, Res] {
+	return &AgentService_DataClient_RecvMsg_Call[Req, Res]{Call: _e.mock.On("RecvMsg", m)}
+}
+
+func (_c *AgentService_DataClient_RecvMsg_Call[Req, Res]) Run(run func(m interface{})) *AgentService_DataClient_RecvMsg_Call[Req, Res] {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(interface{}))
+	})
+	return _c
+}
+
+func (_c *AgentService_DataClient_RecvMsg_Call[Req, Res]) Return(_a0 error) *AgentService_DataClient_RecvMsg_Call[Req, Res] {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *AgentService_DataClient_RecvMsg_Call[Req, Res]) RunAndReturn(run func(interface{}) error) *AgentService_DataClient_RecvMsg_Call[Req, Res] {
+	_c.Call.Return(run)
+	return _c
+}
+
 // Send provides a mock function with given fields: _a0
-func (_m *AgentService_DataClient) Send(_a0 *agent.DataRequest) error {
+func (_m *AgentService_DataClient[Req, Res]) Send(_a0 *agent.DataRequest) error {
 	ret := _m.Called(_a0)
 
 	if len(ret) == 0 {
@@ -154,8 +298,36 @@ func (_m *AgentService_DataClient) Send(_a0 *agent.DataRequest) error {
 	return r0
 }
 
+// AgentService_DataClient_Send_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Send'
+type AgentService_DataClient_Send_Call[Req interface{}, Res interface{}] struct {
+	*mock.Call
+}
+
+// Send is a helper method to define mock.On call
+//   - _a0 *agent.DataRequest
+func (_e *AgentService_DataClient_Expecter[Req, Res]) Send(_a0 interface{}) *AgentService_DataClient_Send_Call[Req, Res] {
+	return &AgentService_DataClient_Send_Call[Req, Res]{Call: _e.mock.On("Send", _a0)}
+}
+
+func (_c *AgentService_DataClient_Send_Call[Req, Res]) Run(run func(_a0 *agent.DataRequest)) *AgentService_DataClient_Send_Call[Req, Res] {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(*agent.DataRequest))
+	})
+	return _c
+}
+
+func (_c *AgentService_DataClient_Send_Call[Req, Res]) Return(_a0 error) *AgentService_DataClient_Send_Call[Req, Res] {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *AgentService_DataClient_Send_Call[Req, Res]) RunAndReturn(run func(*agent.DataRequest) error) *AgentService_DataClient_Send_Call[Req, Res] {
+	_c.Call.Return(run)
+	return _c
+}
+
 // SendMsg provides a mock function with given fields: m
-func (_m *AgentService_DataClient) SendMsg(m interface{}) error {
+func (_m *AgentService_DataClient[Req, Res]) SendMsg(m interface{}) error {
 	ret := _m.Called(m)
 
 	if len(ret) == 0 {
@@ -172,8 +344,36 @@ func (_m *AgentService_DataClient) SendMsg(m interface{}) error {
 	return r0
 }
 
-// Trailer provides a mock function with given fields:
-func (_m *AgentService_DataClient) Trailer() metadata.MD {
+// AgentService_DataClient_SendMsg_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'SendMsg'
+type AgentService_DataClient_SendMsg_Call[Req interface{}, Res interface{}] struct {
+	*mock.Call
+}
+
+// SendMsg is a helper method to define mock.On call
+//   - m interface{}
+func (_e *AgentService_DataClient_Expecter[Req, Res]) SendMsg(m interface{}) *AgentService_DataClient_SendMsg_Call[Req, Res] {
+	return &AgentService_DataClient_SendMsg_Call[Req, Res]{Call: _e.mock.On("SendMsg", m)}
+}
+
+func (_c *AgentService_DataClient_SendMsg_Call[Req, Res]) Run(run func(m interface{})) *AgentService_DataClient_SendMsg_Call[Req, Res] {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(interface{}))
+	})
+	return _c
+}
+
+func (_c *AgentService_DataClient_SendMsg_Call[Req, Res]) Return(_a0 error) *AgentService_DataClient_SendMsg_Call[Req, Res] {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *AgentService_DataClient_SendMsg_Call[Req, Res]) RunAndReturn(run func(interface{}) error) *AgentService_DataClient_SendMsg_Call[Req, Res] {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Trailer provides a mock function with no fields
+func (_m *AgentService_DataClient[Req, Res]) Trailer() metadata.MD {
 	ret := _m.Called()
 
 	if len(ret) == 0 {
@@ -192,13 +392,40 @@ func (_m *AgentService_DataClient) Trailer() metadata.MD {
 	return r0
 }
 
+// AgentService_DataClient_Trailer_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Trailer'
+type AgentService_DataClient_Trailer_Call[Req interface{}, Res interface{}] struct {
+	*mock.Call
+}
+
+// Trailer is a helper method to define mock.On call
+func (_e *AgentService_DataClient_Expecter[Req, Res]) Trailer() *AgentService_DataClient_Trailer_Call[Req, Res] {
+	return &AgentService_DataClient_Trailer_Call[Req, Res]{Call: _e.mock.On("Trailer")}
+}
+
+func (_c *AgentService_DataClient_Trailer_Call[Req, Res]) Run(run func()) *AgentService_DataClient_Trailer_Call[Req, Res] {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *AgentService_DataClient_Trailer_Call[Req, Res]) Return(_a0 metadata.MD) *AgentService_DataClient_Trailer_Call[Req, Res] {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *AgentService_DataClient_Trailer_Call[Req, Res]) RunAndReturn(run func() metadata.MD) *AgentService_DataClient_Trailer_Call[Req, Res] {
+	_c.Call.Return(run)
+	return _c
+}
+
 // NewAgentService_DataClient creates a new instance of AgentService_DataClient. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
 // The first argument is typically a *testing.T value.
-func NewAgentService_DataClient(t interface {
+func NewAgentService_DataClient[Req interface{}, Res interface{}](t interface {
 	mock.TestingT
 	Cleanup(func())
-}) *AgentService_DataClient {
-	mock := &AgentService_DataClient{}
+}) *AgentService_DataClient[Req, Res] {
+	mock := &AgentService_DataClient[Req, Res]{}
 	mock.Mock.Test(t)
 
 	t.Cleanup(func() { mock.AssertExpectations(t) })

agent/service.go

@@ -129,12 +129,13 @@ type agentService struct {
 	resultsConsumed bool                        // Indicates if the results have been consumed.
 	cancel          context.CancelFunc          // Cancels the computation context.
 	vmpl            int                         // VMPL at which the Agent is running.
+	vtpmAttest      vtpm.VtpmAttest             // Attestation function.
 }
 
 var _ Service = (*agentService)(nil)
 
 // New instantiates the agent service implementation.
-func New(ctx context.Context, logger *slog.Logger, eventSvc events.Service, quoteProvider client.LeveledQuoteProvider, vmlp int) Service {
+func New(ctx context.Context, logger *slog.Logger, eventSvc events.Service, quoteProvider client.LeveledQuoteProvider, vmlp int, vtpmAttest vtpm.VtpmAttest) Service {
 	sm := statemachine.NewStateMachine(Idle)
 	ctx, cancel := context.WithCancel(ctx)
 	svc := &agentService{
@@ -144,6 +145,7 @@ func New(ctx context.Context, logger *slog.Logger, eventSvc events.Service, quot
 		logger:        logger,
 		cancel:        cancel,
 		vmpl:          vmlp,
+		vtpmAttest:    vtpmAttest,
 	}
 
 	transitions := []statemachine.Transition{
@@ -213,14 +215,16 @@ func (as *agentService) StopComputation(ctx context.Context) error {
 	as.mu.Lock()
 	defer as.mu.Unlock()
 
+	as.eventSvc.SendEvent(as.computation.ID, "Stopped", "Stopped", json.RawMessage{})
+
 	as.cancel()
 
-	if err := as.algorithm.Stop(); err != nil {
-		return fmt.Errorf("error stopping computation: %v", err)
+	if as.algorithm != nil {
+		if err := as.algorithm.Stop(); err != nil {
+			return fmt.Errorf("error stopping computation: %v", err)
+		}
 	}
 
-	sm := statemachine.NewStateMachine(Idle)
-
 	if err := os.RemoveAll(algorithm.DatasetsDir); err != nil {
 		return fmt.Errorf("error removing datasets directory: %v", err)
 	}
@@ -229,13 +233,24 @@ func (as *agentService) StopComputation(ctx context.Context) error {
 		return fmt.Errorf("error removing results directory: %v", err)
 	}
 
-	as.sm = sm
+	as.sm.Reset(Idle)
+
 	as.computation = Computation{}
 	as.algorithm = nil
 	as.result = nil
 	as.runError = nil
 	as.resultsConsumed = false
 
+	ctx, cancel := context.WithCancel(ctx)
+	as.cancel = cancel
+
+	go func() {
+		if err := as.sm.Start(ctx); err != nil {
+			as.logger.Error(err.Error())
+		}
+	}()
+	as.sm.SendEvent(Start)
+
 	return nil
 }
 
@@ -411,13 +426,13 @@ func (as *agentService) Attestation(ctx context.Context, reportData [quoteprovid
 		}
 		return rawQuote, nil
 	case config.VTPM:
-		vTPMQuote, err := vtpm.Attest(reportData[:], nonce[:], false)
+		vTPMQuote, err := as.vtpmAttest(reportData[:], nonce[:], false)
 		if err != nil {
 			return []byte{}, err
 		}
 		return vTPMQuote, nil
 	case config.SNPvTPM:
-		vTPMQuote, err := vtpm.Attest(reportData[:], nonce[:], true)
+		vTPMQuote, err := as.vtpmAttest(reportData[:], nonce[:], true)
 		if err != nil {
 			return []byte{}, err
 		}

agent/service_test.go

@@ -121,7 +121,7 @@ func TestAlgo(t *testing.T) {
 
 			ctx, cancel := context.WithCancel(ctx)
 			defer cancel()
-			svc := New(ctx, mglog.NewMock(), events, qp, 0)
+			svc := New(ctx, mglog.NewMock(), events, qp, 0, vtpm.EmptyAttest)
 
 			err := svc.InitComputation(ctx, testComputation(t))
 			require.NoError(t, err)
@@ -216,7 +216,7 @@ func TestData(t *testing.T) {
 			ctx, cancel := context.WithCancel(ctx)
 			defer cancel()
 
-			svc := New(ctx, mglog.NewMock(), events, qp, 0)
+			svc := New(ctx, mglog.NewMock(), events, qp, 0, vtpm.EmptyAttest)
 
 			err := svc.InitComputation(ctx, testComputation(t))
 			require.NoError(t, err)
@@ -365,7 +365,7 @@ func TestAttestation(t *testing.T) {
 			}
 			defer getQuote.Unset()
 
-			svc := New(ctx, mglog.NewMock(), events, qp, 0)
+			svc := New(ctx, mglog.NewMock(), events, qp, 0, vtpm.EmptyAttest)
 			time.Sleep(300 * time.Millisecond)
 			_, err := svc.Attestation(ctx, tc.reportData, tc.nonce, 0)
 			assert.True(t, errors.Contains(err, tc.err), "expected %v, got %v", tc.err, err)

agent/statemachine/mocks/state.go

@@ -1,7 +1,7 @@
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
 
-// Code generated by mockery v2.43.2. DO NOT EDIT.
+// Code generated by mockery v2.53.3. DO NOT EDIT.
 
 package mocks
 
@@ -54,11 +54,11 @@ func (_c *StateMachine_AddTransition_Call) Return() *StateMachine_AddTransition_
 }
 
 func (_c *StateMachine_AddTransition_Call) RunAndReturn(run func(statemachine.Transition)) *StateMachine_AddTransition_Call {
-	_c.Call.Return(run)
+	_c.Run(run)
 	return _c
 }
 
-// GetState provides a mock function with given fields:
+// GetState provides a mock function with no fields
 func (_m *StateMachine) GetState() statemachine.State {
 	ret := _m.Called()
 
@@ -105,6 +105,39 @@ func (_c *StateMachine_GetState_Call) RunAndReturn(run func() statemachine.State
 	return _c
 }
 
+// Reset provides a mock function with given fields: initialState
+func (_m *StateMachine) Reset(initialState statemachine.State) {
+	_m.Called(initialState)
+}
+
+// StateMachine_Reset_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Reset'
+type StateMachine_Reset_Call struct {
+	*mock.Call
+}
+
+// Reset is a helper method to define mock.On call
+//   - initialState statemachine.State
+func (_e *StateMachine_Expecter) Reset(initialState interface{}) *StateMachine_Reset_Call {
+	return &StateMachine_Reset_Call{Call: _e.mock.On("Reset", initialState)}
+}
+
+func (_c *StateMachine_Reset_Call) Run(run func(initialState statemachine.State)) *StateMachine_Reset_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(statemachine.State))
+	})
+	return _c
+}
+
+func (_c *StateMachine_Reset_Call) Return() *StateMachine_Reset_Call {
+	_c.Call.Return()
+	return _c
+}
+
+func (_c *StateMachine_Reset_Call) RunAndReturn(run func(statemachine.State)) *StateMachine_Reset_Call {
+	_c.Run(run)
+	return _c
+}
+
 // SendEvent provides a mock function with given fields: event
 func (_m *StateMachine) SendEvent(event statemachine.Event) {
 	_m.Called(event)
@@ -134,7 +167,7 @@ func (_c *StateMachine_SendEvent_Call) Return() *StateMachine_SendEvent_Call {
 }
 
 func (_c *StateMachine_SendEvent_Call) RunAndReturn(run func(statemachine.Event)) *StateMachine_SendEvent_Call {
-	_c.Call.Return(run)
+	_c.Run(run)
 	return _c
 }
 
@@ -168,7 +201,7 @@ func (_c *StateMachine_SetAction_Call) Return() *StateMachine_SetAction_Call {
 }
 
 func (_c *StateMachine_SetAction_Call) RunAndReturn(run func(statemachine.State, statemachine.Action)) *StateMachine_SetAction_Call {
-	_c.Call.Return(run)
+	_c.Run(run)
 	return _c
 }
 

agent/statemachine/state.go

@@ -30,6 +30,7 @@ type StateMachine interface {
 	GetState() State
 	SendEvent(event Event)
 	Start(ctx context.Context) error
+	Reset(initialState State)
 }
 
 type stateMachine struct {
@@ -89,6 +90,20 @@ func (sm *stateMachine) Start(ctx context.Context) error {
 	}
 }
 
+func (sm *stateMachine) Reset(initialState State) {
+	sm.mu.Lock()
+	defer sm.mu.Unlock()
+
+	// Reset current state to initial state
+	sm.currentState = initialState
+
+	// Close the existing event channel to stop processing events
+	close(sm.eventChan)
+
+	// Create a new event channel
+	sm.eventChan = make(chan Event)
+}
+
 func (sm *stateMachine) handleEvent(event Event) error {
 	sm.mu.Lock()
 	currentState := sm.currentState

cli/attestation.go

@@ -19,7 +19,6 @@ import (
 	"github.com/google/go-sev-guest/proto/check"
 	"github.com/google/go-sev-guest/proto/sevsnp"
 	"github.com/google/go-sev-guest/tools/lib/report"
-	sevVerify "github.com/google/go-sev-guest/verify"
 	tpmAttest "github.com/google/go-tpm-tools/proto/attest"
 	"github.com/google/go-tpm-tools/server"
 	"github.com/google/go-tpm/legacy/tpm2"
@@ -350,7 +349,7 @@ func (cli *CLI) NewValidateAttestationValidationCmd() *cobra.Command {
 		validate <attestationreportfilepath> --report_data <reportdata> --product <product data> //default
 		validate --mode snp <attestationreportfilepath> --report_data <reportdata> --product <product data>
 		validate --mode vtpm <attestationreportfilepath> --nonce <noncevalue> --format <formatvalue>  --output <outputvalue>
-		validate --mode snp-vtpm <attestationreportfilepath> --nonce <noncevalue> --format <formatvalue>  --output <outputvalue>`,
+		validate --mode snp-vtpm <attestationreportfilepath> --report_data <reportdata> --product <product data> --nonce <noncevalue> --format <formatvalue>  --output <outputvalue>`,
 
 		PreRunE: func(cmd *cobra.Command, args []string) error {
 			mode, _ := cmd.Flags().GetString("mode")
@@ -371,13 +370,18 @@ func (cli *CLI) NewValidateAttestationValidationCmd() *cobra.Command {
 				if err := cmd.MarkFlagRequired("nonce"); err != nil {
 					return fmt.Errorf("failed to mark 'nonce' as required for vTPM mode: %v", err)
 				}
+				if err := cmd.MarkFlagRequired("report_data"); err != nil {
+					return fmt.Errorf("failed to mark 'report_data' as required for SEV-SNP mode: %v", err)
+				}
+				if err := cmd.MarkFlagRequired("product"); err != nil {
+					return fmt.Errorf("failed to mark flag as required: %v ❌ ", err)
+				}
 				if err := cmd.MarkFlagRequired("format"); err != nil {
 					return fmt.Errorf("failed to mark 'format' as required for vTPM mode: %v", err)
 				}
 				if err := cmd.MarkFlagRequired("output"); err != nil {
 					return fmt.Errorf("failed to mark 'output' as required for vTPM mode: %v", err)
 				}
-
 			case "vtpm":
 				if err := cmd.MarkFlagRequired("nonce"); err != nil {
 					return fmt.Errorf("failed to mark 'nonce' as required for vTPM mode: %v", err)
@@ -438,13 +442,6 @@ func (cli *CLI) NewValidateAttestationValidationCmd() *cobra.Command {
 		"output file",
 	)
 
-	cmd.Flags().BytesHexVar(
-		&teeNonce,
-		"tee-nonce",
-		[]byte{},
-		"hex encoded teenonce for hardware attestation, can be empty",
-	)
-
 	// SEV-SNP FLAGS
 	cmd.Flags().StringVar(
 		&cfgString,
@@ -639,7 +636,23 @@ func (cli *CLI) NewMeasureCmd(igvmBinaryPath string) *cobra.Command {
 
 			inputFile := args[0]
 
-			return cli.measurement.Run(inputFile)
+			measurement, err := cli.measurement.Run(inputFile)
+			if err != nil {
+				return err
+			}
+
+			outputString := string(measurement)
+			lines := strings.Split(strings.TrimSpace(outputString), "\n")
+
+			if len(lines) == 1 {
+				outputString = strings.ToLower(outputString)
+			} else {
+				return fmt.Errorf("error: %s", outputString)
+			}
+
+			cmd.Print(outputString)
+
+			return nil
 		},
 	}
 
@@ -650,28 +663,18 @@ func sevsnpverify(cmd *cobra.Command, args []string) error {
 	cmd.Println("Checking attestation")
 
 	attestationFile = string(args[0])
-
-	if err := parseConfig(); err != nil {
+	if err := parseAttestationFile(); err != nil {
 		return fmt.Errorf("error parsing config: %v ❌ ", err)
 	}
-	if err := parseHashes(); err != nil {
-		return fmt.Errorf("error parsing hashes: %v ❌ ", err)
-	}
-	if err := parseFiles(); err != nil {
-		return fmt.Errorf("error parsing files: %v ❌ ", err)
-	}
+
 	// This format is the attestation report in AMD's specified ABI format, immediately
 	// followed by the certificate table bytes.
 	if len(attestation) < abi.ReportSize {
 		return fmt.Errorf("attestation too small: got 0x%x bytes, need at least 0x%x bytes", len(attestation), abi.ReportSize)
 	}
-	if err := parseUints(); err != nil {
-		return fmt.Errorf("error parsing uints: %v ❌ ", err)
-	}
-	cfg.Policy.Vmpl = wrapperspb.UInt32(0)
 
-	if err := validateInput(); err != nil {
-		return fmt.Errorf("error validating input: %v ❌ ", err)
+	if err := parseAttestationConfig(); err != nil {
+		return err
 	}
 
 	attestationPB, err := abi.ReportCertsToProto(attestation)
@@ -682,111 +685,80 @@ func sevsnpverify(cmd *cobra.Command, args []string) error {
 	if err := quoteprovider.VerifyAndValidate(attestationPB, &cfg); err != nil {
 		return fmt.Errorf("attestation validation and verification failed with error: %v ❌ ", err)
 	}
+
 	cmd.Println("Attestation validation and verification is successful!")
 	return nil
 }
 
+func parseAttestationConfig() error {
+	if err := parseConfig(); err != nil {
+		return fmt.Errorf("error parsing config: %v ❌ ", err)
+	}
+	if err := parseHashes(); err != nil {
+		return fmt.Errorf("error parsing hashes: %v ❌ ", err)
+	}
+	if err := parseTrustedKeys(); err != nil {
+		return fmt.Errorf("error parsing files: %v ❌ ", err)
+	}
+
+	if err := parseUints(); err != nil {
+		return fmt.Errorf("error parsing uints: %v ❌ ", err)
+	}
+
+	if err := validateInput(); err != nil {
+		return fmt.Errorf("error validating input: %v ❌ ", err)
+	}
+
+	return nil
+}
+
 func vtpmSevSnpverify(args []string) error {
-	tpmAttestationFile = string(args[0])
-	input, err := openInputFile()
-	if err != nil {
-		return err
-	}
-	if closer, ok := input.(*os.File); ok {
-		defer closer.Close()
-	}
-	attestationBytes, err := io.ReadAll(input)
-	if err != nil {
-		return err
-	}
-	attestation := &tpmAttest.Attestation{}
-
-	if format == FormatBinaryPB {
-		err = proto.Unmarshal(attestationBytes, attestation)
-	} else if format == FormatTextProto {
-		err = unmarshalOptions.Unmarshal(attestationBytes, attestation)
-	} else {
-		return fmt.Errorf("format should be either binarypb or textproto")
-	}
-	if err != nil {
-		return fmt.Errorf("fail to unmarshal attestation report: %v", err)
-	}
-
-	pub, err := tpm2.DecodePublic(attestation.GetAkPub())
-	if err != nil {
-		return err
-	}
-	cryptoPub, err := pub.Key()
+	attestation, err := returnvTPMAttestation(args)
 	if err != nil {
 		return err
 	}
 
-	var validateOpts interface{}
+	var teeAttestation *sevsnp.Attestation
 	switch attestation.GetTeeAttestation().(type) {
 	case *tpmAttest.Attestation_SevSnpAttestation:
-		if len(teeNonce) != 0 {
-			validateOpts = &server.VerifySnpOpts{
-				Validation:   server.SevSnpDefaultValidateOpts(teeNonce),
-				Verification: &sevVerify.Options{},
-			}
-		} else {
-			validateOpts = &server.VerifySnpOpts{
-				Validation:   server.SevSnpDefaultValidateOpts(nonce),
-				Verification: &sevVerify.Options{},
-			}
-		}
+		teeAttestation = attestation.GetSevSnpAttestation()
 	default:
-		validateOpts = nil
+		teeAttestation = nil
 	}
 
-	ms, err := server.VerifyAttestation(attestation, server.VerifyOpts{Nonce: nonce, TrustedAKs: []crypto.PublicKey{cryptoPub}, TEEOpts: validateOpts})
-	if err != nil {
-		return fmt.Errorf("verifying attestation: %w", err)
+	if teeAttestation == nil {
+		return fmt.Errorf("tee attestation not fetched")
 	}
-	out, err := marshalOptions.Marshal(ms)
-	if err != nil {
-		return nil
-	}
-	output, err := createOutputFile()
-	if err != nil {
+
+	if err := parseAttestationConfig(); err != nil {
 		return err
 	}
-	if closer, ok := output.(*os.File); ok {
-		defer closer.Close()
+
+	if err := quoteprovider.VerifyAndValidate(teeAttestation, &cfg); err != nil {
+		return fmt.Errorf("attestation validation and verification failed with error: %v ❌ ", err)
 	}
-	if _, err := output.Write(out); err != nil {
-		return fmt.Errorf("failed to write verified attestation report: %v", err)
+
+	if err := verifyvTPM(attestation); err != nil {
+		return err
 	}
 
 	return nil
 }
 
 func vtpmverify(args []string) error {
-	tpmAttestationFile = string(args[0])
-	input, err := openInputFile()
+	attestation, err := returnvTPMAttestation(args)
 	if err != nil {
 		return err
 	}
-	if closer, ok := input.(*os.File); ok {
-		defer closer.Close()
-	}
-	attestationBytes, err := io.ReadAll(input)
-	if err != nil {
+
+	if err := verifyvTPM(attestation); err != nil {
 		return err
 	}
-	attestation := &tpmAttest.Attestation{}
 
-	if format == FormatBinaryPB {
-		err = proto.Unmarshal(attestationBytes, attestation)
-	} else if format == FormatTextProto {
-		err = unmarshalOptions.Unmarshal(attestationBytes, attestation)
-	} else {
-		return fmt.Errorf("format should be either binarypb or textproto")
-	}
-	if err != nil {
-		return fmt.Errorf("fail to unmarshal attestation report: %v", err)
-	}
+	return nil
+}
 
+func verifyvTPM(attestation *tpmAttest.Attestation) error {
 	pub, err := tpm2.DecodePublic(attestation.GetAkPub())
 	if err != nil {
 		return err
@@ -818,6 +790,35 @@ func vtpmverify(args []string) error {
 	return nil
 }
 
+func returnvTPMAttestation(args []string) (*tpmAttest.Attestation, error) {
+	tpmAttestationFile = string(args[0])
+	input, err := openInputFile()
+	if err != nil {
+		return nil, err
+	}
+	if closer, ok := input.(*os.File); ok {
+		defer closer.Close()
+	}
+	attestationBytes, err := io.ReadAll(input)
+	if err != nil {
+		return nil, err
+	}
+	attestation := &tpmAttest.Attestation{}
+
+	if format == FormatBinaryPB {
+		err = proto.Unmarshal(attestationBytes, attestation)
+	} else if format == FormatTextProto {
+		err = unmarshalOptions.Unmarshal(attestationBytes, attestation)
+	} else {
+		return nil, fmt.Errorf("format should be either binarypb or textproto")
+	}
+	if err != nil {
+		return nil, fmt.Errorf("fail to unmarshal attestation report: %v", err)
+	}
+
+	return attestation, nil
+}
+
 func openInputFile() (io.Reader, error) {
 	if tpmAttestationFile == "" {
 		return nil, errEmptyFile
@@ -920,7 +921,7 @@ func parseHashes() error {
 	return nil
 }
 
-func parseFiles() error {
+func parseAttestationFile() error {
 	file, err := os.ReadFile(attestationFile)
 	if err != nil {
 		return err
@@ -933,6 +934,10 @@ func parseFiles() error {
 		}
 	}
 
+	return nil
+}
+
+func parseTrustedKeys() error {
 	for _, path := range trustedAuthorKeys {
 		file, err := os.ReadFile(path)
 		if err != nil {

cli/attestation_policy.go

@@ -3,15 +3,22 @@
 package cli
 
 import (
+	"bytes"
+	"crypto/sha512"
 	"encoding/base64"
+	"encoding/json"
 	"fmt"
 	"os"
+	"strconv"
 
 	"github.com/absmach/magistrala/pkg/errors"
 	"github.com/google/go-sev-guest/proto/check"
+	"github.com/google/go-tpm-tools/proto/attest"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
-	"google.golang.org/protobuf/encoding/protojson"
+	config "github.com/ultravioletrs/cocos/pkg/attestation"
+	"github.com/ultravioletrs/cocos/pkg/attestation/gcp"
+	"google.golang.org/protobuf/proto"
 )
 
 type fieldType int
@@ -99,6 +106,126 @@ func (cli *CLI) NewAddHostDataCmd() *cobra.Command {
 	}
 }
 
+func (cli *CLI) NewGCPAttestationPolicy() *cobra.Command {
+	return &cobra.Command{
+		Use:     "gcp",
+		Short:   "Get attestation policy for GCP CVM",
+		Example: `gcp <bin_vtmp_attestation_report_file> <vcpu_count>`,
+		Args:    cobra.ExactArgs(2),
+		Run: func(cmd *cobra.Command, args []string) {
+			attestationBin, err := os.ReadFile(args[0])
+			if err != nil {
+				printError(cmd, "Error reading attestation report file: %v ❌ ", err)
+				return
+			}
+
+			vcpuCount, err := strconv.Atoi(args[1])
+			if err != nil {
+				printError(cmd, "Error converting vCPU count to integer: %v ❌ ", err)
+				return
+			}
+
+			attestation := &attest.Attestation{}
+
+			if err := proto.Unmarshal(attestationBin, attestation); err != nil {
+				printError(cmd, "Error unmarshaling attestation report: %v ❌ ", err)
+				return
+			}
+
+			attestationPB := attestation.GetSevSnpAttestation()
+
+			measurement, err := gcp.Extract384BitMeasurement(attestationPB)
+			if err != nil {
+				printError(cmd, "Error extracting 384-bit measurement: %v ❌ ", err)
+				return
+			}
+
+			launchEndorsement, err := gcp.GetLaunchEndorsement(cmd.Context(), measurement)
+			if err != nil {
+				printError(cmd, "Error getting launch endorsement: %v ❌ ", err)
+				return
+			}
+
+			attestationPolicy, err := gcp.GenerateAttestationPolicy(launchEndorsement, uint32(vcpuCount))
+			if err != nil {
+				printError(cmd, "Error generating attestation policy: %v ❌ ", err)
+				return
+			}
+
+			attestationPolicyJson, err := json.MarshalIndent(attestationPolicy, "", "  ")
+			if err != nil {
+				printError(cmd, "Error marshaling attestation policy: %v ❌ ", err)
+				return
+			}
+
+			if err := os.WriteFile("attestation_policy.json", attestationPolicyJson, filePermission); err != nil {
+				printError(cmd, "Error writing attestation policy file: %v ❌ ", err)
+				return
+			}
+
+			cmd.Println("Attestation policy file generated successfully ✅")
+		},
+	}
+}
+
+func (cli *CLI) NewDownloadGCPOvmfFile() *cobra.Command {
+	return &cobra.Command{
+		Use:     "download",
+		Short:   "Download GCP OVMF file",
+		Example: `download <bin_vtmp_attestation_report_file>`,
+		Args:    cobra.ExactArgs(1),
+		Run: func(cmd *cobra.Command, args []string) {
+			attestationBin, err := os.ReadFile(args[0])
+			if err != nil {
+				printError(cmd, "Error reading attestation report file: %v ❌ ", err)
+				return
+			}
+
+			attestation := &attest.Attestation{}
+
+			if err := proto.Unmarshal(attestationBin, attestation); err != nil {
+				printError(cmd, "Error unmarshaling attestation report: %v ❌ ", err)
+				return
+			}
+
+			attestationPB := attestation.GetSevSnpAttestation()
+
+			measurement, err := gcp.Extract384BitMeasurement(attestationPB)
+			if err != nil {
+				printError(cmd, "Error extracting 384-bit measurement: %v ❌ ", err)
+				return
+			}
+
+			launchEndorsement, err := gcp.GetLaunchEndorsement(cmd.Context(), measurement)
+			if err != nil {
+				printError(cmd, "Error getting launch endorsement: %v ❌ ", err)
+				return
+			}
+
+			ovmf, err := gcp.DownloadOvmfFile(cmd.Context(), fmt.Sprintf("%x", launchEndorsement.Digest))
+			if err != nil {
+				printError(cmd, "Error downloading OVMF file: %v ❌ ", err)
+				return
+			}
+
+			sum384 := sha512.Sum384(ovmf)
+
+			if !bytes.Equal(sum384[:], launchEndorsement.Digest) {
+				printError(cmd, "Error OVMF file does not match the measurement: %v ❌ ", fmt.Errorf("digest mismatch"))
+			} else {
+				cmd.Println("OVMF firmware in vm is unmodified ✅")
+			}
+
+			if err := os.WriteFile("ovmf.fd", ovmf, filePermission); err != nil {
+				printError(cmd, "Error writing OVMF file: %v ❌ ", err)
+				return
+			}
+
+			cmd.Println("OVMF file downloaded successfully ✅")
+		},
+	}
+}
+
 func changeAttestationConfiguration(fileName, base64Data string, expectedLength int, field fieldType) error {
 	data, err := base64.StdEncoding.DecodeString(base64Data)
 	if err != nil {
@@ -109,27 +236,31 @@ func changeAttestationConfiguration(fileName, base64Data string, expectedLength
 		return errDataLength
 	}
 
-	ac := check.Config{Policy: &check.Policy{}, RootOfTrust: &check.RootOfTrust{}}
+	ac := config.Config{Config: &check.Config{RootOfTrust: &check.RootOfTrust{}, Policy: &check.Policy{}}, PcrConfig: &config.PcrConfig{}}
 
-	attestationPolicy, err := os.ReadFile(fileName)
+	f, err := os.ReadFile(fileName)
 	if err != nil {
 		return errors.Wrap(errReadingAttestationPolicyFile, err)
 	}
 
-	if err = protojson.Unmarshal(attestationPolicy, &ac); err != nil {
+	if err = config.ReadAttestationPolicyFromByte(f, &ac); err != nil {
 		return errors.Wrap(errUnmarshalJSON, err)
 	}
 
+	if ac.Config.Policy == nil {
+		ac.Config.Policy = &check.Policy{}
+	}
+
 	switch field {
 	case measurementField:
-		ac.Policy.Measurement = data
+		ac.Config.Policy.Measurement = data
 	case hostDataField:
-		ac.Policy.HostData = data
+		ac.Config.Policy.HostData = data
 	default:
 		return errAttestationPolicyField
 	}
 
-	fileJson, err := protojson.Marshal(&ac)
+	fileJson, err := json.MarshalIndent(&ac, "", " ")
 	if err != nil {
 		return errors.Wrap(errMarshalJSON, err)
 	}

cli/attestation_policy_test.go

@@ -4,13 +4,14 @@ package cli
 
 import (
 	"encoding/base64"
+	"encoding/json"
 	"os"
 	"testing"
 
 	"github.com/google/go-sev-guest/proto/check"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"google.golang.org/protobuf/encoding/protojson"
+	config "github.com/ultravioletrs/cocos/pkg/attestation"
 )
 
 func TestChangeAttestationConfiguration(t *testing.T) {
@@ -18,9 +19,9 @@ func TestChangeAttestationConfiguration(t *testing.T) {
 	require.NoError(t, err)
 	defer os.Remove(tmpfile.Name())
 
-	initialConfig := check.Config{Policy: &check.Policy{}, RootOfTrust: &check.RootOfTrust{}}
+	initialConfig := config.Config{Config: &check.Config{RootOfTrust: &check.RootOfTrust{}, Policy: &check.Policy{}}, PcrConfig: &config.PcrConfig{}}
 
-	initialJSON, err := protojson.Marshal(&initialConfig)
+	initialJSON, err := json.Marshal(initialConfig)
 	require.NoError(t, err)
 	err = os.WriteFile(tmpfile.Name(), initialJSON, 0o644)
 	require.NoError(t, err)
@@ -86,15 +87,15 @@ func TestChangeAttestationConfiguration(t *testing.T) {
 				content, err := os.ReadFile(tmpfile.Name())
 				require.NoError(t, err)
 
-				config := check.Config{Policy: &check.Policy{}, RootOfTrust: &check.RootOfTrust{}}
-				err = protojson.Unmarshal(content, &config)
+				ap := config.Config{Config: &check.Config{RootOfTrust: &check.RootOfTrust{}, Policy: &check.Policy{}}, PcrConfig: &config.PcrConfig{}}
+				err = config.ReadAttestationPolicyFromByte(content, &ap)
 				require.NoError(t, err)
 
 				decodedData, _ := base64.StdEncoding.DecodeString(tt.base64Data)
 				if tt.field == measurementField {
-					assert.Equal(t, decodedData, config.Policy.Measurement)
+					assert.Equal(t, decodedData, ap.Config.Policy.Measurement)
 				} else if tt.field == hostDataField {
-					assert.Equal(t, decodedData, config.Policy.HostData)
+					assert.Equal(t, decodedData, ap.Config.Policy.HostData)
 				}
 			}
 		})

cli/attestation_test.go

@@ -287,9 +287,9 @@ type MockMeasurement struct {
 	mock.Mock
 }
 
-func (m *MockMeasurement) Run(igvmBinaryPath string) error {
+func (m *MockMeasurement) Run(igvmBinaryPath string) ([]byte, error) {
 	args := m.Called(igvmBinaryPath)
-	return args.Error(0)
+	return nil, args.Error(0)
 }
 
 func (m *MockMeasurement) Stop() error {
@@ -390,7 +390,9 @@ func TestParseFiles(t *testing.T) {
 	trustedAuthorKeys = []string{authorKeyFile}
 	trustedIdKeys = []string{idKeyFile}
 
-	err = parseFiles()
+	err = parseAttestationFile()
+	assert.NoError(t, err)
+	err = parseTrustedKeys()
 	assert.NoError(t, err)
 	assert.Equal(t, []byte("test attestation"), attestation)
 	assert.Len(t, cfg.Policy.TrustedAuthorKeys, 1)
@@ -401,7 +403,7 @@ func TestParseFiles(t *testing.T) {
 	os.Remove(idKeyFile)
 
 	attestationFile = "non_existent_file.bin"
-	err = parseFiles()
+	err = parseAttestationFile()
 	assert.Error(t, err)
 }
 

cli/cache.go

@@ -27,14 +27,14 @@ func (cli *CLI) NewCABundleCmd(fileSavePath string) *cobra.Command {
 		Example: "ca-bundle <path_to_platform_info_json>",
 		Args:    cobra.ExactArgs(1),
 		Run: func(cmd *cobra.Command, args []string) {
-			attestationConfiguration := config.Config{SnpCheck: &check.Config{Policy: &check.Policy{}, RootOfTrust: &check.RootOfTrust{}}, PcrConfig: &config.PcrConfig{}}
+			attestationConfiguration := config.Config{Config: &check.Config{Policy: &check.Policy{}, RootOfTrust: &check.RootOfTrust{}}, PcrConfig: &config.PcrConfig{}}
 			err := config.ReadAttestationPolicy(args[0], &attestationConfiguration)
 			if err != nil {
 				printError(cmd, "Error while reading manifest: %v ❌ ", err)
 				return
 			}
 
-			product := attestationConfiguration.SnpCheck.RootOfTrust.ProductLine
+			product := attestationConfiguration.Config.RootOfTrust.ProductLine
 
 			getter := trust.DefaultHTTPSGetter()
 			caURL := kds.ProductCertChainURL(abi.VcekReportSigner, product)

cli/manager.go

@@ -4,6 +4,7 @@ package cli
 
 import (
 	"os"
+	"time"
 
 	"github.com/fatih/color"
 	"github.com/spf13/cobra"
@@ -15,7 +16,9 @@ const (
 	serverCA  = "server-ca"
 	clientKey = "client-key"
 	clientCrt = "client-crt"
+	caUrl     = "ca-url"
 	logLevel  = "log-level"
+	ttlFlag   = "ttl"
 )
 
 var (
@@ -23,7 +26,9 @@ var (
 	agentCVMServerCA  string
 	agentCVMClientKey string
 	agentCVMClientCrt string
+	agentCVMCaUrl     string
 	agentLogLevel     string
+	ttl               time.Duration
 )
 
 func (c *CLI) NewCreateVMCmd() *cobra.Command {
@@ -47,6 +52,11 @@ func (c *CLI) NewCreateVMCmd() *cobra.Command {
 
 			createReq.AgentCvmServerUrl = agentCVMServerUrl
 			createReq.AgentLogLevel = agentLogLevel
+			createReq.AgentCvmCaUrl = agentCVMCaUrl
+
+			if ttl > 0 {
+				createReq.Ttl = ttl.String()
+			}
 
 			cmd.Println("🔗 Creating a new virtual machine")
 
@@ -56,7 +66,7 @@ func (c *CLI) NewCreateVMCmd() *cobra.Command {
 				return
 			}
 
-			cmd.Println(color.New(color.FgGreen).Sprintf("✅ Virtual machine created successfully with id %s and port %s", res.SvmId, res.ForwardedPort))
+			cmd.Println(color.New(color.FgGreen).Sprintf("✅ Virtual machine created successfully with id %s and port %s", res.CvmId, res.ForwardedPort))
 		},
 	}
 
@@ -64,7 +74,13 @@ func (c *CLI) NewCreateVMCmd() *cobra.Command {
 	cmd.Flags().StringVar(&agentCVMServerCA, serverCA, "", "CVM server CA")
 	cmd.Flags().StringVar(&agentCVMClientKey, clientKey, "", "CVM client key")
 	cmd.Flags().StringVar(&agentCVMClientCrt, clientCrt, "", "CVM client crt")
+	cmd.Flags().StringVar(&agentCVMCaUrl, agentCVMCaUrl, "", "CVM CA service URL")
 	cmd.Flags().StringVar(&agentLogLevel, logLevel, "", "Agent Log level")
+	cmd.Flags().DurationVar(&ttl, ttlFlag, 0, "TTL for the VM")
+	if err := cmd.MarkFlagRequired(serverURL); err != nil {
+		printError(cmd, "Error marking flag as required: %v ❌ ", err)
+		return cmd
+	}
 
 	return cmd
 }
@@ -73,7 +89,7 @@ func (c *CLI) NewRemoveVMCmd() *cobra.Command {
 	return &cobra.Command{
 		Use:     "remove-vm",
 		Short:   "Remove a virtual machine",
-		Example: `remove-vm <svm_id>`,
+		Example: `remove-vm <cvm_id>`,
 		Args:    cobra.ExactArgs(1),
 		Run: func(cmd *cobra.Command, args []string) {
 			if err := c.InitializeManagerClient(cmd); err == nil {
@@ -87,7 +103,7 @@ func (c *CLI) NewRemoveVMCmd() *cobra.Command {
 
 			cmd.Println("🔗 Removing virtual machine")
 
-			_, err := c.managerClient.RemoveVm(cmd.Context(), &manager.RemoveReq{SvmId: args[0]})
+			_, err := c.managerClient.RemoveVm(cmd.Context(), &manager.RemoveReq{CvmId: args[0]})
 			if err != nil {
 				printError(cmd, "Error removing virtual machine: %v ❌ ", err)
 				return

cli/sdk.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/spf13/cobra"
 	"github.com/ultravioletrs/cocos/manager"
-	"github.com/ultravioletrs/cocos/pkg/attestation/igvmmeasure"
+	"github.com/ultravioletrs/cocos/pkg/attestation/cmdconfig"
 	"github.com/ultravioletrs/cocos/pkg/clients/grpc"
 	"github.com/ultravioletrs/cocos/pkg/clients/grpc/agent"
 	managergrpc "github.com/ultravioletrs/cocos/pkg/clients/grpc/manager"
@@ -23,10 +23,10 @@ type CLI struct {
 	client        grpc.Client
 	managerClient manager.ManagerServiceClient
 	connectErr    error
-	measurement   igvmmeasure.MeasurementProvider
+	measurement   cmdconfig.MeasurementProvider
 }
 
-func New(agentConfig grpc.AgentClientConfig, managerConfig grpc.ManagerClientConfig, measurement igvmmeasure.MeasurementProvider) *CLI {
+func New(agentConfig grpc.AgentClientConfig, managerConfig grpc.ManagerClientConfig, measurement cmdconfig.MeasurementProvider) *CLI {
 	return &CLI{
 		agentConfig:   agentConfig,
 		managerConfig: managerConfig,

cmd/agent/main.go

@@ -4,6 +4,10 @@ package main
 
 import (
 	"context"
+	"crypto/sha256"
+	"crypto/sha512"
+	"crypto/x509"
+	"encoding/pem"
 	"errors"
 	"fmt"
 	"log"
@@ -25,8 +29,10 @@ import (
 	"github.com/ultravioletrs/cocos/agent/cvms/server"
 	"github.com/ultravioletrs/cocos/agent/events"
 	agentlogger "github.com/ultravioletrs/cocos/internal/logger"
+	attestationconfig "github.com/ultravioletrs/cocos/pkg/attestation"
 	"github.com/ultravioletrs/cocos/pkg/attestation/quoteprovider"
 	"github.com/ultravioletrs/cocos/pkg/attestation/quoteprovider/mocks"
+	"github.com/ultravioletrs/cocos/pkg/attestation/vtpm"
 	pkggrpc "github.com/ultravioletrs/cocos/pkg/clients/grpc"
 	cvmsgrpc "github.com/ultravioletrs/cocos/pkg/clients/grpc/cvm"
 	"golang.org/x/sync/errgroup"
@@ -41,8 +47,11 @@ const (
 )
 
 type config struct {
-	LogLevel string `env:"AGENT_LOG_LEVEL" envDefault:"debug"`
-	Vmpl     int    `env:"AGENT_VMPL" envDefault:"2"`
+	LogLevel      string `env:"AGENT_LOG_LEVEL" envDefault:"debug"`
+	Vmpl          int    `env:"AGENT_VMPL" envDefault:"2"`
+	AgentGrpcHost string `env:"AGENT_GRPC_HOST" envDefault:"0.0.0.0"`
+	CAUrl         string `env:"AGENT_CVM_CA_URL" envDefault:""`
+	CVMId         string `env:"AGENT_CVM_ID" envDefault:""`
 }
 
 func main() {
@@ -77,12 +86,14 @@ func main() {
 	}
 
 	var qp client.LeveledQuoteProvider
+	vtpmAttest := vtpm.Attest
 
 	if !sevGuesDeviceExists() {
 		logger.Info("SEV-SNP device not found")
 		qpMock := new(mocks.LeveledQuoteProvider)
 		qpMock.On("GetRawQuoteAtLevel", mock.Anything, mock.Anything).Return([]uint8{}, errors.New("SEV-SNP device not found"))
 		qp = qpMock
+		vtpmAttest = vtpm.EmptyAttest
 	} else {
 		qp, err = quoteprovider.GetLeveledQuoteProvider()
 		if err != nil {
@@ -107,14 +118,19 @@ func main() {
 	}
 	defer cvmGRPCClient.Close()
 
-	reconnectFn := func(ctx context.Context) (cvms.Service_ProcessClient, error) {
-		_, newClient, err := cvmsgrpc.NewCVMClient(cvmGrpcConfig)
+	reconnectFn := func(ctx context.Context) (pkggrpc.Client, cvms.Service_ProcessClient, error) {
+		grpcClient, newClient, err := cvmsgrpc.NewCVMClient(cvmGrpcConfig)
 		if err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 		// Don't defer close here as we want to keep the connection open
 
-		return newClient.Process(ctx)
+		pc, err := newClient.Process(ctx)
+		if err != nil {
+			grpcClient.Close()
+			return nil, nil, err
+		}
+		return grpcClient, pc, nil
 	}
 
 	pc, err := cvmsClient.Process(ctx)
@@ -130,7 +146,7 @@ func main() {
 		return
 	}
 
-	svc := newService(ctx, logger, eventSvc, qp, cfg.Vmpl)
+	svc := newService(ctx, logger, eventSvc, qp, cfg.Vmpl, vtpmAttest)
 
 	if err := os.MkdirAll(storageDir, 0o755); err != nil {
 		logger.Error(fmt.Sprintf("failed to create storage directory: %s", err))
@@ -138,7 +154,7 @@ func main() {
 		return
 	}
 
-	mc, err := cvmsapi.NewClient(pc, svc, eventsLogsQueue, logger, server.NewServer(logger, svc), storageDir, reconnectFn)
+	mc, err := cvmsapi.NewClient(pc, svc, eventsLogsQueue, logger, server.NewServer(logger, svc, cfg.AgentGrpcHost, qp, cfg.CAUrl, cfg.CVMId), storageDir, reconnectFn, cvmGRPCClient)
 	if err != nil {
 		logger.Error(err.Error())
 		exitCode = 1
@@ -164,13 +180,29 @@ func main() {
 		return mc.Process(ctx, cancel)
 	})
 
+	attestation, certSerialNumber, err := attestationFromCert(ctx, cvmGrpcConfig.ClientCert, svc)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to get attestation: %s", err))
+		exitCode = 1
+		return
+	}
+
+	eventsLogsQueue <- &cvms.ClientStreamMessage{
+		Message: &cvms.ClientStreamMessage_VTPMattestationReport{
+			VTPMattestationReport: &cvms.AttestationResponse{
+				File:             attestation,
+				CertSerialNumber: certSerialNumber,
+			},
+		},
+	}
+
 	if err := g.Wait(); err != nil {
 		logger.Error(fmt.Sprintf("%s service terminated: %s", svcName, err))
 	}
 }
 
-func newService(ctx context.Context, logger *slog.Logger, eventSvc events.Service, qp client.LeveledQuoteProvider, vmpl int) agent.Service {
-	svc := agent.New(ctx, logger, eventSvc, qp, vmpl)
+func newService(ctx context.Context, logger *slog.Logger, eventSvc events.Service, qp client.LeveledQuoteProvider, vmpl int, vtpmAttest vtpm.VtpmAttest) agent.Service {
+	svc := agent.New(ctx, logger, eventSvc, qp, vmpl, vtpmAttest)
 
 	svc = api.LoggingMiddleware(svc, logger)
 	counter, latency := prometheus.MakeMetrics(svcName, "api")
@@ -187,3 +219,29 @@ func sevGuesDeviceExists() bool {
 	d.Close()
 	return true
 }
+
+func attestationFromCert(ctx context.Context, certFilePath string, svc agent.Service) ([]byte, string, error) {
+	if certFilePath == "" {
+		return nil, "", nil
+	}
+
+	certFile, err := os.ReadFile(certFilePath)
+	if err != nil {
+		return nil, "", err
+	}
+
+	certPem, _ := pem.Decode(certFile)
+	certx509, err := x509.ParseCertificate(certPem.Bytes)
+	if err != nil {
+		return nil, "", err
+	}
+
+	nonceSNP := sha512.Sum512(certFile)
+	nonceVTPM := sha256.Sum256(certFile)
+	attestation, err := svc.Attestation(ctx, nonceSNP, nonceVTPM, attestationconfig.SNPvTPM)
+	if err != nil {
+		return nil, "", err
+	}
+
+	return attestation, certx509.SerialNumber.String(), nil
+}

cmd/cli/main.go

@@ -14,7 +14,7 @@ import (
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 	"github.com/ultravioletrs/cocos/cli"
-	"github.com/ultravioletrs/cocos/pkg/attestation/igvmmeasure"
+	"github.com/ultravioletrs/cocos/pkg/attestation/cmdconfig"
 	"github.com/ultravioletrs/cocos/pkg/clients/grpc"
 	cmd "github.com/virtee/sev-snp-measure-go/sevsnpmeasure/cmd"
 )
@@ -108,7 +108,8 @@ func main() {
 		return
 	}
 
-	measurement, err := igvmmeasure.NewIgvmMeasurement(cfg.IgvmBinaryPath, os.Stderr, os.Stdout)
+	options := cmdconfig.IgvmMeasureOptions
+	measurement, err := cmdconfig.NewCmdConfig(cfg.IgvmBinaryPath, options, os.Stderr)
 	if err != nil {
 		message := color.New(color.FgRed).Sprintf("failed to initialize measurement: %s", err) // Use %s instead of %w
 		rootCmd.Println(message)
@@ -159,6 +160,8 @@ func main() {
 	// Attestation Policy commands
 	attestationPolicyCmd.AddCommand(cliSVC.NewAddMeasurementCmd())
 	attestationPolicyCmd.AddCommand(cliSVC.NewAddHostDataCmd())
+	attestationPolicyCmd.AddCommand(cliSVC.NewGCPAttestationPolicy())
+	attestationPolicyCmd.AddCommand(cliSVC.NewDownloadGCPOvmfFile())
 
 	if err := rootCmd.Execute(); err != nil {
 		logErrorCmd(*rootCmd, err)

cmd/manager/main.go

@@ -42,7 +42,9 @@ type config struct {
 	JaegerURL               url.URL `env:"COCOS_JAEGER_URL"                   envDefault:"http://localhost:4318"`
 	TraceRatio              float64 `env:"COCOS_JAEGER_TRACE_RATIO"           envDefault:"1.0"`
 	InstanceID              string  `env:"MANAGER_INSTANCE_ID"                envDefault:""`
-	AttestationPolicyBinary string  `env:"MANAGER_ATTESTATION_POLICY_BINARY"  envDefault:"../../build"`
+	AttestationPolicyBinary string  `env:"MANAGER_ATTESTATION_POLICY_BINARY"  envDefault:"../../build/attestation_policy"`
+	IgvmMeasureBinary       string  `env:"MANAGER_IGVMMEASURE_BINARY"         envDefault:"../../build/igvmmeasure"`
+	PcrValues               string  `env:"MANAGER_PCR_VALUES"                 envDefault:""`
 	EosVersion              string  `env:"MANAGER_EOS_VERSION"                envDefault:""`
 }
 
@@ -98,7 +100,7 @@ func main() {
 		return
 	}
 
-	svc, err := newService(logger, tracer, qemuCfg, cfg.AttestationPolicyBinary, cfg.EosVersion)
+	svc, err := newService(logger, tracer, qemuCfg, cfg.AttestationPolicyBinary, cfg.IgvmMeasureBinary, cfg.PcrValues, cfg.EosVersion)
 	if err != nil {
 		logger.Error(err.Error())
 		exitCode = 1
@@ -110,7 +112,7 @@ func main() {
 		manager.RegisterManagerServiceServer(srv, managergrpc.NewServer(svc))
 	}
 
-	gs := grpcserver.New(ctx, cancel, svcName, managerGRPCConfig, registerManagerServiceServer, logger, nil, nil)
+	gs := grpcserver.New(ctx, cancel, svcName, managerGRPCConfig, registerManagerServiceServer, logger, nil, nil, "", "")
 
 	g.Go(func() error {
 		return gs.Start()
@@ -125,8 +127,8 @@ func main() {
 	}
 }
 
-func newService(logger *slog.Logger, tracer trace.Tracer, qemuCfg qemu.Config, attestationPolicyPath string, eosVersion string) (manager.Service, error) {
-	svc, err := manager.New(qemuCfg, attestationPolicyPath, logger, qemu.NewVM, eosVersion)
+func newService(logger *slog.Logger, tracer trace.Tracer, qemuCfg qemu.Config, attestationPolicyPath string, igvmMeasurementBinaryPath string, pcrValuesFilePath string, eosVersion string) (manager.Service, error) {
+	svc, err := manager.New(qemuCfg, attestationPolicyPath, igvmMeasurementBinaryPath, pcrValuesFilePath, logger, qemu.NewVM, eosVersion)
 	if err != nil {
 		return nil, err
 	}

cocos-manager.env

@@ -7,6 +7,8 @@ COCOS_JAEGER_TRACE_RATIO=1.0
 # Manager Service Configuration
 MANAGER_INSTANCE_ID=
 MANAGER_ATTESTATION_POLICY_BINARY=../../build
+MANAGER_IGVMMEASURE_BINARY=../../build
+MANAGER_PCR_VALUES=/etc/cocos/pcr_values.json
 MANAGER_GRPC_CLIENT_CERT=
 MANAGER_GRPC_CLIENT_KEY=
 MANAGER_GRPC_SERVER_CA_CERTS=

go.mod

@@ -2,43 +2,67 @@ module github.com/ultravioletrs/cocos
 
 go 1.23.2
 
+toolchain go1.24.1
+
 require (
 	github.com/absmach/magistrala v0.15.1
 	github.com/caarlos0/env/v11 v11.3.1
 	github.com/fatih/color v1.18.0
 	github.com/go-kit/kit v0.13.0
 	github.com/gofrs/uuid v4.4.0+incompatible
-	github.com/google/go-sev-guest v0.12.1
+	github.com/google/go-sev-guest v0.13.0
 	github.com/google/go-tdx-guest v0.3.2-0.20241009005452-097ee70d0843 // indirect
 	github.com/mdlayher/vsock v1.2.1
 	github.com/spf13/cobra v1.9.1
 	github.com/spf13/pflag v1.0.6
 	github.com/stretchr/testify v1.10.0
 	github.com/virtee/sev-snp-measure-go v0.0.0-20240530153610-e6e8dc9b6877
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.59.0
-	go.opentelemetry.io/otel/trace v1.34.0
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0
+	go.opentelemetry.io/otel/trace v1.35.0
 	golang.org/x/crypto v0.35.0
-	golang.org/x/sync v0.11.0
-	google.golang.org/grpc v1.70.0
-	google.golang.org/protobuf v1.36.5
+	golang.org/x/sync v0.12.0
+	google.golang.org/grpc v1.71.1
+	google.golang.org/protobuf v1.36.6
 )
 
 require (
+	cloud.google.com/go/storage v1.51.0
+	github.com/golang/protobuf v1.5.4
+	github.com/google/gce-tcb-verifier v0.3.1
+)
+
+require (
+	cel.dev/expr v0.19.2 // indirect
+	cloud.google.com/go v0.118.3 // indirect
+	cloud.google.com/go/auth v0.15.0 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.7 // indirect
+	cloud.google.com/go/compute/metadata v0.6.0 // indirect
+	cloud.google.com/go/iam v1.4.1 // indirect
+	cloud.google.com/go/monitoring v1.24.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.25.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cncf/xds/go v0.0.0-20250121191232-2f005788dc42 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
+	github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/gofrs/uuid/v5 v5.3.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
 	github.com/google/certificate-transparency-go v1.1.2 // indirect
-	github.com/google/gce-tcb-verifier v0.2.3-0.20240905212129-12f728a62786 // indirect
 	github.com/google/go-attestation v0.5.1 // indirect
 	github.com/google/go-eventlog v0.0.2-0.20241003021507-01bb555f7cba // indirect
 	github.com/google/go-tspi v0.3.0 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.5 // indirect
+	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
+	github.com/hokaccha/go-prettyjson v0.0.0-20211117102719-0474bc63780f // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
@@ -46,21 +70,32 @@ require (
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0 // indirect
+	github.com/pelletier/go-toml v1.9.5 // indirect
+	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.57.0 // indirect
-	go.opentelemetry.io/otel v1.34.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.32.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.32.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.32.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.34.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
+	go.opentelemetry.io/otel v1.35.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.34.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.35.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.35.0 // indirect
 	golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect
+	golang.org/x/oauth2 v0.28.0 // indirect
+	golang.org/x/time v0.10.0 // indirect
+	google.golang.org/api v0.224.0 // indirect
+	google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gotest.tools/v3 v3.5.1 // indirect
+	moul.io/http2curl v1.0.0 // indirect
 )
 
 require (
+	github.com/absmach/certs v0.0.0-20250313105043-afbcda9a9963
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/docker v28.0.1+incompatible
+	github.com/docker/docker v28.0.4+incompatible
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.6.0 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
@@ -75,20 +110,20 @@ require (
 	github.com/mdlayher/socket v0.4.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_golang v1.20.5 // indirect
+	github.com/prometheus/client_golang v1.21.1 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.59.1 // indirect
+	github.com/prometheus/common v0.62.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
-	go.opentelemetry.io/otel/metric v1.34.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
+	go.opentelemetry.io/otel/metric v1.35.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/net v0.34.0 // indirect
-	golang.org/x/sys v0.30.0 // indirect
-	golang.org/x/term v0.29.0
+	golang.org/x/net v0.35.0 // indirect
+	golang.org/x/sys v0.31.0 // indirect
+	golang.org/x/term v0.30.0
 	golang.org/x/text v0.22.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250204164813-702378808489 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250207221924-e9438ea467c6 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 

go.sum

@@ -1,5 +1,7 @@
 bazil.org/fuse v0.0.0-20180421153158-65cc252bf669/go.mod h1:Xbm+BRKSBEpa4q4hTSxohYNQpsxXPbPry4JJWOB3LB8=
 bitbucket.org/creachadair/shell v0.0.6/go.mod h1:8Qqi/cYk7vPnsOePHroKXDJYmb5x7ENhtiFtfZq8K+M=
+cel.dev/expr v0.19.2 h1:V354PbqIXr9IQdwy4SYA4xa0HXaWq1BUPAGzugBY5V4=
+cel.dev/expr v0.19.2/go.mod h1:MrpN08Q+lEBs+bGYdLxxHkZoUSsCp0nSKTs0nTymJgw=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
@@ -30,16 +32,32 @@ cloud.google.com/go v0.90.0/go.mod h1:kRX0mNRHe0e2rC6oNakvwQqzyDmg57xJ+SZU1eT2aD
 cloud.google.com/go v0.92.2/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
 cloud.google.com/go v0.92.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
 cloud.google.com/go v0.93.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
+cloud.google.com/go v0.118.3 h1:jsypSnrE/w4mJysioGdMBg4MiW/hHx/sArFpaBWHdME=
+cloud.google.com/go v0.118.3/go.mod h1:Lhs3YLnBlwJ4KA6nuObNMZ/fCbOQBPuWKPoE0Wa/9Vc=
+cloud.google.com/go/auth v0.15.0 h1:Ly0u4aA5vG/fsSsxu98qCQBemXtAtJf+95z9HK+cxps=
+cloud.google.com/go/auth v0.15.0/go.mod h1:WJDGqZ1o9E9wKIL+IwStfyn/+s59zl4Bi+1KQNVXLZ8=
+cloud.google.com/go/auth/oauth2adapt v0.2.7 h1:/Lc7xODdqcEw8IrZ9SvwnlLX6j9FHQM74z6cBk9Rw6M=
+cloud.google.com/go/auth/oauth2adapt v0.2.7/go.mod h1:NTbTTzfvPl1Y3V1nPpOgl2w6d/FjO7NNUQaWSox6ZMc=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
 cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
 cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
+cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
+cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqClKRT5SZwBmk=
+cloud.google.com/go/iam v1.4.1 h1:cFC25Nv+u5BkTR/BT1tXdoF2daiVbZ1RLx2eqfQ9RMM=
+cloud.google.com/go/iam v1.4.1/go.mod h1:2vUEJpUG3Q9p2UdsyksaKpDzlwOrnMzS30isdReIcLM=
+cloud.google.com/go/logging v1.13.0 h1:7j0HgAp0B94o1YRDqiqm26w4q1rDMH7XNRU34lJXHYc=
+cloud.google.com/go/logging v1.13.0/go.mod h1:36CoKh6KA/M0PbhPKMq6/qety2DCAErbhXT62TuXALA=
+cloud.google.com/go/longrunning v0.6.5 h1:sD+t8DO8j4HKW4QfouCklg7ZC1qC4uzVZt8iz3uTW+Q=
+cloud.google.com/go/longrunning v0.6.5/go.mod h1:Et04XK+0TTLKa5IPYryKf5DkpwImy6TluQ1QTLwlKmY=
 cloud.google.com/go/monitoring v0.1.0/go.mod h1:Hpm3XfzJv+UTiXzCG5Ffp0wijzHTC7Cv4eR7o3x/fEE=
+cloud.google.com/go/monitoring v1.24.0 h1:csSKiCJ+WVRgNkRzzz3BPoGjFhjPY23ZTcaenToJxMM=
+cloud.google.com/go/monitoring v1.24.0/go.mod h1:Bd1PRK5bmQBQNnuGwHBfUamAV1ys9049oEPHnn4pcsc=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
@@ -52,7 +70,11 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
+cloud.google.com/go/storage v1.51.0 h1:ZVZ11zCiD7b3k+cH5lQs/qcNaoSz3U9I0jgwVzqDlCw=
+cloud.google.com/go/storage v1.51.0/go.mod h1:YEJfu/Ki3i5oHC/7jyTgsGZwdQ8P9hqMqvpi5kRKGgc=
 cloud.google.com/go/trace v0.1.0/go.mod h1:wxEwsoeRVPbeSkt7ZC9nWCgmoKQRAoySN7XHW2AmI7g=
+cloud.google.com/go/trace v1.11.3 h1:c+I4YFjxRQjvAhRmSsmjpASUKq88chOX854ied0K/pE=
+cloud.google.com/go/trace v1.11.3/go.mod h1:pt7zCYiDSQjC9Y2oqCsh9jF4GStB/hmjrYLsxRR27q8=
 code.gitea.io/sdk/gitea v0.11.3/go.mod h1:z3uwDV/b9Ls47NGukYM9XhnHtqPh/J+t40lsUrR6JDY=
 contrib.go.opencensus.io/exporter/aws v0.0.0-20181029163544-2befc13012d0/go.mod h1:uu1P0UCM/6RbsMrgPa98ll8ZcHM858i/AD06a9aLRCA=
 contrib.go.opencensus.io/exporter/ocagent v0.5.0/go.mod h1:ImxhfLRpxoYiSq891pBrLVhN+qmP8BTVvdH2YLs7Gl0=
@@ -74,6 +96,14 @@ github.com/Azure/go-autorest v12.0.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSW
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/GoogleCloudPlatform/cloudsql-proxy v0.0.0-20191009163259-e802c2cb94ae/go.mod h1:mjwGPas4yKduTyubHvD1Atl9r1rUq8DfVy+gkVvZ+oo=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.25.0 h1:3c8yed4lgqTt+oTQ+JNMDo+F4xprBf+O/il4ZC0nRLw=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.25.0/go.mod h1:obipzmGjfSjam60XLwGfqUkJsfiheAl+TUjG+4yzyPM=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0 h1:fYE9p3esPxA/C0rQ0AHhP0drtPXDRhaWiwg1DPqO7IU=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0/go.mod h1:BnBReJLvVYx2CS/UHOgVz2BXKXD9wsQPxZug20nZhd0=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.51.0 h1:OqVGm6Ei3x5+yZmSJG1Mh2NwHvpVmZ08CB5qJhT9Nuk=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.51.0/go.mod h1:SZiPHWGOOk3bl8tkevxkoiwPgsIl6CwrWcbwjfHZpdM=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0 h1:6/0iUd0xrnX7qt+mLNRwg5c0PGv8wpE8K90ryANQwMI=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0/go.mod h1:otE2jQekW/PqXk1Awf5lmfokJx4uwuqcj1ab5SpGeW0=
 github.com/Knetic/govaluate v3.0.1-0.20171022003610-9aa49832a739+incompatible/go.mod h1:r7JcOSlj0wfOMncg0iLm8Leh48TZaKVeNIfJntJ2wa0=
 github.com/Masterminds/goutils v1.1.0/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver v1.4.2/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
@@ -89,6 +119,8 @@ github.com/Shopify/sarama v1.19.0/go.mod h1:FVkBWblsNy7DGZRfXLU0O9RCGt5g3g3yEuWX
 github.com/Shopify/toxiproxy v2.1.4+incompatible/go.mod h1:OXgGpZ6Cli1/URJOF1DMxUHB2q5Ap20/P/eIdh4G0pI=
 github.com/VividCortex/gohistogram v1.0.0 h1:6+hBz+qvs0JOrrNhhmR7lFxo5sINxBCGXrdtl/UvroE=
 github.com/VividCortex/gohistogram v1.0.0/go.mod h1:Pf5mBqqDxYaXu3hDrrU+w6nw50o/4+TcAqDqk/vUH7g=
+github.com/absmach/certs v0.0.0-20250313105043-afbcda9a9963 h1:kN6NwYWNyTMAmDAwAGuxVYw6t8TL50CB6Kw3jOHj6iw=
+github.com/absmach/certs v0.0.0-20250313105043-afbcda9a9963/go.mod h1:I4SywlzOXtUfJwVHCyPOUdl8rEsby2cJX2mqA5A4MOw=
 github.com/absmach/magistrala v0.15.1 h1:3Bk2hlyWcV591LxPYwlvRcyCXTfuZ1g/EkNmU+o3NNQ=
 github.com/absmach/magistrala v0.15.1/go.mod h1:9pto6xuBt/IuCtZRdEha0iDQKNQ5tyNOjLXJgUiikYk=
 github.com/afex/hystrix-go v0.0.0-20180502004556-fa1af6a1f4f5/go.mod h1:SkGFH1ia65gfNATL8TAiHDNxPzPdmEL5uirI2Uyuz6c=
@@ -162,6 +194,8 @@ github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGX
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20250121191232-2f005788dc42 h1:Om6kYQYDUk5wWbT0t0q6pvyM49i9XZAv9dDrkDA7gjk=
+github.com/cncf/xds/go v0.0.0-20250121191232-2f005788dc42/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
 github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
 github.com/cockroachdb/datadriven v0.0.0-20200714090401-bf6692d28da5/go.mod h1:h6jFvWxBdQXxjopDMZyH2UVceIRfR84bdzbkoKrsWNo=
 github.com/cockroachdb/errors v1.2.4/go.mod h1:rQD95gz6FARkaKkQXUksEje/d9a6wBJoCr5oaCLELYA=
@@ -201,8 +235,8 @@ github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8
 github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/docker v28.0.1+incompatible h1:FCHjSRdXhNRFjlHMTv4jUNlIBbTeRjrWfeFuJp7jpo0=
-github.com/docker/docker v28.0.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v28.0.4+incompatible h1:JNNkBctYKurkw6FrHfKqY0nKIDf5nrbxjVBtS+cdcok=
+github.com/docker/docker v28.0.4+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
 github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
@@ -222,8 +256,16 @@ github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5y
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
+github.com/envoyproxy/go-control-plane v0.13.4 h1:zEqyPVyku6IvWCFwux4x9RxkLOMUL+1vC9xUFv5l2/M=
+github.com/envoyproxy/go-control-plane v0.13.4/go.mod h1:kDfuBlDVsSj2MjrLEtRWtHlsWIFcGyB2RMO44Dc5GZA=
+github.com/envoyproxy/go-control-plane/envoy v1.32.4 h1:jb83lalDRZSpPWW2Z7Mck/8kXZ5CQAFYVjQcdVIr83A=
+github.com/envoyproxy/go-control-plane/envoy v1.32.4/go.mod h1:Gzjc5k8JcJswLjAx1Zm+wSYE20UrLtt7JZMWiWQXQEw=
+github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
+github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v0.3.0-java/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
+github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU=
 github.com/etcd-io/gofail v0.0.0-20190801230047-ad7f989257ca/go.mod h1:49H/RkXP8pKaZy4h0d+NW16rSLhyVBt4o6VLJbmOqDE=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
@@ -247,6 +289,8 @@ github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeME
 github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
 github.com/gin-gonic/gin v1.5.0/go.mod h1:Nd6IXA8m5kNZdNEHMBd93KT+mdY3+bewLgRvmCsR2Do=
 github.com/gliderlabs/ssh v0.2.2/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
+github.com/go-chi/chi/v5 v5.2.1 h1:KOIHODQj58PmL80G2Eak4WdvUzjSJSm0vG72crDCqb8=
+github.com/go-chi/chi/v5 v5.2.1/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -290,6 +334,8 @@ github.com/gogo/protobuf v1.3.0/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXP
 github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
+github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -335,8 +381,8 @@ github.com/google/certificate-transparency-go v1.1.2-0.20210422104406-9f33727a7a
 github.com/google/certificate-transparency-go v1.1.2-0.20210512142713-bed466244fa6/go.mod h1:aF2dp7Dh81mY8Y/zpzyXps4fQW5zQbDu2CxfpJB6NkI=
 github.com/google/certificate-transparency-go v1.1.2 h1:4hE0GEId6NAW28dFpC+LrRGwQX5dtmXQGDbg8+/MZOM=
 github.com/google/certificate-transparency-go v1.1.2/go.mod h1:3OL+HKDqHPUfdKrHVQxO6T8nDLO0HF7LRTlkIWXaWvQ=
-github.com/google/gce-tcb-verifier v0.2.3-0.20240905212129-12f728a62786 h1:1ijRI0+jsZCl3CqeJG3Cib6w+wYCBlD/rWRo5a+ZME4=
-github.com/google/gce-tcb-verifier v0.2.3-0.20240905212129-12f728a62786/go.mod h1:Jvv9i6JF1t7sDVW09zP2x+9vN3lcujtih2Zb/lVXaLs=
+github.com/google/gce-tcb-verifier v0.3.1 h1:4L9YgkOtqC2U7cj4FofCUufHFCCpdD4Y0yPKI8UhOhI=
+github.com/google/gce-tcb-verifier v0.3.1/go.mod h1:GZCDLQxmEOCqUTL2BMB/zjo+hgXdUrR0Wgwz1OrwRYg=
 github.com/google/go-attestation v0.5.1 h1:jqtOrLk5MNdliTKjPbIPrAaRKJaKW+0LIU2n/brJYms=
 github.com/google/go-attestation v0.5.1/go.mod h1:KqGatdUhg5kPFkokyzSBDxwSCFyRgIgtRkMp6c3lOBQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@@ -351,8 +397,8 @@ github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-configfs-tsm v0.3.3-0.20240919001351-b4b5b84fdcbc h1:SG12DWUUM5igxm+//YX5Yq4vhdoRnOG9HkCodkOn+YU=
 github.com/google/go-configfs-tsm v0.3.3-0.20240919001351-b4b5b84fdcbc/go.mod h1:EL1GTDFMb5PZQWDviGfZV9n87WeGTR/JUg13RfwkgRo=
 github.com/google/go-eventlog v0.0.2-0.20241003021507-01bb555f7cba h1:05m5+kgZjxYUZrx3bZfkKHl6wkch+Khao6N21rFHInk=
@@ -362,8 +408,8 @@ github.com/google/go-licenses v0.0.0-20210329231322-ce1d9163b77d/go.mod h1:+TYOm
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
 github.com/google/go-replayers/grpcreplay v0.1.0/go.mod h1:8Ig2Idjpr6gifRd6pNVggX6TC1Zw6Jx74AKp7QNH2QE=
 github.com/google/go-replayers/httpreplay v0.1.0/go.mod h1:YKZViNhiGgqdBlUbI2MwGpq4pXxNmhJLPHQ7cv2b5no=
-github.com/google/go-sev-guest v0.12.1 h1:H4rFYnPIn8HtqEsNTmh56Zxcf9BI9n48ZSYCnpYLYvc=
-github.com/google/go-sev-guest v0.12.1/go.mod h1:SK9vW+uyfuzYdVN0m8BShL3OQCtXZe/JPF7ZkpD3760=
+github.com/google/go-sev-guest v0.13.0 h1:DJB6ACdykyweMU0HGOp/TQ7cjsnbV2ecbYunu2E0qy0=
+github.com/google/go-sev-guest v0.13.0/go.mod h1:SK9vW+uyfuzYdVN0m8BShL3OQCtXZe/JPF7ZkpD3760=
 github.com/google/go-tdx-guest v0.3.2-0.20241009005452-097ee70d0843 h1:+MoPobRN9HrDhGyn6HnF5NYo4uMBKaiFqAtf/D/OB4A=
 github.com/google/go-tdx-guest v0.3.2-0.20241009005452-097ee70d0843/go.mod h1:g/n8sKITIT9xRivBUbizo34DTsUm2nN2uU3A662h09g=
 github.com/google/go-tpm v0.9.3 h1:+yx0/anQuGzi+ssRqeD6WpXjW2L/V0dItUayO0i9sRc=
@@ -375,10 +421,13 @@ github.com/google/licenseclassifier v0.0.0-20210325184830-bb04aff29e72/go.mod h1
 github.com/google/logger v1.1.1 h1:+6Z2geNxc9G+4D4oDO9njjjn2d0wN5d7uOo0vOIW1NQ=
 github.com/google/logger v1.1.1/go.mod h1:BkeJZ+1FhQ+/d087r4dzojEg1u2ZX+ZqG1jTUrLM+zQ=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/martian v2.1.1-0.20190517191504-25dcb96d9e51+incompatible h1:xmapqc1AyLoB+ddYT6r04bD9lIjlOqGaREovi0SzFaE=
 github.com/google/martian v2.1.1-0.20190517191504-25dcb96d9e51+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.2.1/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
+github.com/google/martian/v3 v3.3.3 h1:DIhPTQrbPkgs2yJYdXU/eNACCG5DVQjySNRNlflZ9Fc=
+github.com/google/martian/v3 v3.3.3/go.mod h1:iEPrYcgCF7jA9OtScMFQyAlZZ4YXTKEtJ1E6RWzmBA0=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
@@ -396,6 +445,8 @@ github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/rpmpack v0.0.0-20191226140753-aa36bfddb3a0/go.mod h1:RaTPr0KUf2K7fnZYLNDrr8rxAamWs3iNywJLtQ2AzBg=
+github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
+github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/subcommands v1.0.1/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
 github.com/google/trillian v1.3.14-0.20210409160123-c5ea3abd4a41/go.mod h1:1dPv0CUjNQVFEDuAUFhZql16pw/VlPgaX8qj+g5pVzQ=
 github.com/google/trillian v1.3.14-0.20210511103300-67b5f349eefa/go.mod h1:s4jO3Ai4NSvxucdvqUHON0bCqJyoya32eNw6XJwsmNc=
@@ -407,10 +458,16 @@ github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/wire v0.3.0/go.mod h1:i1DMg/Lu8Sz5yYl25iOdmc5CT5qusaa+zmRWs16741s=
+github.com/googleapis/enterprise-certificate-proxy v0.3.5 h1:VgzTY2jogw3xt39CusEnFJWm7rlsq5yL5q9XdLOuP5g=
+github.com/googleapis/enterprise-certificate-proxy v0.3.5/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
 github.com/googleapis/gax-go v2.0.2+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
+github.com/googleapis/gax-go/v2 v2.14.1 h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrkurSS/Q=
+github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEPqouaLeN2IUxoA=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gopherjs/gopherjs v1.17.2 h1:fQnZVsXk8uxXIStYb0N4bGk7jeyTalG/wsZjQ25dO0g=
+github.com/gopherjs/gopherjs v1.17.2/go.mod h1:pRRIvn/QzFLrKfvEz3qUuEhtE/zLCWfreZ6J5gM2i+k=
 github.com/gordonklaus/ineffassign v0.0.0-20200309095847-7953dde2c7bf/go.mod h1:cuNKsD1zp2v6XfE/orVX2QE1LC+i254ceGcVeDT3pTU=
 github.com/goreleaser/goreleaser v0.134.0/go.mod h1:ZT6Y2rSYa6NxQzIsdfWWNWAlYGXGbreo66NmE+3X3WQ=
 github.com/goreleaser/nfpm v1.2.1/go.mod h1:TtWrABZozuLOttX2uDlYyECfQX7x5XYkVxhjYcR6G9w=
@@ -458,6 +515,8 @@ github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO
 github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
 github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
 github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
+github.com/hokaccha/go-prettyjson v0.0.0-20211117102719-0474bc63780f h1:7LYC+Yfkj3CTRcShK0KOL/w6iTiKyqqBA9a41Wnggw8=
+github.com/hokaccha/go-prettyjson v0.0.0-20211117102719-0474bc63780f/go.mod h1:pFlLw2CfqZiIBOx6BuCeRLCrfxBJipTY0nIOF/VbGcI=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/huandu/xstrings v1.0.0/go.mod h1:4qWG/gcEcfX4z/mBDHJ++3ReCw9ibxbsNJbcucJdbSo=
 github.com/huandu/xstrings v1.2.0/go.mod h1:DvyZB1rfVYsBIigL8HwpZgxHwXozlTgGqn63UyNX5k4=
@@ -494,6 +553,7 @@ github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/
 github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
+github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/juju/ratelimit v1.0.1/go.mod h1:qapgC/Gy+xNh9UxzV13HGGl/6UXNN+ct+vwSgWNm/qk=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
@@ -503,8 +563,8 @@ github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvW
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.17.9 h1:6KIumPrER1LHsvBVuDa0r5xaG0Es51mhhB9BQB2qeMA=
-github.com/klauspost/compress v1.17.9/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
+github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
+github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
@@ -627,6 +687,8 @@ github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FI
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pelletier/go-buffruneio v0.2.0/go.mod h1:JkE26KsDizTr40EUHkXVtNPvgGtbSNq5BcowyYOWdKo=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
+github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
+github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/performancecopilot/speed v3.0.0+incompatible/go.mod h1:/CLtqpZ5gBg1M9iaPbIdPPGyKcA8hKdoy6hAWba7Yac=
 github.com/pierrec/lz4 v1.0.2-0.20190131084431-473cd7ce01a1/go.mod h1:3/3N9NVKO0jef7pBehbT1qWhCMrIgbYNnFAZCqQ5LRc=
 github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
@@ -635,6 +697,8 @@ github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/profile v1.2.1/go.mod h1:hJw3o1OdXxsrSjjVksARp5W95eeEaEfptyVZyv6JUPA=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
 github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
@@ -649,8 +713,8 @@ github.com/prometheus/client_golang v1.5.1/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3O
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
 github.com/prometheus/client_golang v1.10.0/go.mod h1:WJM3cc3yu7XKBKa/I8WeZm+V3eltZnBwfENSU7mdogU=
 github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
-github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
-github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
+github.com/prometheus/client_golang v1.21.1 h1:DOvXXTqVzvkIewV/CDPFdejpMCGeMcbGCQ8YOmu+Ibk=
+github.com/prometheus/client_golang v1.21.1/go.mod h1:U9NM32ykUErtVBxdvD3zfi+EuFkkaBvMb09mIfe0Zgg=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190115171406-56726106282f/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@@ -668,8 +732,8 @@ github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8b
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
 github.com/prometheus/common v0.18.0/go.mod h1:U+gB1OBLb1lF3O42bTCL+FK18tX9Oar16Clt/msog/s=
 github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
-github.com/prometheus/common v0.59.1 h1:LXb1quJHWm1P6wq/U824uxYi4Sg0oGvNeUm1z5dJoX0=
-github.com/prometheus/common v0.59.1/go.mod h1:GpWM7dewqmVYcd7SmRaiWVe9SSqjf0UrwnYnpEZNuT0=
+github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
+github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190117184657-bf6a532e95b1/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
@@ -712,10 +776,14 @@ github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrf
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/smarty/assertions v1.15.0 h1:cR//PqUBUiQRakZWqBiFFQ9wb8emQGDb0HeGdqGByCY=
+github.com/smarty/assertions v1.15.0/go.mod h1:yABtdzeQs6l1brC900WlRNwj6ZR55d7B+E8C6HtKdec=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
 github.com/smartystreets/go-aws-auth v0.0.0-20180515143844-0c1422d1fdb9/go.mod h1:SnhjPscd9TpLiy1LpzGSKh3bXCfxxXuqd9xmQJy3slM=
 github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
+github.com/smartystreets/goconvey v1.8.1 h1:qGjIddxOk4grTu9JPOU31tVfq3cNdBlNa5sSznIX1xY=
+github.com/smartystreets/goconvey v1.8.1/go.mod h1:+/u4qLyY6x1jReYOp7GOM2FSt8aP9CzCZL03bI28W60=
 github.com/smartystreets/gunit v1.0.0/go.mod h1:qwPWnhz6pn0NnRBP++URONOVyNkPyr4SauJk4cUOwJs=
 github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
 github.com/soheilhy/cmux v0.1.5-0.20210205191134-5ec6847320e5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
@@ -826,42 +894,48 @@ go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
 go.opentelemetry.io/contrib v0.20.0/go.mod h1:G/EtFaa6qaN7+LxqfIAT3GiZa7Wv5DTBUzl5H4LY0Kc=
+go.opentelemetry.io/contrib/detectors/gcp v1.34.0 h1:JRxssobiPg23otYU5SbWtQC//snGVIM3Tx6QRzlQBao=
+go.opentelemetry.io/contrib/detectors/gcp v1.34.0/go.mod h1:cV4BMFcscUR/ckqLkbfQmF0PRsq8w/lMGzdbCSveBHo=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.20.0/go.mod h1:oVGt1LRbBOBq1A5BQLlUg9UaU/54aiHw8cgjV3aWZ/E=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.59.0 h1:rgMkmiGfix9vFJDcDi1PK8WEQP4FLQwLDfhp5ZLpFeE=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.59.0/go.mod h1:ijPqXp5P6IRRByFVVg9DY8P5HkxkHE5ARIa+86aXPf4=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.57.0 h1:DheMAlT6POBP+gh8RUH19EOTnQIor5QE0uSRPtzCpSw=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.57.0/go.mod h1:wZcGmeVO9nzP67aYSLDqXNWK87EZWhi7JWj1v7ZXf94=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 h1:x7wzEgXfnzJcHDwStJT+mxOz4etr2EcexjqhBvmoakw=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0/go.mod h1:rg+RlpR5dKwaS95IyyZqj5Wd4E13lk/msnTS0Xl9lJM=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
 go.opentelemetry.io/otel v0.20.0/go.mod h1:Y3ugLH2oa81t5QO+Lty+zXf8zC9L26ax4Nzoxm/dooo=
-go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY=
-go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI=
+go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
+go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
 go.opentelemetry.io/otel/exporters/otlp v0.20.0/go.mod h1:YIieizyaN77rtLJra0buKiNBOm9XQfkPEKBeuhoMwAM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.32.0 h1:IJFEoHiytixx8cMiVAO+GmHR6Frwu+u5Ur8njpFO6Ac=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.32.0/go.mod h1:3rHrKNtLIoS0oZwkY2vxi+oJcwFRWdtUyRII+so45p8=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.32.0 h1:cMyu9O88joYEaI47CnQkxO1XZdpoTF9fEnW2duIddhw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.32.0/go.mod h1:6Am3rn7P9TVVeXYG+wtcGE7IE1tsQ+bP3AuWcKt/gOI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 h1:OeNbIYk/2C15ckl7glBlOBp5+WlYsOElzTNmiPW/x60=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0/go.mod h1:7Bept48yIeqxP2OZ9/AqIpYS94h2or0aB4FypJTc8ZM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.34.0 h1:BEj3SPM81McUZHYjRS5pEgNgnmzGJ5tRpU5krWnV8Bs=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.34.0/go.mod h1:9cKLGBDzI/F3NoHLQGm4ZrYdIHsvGt6ej6hUowxY0J4=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.29.0 h1:WDdP9acbMYjbKIyJUhTvtzj601sVJOqgWdUxSdR/Ysc=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.29.0/go.mod h1:BLbf7zbNIONBLPwvFnwNHGj4zge8uTCM/UPIVW1Mq2I=
 go.opentelemetry.io/otel/metric v0.20.0/go.mod h1:598I5tYlH1vzBjn+BTuhzTCSb/9debfNp6R3s7Pr1eU=
-go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ=
-go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE=
+go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
+go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
 go.opentelemetry.io/otel/oteltest v0.20.0/go.mod h1:L7bgKf9ZB7qCwT9Up7i9/pn0PWIa9FqQ2IQ8LoxiGnw=
 go.opentelemetry.io/otel/sdk v0.20.0/go.mod h1:g/IcepuwNsoiX5Byy2nNV0ySUF1em498m7hBWC279Yc=
-go.opentelemetry.io/otel/sdk v1.32.0 h1:RNxepc9vK59A8XsgZQouW8ue8Gkb4jpWtJm9ge5lEG4=
-go.opentelemetry.io/otel/sdk v1.32.0/go.mod h1:LqgegDBjKMmb2GC6/PrTnteJG39I8/vJCAP9LlJXEjU=
+go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
+go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
 go.opentelemetry.io/otel/sdk/export/metric v0.20.0/go.mod h1:h7RBNMsDJ5pmI1zExLi+bJK+Dr8NQCh0qGhm1KDnNlE=
 go.opentelemetry.io/otel/sdk/metric v0.20.0/go.mod h1:knxiS8Xd4E/N+ZqKmUPf3gTTZ4/0TjTXukfxjzSTpHE=
-go.opentelemetry.io/otel/sdk/metric v1.32.0 h1:rZvFnvmvawYb0alrYkjraqJq0Z4ZUJAiyYCU9snn1CU=
-go.opentelemetry.io/otel/sdk/metric v1.32.0/go.mod h1:PWeZlq0zt9YkYAp3gjKZ0eicRYvOh1Gd+X99x6GHpCQ=
+go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
+go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
 go.opentelemetry.io/otel/trace v0.20.0/go.mod h1:6GjCW8zgDjwGHGa6GkyeB8+/5vjT16gUEi0Nf1iBdgw=
-go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k=
-go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE=
+go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
+go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
-go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
+go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
+go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
 go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
 go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
@@ -891,6 +965,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs=
 golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ=
+golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
+golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -981,8 +1057,8 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
-golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
+golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8=
+golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1002,6 +1078,8 @@ golang.org/x/oauth2 v0.0.0-20210427180440-81ed05c6b58c/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc=
+golang.org/x/oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1014,8 +1092,8 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
-golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
+golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1093,9 +1171,12 @@ golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
 golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
 golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
+golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
+golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1106,14 +1187,16 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
 golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
-golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.10.0 h1:3usCWA8tQn0L8+hFJQNgzpWbd89begxN66o1Ojdn5L4=
+golang.org/x/time v0.10.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -1222,6 +1305,8 @@ google.golang.org/api v0.48.0/go.mod h1:71Pr1vy+TAZRPkPs/xlCf5SsU8WjuAWv1Pfjbtuk
 google.golang.org/api v0.50.0/go.mod h1:4bNT5pAuq5ji4SRZm+5QIkjny9JAyVD/3gaSihNefaw=
 google.golang.org/api v0.51.0/go.mod h1:t4HdrdoNgyN5cbEfm7Lum0lcLDLiise1F8qDKX00sOU=
 google.golang.org/api v0.54.0/go.mod h1:7C4bFFOvVDGXjfDTAsgGwDgAxRDeQ4X8NvUedIt6z3k=
+google.golang.org/api v0.224.0 h1:Ir4UPtDsNiwIOHdExr3fAj4xZ42QjK7uQte3lORLJwU=
+google.golang.org/api v0.224.0/go.mod h1:3V39my2xAGkodXy0vEqcEtkqgw2GtrFL5WuBZlCTCOQ=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.2.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -1297,8 +1382,17 @@ google.golang.org/genproto v0.0.0-20210813162853-db860fec028c/go.mod h1:cFeNkxwy
 google.golang.org/genproto v0.0.0-20210821163610-241b8fcbd6c8/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
 google.golang.org/genproto/googleapis/api v0.0.0-20250204164813-702378808489 h1:fCuMM4fowGzigT89NCIsW57Pk9k2D12MMi2ODn+Nk+o=
 google.golang.org/genproto/googleapis/api v0.0.0-20250204164813-702378808489/go.mod h1:iYONQfRdizDB8JJBybql13nArx91jcUk7zCXEsOofM4=
+google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:jbe3Bkdp+Dh2IrslsFCklNhweNTBgSYanP1UXhJDhKg=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250207221924-e9438ea467c6 h1:2duwAxN2+k0xLNpjnHTXoMUgnv6VPSp5fiqTuwSxjmI=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250207221924-e9438ea467c6/go.mod h1:8BS3B93F/U1juMFq9+EDk+qOT5CO1R9IzXxG3PTqiRk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a h1:51aaUVRocpvUOSQKM6Q7VuoaktNIaMCLuhZB6DKksq4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a/go.mod h1:uRxBH1mhmO8PGhU89cMcHaXKZqO+OfakD8QQO0oYwlQ=
+google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb h1:ITgPrl429bc6+2ZraNSzMDk3I95nmQln2fuPstKwFDE=
+google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:sAo5UzpjUwgFBCzupwhcLcxHVDK7vG5IqI30YnwX2eE=
+google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb h1:p31xT4yrYrSM/G4Sn2+TNUkVhFCbG9y8itM2S6Th950=
+google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:jbe3Bkdp+Dh2IrslsFCklNhweNTBgSYanP1UXhJDhKg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb h1:TLPQVbx1GJ8VKZxz52VAxl1EBgKXXbTiU9Fc5fZeLn4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:LuRYeWDFV6WOn90g357N17oMCaxpgCnbi/44qJvDn2I=
 google.golang.org/grpc v1.8.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -1331,8 +1425,10 @@ google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQ
 google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.70.0 h1:pWFv03aZoHzlRKHWicjsZytKAiYCtNS0dHbXnIdq7jQ=
-google.golang.org/grpc v1.70.0/go.mod h1:ofIJqVKDXx/JiXrwr2IG4/zwdH9txy3IlF40RmcJSQw=
+google.golang.org/grpc v1.71.0 h1:kF77BGdPTQ4/JZWMlb9VpJ5pa25aqvVqogsxNHHdeBg=
+google.golang.org/grpc v1.71.0/go.mod h1:H0GRtasmQOh9LkFoCPDu3ZrwUtD1YGE+b2vYBYd/8Ec=
+google.golang.org/grpc v1.71.1 h1:ffsFWr7ygTUscGPI0KKK6TLrGz0476KUvvsbqWK0rPI=
+google.golang.org/grpc v1.71.1/go.mod h1:H0GRtasmQOh9LkFoCPDu3ZrwUtD1YGE+b2vYBYd/8Ec=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -1348,8 +1444,8 @@ google.golang.org/protobuf v1.25.1-0.20200805231151-a709e31e5d12/go.mod h1:9JNX7
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
-google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -1379,6 +1475,7 @@ gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -1394,6 +1491,8 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+moul.io/http2curl v1.0.0 h1:6XwpyZOYsgZJrU8exnG87ncVkU1FVCcTRpwzOkTDUi8=
+moul.io/http2curl v1.0.0/go.mod h1:f6cULg+e4Md/oW1cYmwW4IWQOVl2lGbmCNGOHvzX2kE=
 pack.ag/amqp v0.11.2/go.mod h1:4/cbmt4EJXSKlG6LCfWHoqmN0uFdy5i/+YFz+fTfhV4=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=

hal/cloud/config.yaml

@@ -11,14 +11,16 @@ users:
       - docker # Add cocos user to the docker group
     sudo:
       - ALL=(ALL:ALL) ALL
+    shell: /sbin/nologin
+  - name: algo_user
+    gecos: Algorithm User
+    groups:
+      - docker # Add to docker group for container execution
     shell: /bin/bash
-
-chpasswd:
-  list: |
-    cocos_user:password
-  expire: False
-
-ssh_pwauth: True
+    sudo:
+      - /usr/bin/python3 # Allow running Python
+      - /home/algo_user/.wasmtime/bin/wasmtime # Allow running Wasmtime
+      - /usr/bin/docker # Allow running Docker commands
 
 packages:
   - curl
@@ -27,6 +29,8 @@ packages:
   - python3
   - python3-dev
   - net-tools # Add net-tools to install the 'route' command
+  - iptables-persistent # Add iptables-persistent to save firewall rules
+  - sudo # Ensure sudo is installed
 
 write_files:
   - path: /etc/cocos/certs/cert.pem
@@ -134,6 +138,102 @@ write_files:
       exec /bin/cocos-agent
     permissions: "0755"
 
+  # Firewall configuration script
+  - path: /cocos_init/setup_firewall.sh
+    content: |
+      #!/bin/bash
+      
+      # Flush existing rules
+      iptables -F
+      iptables -X
+      iptables -t nat -F
+      iptables -t nat -X
+      iptables -t mangle -F
+      iptables -t mangle -X
+      
+      # Set default policies to DROP
+      iptables -P INPUT DROP
+      iptables -P FORWARD DROP
+      iptables -P OUTPUT ACCEPT
+      
+      # Allow loopback interface
+      iptables -A INPUT -i lo -j ACCEPT
+      iptables -A OUTPUT -o lo -j ACCEPT
+      
+      # Allow established and related connections
+      iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+      
+      # Allow port 7002 (TCP) for incoming connections
+      iptables -A INPUT -p tcp --dport 7002 -j ACCEPT
+      
+      # Save rules to persist after reboot
+      mkdir -p /etc/iptables
+      iptables-save > /etc/iptables/rules.v4
+      
+      echo "Firewall configured to allow only port 7002"
+    permissions: "0755"
+
+  # Setup script for algo_user
+  - path: /cocos_init/setup_algo_user.sh
+    content: |
+      #!/bin/bash
+      
+      # Create datasets directory with the right permissions
+      mkdir -p /datasets
+      chown root:root /datasets
+      chmod 755 /datasets
+      
+      # Create a home directory for algo_user
+      mkdir -p /home/algo_user
+      chown algo_user:algo_user /home/algo_user
+      chmod 750 /home/algo_user
+      
+      # Set up Wasmtime for algo_user
+      mkdir -p /home/algo_user/.wasmtime/bin
+      
+      # Link system Wasmtime to user's directory
+      ln -s /root/.wasmtime/bin/wasmtime /home/algo_user/.wasmtime/bin/wasmtime
+      chown -R algo_user:algo_user /home/algo_user/.wasmtime
+      
+      # Configure sudoers for algo_user
+      cat > /etc/sudoers.d/algo_user << EOF
+      algo_user ALL=(ALL) NOPASSWD: /usr/bin/python3
+      algo_user ALL=(ALL) NOPASSWD: /home/algo_user/.wasmtime/bin/wasmtime
+      algo_user ALL=(ALL) NOPASSWD: /usr/bin/docker
+      Defaults:algo_user !requiretty
+      EOF
+      
+      chmod 440 /etc/sudoers.d/algo_user
+      
+      # Create a .bashrc file that restricts navigation to /datasets
+      cat > /home/algo_user/.bashrc << EOF
+      # .bashrc for algo_user
+      
+      # Restrict navigation outside /datasets
+      function cd() {
+          if [[ "\$1" == /* && "\$1" != "/datasets"* && "\$1" != "/home/algo_user"* ]]; then
+              echo "Access denied: You can only access files in /datasets or your home directory"
+              return 1
+          else
+              builtin cd "\$1"
+          fi
+      }
+      
+      # Set PATH to include necessary binaries
+      export PATH=/usr/bin:/bin:/usr/local/bin:/home/algo_user/.wasmtime/bin
+      
+      # Set default directory
+      if [[ \$PWD != "/datasets"* && \$PWD != "/home/algo_user"* ]]; then
+          cd /datasets
+      fi
+      EOF
+      
+      chown algo_user:algo_user /home/algo_user/.bashrc
+      chmod 644 /home/algo_user/.bashrc
+      
+      echo "algo_user setup completed successfully"
+    permissions: "0755"
+
 runcmd:
   # Create necessary directories
   - mkdir -p /cocos
@@ -163,6 +263,41 @@ runcmd:
   - sh ./get-docker.sh && echo "Docker installed successfully" || echo "Failed to install Docker"
   - usermod -aG docker cocos_user && echo "Added cocos_user to the docker group" || echo "Failed to add cocos_user to the docker group"
 
+  # Disable SSH service
+  - echo "Disabling SSH service..."
+  - systemctl disable ssh.service && echo "SSH service disabled successfully" || echo "Failed to disable SSH service"
+  - systemctl disable sshd.service && echo "SSHD service disabled successfully" || echo "Failed to disable SSHD service"
+  - systemctl stop ssh.service && echo "SSH service stopped successfully" || echo "Failed to stop SSH service"
+  - systemctl stop sshd.service && echo "SSHD service stopped successfully" || echo "Failed to stop SSHD service"
+
+  # Completely remove SSH server
+  - echo "Removing SSH server..."
+  - apt-get purge -y openssh-server && echo "SSH server removed successfully" || echo "Failed to remove SSH server"
+  - apt-get autoremove -y && echo "Removed dependencies successfully" || echo "Failed to remove dependencies"
+
+  # Set up firewall to only allow port 7002
+  - echo "Setting up firewall..."
+  - bash /cocos_init/setup_firewall.sh && echo "Firewall configured successfully" || echo "Failed to configure firewall"
+  
+  # Ensure iptables rules persist after reboot
+  - echo "Ensuring iptables rules persist after reboot..."
+  - systemctl enable netfilter-persistent && echo "netfilter-persistent service enabled successfully" || echo "Failed to enable netfilter-persistent service"
+  - systemctl start netfilter-persistent && echo "netfilter-persistent service started successfully" || echo "Failed to start netfilter-persistent service"
+
+  # Set up algo_user environment
+  - echo "Setting up algo_user environment..."
+  - bash /cocos_init/setup_algo_user.sh && echo "algo_user environment setup successfully" || echo "Failed to set up algo_user environment"
+  
+  # Create datasets directory and set permissions
+  - echo "Creating datasets directory..."
+  - mkdir -p /datasets && echo "datasets directory created successfully" || echo "Failed to create datasets directory"
+  - chown root:root /datasets && echo "datasets ownership set successfully" || echo "Failed to set datasets ownership"
+  - chmod 755 /datasets && echo "datasets permissions set successfully" || echo "Failed to set datasets permissions"
+  
+  # Add algo_user to the docker group
+  - echo "Adding algo_user to the docker group..."
+  - usermod -aG docker algo_user && echo "Added algo_user to the docker group" || echo "Failed to add algo_user to the docker group"
+
   # Reload systemd and enable the service
   - echo "[ COCOS AGENT SETUP ] Reloading systemd daemon..."
   - systemctl daemon-reload && echo "[ COCOS AGENT SETUP ] Systemd daemon reloaded successfully" || echo "[ COCOS AGENT SETUP ] Failed to reload systemd daemon"
@@ -171,4 +306,4 @@ runcmd:
   - echo "[ COCOS AGENT SETUP ] Starting cocos-agent.service..."
   - systemctl start cocos-agent.service && echo "[ COCOS AGENT SETUP ] cocos-agent.service started successfully" || echo "[ COCOS AGENT SETUP ] Failed to start cocos-agent.service"
 
-final_message: "Cocos agent setup complete. Verify logs to confirm successful service startup."
+final_message: "Cocos agent and algo_user setup complete. Verify logs to confirm successful service startup."

internal/server/grpc/grpc.go

@@ -4,6 +4,7 @@
 package grpc
 
 import (
+	"bytes"
 	"context"
 	"crypto/ecdsa"
 	"crypto/elliptic"
@@ -11,15 +12,23 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
+	"encoding/json"
 	"encoding/pem"
 	"fmt"
+	"io"
 	"log/slog"
 	"math/big"
 	"net"
+	"net/http"
+	"net/url"
 	"os"
 	"strings"
 	"time"
 
+	certs "github.com/absmach/certs"
+	certscli "github.com/absmach/certs/cli"
+	"github.com/absmach/certs/errors"
+	certssdk "github.com/absmach/certs/sdk"
 	"github.com/google/go-sev-guest/client"
 	agentgrpc "github.com/ultravioletrs/cocos/agent/api/grpc"
 	"github.com/ultravioletrs/cocos/agent/auth"
@@ -55,13 +64,19 @@ type Server struct {
 	quoteProvider   client.LeveledQuoteProvider
 	authSvc         auth.Authenticator
 	health          *health.Server
+	caUrl           string
+	cvmId           string
+}
+
+type csrReq struct {
+	CSR string `json:"csr,omitempty"`
 }
 
 type serviceRegister func(srv *grpc.Server)
 
 var _ server.Server = (*Server)(nil)
 
-func New(ctx context.Context, cancel context.CancelFunc, name string, config server.ServerConfiguration, registerService serviceRegister, logger *slog.Logger, qp client.LeveledQuoteProvider, authSvc auth.Authenticator) server.Server {
+func New(ctx context.Context, cancel context.CancelFunc, name string, config server.ServerConfiguration, registerService serviceRegister, logger *slog.Logger, qp client.LeveledQuoteProvider, authSvc auth.Authenticator, caUrl string, cvmId string) server.Server {
 	base := config.GetBaseConfig()
 	listenFullAddress := fmt.Sprintf("%s:%s", base.Host, base.Port)
 	return &Server{
@@ -76,6 +91,8 @@ func New(ctx context.Context, cancel context.CancelFunc, name string, config ser
 		registerService: registerService,
 		quoteProvider:   qp,
 		authSvc:         authSvc,
+		caUrl:           caUrl,
+		cvmId:           cvmId,
 	}
 }
 
@@ -95,7 +112,7 @@ func (s *Server) Start() error {
 	var listener net.Listener
 
 	if agCfg, ok := s.Config.(server.AgentConfig); ok && agCfg.AttestedTLS {
-		certificateBytes, privateKeyBytes, err := generateCertificatesForATLS()
+		certificateBytes, privateKeyBytes, err := generateCertificatesForATLS(s.caUrl, s.cvmId)
 		if err != nil {
 			return fmt.Errorf("failed to create certificate: %w", err)
 		}
@@ -258,33 +275,99 @@ func loadX509KeyPair(certfile, keyfile string) (tls.Certificate, error) {
 	return tls.X509KeyPair(cert, key)
 }
 
-func generateCertificatesForATLS() ([]byte, []byte, error) {
+func generateCertificatesForATLS(caUrl string, cvmId string) ([]byte, []byte, error) {
 	curve := elliptic.P256()
+
 	privateKey, err := ecdsa.GenerateKey(curve, rand.Reader)
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to generate private/public key: %w", err)
 	}
 
-	certTemplate := &x509.Certificate{
-		SerialNumber: big.NewInt(202403311),
-		Subject: pkix.Name{
+	var certDERBytes []byte
+
+	if caUrl == "" || cvmId == "" {
+		certTemplate := &x509.Certificate{
+			SerialNumber: big.NewInt(202403311),
+			Subject: pkix.Name{
+				Organization:  []string{organization},
+				Country:       []string{country},
+				Province:      []string{province},
+				Locality:      []string{locality},
+				StreetAddress: []string{streetAddress},
+				PostalCode:    []string{postalCode},
+			},
+			NotBefore:             time.Now(),
+			NotAfter:              time.Now().AddDate(notAfterYear, notAfterMonth, notAfterDay),
+			KeyUsage:              x509.KeyUsageDigitalSignature,
+			ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+			BasicConstraintsValid: true,
+		}
+
+		DERBytes, err := x509.CreateCertificate(rand.Reader, certTemplate, certTemplate, &privateKey.PublicKey, privateKey)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to create certificate: %w", err)
+		}
+
+		certDERBytes = DERBytes
+	} else {
+		csrmd := certs.CSRMetadata{
 			Organization:  []string{organization},
 			Country:       []string{country},
 			Province:      []string{province},
 			Locality:      []string{locality},
 			StreetAddress: []string{streetAddress},
 			PostalCode:    []string{postalCode},
-		},
-		NotBefore:             time.Now(),
-		NotAfter:              time.Now().AddDate(notAfterYear, notAfterMonth, notAfterDay),
-		KeyUsage:              x509.KeyUsageDigitalSignature,
-		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
-		BasicConstraintsValid: true,
-	}
+		}
 
-	certDERBytes, err := x509.CreateCertificate(rand.Reader, certTemplate, certTemplate, &privateKey.PublicKey, privateKey)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed to create certificate: %w", err)
+		csr, err := certscli.CreateCSR(csrmd, privateKey)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to create CSR: %w", err)
+		}
+
+		csrData := string(csr.CSR)
+
+		r := csrReq{
+			CSR: csrData,
+		}
+
+		data, error := json.Marshal(r)
+		if error != nil {
+			return nil, nil, errors.NewSDKError(error)
+		}
+
+		notBefore := time.Now()
+		notAfter := time.Now().AddDate(notAfterYear, notAfterMonth, notAfterDay)
+		ttlString := notAfter.Sub(notBefore).String()
+
+		query := url.Values{}
+		query.Add("ttl", ttlString)
+		query_string := query.Encode()
+
+		certsEndpoint := "certs"
+		csrEndpoint := "csrs"
+		endpoint := fmt.Sprintf("%s/%s/%s", certsEndpoint, csrEndpoint, cvmId)
+
+		url := fmt.Sprintf("%s/%s?%s", caUrl, endpoint, query_string)
+
+		_, body, sdkerr := processRequest(http.MethodPost, url, data, nil, http.StatusOK)
+		if sdkerr != nil {
+			return nil, nil, errors.NewSDKError(sdkerr)
+		}
+
+		var cert certssdk.Certificate
+		if err := json.Unmarshal(body, &cert); err != nil {
+			return nil, nil, errors.NewSDKError(err)
+		}
+
+		cleanCertificateString := strings.ReplaceAll(cert.Certificate, "\\n", "\n")
+
+		block, rest := pem.Decode([]byte(cleanCertificateString))
+
+		if len(rest) != 0 {
+			return nil, nil, fmt.Errorf("failed to convert generated certificate to DER format: %s", cleanCertificateString)
+		}
+
+		certDERBytes = block.Bytes
 	}
 
 	certBytes := pem.EncodeToMemory(&pem.Block{
@@ -318,3 +401,41 @@ func generateCertificatesForATLS() ([]byte, []byte, error) {
 
 	return certBytes, keyBytes, nil
 }
+
+func processRequest(method, reqUrl string, data []byte, headers map[string]string, expectedRespCodes ...int) (http.Header, []byte, errors.SDKError) {
+	req, err := http.NewRequest(method, reqUrl, bytes.NewReader(data))
+	if err != nil {
+		return make(http.Header), []byte{}, errors.NewSDKError(err)
+	}
+
+	// Sets a default value for the Content-Type.
+	// Overridden if Content-Type is passed in the headers arguments.
+	req.Header.Add("Content-Type", "application/json")
+
+	for key, value := range headers {
+		req.Header.Add(key, value)
+	}
+
+	client := &http.Client{
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				InsecureSkipVerify: true,
+			},
+		},
+	}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return make(http.Header), []byte{}, errors.NewSDKError(err)
+	}
+	defer resp.Body.Close()
+	sdkerr := errors.CheckError(resp, expectedRespCodes...)
+	if sdkerr != nil {
+		return make(http.Header), []byte{}, sdkerr
+	}
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return make(http.Header), []byte{}, errors.NewSDKError(err)
+	}
+	return resp.Header, body, nil
+}

internal/server/grpc/grpc_test.go

@@ -73,7 +73,7 @@ func TestNew(t *testing.T) {
 	qp := new(mocks.LeveledQuoteProvider)
 	authSvc := new(authmocks.Authenticator)
 
-	srv := New(ctx, cancel, "TestServer", config, func(srv *grpc.Server) {}, logger, qp, authSvc)
+	srv := New(ctx, cancel, "TestServer", config, func(srv *grpc.Server) {}, logger, qp, authSvc, "", "")
 
 	assert.NotNil(t, srv)
 	assert.IsType(t, &Server{}, srv)
@@ -123,7 +123,7 @@ func TestServerStartWithTLSFile(t *testing.T) {
 	qp := new(mocks.LeveledQuoteProvider)
 	authSvc := new(authmocks.Authenticator)
 
-	srv := New(ctx, cancel, "TestServer", config, func(srv *grpc.Server) {}, logger, qp, authSvc)
+	srv := New(ctx, cancel, "TestServer", config, func(srv *grpc.Server) {}, logger, qp, authSvc, "", "")
 
 	var wg sync.WaitGroup
 	wg.Add(1)
@@ -170,7 +170,7 @@ func TestServerStartWithmTLSFile(t *testing.T) {
 	qp := new(mocks.LeveledQuoteProvider)
 	authSvc := new(authmocks.Authenticator)
 
-	srv := New(ctx, cancel, "TestServer", config, func(srv *grpc.Server) {}, logger, qp, authSvc)
+	srv := New(ctx, cancel, "TestServer", config, func(srv *grpc.Server) {}, logger, qp, authSvc, "", "")
 
 	var wg sync.WaitGroup
 	wg.Add(1)
@@ -210,7 +210,7 @@ func TestServerStop(t *testing.T) {
 	qp := new(mocks.LeveledQuoteProvider)
 	authSvc := new(authmocks.Authenticator)
 
-	srv := New(ctx, cancel, "TestServer", config, func(srv *grpc.Server) {}, logger, qp, authSvc)
+	srv := New(ctx, cancel, "TestServer", config, func(srv *grpc.Server) {}, logger, qp, authSvc, "", "")
 
 	go func() {
 		err := srv.Start()
@@ -402,7 +402,7 @@ func TestServerInitializationAndStartup(t *testing.T) {
 			qp := new(mocks.LeveledQuoteProvider)
 			authSvc := new(authmocks.Authenticator)
 
-			srv := New(ctx, cancel, "TestServer", tc.config, func(srv *grpc.Server) {}, logger, qp, authSvc)
+			srv := New(ctx, cancel, "TestServer", tc.config, func(srv *grpc.Server) {}, logger, qp, authSvc, "", "")
 			var wg sync.WaitGroup
 			wg.Add(1)
 

internal/server/mocks/server.go

@@ -1,7 +1,7 @@
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
 
-// Code generated by mockery v2.43.2. DO NOT EDIT.
+// Code generated by mockery v2.53.3. DO NOT EDIT.
 
 package mocks
 
@@ -20,7 +20,7 @@ func (_m *Server) EXPECT() *Server_Expecter {
 	return &Server_Expecter{mock: &_m.Mock}
 }
 
-// Start provides a mock function with given fields:
+// Start provides a mock function with no fields
 func (_m *Server) Start() error {
 	ret := _m.Called()
 
@@ -65,7 +65,7 @@ func (_c *Server_Start_Call) RunAndReturn(run func() error) *Server_Start_Call {
 	return _c
 }
 
-// Stop provides a mock function with given fields:
+// Stop provides a mock function with no fields
 func (_m *Server) Stop() error {
 	ret := _m.Called()
 

manager/README.md

@@ -6,64 +6,66 @@ Manager service provides a barebones gRPC API and Service interface implementati
 
 The service is configured using the environment variables from the following table. Note that any unset variables will be replaced with their default values.
 
-| Variable                                  | Description                                                                                                      | Default                      |
-| ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | ---------------------------- |
-| COCOS_JAEGER_URL                          | The URL for the Jaeger tracing endpoint.                                                                         | http://localhost:4318        |
-| COCOS_JAEGER_TRACE_RATIO                  | The ratio of traces to sample.                                                                                   | 1.0                          |
-| MANAGER_INSTANCE_ID                       | The instance ID for the manager service.                                                                         |                              |
-| MANAGER_ATTESTATION_POLICY_BINARY         | The file path for the attestation policy and igvmmeassure binaries.                                              | ../../build                  |
-| MANAGER_GRPC_CLIENT_CERT                  | The file path for the client certificate.                                                                        |                              |
-| MANAGER_GRPC_CLIENT_KEY                   | The file path for the client private key.                                                                        |                              |
-| MANAGER_GRPC_SERVER_CA_CERTS              | The file path for the server CA certificate(s).                                                                  |                              |
-| MANAGER_GRPC_URL                          | The URL for the gRPC endpoint.                                                                                   | localhost:7001               |
-| MANAGER_GRPC_TIMEOUT                      | The timeout for gRPC requests.                                                                                   | 60s                          |
-| MANAGER_EOS_VERSION                       | The EOS version used for booting SVMs.                                                                           |                              |
-| MANAGER_INSTANCE_ID                       | Manager service instance ID                                                                                      |                              |
-| MANAGER_QEMU_MEMORY_SIZE                  | The total memory size for the virtual machine. Can be specified in a human-readable format like "2048M" or "4G". | 2048M                        |
-| MANAGER_QEMU_MEMORY_SLOTS                 | The number of memory slots for the virtual machine.                                                              | 5                            |
-| MANAGER_QEMU_MAX_MEMORY                   | The maximum memory size for the virtual machine. Can be specified in a human-readable format like "30G".         | 30G                          |
-| MANAGER_QEMU_OVMF_CODE_IF                 | The interface type for the OVMF code.                                                                            | pflash                       |
-| MANAGER_QEMU_OVMF_CODE_FORMAT             | The format of the OVMF code file.                                                                                | raw                          |
-| MANAGER_QEMU_OVMF_CODE_UNIT               | The unit number for the OVMF code.                                                                               | 0                            |
-| MANAGER_QEMU_OVMF_CODE_FILE               | The file path for the OVMF code.                                                                                 | /usr/share/OVMF/OVMF_CODE.fd |
-| MANAGER_QEMU_OVMF_VERSION                 | The version number of EDKII from which OVMF was built                                                            | edk2-stable202408            |
-| MANAGER_QEMU_OVMF_CODE_READONLY           | Whether the OVMF code should be read-only.                                                                       | on                           |
-| MANAGER_QEMU_OVMF_VARS_IF                 | The interface type for the OVMF variables.                                                                       | pflash                       |
-| MANAGER_QEMU_OVMF_VARS_FORMAT             | The format of the OVMF variables file.                                                                           | raw                          |
-| MANAGER_QEMU_OVMF_VARS_UNIT               | The unit number for the OVMF variables.                                                                          | 1                            |
-| MANAGER_QEMU_OVMF_VARS_FILE               | The file path for the OVMF variables.                                                                            | /usr/share/OVMF/OVMF_VARS.fd |
-| MANAGER_QEMU_NETDEV_ID                    | The ID for the network device.                                                                                   | vmnic                        |
-| MANAGER_QEMU_HOST_FWD_AGENT               | The port number for the host forward agent.                                                                      | 7020                         |
-| MANAGER_QEMU_GUEST_FWD_AGENT              | The port number for the guest forward agent.                                                                     | 7002                         |
-| MANAGER_QEMU_VIRTIO_NET_PCI_DISABLE_LEGACY | Whether to disable the legacy PCI device.                                                                       | on                           |
-| MANAGER_QEMU_VIRTIO_NET_PCI_IOMMU_PLATFORM | Whether to enable the IOMMU platform for the virtio-net PCI device.                                             | true                         |
-| MANAGER_QEMU_VIRTIO_NET_PCI_ADDR           | The PCI address for the virtio-net PCI device.                                                                  | 0x2                          |
-| MANAGER_QEMU_VIRTIO_NET_PCI_ROMFILE        | The file path for the ROM image for the virtio-net PCI device.                                                  |                              |
-| MANAGER_QEMU_DISK_IMG_KERNEL_FILE          | The file path for the kernel image.                                                                             | img/bzImage                  |
-| MANAGER_QEMU_DISK_IMG_ROOTFS_FILE          | The file path for the root filesystem image.                                                                    | img/rootfs.cpio.gz           |
-| MANAGER_QEMU_SEV_ID                        | The ID for the Secure Encrypted Virtualization (SEV) device.                                                    | sev0                         |
-| MANAGER_QEMU_SEV_CBITPOS                   | The position of the C-bit in the physical address.                                                              | 51                           |
-| MANAGER_QEMU_SEV_REDUCED_PHYS_BITS         | The number of reduced physical address bits for SEV.                                                            | 1                            |
-| MANAGER_QEMU_ENABLE_HOST_DATA              | Enable additional data for the SEV host.                                                                        | false                        |
-| MANAGER_QEMU_HOST_DATA                     | Additional data for the SEV host.                                                                               |                              |
-| MANAGER_QEMU_IGVM_ID                       | The ID of the IGVM file.                                                                                        | igvm0                        |
-| MANAGER_QEMU_IGVM_FILE                     | The file path to the IGVM file.                                                                                 | /root/coconut-qemu.igvm      |
-| MANAGER_QEMU_VSOCK_ID                      | The ID for the virtual socket device.                                                                           | vhost-vsock-pci0             |
-| MANAGER_QEMU_VSOCK_GUEST_CID               | The guest-side CID (Context ID) for the virtual socket device.                                                  | 3                            |
-| MANAGER_QEMU_VSOCK_VNC                     | Whether to enable the virtual socket device for VNC.                                                            | 0                            |
-| MANAGER_QEMU_BIN_PATH                      | The file path for the QEMU binary.                                                                              | qemu-system-x86_64           |
-| MANAGER_QEMU_USE_SUDO                      | Whether to use sudo to run QEMU.                                                                                | false                        |
-| MANAGER_QEMU_ENABLE_SEV                    | Whether to enable Secure Encrypted Virtualization (SEV).                                                        | false                        |
-| MANAGER_QEMU_ENABLE_SEV_SNP                | Whether to enable Secure Nested Paging (SEV-SNP).                                                               | true                         |
-| MANAGER_QEMU_ENABLE_KVM                    | Whether to enable the Kernel-based Virtual Machine (KVM) acceleration.                                          | true                         |
-| MANAGER_QEMU_MACHINE                       | The machine type for QEMU.                                                                                      | q35                          |
-| MANAGER_QEMU_CPU                           | The CPU model for QEMU.                                                                                         | EPYC                         |
-| MANAGER_QEMU_SMP_COUNT                     | The number of virtual CPUs.                                                                                     | 4                            |
-| MANAGER_QEMU_SMP_MAXCPUS                   | The maximum number of virtual CPUs.                                                                             | 64                           |
-| MANAGER_QEMU_MEM_ID                        | The ID for the memory device.                                                                                   | ram1                         |
-| MANAGER_QEMU_NO_GRAPHIC                    | Whether to disable the graphical display.                                                                       | true                         |
-| MANAGER_QEMU_MONITOR                       | The type of monitor to use.                                                                                     | pty                          |
-| MANAGER_QEMU_HOST_FWD_RANGE                | The range of host ports to forward.                                                                             | 6100-6200                    |
+| Variable                                   | Description                                                                                                      | Default                        |
+| ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------- | ------------------------------ |
+| COCOS_JAEGER_URL                           | The URL for the Jaeger tracing endpoint.                                                                         | http://localhost:4318          |
+| COCOS_JAEGER_TRACE_RATIO                   | The ratio of traces to sample.                                                                                   | 1.0                            |
+| MANAGER_INSTANCE_ID                        | The instance ID for the manager service.                                                                         |                                |
+| MANAGER_ATTESTATION_POLICY_BINARY          | The file path for the attestation policy binarie.                                                                | ../../build/attestation_policy |
+| MANAGER_IGVMMEASURE_BINARY                 | The file path for the igvmmeasure binarie.                                                                       | ../../build/igvmmeasure        |
+| MANAGER_PCR_VALUES                         | The file path for the file with the expected PCR values.                                                         |                                |
+| MANAGER_GRPC_CLIENT_CERT                   | The file path for the client certificate.                                                                        |                                |
+| MANAGER_GRPC_CLIENT_KEY                    | The file path for the client private key.                                                                        |                                |
+| MANAGER_GRPC_SERVER_CA_CERTS               | The file path for the server CA certificate(s).                                                                  |                                |
+| MANAGER_GRPC_URL                           | The URL for the gRPC endpoint.                                                                                   | localhost:7001                 |
+| MANAGER_GRPC_TIMEOUT                       | The timeout for gRPC requests.                                                                                   | 60s                            |
+| MANAGER_EOS_VERSION                        | The EOS version used for booting CVMs.                                                                           |                                |
+| MANAGER_INSTANCE_ID                        | Manager service instance ID                                                                                      |                                |
+| MANAGER_QEMU_MEMORY_SIZE                   | The total memory size for the virtual machine. Can be specified in a human-readable format like "2048M" or "4G". | 2048M                          |
+| MANAGER_QEMU_MEMORY_SLOTS                  | The number of memory slots for the virtual machine.                                                              | 5                              |
+| MANAGER_QEMU_MAX_MEMORY                    | The maximum memory size for the virtual machine. Can be specified in a human-readable format like "30G".         | 30G                            |
+| MANAGER_QEMU_OVMF_CODE_IF                  | The interface type for the OVMF code.                                                                            | pflash                         |
+| MANAGER_QEMU_OVMF_CODE_FORMAT              | The format of the OVMF code file.                                                                                | raw                            |
+| MANAGER_QEMU_OVMF_CODE_UNIT                | The unit number for the OVMF code.                                                                               | 0                              |
+| MANAGER_QEMU_OVMF_CODE_FILE                | The file path for the OVMF code.                                                                                 | /usr/share/OVMF/OVMF_CODE.fd   |
+| MANAGER_QEMU_OVMF_VERSION                  | The version number of EDKII from which OVMF was built                                                            | edk2-stable202408              |
+| MANAGER_QEMU_OVMF_CODE_READONLY            | Whether the OVMF code should be read-only.                                                                       | on                             |
+| MANAGER_QEMU_OVMF_VARS_IF                  | The interface type for the OVMF variables.                                                                       | pflash                         |
+| MANAGER_QEMU_OVMF_VARS_FORMAT              | The format of the OVMF variables file.                                                                           | raw                            |
+| MANAGER_QEMU_OVMF_VARS_UNIT                | The unit number for the OVMF variables.                                                                          | 1                              |
+| MANAGER_QEMU_OVMF_VARS_FILE                | The file path for the OVMF variables.                                                                            | /usr/share/OVMF/OVMF_VARS.fd   |
+| MANAGER_QEMU_NETDEV_ID                     | The ID for the network device.                                                                                   | vmnic                          |
+| MANAGER_QEMU_HOST_FWD_AGENT                | The port number for the host forward agent.                                                                      | 7020                           |
+| MANAGER_QEMU_GUEST_FWD_AGENT               | The port number for the guest forward agent.                                                                     | 7002                           |
+| MANAGER_QEMU_VIRTIO_NET_PCI_DISABLE_LEGACY | Whether to disable the legacy PCI device.                                                                        | on                             |
+| MANAGER_QEMU_VIRTIO_NET_PCI_IOMMU_PLATFORM | Whether to enable the IOMMU platform for the virtio-net PCI device.                                              | true                           |
+| MANAGER_QEMU_VIRTIO_NET_PCI_ADDR           | The PCI address for the virtio-net PCI device.                                                                   | 0x2                            |
+| MANAGER_QEMU_VIRTIO_NET_PCI_ROMFILE        | The file path for the ROM image for the virtio-net PCI device.                                                   |                                |
+| MANAGER_QEMU_DISK_IMG_KERNEL_FILE          | The file path for the kernel image.                                                                              | img/bzImage                    |
+| MANAGER_QEMU_DISK_IMG_ROOTFS_FILE          | The file path for the root filesystem image.                                                                     | img/rootfs.cpio.gz             |
+| MANAGER_QEMU_SEV_ID                        | The ID for the Secure Encrypted Virtualization (SEV) device.                                                     | sev0                           |
+| MANAGER_QEMU_SEV_CBITPOS                   | The position of the C-bit in the physical address.                                                               | 51                             |
+| MANAGER_QEMU_SEV_REDUCED_PHYS_BITS         | The number of reduced physical address bits for SEV.                                                             | 1                              |
+| MANAGER_QEMU_ENABLE_HOST_DATA              | Enable additional data for the SEV host.                                                                         | false                          |
+| MANAGER_QEMU_HOST_DATA                     | Additional data for the SEV host.                                                                                |                                |
+| MANAGER_QEMU_IGVM_ID                       | The ID of the IGVM file.                                                                                         | igvm0                          |
+| MANAGER_QEMU_IGVM_FILE                     | The file path to the IGVM file.                                                                                  | /root/coconut-qemu.igvm        |
+| MANAGER_QEMU_VSOCK_ID                      | The ID for the virtual socket device.                                                                            | vhost-vsock-pci0               |
+| MANAGER_QEMU_VSOCK_GUEST_CID               | The guest-side CID (Context ID) for the virtual socket device.                                                   | 3                              |
+| MANAGER_QEMU_VSOCK_VNC                     | Whether to enable the virtual socket device for VNC.                                                             | 0                              |
+| MANAGER_QEMU_BIN_PATH                      | The file path for the QEMU binary.                                                                               | qemu-system-x86_64             |
+| MANAGER_QEMU_USE_SUDO                      | Whether to use sudo to run QEMU.                                                                                 | false                          |
+| MANAGER_QEMU_ENABLE_SEV                    | Whether to enable Secure Encrypted Virtualization (SEV).                                                         | false                          |
+| MANAGER_QEMU_ENABLE_SEV_SNP                | Whether to enable Secure Nested Paging (SEV-SNP).                                                                | true                           |
+| MANAGER_QEMU_ENABLE_KVM                    | Whether to enable the Kernel-based Virtual Machine (KVM) acceleration.                                           | true                           |
+| MANAGER_QEMU_MACHINE                       | The machine type for QEMU.                                                                                       | q35                            |
+| MANAGER_QEMU_CPU                           | The CPU model for QEMU.                                                                                          | EPYC                           |
+| MANAGER_QEMU_SMP_COUNT                     | The number of virtual CPUs.                                                                                      | 4                              |
+| MANAGER_QEMU_SMP_MAXCPUS                   | The maximum number of virtual CPUs.                                                                              | 64                             |
+| MANAGER_QEMU_MEM_ID                        | The ID for the memory device.                                                                                    | ram1                           |
+| MANAGER_QEMU_NO_GRAPHIC                    | Whether to disable the graphical display.                                                                        | true                           |
+| MANAGER_QEMU_MONITOR                       | The type of monitor to use.                                                                                      | pty                            |
+| MANAGER_QEMU_HOST_FWD_RANGE                | The range of host ports to forward.                                                                              | 6100-6200                      |
 
 ## Setup
 
@@ -90,21 +92,11 @@ sudo apt install qemu-kvm
 
 Create `img` directory in `cmd/manager`.
 
-#### Add Vsock
-The necessary kernel modules must be loaded on the hypervisor. To check if `vhost_vsock` is loaded run:
-```shell
-lsmod | grep vhost_vsock
-```
+#### Virtual filesystem
 
-If `vhost_vsock` is not loaded run the following commands:
+9P (or Plan 9 Filesystem) in QEMU is a lightweight, network-based file-sharing protocol. In Cocos, the 9P is used to transfer environment variables and TLS certificates for cloud communication from the Manager to the Agent.
 
-```shell
-sudo modprobe vhost_vsock
-ls -l /dev/vhost-vsock
-# crw-rw-rw- 1 root kvm 10, 241 Jan 16 12:05 /dev/vhost-vsock
-ls -l /dev/vsock
-# crw-rw-rw- 1 root root 10, 121 Jan 16 12:05 /dev/vsock
-```
+You should define the environment variables in a file called environment. For the number and meaning of the environment variables, please refer to the Agent [Readme](https://github.com/ultravioletrs/cocos/blob/main/agent/README.md).
 
 ### Prepare Cocos HAL
 
@@ -124,10 +116,32 @@ OVMF_CODE=/usr/share/OVMF/OVMF_CODE.fd
 
 sudo find / -name OVMF_VARS.fd
 # => /usr/share/OVMF/OVMF_VARS.fd
-OVMF_VARS=/usr/share/OVMF/OVMF_VARS.fd
 
+# Create a local copy of OVMF_VARS.
+cp /usr/share/OVMF/OVMF_VARS.fd .
+
+# Create a directory for the environment file and the certificates for cloud certificates.
+mkdir env
+mkdir certs
+
+# Enter the env directory and create the environemnt file.
+cd env
+touch environment
+
+# Define Computations endpoint URL for agent.
+# Make sure the Computation endpoint is running (like Cocos Prism).
+echo AGENT_CVM_GRPC_URL=localhost:7001 >> ./environment
+# Define log level for the agent.
+echo AGENT_LOG_LEVEL=debug >> ./environment
+
+# Return to cmd/manager
+cd ..
+
+OVMF_VARS=./OVMF_VARS.fd
 KERNEL="img/bzImage"
 INITRD="img/rootfs.cpio.gz"
+ENV_PATH=./env
+CERTH_PATH=./certs
 
 qemu-system-x86_64 \
     -enable-kvm \
@@ -137,15 +151,19 @@ qemu-system-x86_64 \
     -m 2048M,slots=5,maxmem=10240M \
     -no-reboot \
     -drive if=pflash,format=raw,unit=0,file=$OVMF_CODE,readonly=on \
+    -drive if=pflash,format=raw,unit=1,file=$OVMF_VARS \
     -netdev user,id=vmnic,hostfwd=tcp::7020-:7002 \
     -device virtio-net-pci,disable-legacy=on,iommu_platform=true,netdev=vmnic,romfile= \
-    -device vhost-vsock-pci,id=vhost-vsock-pci0,guest-cid=3 -vnc :0 \
     -kernel $KERNEL \
     -append "earlyprintk=serial console=ttyS0" \
     -initrd $INITRD \
     -nographic \
     -monitor pty \
-    -monitor unix:monitor,server,nowait
+    -monitor unix:monitor,server,nowait \
+    -fsdev local,id=env_fs,path=$ENV_PATH,security_model=mapped \
+    -device virtio-9p-pci,fsdev=env_fs,mount_tag=env_share \
+    -fsdev local,id=cert_fs,path=$CERTH_PATH,security_model=mapped \
+    -device virtio-9p-pci,fsdev=cert_fs,mount_tag=certs_share
 ```
 Once the VM is booted press enter and on the login use username `root`.
 
@@ -190,10 +208,21 @@ MANAGER_QEMU_OVMF_VARS_FILE=/usr/share/OVMF/OVMF_VARS.fd
 
 NB: we set environment variables that we will use in the shell process where we run `manager`.
 
+### Trusted Platform Module (TPM)
+
+The Trusted Platform Module (TPM) plays a fundamental role in this process by providing a tamper-resistant foundation for cryptographic operations, securing sensitive artifacts, measuring system state, and enabling attestation mechanisms.
+
+### IGVM
+
+An IGVM file contains all the necessary information to launch a virtual machine on different virtualization platforms. It includes setup commands for the guest system and verification data to ensure the VM is loaded securely and correctly.
+
+Cocos uses the [COCONUT-SVSM](https://github.com/coconut-svsm/svsm/blob/main/Documentation/docs/installation/INSTALL.md) for the vTPM. The IGVM file contains the OVMF file and the vTPM.
 
 ## Deployment
 
-To start the service, execute the following shell script (note a server needs to be running see  [here](../test/cvms/README.md)):
+To start the service, execute the following shell script (note a server needs to be running see [here](../test/cvms/README.md)):
+
+The manager can be started as a *systemd* service or a standalone executable. To start the manager as a systemd service, look at the systemd service script [here](https://github.com/ultravioletrs/cocos/blob/main/init/systemd/cocos-manager.service). The environment variables are defined in the `cocos-manager.env` file. Below are examples of how to start the manager.
 
 ```bash
 # Download the latest version of the service
@@ -205,13 +234,14 @@ cd cocos
 make manager
 
 # Set the environment variables and run the service
-MANAGER_GRPC_URL=localhost:7001
+MANAGER_GRPC_URL=localhost:7001 \
 MANAGER_LOG_LEVEL=debug \
 MANAGER_QEMU_USE_SUDO=false \
 MANAGER_QEMU_ENABLE_SEV=false \
 ./build/cocos-manager
 ```
 
+
 To enable [AMD SEV](https://www.amd.com/en/developer/sev.html) support, start manager like this 
 
 ```sh
@@ -223,7 +253,7 @@ MANAGER_QEMU_SEV_CBITPOS=51 \
 ./build/cocos-manager
 ```
 
-To build the OVMF with the kernel hash capability, we must build the AmdSev package of OVMF. The result of the build should be a single `OVMF.fd` file (unlike the regular two OVFM files). The OVMF package is located at `OvmfPkg/AmdSev/AmdSevX64.dsc`.
+To start SEV-SNP, define the IGVM file that contains the vTPM and the OVMF (combined OVMF_CODE and OVMF_VARS) of the CVM.
 
 To enable [AMD SEV-SNP](https://www.amd.com/en/developer/sev.html) support, start manager like this 
 
@@ -238,42 +268,6 @@ MANAGER_QEMU_IGVM_FILE=<path to IGVM file> \
 ./build/cocos-manager
 ```
 
-### Verifying VM launch
-
-NB: To verify that the manager successfully launched the VM, you need to open three terminals on the same machine. In one terminal, you need to launch the computations server by executing (with the environment variables of choice):
-
-```bash
-go run ./test/computations/main.go <dataset path> <algo path>
-```
-
-and in the second the manager by executing (with the environment variables of choice):
-
-```bash
-go run ./cmd/manager/main.go
-```
-
-Ensure that the Manager can connect to the Manager test server by setting the MANAGER_GRPC_PORT with the port value of the Manager test server. In the last terminal, you can run the verification commands.
-
-To verify that the manager launched the VM successfully, run the following command:
-
-```sh
-ps aux | grep qemu-system-x86_64
-```
-
-You should get something similar to this
-```
-darko     324763 95.3  6.0 6398136 981044 ?      Sl   16:17   0:15 /usr/bin/qemu-system-x86_64 -enable-kvm -machine q35 -cpu EPYC -smp 4,maxcpus=64 -m 4096M,slots=5,maxmem=30G -drive if=pflash,format=raw,unit=0,file=/usr/share/OVMF/OVMF_CODE.fd,readonly=on -drive if=pflash,format=raw,unit=1,file=img/OVMF_VARS.fd -device virtio-scsi-pci,id=scsi,disable-legacy=on,iommu_platform=true -drive file=img/focal-server-cloudimg-amd64.img,if=none,id=disk0,format=qcow2 -device scsi-hd,drive=disk0 -netdev user,id=vmnic,hostfwd=tcp::2222-:22,hostfwd=tcp::9301-:9031,hostfwd=tcp::7020-:7002 -device virtio-net-pci,disable-legacy=on,iommu_platform=true,netdev=vmnic,romfile= -nographic -monitor pty
-```
-
-If you run a command as `sudo`, you should get the output similar to this one
-
-```
-root       37982  0.0  0.0   9444  4572 pts/0    S+   16:18   0:00 sudo /usr/local/bin/qemu-system-x86_64 -enable-kvm -machine q35 -cpu EPYC -smp 4,maxcpus=64 -m 4096M,slots=5,maxmem=30G -drive if=pflash,format=raw,unit=0,file=/usr/share/OVMF/OVMF_CODE.fd,readonly=on -drive if=pflash,format=raw,unit=1,file=img/OVMF_VARS.fd -device virtio-scsi-pci,id=scsi,disable-legacy=on,iommu_platform=true -drive file=img/focal-server-cloudimg-amd64.img,if=none,id=disk0,format=qcow2 -device scsi-hd,drive=disk0 -netdev user,id=vmnic,hostfwd=tcp::2222-:22,hostfwd=tcp::9301-:9031,hostfwd=tcp::7020-:7002 -device virtio-net-pci,disable-legacy=on,iommu_platform=true,netdev=vmnic,romfile= -object sev-guest,id=sev0,cbitpos=51,reduced-phys-bits=1 -machine memory-encryption=sev0 -nographic -monitor pty
-root       37989  122 13.1 5345816 4252312 pts/0 Sl+  16:19   0:04 /usr/local/bin/qemu-system-x86_64 -enable-kvm -machine q35 -cpu EPYC -smp 4,maxcpus=64 -m 4096M,slots=5,maxmem=30G -drive if=pflash,format=raw,unit=0,file=/usr/share/OVMF/OVMF_CODE.fd,readonly=on -drive if=pflash,format=raw,unit=1,file=img/OVMF_VARS.fd -device virtio-scsi-pci,id=scsi,disable-legacy=on,iommu_platform=true -drive file=img/focal-server-cloudimg-amd64.img,if=none,id=disk0,format=qcow2 -device scsi-hd,drive=disk0 -netdev user,id=vmnic,hostfwd=tcp::2222-:22,hostfwd=tcp::9301-:9031,hostfwd=tcp::7020-:7002 -device virtio-net-pci,disable-legacy=on,iommu_platform=true,netdev=vmnic,romfile= -object sev-guest,id=sev0,cbitpos=51,reduced-phys-bits=1 -machine memory-encryption=sev0 -nographic -monitor pty
-```
-
-The two processes are due to the fact that we run the command `/usr/bin/qemu-system-x86_64` as `sudo`, so there is one process for `sudo` command and the other for `/usr/bin/qemu-system-x86_64`.
-
 ### Troubleshooting
 
 If the `ps aux | grep qemu-system-x86_64` give you something like this

manager/api/grpc/server.go

@@ -35,22 +35,22 @@ func (s *grpcServer) CreateVm(ctx context.Context, req *manager.CreateReq) (*man
 
 	return &manager.CreateRes{
 		ForwardedPort: port,
-		SvmId:         id,
+		CvmId:         id,
 	}, nil
 }
 
 func (s *grpcServer) RemoveVm(ctx context.Context, req *manager.RemoveReq) (*emptypb.Empty, error) {
-	if err := s.svc.RemoveVM(ctx, req.SvmId); err != nil {
+	if err := s.svc.RemoveVM(ctx, req.CvmId); err != nil {
 		return nil, err
 	}
 
 	return &emptypb.Empty{}, nil
 }
 
-func (s *grpcServer) SVMInfo(ctx context.Context, req *manager.SVMInfoReq) (*manager.SVMInfoRes, error) {
-	ovmf, cpunum, cputype, eosversion := s.svc.ReturnSVMInfo(ctx)
+func (s *grpcServer) CVMInfo(ctx context.Context, req *manager.CVMInfoReq) (*manager.CVMInfoRes, error) {
+	ovmf, cpunum, cputype, eosversion := s.svc.ReturnCVMInfo(ctx)
 
-	return &manager.SVMInfoRes{
+	return &manager.CVMInfoRes{
 		OvmfVersion: ovmf,
 		CpuNum:      int32(cpunum),
 		CpuType:     cputype,

manager/api/logging.go

@@ -67,11 +67,11 @@ func (lm *loggingMiddleware) FetchAttestationPolicy(ctx context.Context, cmpId s
 	return lm.svc.FetchAttestationPolicy(ctx, cmpId)
 }
 
-func (lm *loggingMiddleware) ReturnSVMInfo(ctx context.Context) (string, int, string, string) {
+func (lm *loggingMiddleware) ReturnCVMInfo(ctx context.Context) (string, int, string, string) {
 	defer func(begin time.Time) {
-		message := fmt.Sprintf("Method ReturnSVMInfo for computation took %s to complete", time.Since(begin))
+		message := fmt.Sprintf("Method ReturnCVMInfo for computation took %s to complete", time.Since(begin))
 		lm.logger.Info(message)
 	}(time.Now())
 
-	return lm.svc.ReturnSVMInfo(ctx)
+	return lm.svc.ReturnCVMInfo(ctx)
 }

manager/api/metrics.go

@@ -59,11 +59,11 @@ func (ms *metricsMiddleware) FetchAttestationPolicy(ctx context.Context, cmpId s
 	return ms.svc.FetchAttestationPolicy(ctx, cmpId)
 }
 
-func (ms *metricsMiddleware) ReturnSVMInfo(ctx context.Context) (string, int, string, string) {
+func (ms *metricsMiddleware) ReturnCVMInfo(ctx context.Context) (string, int, string, string) {
 	defer func(begin time.Time) {
-		ms.counter.With("method", "ReturnSVMInfo").Add(1)
-		ms.latency.With("method", "ReturnSVMInfo").Observe(time.Since(begin).Seconds())
+		ms.counter.With("method", "ReturnCVMInfo").Add(1)
+		ms.latency.With("method", "ReturnCVMInfo").Observe(time.Since(begin).Seconds())
 	}(time.Now())
 
-	return ms.svc.ReturnSVMInfo(ctx)
+	return ms.svc.ReturnCVMInfo(ctx)
 }

manager/attestation_policy.go

@@ -11,24 +11,38 @@ import (
 	"bytes"
 	"context"
 	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
 	"fmt"
-	"os"
-	"os/exec"
 	"strconv"
+	"strings"
 
 	"github.com/google/go-sev-guest/proto/check"
 	"github.com/ultravioletrs/cocos/manager/qemu"
-	"github.com/ultravioletrs/cocos/pkg/attestation/igvmmeasure"
+	config "github.com/ultravioletrs/cocos/pkg/attestation"
+	"github.com/ultravioletrs/cocos/pkg/attestation/cmdconfig"
 	"github.com/virtee/sev-snp-measure-go/cpuid"
 	"github.com/virtee/sev-snp-measure-go/guest"
 	"github.com/virtee/sev-snp-measure-go/vmmtypes"
-	"google.golang.org/protobuf/encoding/protojson"
 )
 
 const defGuestFeatures = 0x1
 
 func (ms *managerService) FetchAttestationPolicy(_ context.Context, computationId string) ([]byte, error) {
-	cmd := exec.Command("sudo", fmt.Sprintf("%s/attestation_policy", ms.attestationPolicyBinaryPath), "--policy", "196608")
+	var stderrBuffer bytes.Buffer
+	options := []string{"--policy", "196608"}
+
+	if ms.pcrValuesFilePath != "" {
+		pcrValues := []string{"--pcr", ms.pcrValuesFilePath}
+		options = append(options, pcrValues...)
+	}
+
+	stderr := bufio.NewWriter(&stderrBuffer)
+
+	attestPolicyCmd, err := cmdconfig.NewCmdConfig("sudo", options, stderr)
+	if err != nil {
+		return nil, err
+	}
 
 	ms.mu.Lock()
 	vm, exists := ms.vms[computationId]
@@ -43,22 +57,15 @@ func (ms *managerService) FetchAttestationPolicy(_ context.Context, computationI
 	}
 
 	ms.ap.Lock()
-	_, err := cmd.Output()
+	stdOutByte, err := attestPolicyCmd.Run(ms.attestationPolicyBinaryPath)
 	ms.ap.Unlock()
 	if err != nil {
 		return nil, err
 	}
 
-	ms.ap.Lock()
-	f, err := os.ReadFile("./attestation_policy.json")
-	ms.ap.Unlock()
-	if err != nil {
-		return nil, err
-	}
+	attestationPolicy := config.Config{Config: &check.Config{RootOfTrust: &check.RootOfTrust{}, Policy: &check.Policy{}}, PcrConfig: &config.PcrConfig{}}
 
-	var attestationPolicy check.Config
-
-	if err = protojson.Unmarshal(f, &attestationPolicy); err != nil {
+	if err = config.ReadAttestationPolicyFromByte(stdOutByte, &attestationPolicy); err != nil {
 		return nil, err
 	}
 
@@ -70,29 +77,37 @@ func (ms *managerService) FetchAttestationPolicy(_ context.Context, computationI
 			return nil, err
 		}
 	case vmi.Config.EnableSEVSNP:
-		igvmMeasurementBinaryPath := fmt.Sprintf("%s/igvmmeasure", ms.attestationPolicyBinaryPath)
-
-		var stdoutBuffer bytes.Buffer
-		var stderrBuffer bytes.Buffer
-
-		stdout := bufio.NewWriter(&stdoutBuffer)
 		stderr := bufio.NewWriter(&stderrBuffer)
+		options := cmdconfig.IgvmMeasureOptions
 
-		igvmMeasurement, err := igvmmeasure.NewIgvmMeasurement(igvmMeasurementBinaryPath, stderr, stdout)
+		igvmMeasurement, err := cmdconfig.NewCmdConfig(ms.igvmMeasurementBinaryPath, options, stderr)
 		if err != nil {
 			return nil, err
 		}
 
-		err = igvmMeasurement.Run(ms.qemuCfg.IGVMConfig.File)
+		outputByte, err := igvmMeasurement.Run(ms.qemuCfg.IGVMConfig.File)
 		if err != nil {
 			return nil, err
 		}
 
-		measurement = stdoutBuffer.Bytes()
+		outputString := string(outputByte)
+		lines := strings.Split(strings.TrimSpace(outputString), "\n")
+
+		if len(lines) == 1 {
+			outputString = strings.TrimSpace(outputString)
+			outputString = strings.ToLower(outputString)
+		} else {
+			return nil, fmt.Errorf("error: %s", outputString)
+		}
+
+		measurement, err = hex.DecodeString(outputString)
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	if measurement != nil {
-		attestationPolicy.Policy.Measurement = measurement
+		attestationPolicy.Config.Policy.Measurement = measurement
 	}
 
 	if vmi.Config.SevConfig.EnableHostData {
@@ -100,12 +115,12 @@ func (ms *managerService) FetchAttestationPolicy(_ context.Context, computationI
 		if err != nil {
 			return nil, err
 		}
-		attestationPolicy.Policy.HostData = hostData
+		attestationPolicy.Config.Policy.HostData = hostData
 	}
 
-	attestationPolicy.Policy.MinimumLaunchTcb = vmi.LaunchTCB
+	attestationPolicy.Config.Policy.MinimumLaunchTcb = vmi.LaunchTCB
 
-	f, err = protojson.Marshal(&attestationPolicy)
+	f, err := json.MarshalIndent(attestationPolicy, "", " ")
 	if err != nil {
 		return nil, err
 	}

manager/attestation_policy_test.go

@@ -6,6 +6,7 @@ import (
 	"context"
 	"encoding/json"
 	"os"
+	"path"
 	"path/filepath"
 	"testing"
 
@@ -20,7 +21,7 @@ func CreateDummyAttestationPolicyBinary(t *testing.T, behavior string) string {
 	switch behavior {
 	case "success":
 		content = []byte(`#!/bin/sh
-echo '{"policy": {"measurement": null, "host_data": null}}' > attestation_policy.json
+echo '{"pcr_values": {"sha256": null, "sha384": null}, "policy": {"measurement": null, "host_data": null}}'
 `)
 	case "fail":
 		content = []byte(`#!/bin/sh
@@ -105,7 +106,7 @@ func TestFetchAttestationPolicy(t *testing.T) {
 				},
 				LaunchTCB: 0,
 			},
-			expectedError: "no such file or directory",
+			expectedError: "failed to decode Attestation Policy file",
 		},
 	}
 
@@ -116,7 +117,8 @@ func TestFetchAttestationPolicy(t *testing.T) {
 
 			ms := &managerService{
 				vms:                         make(map[string]vm.VM),
-				attestationPolicyBinaryPath: tempDir,
+				attestationPolicyBinaryPath: path.Join(tempDir, "attestation_policy"),
+				pcrValuesFilePath:           tempDir,
 				qemuCfg: qemu.Config{
 					CPU: "EPYC",
 				},

manager/manager.pb.go

@@ -3,8 +3,8 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.4
-// 	protoc        v5.29.3
+// 	protoc-gen-go v1.36.5
+// 	protoc        v5.29.0
 // source: manager/manager.proto
 
 package manager
@@ -32,6 +32,8 @@ type CreateReq struct {
 	AgentCvmClientKey    []byte                 `protobuf:"bytes,3,opt,name=agent_cvm_client_key,json=agentCvmClientKey,proto3" json:"agent_cvm_client_key,omitempty"`
 	AgentCvmClientCert   []byte                 `protobuf:"bytes,4,opt,name=agent_cvm_client_cert,json=agentCvmClientCert,proto3" json:"agent_cvm_client_cert,omitempty"`
 	AgentCvmServerUrl    string                 `protobuf:"bytes,5,opt,name=agent_cvm_server_url,json=agentCvmServerUrl,proto3" json:"agent_cvm_server_url,omitempty"`
+	AgentCvmCaUrl        string                 `protobuf:"bytes,6,opt,name=agent_cvm_ca_url,json=agentCvmCaUrl,proto3" json:"agent_cvm_ca_url,omitempty"`
+	Ttl                  string                 `protobuf:"bytes,7,opt,name=ttl,proto3" json:"ttl,omitempty"`
 	unknownFields        protoimpl.UnknownFields
 	sizeCache            protoimpl.SizeCache
 }
@@ -101,10 +103,24 @@ func (x *CreateReq) GetAgentCvmServerUrl() string {
 	return ""
 }
 
+func (x *CreateReq) GetAgentCvmCaUrl() string {
+	if x != nil {
+		return x.AgentCvmCaUrl
+	}
+	return ""
+}
+
+func (x *CreateReq) GetTtl() string {
+	if x != nil {
+		return x.Ttl
+	}
+	return ""
+}
+
 type CreateRes struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	ForwardedPort string                 `protobuf:"bytes,1,opt,name=forwarded_port,json=forwardedPort,proto3" json:"forwarded_port,omitempty"`
-	SvmId         string                 `protobuf:"bytes,2,opt,name=svm_id,json=svmId,proto3" json:"svm_id,omitempty"`
+	CvmId         string                 `protobuf:"bytes,2,opt,name=cvm_id,json=cvmId,proto3" json:"cvm_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -146,16 +162,16 @@ func (x *CreateRes) GetForwardedPort() string {
 	return ""
 }
 
-func (x *CreateRes) GetSvmId() string {
+func (x *CreateRes) GetCvmId() string {
 	if x != nil {
-		return x.SvmId
+		return x.CvmId
 	}
 	return ""
 }
 
 type RemoveReq struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
-	SvmId         string                 `protobuf:"bytes,1,opt,name=svm_id,json=svmId,proto3" json:"svm_id,omitempty"`
+	CvmId         string                 `protobuf:"bytes,1,opt,name=cvm_id,json=cvmId,proto3" json:"cvm_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -190,9 +206,9 @@ func (*RemoveReq) Descriptor() ([]byte, []int) {
 	return file_manager_manager_proto_rawDescGZIP(), []int{2}
 }
 
-func (x *RemoveReq) GetSvmId() string {
+func (x *RemoveReq) GetCvmId() string {
 	if x != nil {
-		return x.SvmId
+		return x.CvmId
 	}
 	return ""
 }
@@ -249,7 +265,7 @@ func (x *AttestationPolicyRes) GetId() string {
 	return ""
 }
 
-type SVMInfoRes struct {
+type CVMInfoRes struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
 	OvmfVersion   string                 `protobuf:"bytes,2,opt,name=ovmf_version,json=ovmfVersion,proto3" json:"ovmf_version,omitempty"`
@@ -261,20 +277,20 @@ type SVMInfoRes struct {
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *SVMInfoRes) Reset() {
-	*x = SVMInfoRes{}
+func (x *CVMInfoRes) Reset() {
+	*x = CVMInfoRes{}
 	mi := &file_manager_manager_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *SVMInfoRes) String() string {
+func (x *CVMInfoRes) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*SVMInfoRes) ProtoMessage() {}
+func (*CVMInfoRes) ProtoMessage() {}
 
-func (x *SVMInfoRes) ProtoReflect() protoreflect.Message {
+func (x *CVMInfoRes) ProtoReflect() protoreflect.Message {
 	mi := &file_manager_manager_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -286,47 +302,47 @@ func (x *SVMInfoRes) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use SVMInfoRes.ProtoReflect.Descriptor instead.
-func (*SVMInfoRes) Descriptor() ([]byte, []int) {
+// Deprecated: Use CVMInfoRes.ProtoReflect.Descriptor instead.
+func (*CVMInfoRes) Descriptor() ([]byte, []int) {
 	return file_manager_manager_proto_rawDescGZIP(), []int{4}
 }
 
-func (x *SVMInfoRes) GetId() string {
+func (x *CVMInfoRes) GetId() string {
 	if x != nil {
 		return x.Id
 	}
 	return ""
 }
 
-func (x *SVMInfoRes) GetOvmfVersion() string {
+func (x *CVMInfoRes) GetOvmfVersion() string {
 	if x != nil {
 		return x.OvmfVersion
 	}
 	return ""
 }
 
-func (x *SVMInfoRes) GetCpuNum() int32 {
+func (x *CVMInfoRes) GetCpuNum() int32 {
 	if x != nil {
 		return x.CpuNum
 	}
 	return 0
 }
 
-func (x *SVMInfoRes) GetCpuType() string {
+func (x *CVMInfoRes) GetCpuType() string {
 	if x != nil {
 		return x.CpuType
 	}
 	return ""
 }
 
-func (x *SVMInfoRes) GetKernelCmd() string {
+func (x *CVMInfoRes) GetKernelCmd() string {
 	if x != nil {
 		return x.KernelCmd
 	}
 	return ""
 }
 
-func (x *SVMInfoRes) GetEosVersion() string {
+func (x *CVMInfoRes) GetEosVersion() string {
 	if x != nil {
 		return x.EosVersion
 	}
@@ -377,27 +393,27 @@ func (x *AttestationPolicyReq) GetId() string {
 	return ""
 }
 
-type SVMInfoReq struct {
+type CVMInfoReq struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *SVMInfoReq) Reset() {
-	*x = SVMInfoReq{}
+func (x *CVMInfoReq) Reset() {
+	*x = CVMInfoReq{}
 	mi := &file_manager_manager_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *SVMInfoReq) String() string {
+func (x *CVMInfoReq) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*SVMInfoReq) ProtoMessage() {}
+func (*CVMInfoReq) ProtoMessage() {}
 
-func (x *SVMInfoReq) ProtoReflect() protoreflect.Message {
+func (x *CVMInfoReq) ProtoReflect() protoreflect.Message {
 	mi := &file_manager_manager_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -409,12 +425,12 @@ func (x *SVMInfoReq) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use SVMInfoReq.ProtoReflect.Descriptor instead.
-func (*SVMInfoReq) Descriptor() ([]byte, []int) {
+// Deprecated: Use CVMInfoReq.ProtoReflect.Descriptor instead.
+func (*CVMInfoReq) Descriptor() ([]byte, []int) {
 	return file_manager_manager_proto_rawDescGZIP(), []int{6}
 }
 
-func (x *SVMInfoReq) GetId() string {
+func (x *CVMInfoReq) GetId() string {
 	if x != nil {
 		return x.Id
 	}
@@ -427,7 +443,7 @@ var file_manager_manager_proto_rawDesc = string([]byte{
 	0x0a, 0x15, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
 	0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x07, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72,
 	0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x80, 0x02,
+	0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xbb, 0x02,
 	0x0a, 0x09, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x12, 0x26, 0x0a, 0x0f, 0x61,
 	0x67, 0x65, 0x6e, 0x74, 0x5f, 0x6c, 0x6f, 0x67, 0x5f, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x01,
 	0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x4c, 0x6f, 0x67, 0x4c, 0x65,
@@ -444,51 +460,55 @@ var file_manager_manager_proto_rawDesc = string([]byte{
 	0x2f, 0x0a, 0x14, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x76, 0x6d, 0x5f, 0x73, 0x65, 0x72,
 	0x76, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x61,
 	0x67, 0x65, 0x6e, 0x74, 0x43, 0x76, 0x6d, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x55, 0x72, 0x6c,
-	0x22, 0x49, 0x0a, 0x09, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x12, 0x25, 0x0a,
-	0x0e, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x64, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x64,
-	0x50, 0x6f, 0x72, 0x74, 0x12, 0x15, 0x0a, 0x06, 0x73, 0x76, 0x6d, 0x5f, 0x69, 0x64, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x73, 0x76, 0x6d, 0x49, 0x64, 0x22, 0x22, 0x0a, 0x09, 0x52,
-	0x65, 0x6d, 0x6f, 0x76, 0x65, 0x52, 0x65, 0x71, 0x12, 0x15, 0x0a, 0x06, 0x73, 0x76, 0x6d, 0x5f,
-	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x73, 0x76, 0x6d, 0x49, 0x64, 0x22,
-	0x3a, 0x0a, 0x14, 0x41, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x6e, 0x66, 0x6f, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x69, 0x6e, 0x66, 0x6f, 0x12, 0x0e, 0x0a, 0x02, 0x69,
-	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0xb3, 0x01, 0x0a, 0x0a,
-	0x53, 0x56, 0x4d, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x65, 0x73, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x6f, 0x76,
-	0x6d, 0x66, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x0b, 0x6f, 0x76, 0x6d, 0x66, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x17, 0x0a,
-	0x07, 0x63, 0x70, 0x75, 0x5f, 0x6e, 0x75, 0x6d, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06,
-	0x63, 0x70, 0x75, 0x4e, 0x75, 0x6d, 0x12, 0x19, 0x0a, 0x08, 0x63, 0x70, 0x75, 0x5f, 0x74, 0x79,
-	0x70, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x70, 0x75, 0x54, 0x79, 0x70,
-	0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x5f, 0x63, 0x6d, 0x64, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x43, 0x6d, 0x64,
-	0x12, 0x1f, 0x0a, 0x0b, 0x65, 0x6f, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18,
-	0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x65, 0x6f, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f,
-	0x6e, 0x22, 0x26, 0x0a, 0x14, 0x41, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0x1c, 0x0a, 0x0a, 0x53, 0x56, 0x4d,
-	0x49, 0x6e, 0x66, 0x6f, 0x52, 0x65, 0x71, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x32, 0x8c, 0x02, 0x0a, 0x0e, 0x4d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x34, 0x0a, 0x08, 0x43, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x56, 0x6d, 0x12, 0x12, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72,
-	0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x1a, 0x12, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x72, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x22, 0x00,
-	0x12, 0x38, 0x0a, 0x08, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x56, 0x6d, 0x12, 0x12, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x52, 0x65, 0x71,
-	0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x35, 0x0a, 0x07, 0x53, 0x56,
-	0x4d, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x13, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e,
-	0x53, 0x56, 0x4d, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x65, 0x71, 0x1a, 0x13, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x72, 0x2e, 0x53, 0x56, 0x4d, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x65, 0x73, 0x22,
-	0x00, 0x12, 0x53, 0x0a, 0x11, 0x41, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72,
-	0x2e, 0x41, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x52, 0x65, 0x71, 0x1a, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e,
+	0x12, 0x27, 0x0a, 0x10, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x76, 0x6d, 0x5f, 0x63, 0x61,
+	0x5f, 0x75, 0x72, 0x6c, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x67, 0x65, 0x6e,
+	0x74, 0x43, 0x76, 0x6d, 0x43, 0x61, 0x55, 0x72, 0x6c, 0x12, 0x10, 0x0a, 0x03, 0x74, 0x74, 0x6c,
+	0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x74, 0x74, 0x6c, 0x22, 0x49, 0x0a, 0x09, 0x43,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x66, 0x6f, 0x72, 0x77,
+	0x61, 0x72, 0x64, 0x65, 0x64, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0d, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x12,
+	0x15, 0x0a, 0x06, 0x63, 0x76, 0x6d, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x63, 0x76, 0x6d, 0x49, 0x64, 0x22, 0x22, 0x0a, 0x09, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65,
+	0x52, 0x65, 0x71, 0x12, 0x15, 0x0a, 0x06, 0x63, 0x76, 0x6d, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x05, 0x63, 0x76, 0x6d, 0x49, 0x64, 0x22, 0x3a, 0x0a, 0x14, 0x41, 0x74,
+	0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52,
+	0x65, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x6e, 0x66, 0x6f, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c,
+	0x52, 0x04, 0x69, 0x6e, 0x66, 0x6f, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0xb3, 0x01, 0x0a, 0x0a, 0x43, 0x56, 0x4d, 0x49, 0x6e,
+	0x66, 0x6f, 0x52, 0x65, 0x73, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x6f, 0x76, 0x6d, 0x66, 0x5f, 0x76, 0x65,
+	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6f, 0x76, 0x6d,
+	0x66, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x17, 0x0a, 0x07, 0x63, 0x70, 0x75, 0x5f,
+	0x6e, 0x75, 0x6d, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x63, 0x70, 0x75, 0x4e, 0x75,
+	0x6d, 0x12, 0x19, 0x0a, 0x08, 0x63, 0x70, 0x75, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x70, 0x75, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1d, 0x0a, 0x0a,
+	0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x5f, 0x63, 0x6d, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x43, 0x6d, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x65,
+	0x6f, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0a, 0x65, 0x6f, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x26, 0x0a, 0x14,
 	0x41, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0x52, 0x65, 0x73, 0x22, 0x00, 0x42, 0x0b, 0x5a, 0x09, 0x2e, 0x2f, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x72, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x79, 0x52, 0x65, 0x71, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x02, 0x69, 0x64, 0x22, 0x1c, 0x0a, 0x0a, 0x43, 0x56, 0x4d, 0x49, 0x6e, 0x66, 0x6f, 0x52,
+	0x65, 0x71, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
+	0x69, 0x64, 0x32, 0x8c, 0x02, 0x0a, 0x0e, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x53, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x34, 0x0a, 0x08, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x56,
+	0x6d, 0x12, 0x12, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x43, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x52, 0x65, 0x71, 0x1a, 0x12, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e,
+	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x22, 0x00, 0x12, 0x38, 0x0a, 0x08, 0x52,
+	0x65, 0x6d, 0x6f, 0x76, 0x65, 0x56, 0x6d, 0x12, 0x12, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x72, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x52, 0x65, 0x71, 0x1a, 0x16, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d,
+	0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x35, 0x0a, 0x07, 0x43, 0x56, 0x4d, 0x49, 0x6e, 0x66, 0x6f,
+	0x12, 0x13, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x43, 0x56, 0x4d, 0x49, 0x6e,
+	0x66, 0x6f, 0x52, 0x65, 0x71, 0x1a, 0x13, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e,
+	0x43, 0x56, 0x4d, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x65, 0x73, 0x22, 0x00, 0x12, 0x53, 0x0a, 0x11,
+	0x41, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x12, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x41, 0x74, 0x74, 0x65,
+	0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71,
+	0x1a, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x41, 0x74, 0x74, 0x65, 0x73,
+	0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x22,
+	0x00, 0x42, 0x0b, 0x5a, 0x09, 0x2e, 0x2f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 })
 
 var (
@@ -509,19 +529,19 @@ var file_manager_manager_proto_goTypes = []any{
 	(*CreateRes)(nil),            // 1: manager.CreateRes
 	(*RemoveReq)(nil),            // 2: manager.RemoveReq
 	(*AttestationPolicyRes)(nil), // 3: manager.AttestationPolicyRes
-	(*SVMInfoRes)(nil),           // 4: manager.SVMInfoRes
+	(*CVMInfoRes)(nil),           // 4: manager.CVMInfoRes
 	(*AttestationPolicyReq)(nil), // 5: manager.AttestationPolicyReq
-	(*SVMInfoReq)(nil),           // 6: manager.SVMInfoReq
+	(*CVMInfoReq)(nil),           // 6: manager.CVMInfoReq
 	(*emptypb.Empty)(nil),        // 7: google.protobuf.Empty
 }
 var file_manager_manager_proto_depIdxs = []int32{
 	0, // 0: manager.ManagerService.CreateVm:input_type -> manager.CreateReq
 	2, // 1: manager.ManagerService.RemoveVm:input_type -> manager.RemoveReq
-	6, // 2: manager.ManagerService.SVMInfo:input_type -> manager.SVMInfoReq
+	6, // 2: manager.ManagerService.CVMInfo:input_type -> manager.CVMInfoReq
 	5, // 3: manager.ManagerService.AttestationPolicy:input_type -> manager.AttestationPolicyReq
 	1, // 4: manager.ManagerService.CreateVm:output_type -> manager.CreateRes
 	7, // 5: manager.ManagerService.RemoveVm:output_type -> google.protobuf.Empty
-	4, // 6: manager.ManagerService.SVMInfo:output_type -> manager.SVMInfoRes
+	4, // 6: manager.ManagerService.CVMInfo:output_type -> manager.CVMInfoRes
 	3, // 7: manager.ManagerService.AttestationPolicy:output_type -> manager.AttestationPolicyRes
 	4, // [4:8] is the sub-list for method output_type
 	0, // [0:4] is the sub-list for method input_type

manager/manager.proto

@@ -12,7 +12,7 @@ option go_package = "./manager";
 service ManagerService {
   rpc CreateVm(CreateReq) returns (CreateRes) {}
   rpc RemoveVm(RemoveReq) returns (google.protobuf.Empty) {}
-  rpc SVMInfo(SVMInfoReq) returns (SVMInfoRes) {}
+  rpc CVMInfo(CVMInfoReq) returns (CVMInfoRes) {}
   rpc AttestationPolicy(AttestationPolicyReq) returns (AttestationPolicyRes) {}
 }
 
@@ -22,15 +22,17 @@ message CreateReq{
   bytes agent_cvm_client_key = 3;
   bytes agent_cvm_client_cert = 4;
   string agent_cvm_server_url = 5;
+  string agent_cvm_ca_url = 6;
+  string ttl = 7;
 }
 
 message CreateRes{
   string forwarded_port = 1;
-  string svm_id = 2;
+  string cvm_id = 2;
 }
 
 message RemoveReq{
-  string svm_id = 1;
+  string cvm_id = 1;
 }
 
 message AttestationPolicyRes{
@@ -38,7 +40,7 @@ message AttestationPolicyRes{
   string id = 2;
 }
 
-message SVMInfoRes{
+message CVMInfoRes{
   string id = 1;
   string ovmf_version = 2;
   int32 cpu_num = 3;
@@ -51,7 +53,7 @@ message AttestationPolicyReq {
   string id = 1;
 }
 
-message SVMInfoReq {
+message CVMInfoReq {
   string id = 1;
 }
 

manager/manager_grpc.pb.go

@@ -4,7 +4,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.5.1
-// - protoc             v5.29.3
+// - protoc             v5.29.0
 // source: manager/manager.proto
 
 package manager
@@ -25,7 +25,7 @@ const _ = grpc.SupportPackageIsVersion9
 const (
 	ManagerService_CreateVm_FullMethodName          = "/manager.ManagerService/CreateVm"
 	ManagerService_RemoveVm_FullMethodName          = "/manager.ManagerService/RemoveVm"
-	ManagerService_SVMInfo_FullMethodName           = "/manager.ManagerService/SVMInfo"
+	ManagerService_CVMInfo_FullMethodName           = "/manager.ManagerService/CVMInfo"
 	ManagerService_AttestationPolicy_FullMethodName = "/manager.ManagerService/AttestationPolicy"
 )
 
@@ -35,7 +35,7 @@ const (
 type ManagerServiceClient interface {
 	CreateVm(ctx context.Context, in *CreateReq, opts ...grpc.CallOption) (*CreateRes, error)
 	RemoveVm(ctx context.Context, in *RemoveReq, opts ...grpc.CallOption) (*emptypb.Empty, error)
-	SVMInfo(ctx context.Context, in *SVMInfoReq, opts ...grpc.CallOption) (*SVMInfoRes, error)
+	CVMInfo(ctx context.Context, in *CVMInfoReq, opts ...grpc.CallOption) (*CVMInfoRes, error)
 	AttestationPolicy(ctx context.Context, in *AttestationPolicyReq, opts ...grpc.CallOption) (*AttestationPolicyRes, error)
 }
 
@@ -67,10 +67,10 @@ func (c *managerServiceClient) RemoveVm(ctx context.Context, in *RemoveReq, opts
 	return out, nil
 }
 
-func (c *managerServiceClient) SVMInfo(ctx context.Context, in *SVMInfoReq, opts ...grpc.CallOption) (*SVMInfoRes, error) {
+func (c *managerServiceClient) CVMInfo(ctx context.Context, in *CVMInfoReq, opts ...grpc.CallOption) (*CVMInfoRes, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(SVMInfoRes)
-	err := c.cc.Invoke(ctx, ManagerService_SVMInfo_FullMethodName, in, out, cOpts...)
+	out := new(CVMInfoRes)
+	err := c.cc.Invoke(ctx, ManagerService_CVMInfo_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -93,7 +93,7 @@ func (c *managerServiceClient) AttestationPolicy(ctx context.Context, in *Attest
 type ManagerServiceServer interface {
 	CreateVm(context.Context, *CreateReq) (*CreateRes, error)
 	RemoveVm(context.Context, *RemoveReq) (*emptypb.Empty, error)
-	SVMInfo(context.Context, *SVMInfoReq) (*SVMInfoRes, error)
+	CVMInfo(context.Context, *CVMInfoReq) (*CVMInfoRes, error)
 	AttestationPolicy(context.Context, *AttestationPolicyReq) (*AttestationPolicyRes, error)
 	mustEmbedUnimplementedManagerServiceServer()
 }
@@ -111,8 +111,8 @@ func (UnimplementedManagerServiceServer) CreateVm(context.Context, *CreateReq) (
 func (UnimplementedManagerServiceServer) RemoveVm(context.Context, *RemoveReq) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method RemoveVm not implemented")
 }
-func (UnimplementedManagerServiceServer) SVMInfo(context.Context, *SVMInfoReq) (*SVMInfoRes, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method SVMInfo not implemented")
+func (UnimplementedManagerServiceServer) CVMInfo(context.Context, *CVMInfoReq) (*CVMInfoRes, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CVMInfo not implemented")
 }
 func (UnimplementedManagerServiceServer) AttestationPolicy(context.Context, *AttestationPolicyReq) (*AttestationPolicyRes, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method AttestationPolicy not implemented")
@@ -174,20 +174,20 @@ func _ManagerService_RemoveVm_Handler(srv interface{}, ctx context.Context, dec
 	return interceptor(ctx, in, info, handler)
 }
 
-func _ManagerService_SVMInfo_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(SVMInfoReq)
+func _ManagerService_CVMInfo_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CVMInfoReq)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(ManagerServiceServer).SVMInfo(ctx, in)
+		return srv.(ManagerServiceServer).CVMInfo(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: ManagerService_SVMInfo_FullMethodName,
+		FullMethod: ManagerService_CVMInfo_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ManagerServiceServer).SVMInfo(ctx, req.(*SVMInfoReq))
+		return srv.(ManagerServiceServer).CVMInfo(ctx, req.(*CVMInfoReq))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -226,8 +226,8 @@ var ManagerService_ServiceDesc = grpc.ServiceDesc{
 			Handler:    _ManagerService_RemoveVm_Handler,
 		},
 		{
-			MethodName: "SVMInfo",
-			Handler:    _ManagerService_SVMInfo_Handler,
+			MethodName: "CVMInfo",
+			Handler:    _ManagerService_CVMInfo_Handler,
 		},
 		{
 			MethodName: "AttestationPolicy",

manager/mocks/manager_service_client.go

@@ -1,7 +1,7 @@
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
 
-// Code generated by mockery v2.43.2. DO NOT EDIT.
+// Code generated by mockery v2.53.3. DO NOT EDIT.
 
 package mocks
 
@@ -103,6 +103,80 @@ func (_c *ManagerServiceClient_AttestationPolicy_Call) RunAndReturn(run func(con
 	return _c
 }
 
+// CVMInfo provides a mock function with given fields: ctx, in, opts
+func (_m *ManagerServiceClient) CVMInfo(ctx context.Context, in *manager.CVMInfoReq, opts ...grpc.CallOption) (*manager.CVMInfoRes, error) {
+	_va := make([]interface{}, len(opts))
+	for _i := range opts {
+		_va[_i] = opts[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, ctx, in)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	if len(ret) == 0 {
+		panic("no return value specified for CVMInfo")
+	}
+
+	var r0 *manager.CVMInfoRes
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *manager.CVMInfoReq, ...grpc.CallOption) (*manager.CVMInfoRes, error)); ok {
+		return rf(ctx, in, opts...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *manager.CVMInfoReq, ...grpc.CallOption) *manager.CVMInfoRes); ok {
+		r0 = rf(ctx, in, opts...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*manager.CVMInfoRes)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *manager.CVMInfoReq, ...grpc.CallOption) error); ok {
+		r1 = rf(ctx, in, opts...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// ManagerServiceClient_CVMInfo_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'CVMInfo'
+type ManagerServiceClient_CVMInfo_Call struct {
+	*mock.Call
+}
+
+// CVMInfo is a helper method to define mock.On call
+//   - ctx context.Context
+//   - in *manager.CVMInfoReq
+//   - opts ...grpc.CallOption
+func (_e *ManagerServiceClient_Expecter) CVMInfo(ctx interface{}, in interface{}, opts ...interface{}) *ManagerServiceClient_CVMInfo_Call {
+	return &ManagerServiceClient_CVMInfo_Call{Call: _e.mock.On("CVMInfo",
+		append([]interface{}{ctx, in}, opts...)...)}
+}
+
+func (_c *ManagerServiceClient_CVMInfo_Call) Run(run func(ctx context.Context, in *manager.CVMInfoReq, opts ...grpc.CallOption)) *ManagerServiceClient_CVMInfo_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		variadicArgs := make([]grpc.CallOption, len(args)-2)
+		for i, a := range args[2:] {
+			if a != nil {
+				variadicArgs[i] = a.(grpc.CallOption)
+			}
+		}
+		run(args[0].(context.Context), args[1].(*manager.CVMInfoReq), variadicArgs...)
+	})
+	return _c
+}
+
+func (_c *ManagerServiceClient_CVMInfo_Call) Return(_a0 *manager.CVMInfoRes, _a1 error) *ManagerServiceClient_CVMInfo_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *ManagerServiceClient_CVMInfo_Call) RunAndReturn(run func(context.Context, *manager.CVMInfoReq, ...grpc.CallOption) (*manager.CVMInfoRes, error)) *ManagerServiceClient_CVMInfo_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // CreateVm provides a mock function with given fields: ctx, in, opts
 func (_m *ManagerServiceClient) CreateVm(ctx context.Context, in *manager.CreateReq, opts ...grpc.CallOption) (*manager.CreateRes, error) {
 	_va := make([]interface{}, len(opts))
@@ -251,80 +325,6 @@ func (_c *ManagerServiceClient_RemoveVm_Call) RunAndReturn(run func(context.Cont
 	return _c
 }
 
-// SVMInfo provides a mock function with given fields: ctx, in, opts
-func (_m *ManagerServiceClient) SVMInfo(ctx context.Context, in *manager.SVMInfoReq, opts ...grpc.CallOption) (*manager.SVMInfoRes, error) {
-	_va := make([]interface{}, len(opts))
-	for _i := range opts {
-		_va[_i] = opts[_i]
-	}
-	var _ca []interface{}
-	_ca = append(_ca, ctx, in)
-	_ca = append(_ca, _va...)
-	ret := _m.Called(_ca...)
-
-	if len(ret) == 0 {
-		panic("no return value specified for SVMInfo")
-	}
-
-	var r0 *manager.SVMInfoRes
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, *manager.SVMInfoReq, ...grpc.CallOption) (*manager.SVMInfoRes, error)); ok {
-		return rf(ctx, in, opts...)
-	}
-	if rf, ok := ret.Get(0).(func(context.Context, *manager.SVMInfoReq, ...grpc.CallOption) *manager.SVMInfoRes); ok {
-		r0 = rf(ctx, in, opts...)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*manager.SVMInfoRes)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(context.Context, *manager.SVMInfoReq, ...grpc.CallOption) error); ok {
-		r1 = rf(ctx, in, opts...)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// ManagerServiceClient_SVMInfo_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'SVMInfo'
-type ManagerServiceClient_SVMInfo_Call struct {
-	*mock.Call
-}
-
-// SVMInfo is a helper method to define mock.On call
-//   - ctx context.Context
-//   - in *manager.SVMInfoReq
-//   - opts ...grpc.CallOption
-func (_e *ManagerServiceClient_Expecter) SVMInfo(ctx interface{}, in interface{}, opts ...interface{}) *ManagerServiceClient_SVMInfo_Call {
-	return &ManagerServiceClient_SVMInfo_Call{Call: _e.mock.On("SVMInfo",
-		append([]interface{}{ctx, in}, opts...)...)}
-}
-
-func (_c *ManagerServiceClient_SVMInfo_Call) Run(run func(ctx context.Context, in *manager.SVMInfoReq, opts ...grpc.CallOption)) *ManagerServiceClient_SVMInfo_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		variadicArgs := make([]grpc.CallOption, len(args)-2)
-		for i, a := range args[2:] {
-			if a != nil {
-				variadicArgs[i] = a.(grpc.CallOption)
-			}
-		}
-		run(args[0].(context.Context), args[1].(*manager.SVMInfoReq), variadicArgs...)
-	})
-	return _c
-}
-
-func (_c *ManagerServiceClient_SVMInfo_Call) Return(_a0 *manager.SVMInfoRes, _a1 error) *ManagerServiceClient_SVMInfo_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *ManagerServiceClient_SVMInfo_Call) RunAndReturn(run func(context.Context, *manager.SVMInfoReq, ...grpc.CallOption) (*manager.SVMInfoRes, error)) *ManagerServiceClient_SVMInfo_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
 // NewManagerServiceClient creates a new instance of ManagerServiceClient. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
 // The first argument is typically a *testing.T value.
 func NewManagerServiceClient(t interface {

manager/mocks/service.go

@@ -1,7 +1,7 @@
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
 
-// Code generated by mockery v2.43.2. DO NOT EDIT.
+// Code generated by mockery v2.53.3. DO NOT EDIT.
 
 package mocks
 
@@ -195,12 +195,12 @@ func (_c *Service_RemoveVM_Call) RunAndReturn(run func(context.Context, string)
 	return _c
 }
 
-// ReturnSVMInfo provides a mock function with given fields: ctx
-func (_m *Service) ReturnSVMInfo(ctx context.Context) (string, int, string, string) {
+// ReturnCVMInfo provides a mock function with given fields: ctx
+func (_m *Service) ReturnCVMInfo(ctx context.Context) (string, int, string, string) {
 	ret := _m.Called(ctx)
 
 	if len(ret) == 0 {
-		panic("no return value specified for ReturnSVMInfo")
+		panic("no return value specified for ReturnCVMInfo")
 	}
 
 	var r0 string
@@ -237,30 +237,30 @@ func (_m *Service) ReturnSVMInfo(ctx context.Context) (string, int, string, stri
 	return r0, r1, r2, r3
 }
 
-// Service_ReturnSVMInfo_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ReturnSVMInfo'
-type Service_ReturnSVMInfo_Call struct {
+// Service_ReturnCVMInfo_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ReturnCVMInfo'
+type Service_ReturnCVMInfo_Call struct {
 	*mock.Call
 }
 
-// ReturnSVMInfo is a helper method to define mock.On call
+// ReturnCVMInfo is a helper method to define mock.On call
 //   - ctx context.Context
-func (_e *Service_Expecter) ReturnSVMInfo(ctx interface{}) *Service_ReturnSVMInfo_Call {
-	return &Service_ReturnSVMInfo_Call{Call: _e.mock.On("ReturnSVMInfo", ctx)}
+func (_e *Service_Expecter) ReturnCVMInfo(ctx interface{}) *Service_ReturnCVMInfo_Call {
+	return &Service_ReturnCVMInfo_Call{Call: _e.mock.On("ReturnCVMInfo", ctx)}
 }
 
-func (_c *Service_ReturnSVMInfo_Call) Run(run func(ctx context.Context)) *Service_ReturnSVMInfo_Call {
+func (_c *Service_ReturnCVMInfo_Call) Run(run func(ctx context.Context)) *Service_ReturnCVMInfo_Call {
 	_c.Call.Run(func(args mock.Arguments) {
 		run(args[0].(context.Context))
 	})
 	return _c
 }
 
-func (_c *Service_ReturnSVMInfo_Call) Return(_a0 string, _a1 int, _a2 string, _a3 string) *Service_ReturnSVMInfo_Call {
+func (_c *Service_ReturnCVMInfo_Call) Return(_a0 string, _a1 int, _a2 string, _a3 string) *Service_ReturnCVMInfo_Call {
 	_c.Call.Return(_a0, _a1, _a2, _a3)
 	return _c
 }
 
-func (_c *Service_ReturnSVMInfo_Call) RunAndReturn(run func(context.Context) (string, int, string, string)) *Service_ReturnSVMInfo_Call {
+func (_c *Service_ReturnCVMInfo_Call) RunAndReturn(run func(context.Context) (string, int, string, string)) *Service_ReturnCVMInfo_Call {
 	_c.Call.Return(run)
 	return _c
 }

manager/qemu/mocks/persistence.go

@@ -1,7 +1,7 @@
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
 
-// Code generated by mockery v2.43.2. DO NOT EDIT.
+// Code generated by mockery v2.53.3. DO NOT EDIT.
 
 package mocks
 
@@ -69,7 +69,7 @@ func (_c *Persistence_DeleteVM_Call) RunAndReturn(run func(string) error) *Persi
 	return _c
 }
 
-// LoadVMs provides a mock function with given fields:
+// LoadVMs provides a mock function with no fields
 func (_m *Persistence) LoadVMs() ([]qemu.VMState, error) {
 	ret := _m.Called()
 

manager/qemu/vm.go

@@ -4,6 +4,7 @@ package qemu
 
 import (
 	"fmt"
+	"log/slog"
 	"os"
 	"os/exec"
 	"syscall"
@@ -30,17 +31,19 @@ type VMInfo struct {
 }
 
 type qemuVM struct {
-	vmi           VMInfo
-	cmd           *exec.Cmd
-	computationId string
+	vmi    VMInfo
+	cmd    *exec.Cmd
+	cvmId  string
+	logger *slog.Logger
 	vm.StateMachine
 }
 
-func NewVM(config interface{}, computationId string) vm.VM {
+func NewVM(config interface{}, cvmId string, logger *slog.Logger) vm.VM {
 	return &qemuVM{
-		vmi:           config.(VMInfo),
-		computationId: computationId,
-		StateMachine:  vm.NewStateMachine(),
+		vmi:          config.(VMInfo),
+		cvmId:        cvmId,
+		StateMachine: vm.NewStateMachine(),
+		logger:       logger,
 	}
 }
 
@@ -76,8 +79,8 @@ func (v *qemuVM) Start() (err error) {
 	}
 
 	v.cmd = exec.Command(exe, args...)
-	v.cmd.Stdout = os.Stdout
-	v.cmd.Stderr = os.Stderr
+	v.cmd.Stdout = &vm.Stdout{StateMachine: v.StateMachine, Logger: v.logger.With(slog.String("cvm", v.cvmId))}
+	v.cmd.Stderr = &vm.Stderr{StateMachine: v.StateMachine, Logger: v.logger.With(slog.String("cvm", v.cvmId))}
 
 	return v.cmd.Start()
 }

manager/qemu/vm_test.go

@@ -3,6 +3,7 @@
 package qemu
 
 import (
+	"log/slog"
 	"os"
 	"os/exec"
 	"testing"
@@ -17,7 +18,7 @@ const testComputationID = "test-computation"
 func TestNewVM(t *testing.T) {
 	config := VMInfo{Config: Config{}}
 
-	vm := NewVM(config, testComputationID)
+	vm := NewVM(config, testComputationID, slog.Default())
 
 	assert.NotNil(t, vm)
 	assert.IsType(t, &qemuVM{}, vm)
@@ -36,7 +37,7 @@ func TestStart(t *testing.T) {
 		QemuBinPath: "echo",
 	}}
 
-	vm := NewVM(config, testComputationID).(*qemuVM)
+	vm := NewVM(config, testComputationID, slog.Default()).(*qemuVM)
 
 	err = vm.Start()
 	assert.NoError(t, err)
@@ -59,7 +60,7 @@ func TestStartSudo(t *testing.T) {
 		UseSudo:     true,
 	}}
 
-	vm := NewVM(config, testComputationID).(*qemuVM)
+	vm := NewVM(config, testComputationID, slog.Default()).(*qemuVM)
 
 	err = vm.Start()
 	assert.NoError(t, err)

manager/service.go

@@ -3,17 +3,19 @@
 package manager
 
 import (
+	"bufio"
+	"bytes"
 	"context"
 	"encoding/base64"
 	"fmt"
 	"log/slog"
 	"net"
 	"os"
-	"os/exec"
 	"regexp"
 	"strconv"
 	"sync"
 	"syscall"
+	"time"
 
 	"github.com/absmach/magistrala/pkg/errors"
 	"github.com/google/go-sev-guest/proto/check"
@@ -21,6 +23,7 @@ import (
 	"github.com/ultravioletrs/cocos/manager/qemu"
 	"github.com/ultravioletrs/cocos/manager/vm"
 	config "github.com/ultravioletrs/cocos/pkg/attestation"
+	"github.com/ultravioletrs/cocos/pkg/attestation/cmdconfig"
 	"github.com/ultravioletrs/cocos/pkg/manager"
 	"golang.org/x/crypto/sha3"
 )
@@ -33,6 +36,8 @@ const (
 	agentCvmClientCertKey   = "AGENT_CVM_GRPC_CLIENT_CERT"
 	agentCvmClientKey       = "AGENT_CVM_GRPC_CLIENT_KEY"
 	agentCvmServerCaCertKey = "AGENT_CVM_GRPC_SERVER_CA_CERTS"
+	agentCvmId              = "AGENT_CVM_ID"
+	agentCvmCaUrl           = "AGENT_CVM_CA_URL"
 	defClientCertPath       = "/etc/certs/cert.pem"
 	defClientKeyPath        = "/etc/certs/key.pem"
 	defServerCaCertPath     = "/etc/certs/ca.pem"
@@ -76,8 +81,8 @@ type Service interface {
 	RemoveVM(ctx context.Context, computationID string) error
 	// FetchAttestationPolicy measures and fetches the attestation policy.
 	FetchAttestationPolicy(ctx context.Context, computationID string) ([]byte, error)
-	// ReturnSVMInfo returns SVM information needed for attestation verification and validation.
-	ReturnSVMInfo(ctx context.Context) (string, int, string, string)
+	// ReturnCVMInfo returns CVM information needed for attestation verification and validation.
+	ReturnCVMInfo(ctx context.Context) (string, int, string, string)
 }
 
 type managerService struct {
@@ -85,6 +90,8 @@ type managerService struct {
 	ap                          sync.Mutex
 	qemuCfg                     qemu.Config
 	attestationPolicyBinaryPath string
+	igvmMeasurementBinaryPath   string
+	pcrValuesFilePath           string
 	logger                      *slog.Logger
 	vms                         map[string]vm.VM
 	vmFactory                   vm.Provider
@@ -97,7 +104,7 @@ type managerService struct {
 var _ Service = (*managerService)(nil)
 
 // New instantiates the manager service implementation.
-func New(cfg qemu.Config, attestationPolicyBinPath string, logger *slog.Logger, vmFactory vm.Provider, eosVersion string) (Service, error) {
+func New(cfg qemu.Config, attestationPolicyBinPath string, igvmMeasurementBinaryPath string, pcrValuesFilePath string, logger *slog.Logger, vmFactory vm.Provider, eosVersion string) (Service, error) {
 	start, end, err := decodeRange(cfg.HostFwdRange)
 	if err != nil {
 		return nil, err
@@ -114,6 +121,8 @@ func New(cfg qemu.Config, attestationPolicyBinPath string, logger *slog.Logger,
 		vms:                         make(map[string]vm.VM),
 		vmFactory:                   vmFactory,
 		attestationPolicyBinaryPath: attestationPolicyBinPath,
+		igvmMeasurementBinaryPath:   igvmMeasurementBinaryPath,
+		pcrValuesFilePath:           pcrValuesFilePath,
 		portRangeMin:                start,
 		portRangeMax:                end,
 		persistence:                 persistence,
@@ -150,30 +159,36 @@ func (ms *managerService) CreateVM(ctx context.Context, req *CreateReq) (string,
 	cfg.Config.EnvMount = tmpEnvDir
 
 	if ms.qemuCfg.EnableSEVSNP || ms.qemuCfg.EnableSEV {
-		cmd := exec.Command("sudo", fmt.Sprintf("%s/attestation_policy", ms.attestationPolicyBinaryPath), "--policy", "196608")
+		var stderrBuffer bytes.Buffer
+		options := []string{"--policy", "196608"}
+
+		if ms.pcrValuesFilePath != "" {
+			pcrValues := []string{"--pcr", ms.pcrValuesFilePath}
+			options = append(options, pcrValues...)
+		}
+
+		stderr := bufio.NewWriter(&stderrBuffer)
+
+		attestPolicyCmd, err := cmdconfig.NewCmdConfig("sudo", options, stderr)
+		if err != nil {
+			return "", id, err
+		}
 
 		ms.ap.Lock()
-		_, err := cmd.Output()
+		stdOutByte, err := attestPolicyCmd.Run(ms.attestationPolicyBinaryPath)
 		ms.ap.Unlock()
 		if err != nil {
 			return "", id, errors.Wrap(ErrFailedToCreateAttestationPolicy, err)
 		}
 
-		ms.ap.Lock()
-		f, err := os.ReadFile("./attestation_policy.json")
-		ms.ap.Unlock()
-		if err != nil {
-			return "", id, errors.Wrap(ErrFailedToReadPolicy, err)
-		}
+		attestationPolicy := config.Config{Config: &check.Config{RootOfTrust: &check.RootOfTrust{}, Policy: &check.Policy{}}, PcrConfig: &config.PcrConfig{}}
 
-		attestationPolicy := config.Config{SnpCheck: &check.Config{RootOfTrust: &check.RootOfTrust{}, Policy: &check.Policy{}}, PcrConfig: &config.PcrConfig{}}
-
-		if err = config.ReadAttestationPolicyFromByte(f, &attestationPolicy); err != nil {
+		if err = config.ReadAttestationPolicyFromByte(stdOutByte, &attestationPolicy); err != nil {
 			return "", id, errors.Wrap(ErrUnmarshalFailed, err)
 		}
 
 		// Define the TCB that was present at launch of the VM.
-		cfg.LaunchTCB = attestationPolicy.SnpCheck.Policy.MinimumLaunchTcb
+		cfg.LaunchTCB = attestationPolicy.Config.Policy.MinimumLaunchTcb
 	}
 
 	agentPort, err := getFreePort(ms.portRangeMin, ms.portRangeMax)
@@ -204,7 +219,7 @@ func (ms *managerService) CreateVM(ctx context.Context, req *CreateReq) (string,
 		cfg.Config.SevConfig.HostData = base64.StdEncoding.EncodeToString(todo[:])
 	}
 
-	cvm := ms.vmFactory(cfg, id)
+	cvm := ms.vmFactory(cfg, id, ms.logger)
 	if err = cvm.Start(); err != nil {
 		return "", id, err
 	}
@@ -212,6 +227,24 @@ func (ms *managerService) CreateVM(ctx context.Context, req *CreateReq) (string,
 	ms.vms[id] = cvm
 	ms.mu.Unlock()
 
+	if req.Ttl != "" {
+		ttl, err := time.ParseDuration(req.Ttl)
+		if err != nil {
+			return "", id, err
+		}
+
+		go func() {
+			select {
+			case <-time.After(ttl):
+				if err := ms.RemoveVM(ctx, id); err != nil {
+					ms.logger.Error("Failed to remove VM after TTL", "error", err)
+				}
+			case <-ctx.Done():
+				return
+			}
+		}()
+	}
+
 	pid := cvm.GetProcess()
 
 	state := qemu.VMState{
@@ -251,7 +284,7 @@ func (ms *managerService) RemoveVM(ctx context.Context, computationID string) er
 	return nil
 }
 
-func (ms *managerService) ReturnSVMInfo(ctx context.Context) (string, int, string, string) {
+func (ms *managerService) ReturnCVMInfo(ctx context.Context) (string, int, string, string) {
 	return ms.qemuCfg.OVMFCodeConfig.Version, ms.qemuCfg.SMPCount, ms.qemuCfg.CPU, ms.eosVersion
 }
 
@@ -338,7 +371,7 @@ func (ms *managerService) restoreVMs() error {
 			continue
 		}
 
-		cvm := ms.vmFactory(state.VMinfo, state.ID)
+		cvm := ms.vmFactory(state.VMinfo, state.ID, ms.logger)
 
 		if err = cvm.SetProcess(state.PID); err != nil {
 			ms.logger.Warn("Failed to reattach to process", "computation", state.ID, "pid", state.PID, "error", err)
@@ -402,6 +435,8 @@ func tmpEnvironment(id string, req *CreateReq) (string, error) {
 	envMap := map[string]string{
 		agentLogLevelKey:   req.AgentLogLevel,
 		agentCvmGrpcUrlKey: req.AgentCvmServerUrl,
+		agentCvmId:         id,
+		agentCvmCaUrl:      req.AgentCvmCaUrl,
 	}
 
 	if req.AgentCvmClientCert != nil {

manager/service_test.go

@@ -9,6 +9,7 @@ import (
 	"net"
 	"os"
 	"os/exec"
+	"path"
 	"testing"
 
 	mglog "github.com/absmach/magistrala/logger"
@@ -29,7 +30,7 @@ func TestNew(t *testing.T) {
 	logger := slog.Default()
 	vmf := new(mocks.Provider)
 
-	service, err := New(cfg, "", logger, vmf.Execute, "")
+	service, err := New(cfg, "", "", "", logger, vmf.Execute, "")
 	require.NoError(t, err)
 
 	assert.NotNil(t, service)
@@ -94,7 +95,8 @@ func TestRun(t *testing.T) {
 
 			ms := &managerService{
 				qemuCfg:                     qemuCfg,
-				attestationPolicyBinaryPath: tempDir,
+				attestationPolicyBinaryPath: path.Join(tempDir, "attestation_policy"),
+				pcrValuesFilePath:           tempDir,
 				logger:                      logger,
 				vms:                         make(map[string]vm.VM),
 				vmFactory:                   vmf.Execute,

manager/tracing/tracing.go

@@ -42,9 +42,9 @@ func (tm *tracingMiddleware) FetchAttestationPolicy(ctx context.Context, computa
 	return tm.svc.FetchAttestationPolicy(ctx, computationId)
 }
 
-func (tm *tracingMiddleware) ReturnSVMInfo(ctx context.Context) (string, int, string, string) {
-	_, span := tm.tracer.Start(ctx, "return_svm_info")
+func (tm *tracingMiddleware) ReturnCVMInfo(ctx context.Context) (string, int, string, string) {
+	_, span := tm.tracer.Start(ctx, "return_cvm_info")
 	defer span.End()
 
-	return tm.svc.ReturnSVMInfo(ctx)
+	return tm.svc.ReturnCVMInfo(ctx)
 }

manager/vm/logging.go

@@ -0,0 +1,81 @@
+// Copyright (c) Ultraviolet
+// SPDX-License-Identifier: Apache-2.0
+package vm
+
+import (
+	"bytes"
+	"io"
+	"log/slog"
+	"strings"
+)
+
+var (
+	_ io.Writer = &Stdout{}
+	_ io.Writer = &Stderr{}
+)
+
+const bufSize = 1024
+
+type Stdout struct {
+	StateMachine StateMachine
+	Logger       *slog.Logger
+}
+
+// Write implements io.Writer.
+func (s *Stdout) Write(p []byte) (n int, err error) {
+	inBuf := bytes.NewBuffer(p)
+
+	buf := make([]byte, bufSize)
+
+	for {
+		n, err := inBuf.Read(buf)
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return len(p) - inBuf.Len(), err
+		}
+
+		args := []any{
+			slog.String("state", s.StateMachine.State()),
+		}
+
+		s.Logger.Info(string(buf[:n]), args...)
+	}
+
+	return len(p), nil
+}
+
+type Stderr struct {
+	StateMachine StateMachine
+	Logger       *slog.Logger
+}
+
+// Write implements io.Writer.
+func (s *Stderr) Write(p []byte) (n int, err error) {
+	inBuf := bytes.NewBuffer(p)
+
+	buf := make([]byte, bufSize)
+
+	for {
+		n, err := inBuf.Read(buf)
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return len(p) - inBuf.Len(), err
+		}
+
+		args := []any{
+			slog.String("state", s.StateMachine.State()),
+		}
+
+		if strings.Contains(string(buf[:n]), "Error") {
+			s.Logger.Error(string(buf[:n]), args...)
+		} else {
+			s.Logger.Warn(string(buf[:n]), args...)
+		}
+	}
+
+	return len(p), nil
+}

manager/vm/mocks/provider.go

@@ -1,12 +1,15 @@
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
 
-// Code generated by mockery v2.43.2. DO NOT EDIT.
+// Code generated by mockery v2.53.3. DO NOT EDIT.
 
 package mocks
 
 import (
+	slog "log/slog"
+
 	mock "github.com/stretchr/testify/mock"
+
 	vm "github.com/ultravioletrs/cocos/manager/vm"
 )
 
@@ -23,17 +26,17 @@ func (_m *Provider) EXPECT() *Provider_Expecter {
 	return &Provider_Expecter{mock: &_m.Mock}
 }
 
-// Execute provides a mock function with given fields: config, computationId
-func (_m *Provider) Execute(config interface{}, computationId string) vm.VM {
-	ret := _m.Called(config, computationId)
+// Execute provides a mock function with given fields: config, computationId, logger
+func (_m *Provider) Execute(config interface{}, computationId string, logger *slog.Logger) vm.VM {
+	ret := _m.Called(config, computationId, logger)
 
 	if len(ret) == 0 {
 		panic("no return value specified for Execute")
 	}
 
 	var r0 vm.VM
-	if rf, ok := ret.Get(0).(func(interface{}, string) vm.VM); ok {
-		r0 = rf(config, computationId)
+	if rf, ok := ret.Get(0).(func(interface{}, string, *slog.Logger) vm.VM); ok {
+		r0 = rf(config, computationId, logger)
 	} else {
 		if ret.Get(0) != nil {
 			r0 = ret.Get(0).(vm.VM)
@@ -51,13 +54,14 @@ type Provider_Execute_Call struct {
 // Execute is a helper method to define mock.On call
 //   - config interface{}
 //   - computationId string
-func (_e *Provider_Expecter) Execute(config interface{}, computationId interface{}) *Provider_Execute_Call {
-	return &Provider_Execute_Call{Call: _e.mock.On("Execute", config, computationId)}
+//   - logger *slog.Logger
+func (_e *Provider_Expecter) Execute(config interface{}, computationId interface{}, logger interface{}) *Provider_Execute_Call {
+	return &Provider_Execute_Call{Call: _e.mock.On("Execute", config, computationId, logger)}
 }
 
-func (_c *Provider_Execute_Call) Run(run func(config interface{}, computationId string)) *Provider_Execute_Call {
+func (_c *Provider_Execute_Call) Run(run func(config interface{}, computationId string, logger *slog.Logger)) *Provider_Execute_Call {
 	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(interface{}), args[1].(string))
+		run(args[0].(interface{}), args[1].(string), args[2].(*slog.Logger))
 	})
 	return _c
 }
@@ -67,7 +71,7 @@ func (_c *Provider_Execute_Call) Return(_a0 vm.VM) *Provider_Execute_Call {
 	return _c
 }
 
-func (_c *Provider_Execute_Call) RunAndReturn(run func(interface{}, string) vm.VM) *Provider_Execute_Call {
+func (_c *Provider_Execute_Call) RunAndReturn(run func(interface{}, string, *slog.Logger) vm.VM) *Provider_Execute_Call {
 	_c.Call.Return(run)
 	return _c
 }

manager/vm/mocks/state_machine.go

@@ -1,7 +1,7 @@
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
 
-// Code generated by mockery v2.43.2. DO NOT EDIT.
+// Code generated by mockery v2.53.3. DO NOT EDIT.
 
 package mocks
 
@@ -23,7 +23,7 @@ func (_m *StateMachine) EXPECT() *StateMachine_Expecter {
 	return &StateMachine_Expecter{mock: &_m.Mock}
 }
 
-// State provides a mock function with given fields:
+// State provides a mock function with no fields
 func (_m *StateMachine) State() string {
 	ret := _m.Called()
 

manager/vm/mocks/vm.go

@@ -1,7 +1,7 @@
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
 
-// Code generated by mockery v2.43.2. DO NOT EDIT.
+// Code generated by mockery v2.53.3. DO NOT EDIT.
 
 package mocks
 
@@ -25,7 +25,7 @@ func (_m *VM) EXPECT() *VM_Expecter {
 	return &VM_Expecter{mock: &_m.Mock}
 }
 
-// GetCID provides a mock function with given fields:
+// GetCID provides a mock function with no fields
 func (_m *VM) GetCID() int {
 	ret := _m.Called()
 
@@ -70,7 +70,7 @@ func (_c *VM_GetCID_Call) RunAndReturn(run func() int) *VM_GetCID_Call {
 	return _c
 }
 
-// GetConfig provides a mock function with given fields:
+// GetConfig provides a mock function with no fields
 func (_m *VM) GetConfig() interface{} {
 	ret := _m.Called()
 
@@ -117,7 +117,7 @@ func (_c *VM_GetConfig_Call) RunAndReturn(run func() interface{}) *VM_GetConfig_
 	return _c
 }
 
-// GetProcess provides a mock function with given fields:
+// GetProcess provides a mock function with no fields
 func (_m *VM) GetProcess() int {
 	ret := _m.Called()
 
@@ -254,7 +254,7 @@ func (_c *VM_SetProcess_Call) RunAndReturn(run func(int) error) *VM_SetProcess_C
 	return _c
 }
 
-// Start provides a mock function with given fields:
+// Start provides a mock function with no fields
 func (_m *VM) Start() error {
 	ret := _m.Called()
 
@@ -299,7 +299,7 @@ func (_c *VM_Start_Call) RunAndReturn(run func() error) *VM_Start_Call {
 	return _c
 }
 
-// State provides a mock function with given fields:
+// State provides a mock function with no fields
 func (_m *VM) State() string {
 	ret := _m.Called()
 
@@ -344,7 +344,7 @@ func (_c *VM_State_Call) RunAndReturn(run func() string) *VM_State_Call {
 	return _c
 }
 
-// Stop provides a mock function with given fields:
+// Stop provides a mock function with no fields
 func (_m *VM) Stop() error {
 	ret := _m.Called()
 

manager/vm/vm.go

@@ -3,6 +3,8 @@
 package vm
 
 import (
+	"log/slog"
+
 	"github.com/ultravioletrs/cocos/agent"
 	pkgmanager "github.com/ultravioletrs/cocos/pkg/manager"
 	"google.golang.org/protobuf/types/known/timestamppb"
@@ -21,7 +23,7 @@ type VM interface {
 	GetConfig() interface{}
 }
 
-type Provider func(config interface{}, computationId string) VM
+type Provider func(config interface{}, computationId string, logger *slog.Logger) VM
 
 type Event struct {
 	EventType     string

mockery.yml

@@ -119,3 +119,10 @@ packages:
           dir: "{{.InterfaceDir}}/mocks"
           filename: "storage.go"
           mockname: "{{.InterfaceName}}"
+  github.com/ultravioletrs/cocos/pkg/clients/grpc:
+    interfaces:
+      Client:
+        config:
+          dir: "{{.InterfaceDir}}/mocks"
+          filename: "client.go"
+          mockname: "{{.InterfaceName}}"

pkg/attestation/cmdconfig/cmdconfig.go

@@ -1,48 +1,46 @@
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
-package igvmmeasure
+package cmdconfig
 
 import (
 	"bytes"
 	"fmt"
 	"io"
 	"os/exec"
-	"strings"
 )
 
+var IgvmMeasureOptions = []string{"measure", "-b"}
+
 type MeasurementProvider interface {
-	Run(igvmBinaryPath string) error
+	Run(binaryPath string) ([]byte, error)
 	Stop() error
 }
-type IgvmMeasurement struct {
+type CmdConfig struct {
 	binPath     string
 	options     []string
 	stderr      io.Writer
-	stdout      io.Writer
 	cmd         *exec.Cmd
 	execCommand func(name string, arg ...string) *exec.Cmd
 }
 
-func NewIgvmMeasurement(binPath string, stderr, stdout io.Writer) (*IgvmMeasurement, error) {
+func NewCmdConfig(binPath string, options []string, stderr io.Writer) (*CmdConfig, error) {
 	if binPath == "" {
 		return nil, fmt.Errorf("pathToBinary cannot be empty")
 	}
 
-	return &IgvmMeasurement{
+	return &CmdConfig{
 		binPath:     binPath,
+		options:     options,
 		stderr:      stderr,
-		stdout:      stdout,
 		execCommand: exec.Command,
 	}, nil
 }
 
-func (m *IgvmMeasurement) Run(pathToFile string) error {
+func (m *CmdConfig) Run(pathToFile string) ([]byte, error) {
 	binary := m.binPath
 	args := []string{}
-	args = append(args, m.options...)
 	args = append(args, pathToFile)
-	args = append(args, "measure")
-	args = append(args, "-b")
+	args = append(args, m.options...)
 
 	outBuf := &bytes.Buffer{}
 	cmd := m.execCommand(binary, args...)
@@ -50,26 +48,13 @@ func (m *IgvmMeasurement) Run(pathToFile string) error {
 	cmd.Stdout = outBuf
 
 	if err := cmd.Run(); err != nil {
-		return err
-	}
-	outputString := outBuf.String()
-
-	lines := strings.Split(strings.TrimSpace(outputString), "\n")
-
-	if len(lines) == 1 {
-		outputString = strings.ToLower(outputString)
-		_, err := m.stdout.Write([]byte(outputString))
-		if err != nil {
-			return err
-		}
-	} else {
-		return fmt.Errorf("error: %s", outputString)
+		return nil, err
 	}
 
-	return nil
+	return outBuf.Bytes(), nil
 }
 
-func (m *IgvmMeasurement) Stop() error {
+func (m *CmdConfig) Stop() error {
 	if m.cmd == nil || m.cmd.Process == nil {
 		return fmt.Errorf("no running process to stop")
 	}
@@ -82,6 +67,6 @@ func (m *IgvmMeasurement) Stop() error {
 }
 
 // SetExecCommand allows tests to inject a mock execCommand function.
-func (m *IgvmMeasurement) SetExecCommand(cmdFunc func(name string, arg ...string) *exec.Cmd) {
+func (m *CmdConfig) SetExecCommand(cmdFunc func(name string, arg ...string) *exec.Cmd) {
 	m.execCommand = cmdFunc
 }

pkg/attestation/cmdconfig/cmdconfig_test.go

@@ -1,6 +1,6 @@
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
-package igvmmeasure
+package cmdconfig
 
 import (
 	"bytes"
@@ -14,15 +14,15 @@ import (
 func TestIgvmMeasurement(t *testing.T) {
 	tests := []struct {
 		name        string
-		setup       func() *IgvmMeasurement
+		setup       func() *CmdConfig
 		runArgs     string
 		expectErr   bool
 		expectedErr string
 	}{
 		{
 			name: "NewIgvmMeasurement - Empty pathToBinary",
-			setup: func() *IgvmMeasurement {
-				igvm, err := NewIgvmMeasurement("", nil, nil)
+			setup: func() *CmdConfig {
+				igvm, err := NewCmdConfig("", []string{""}, nil)
 				assert.Error(t, err)
 				assert.Nil(t, igvm)
 				return nil
@@ -32,8 +32,8 @@ func TestIgvmMeasurement(t *testing.T) {
 		},
 		{
 			name: "Run - Successful Execution",
-			setup: func() *IgvmMeasurement {
-				igvm, _ := NewIgvmMeasurement("/valid/path", nil, nil)
+			setup: func() *CmdConfig {
+				igvm, _ := NewCmdConfig("/valid/path", []string{""}, nil)
 				igvm.SetExecCommand(func(name string, arg ...string) *exec.Cmd {
 					return exec.Command("sh", "-c", "echo 'measurement successful'")
 				})
@@ -43,8 +43,8 @@ func TestIgvmMeasurement(t *testing.T) {
 		},
 		{
 			name: "Run - Failure Execution",
-			setup: func() *IgvmMeasurement {
-				igvm, _ := NewIgvmMeasurement("/invalid/path", nil, nil)
+			setup: func() *CmdConfig {
+				igvm, _ := NewCmdConfig("/invalid/path", []string{""}, nil)
 				igvm.SetExecCommand(func(name string, arg ...string) *exec.Cmd {
 					return exec.Command("sh", "-c", "echo 'some error occurred\nextra line' && exit 1")
 				})
@@ -61,10 +61,9 @@ func TestIgvmMeasurement(t *testing.T) {
 
 			if igvm != nil {
 				buf := new(bytes.Buffer)
-				igvm.stdout = buf
 				igvm.stderr = buf
 
-				err := igvm.Run(tc.runArgs)
+				_, err := igvm.Run(tc.runArgs)
 				if tc.expectErr {
 					assert.Error(t, err)
 					assert.Equal(t, strings.TrimSpace(tc.expectedErr), strings.TrimSpace(err.Error()))

pkg/attestation/config.go

@@ -21,15 +21,17 @@ const (
 )
 
 var (
-	AttestationPolicy           = Config{SnpCheck: &check.Config{Policy: &check.Policy{}, RootOfTrust: &check.RootOfTrust{}}, PcrConfig: &PcrConfig{}}
+	AttestationPolicy           = Config{Config: &check.Config{Policy: &check.Policy{}, RootOfTrust: &check.RootOfTrust{}}, PcrConfig: &PcrConfig{}}
 	ErrAttestationPolicyOpen    = errors.New("failed to open Attestation Policy file")
 	ErrAttestationPolicyDecode  = errors.New("failed to decode Attestation Policy file")
 	ErrAttestationPolicyMissing = errors.New("failed due to missing Attestation Policy file")
+	ErrAttestationPolicyEncode  = errors.New("failed to encode the Attestation Policy")
 )
 
 type PcrValues struct {
 	Sha256 map[string]string `json:"sha256"`
 	Sha384 map[string]string `json:"sha384"`
+	Sha1   map[string]string `json:"sha1"`
 }
 
 type PcrConfig struct {
@@ -37,8 +39,8 @@ type PcrConfig struct {
 }
 
 type Config struct {
-	SnpCheck  *check.Config
-	PcrConfig *PcrConfig
+	*check.Config
+	*PcrConfig
 }
 
 func ReadAttestationPolicy(policyPath string, attestationConfiguration *Config) error {
@@ -57,7 +59,7 @@ func ReadAttestationPolicy(policyPath string, attestationConfiguration *Config)
 func ReadAttestationPolicyFromByte(policyData []byte, attestationConfiguration *Config) error {
 	unmarshalOptions := protojson.UnmarshalOptions{AllowPartial: true, DiscardUnknown: true}
 
-	if err := unmarshalOptions.Unmarshal(policyData, attestationConfiguration.SnpCheck); err != nil {
+	if err := unmarshalOptions.Unmarshal(policyData, attestationConfiguration.Config); err != nil {
 		return errors.Wrap(ErrAttestationPolicyDecode, err)
 	}
 

pkg/attestation/gcp/gcp.go

@@ -0,0 +1,111 @@
+// Copyright (c) Ultraviolet
+// SPDX-License-Identifier: Apache-2.0
+
+package gcp
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	"cloud.google.com/go/storage"
+	"github.com/golang/protobuf/proto"
+	"github.com/google/gce-tcb-verifier/proto/endorsement"
+	"github.com/google/go-sev-guest/proto/check"
+	"github.com/google/go-sev-guest/proto/sevsnp"
+	"github.com/google/go-sev-guest/tools/lib/report"
+	config "github.com/ultravioletrs/cocos/pkg/attestation"
+)
+
+const (
+	// Offset of the 384-bit measurement in the report.
+	// The measurement is 48 bytes long and starts at offset 0x90.
+	// https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/56860.pdf page 56
+	measurementOffset = 0x90
+	measurementSize   = 48
+	bucketName        = "gce_tcb_integrity"
+	objectName        = "ovmf_x64_csm/sevsnp/%s.binarypb"
+	ovmfObjectName    = "ovmf_x64_csm/%s.fd"
+)
+
+func Extract384BitMeasurement(attestation *sevsnp.Attestation) (string, error) {
+	if attestation == nil {
+		return "", fmt.Errorf("report is nil")
+	}
+
+	reportBin, err := report.Transform(attestation, "bin")
+	if err != nil {
+		return "", fmt.Errorf("failed to transform report to binary: %v", err)
+	}
+
+	if len(reportBin) < measurementOffset+measurementSize {
+		return "", fmt.Errorf("report is too short to contain the 384-bit measurement")
+	}
+
+	measurement := reportBin[measurementOffset : measurementOffset+measurementSize]
+	return fmt.Sprintf("%x", measurement), nil
+}
+
+func GetLaunchEndorsement(ctx context.Context, measurement384 string) (*endorsement.VMGoldenMeasurement, error) {
+	client, err := storage.NewClient(ctx)
+	if err != nil {
+		return &endorsement.VMGoldenMeasurement{}, fmt.Errorf("failed to create storage client: %v", err)
+	}
+
+	reader, err := client.Bucket(bucketName).Object(fmt.Sprintf(objectName, measurement384)).NewReader(ctx)
+	if err != nil {
+		return &endorsement.VMGoldenMeasurement{}, fmt.Errorf("failed to create reader: %v", err)
+	}
+
+	defer reader.Close()
+
+	launchEndorsements, err := io.ReadAll(reader)
+	if err != nil {
+		return &endorsement.VMGoldenMeasurement{}, fmt.Errorf("failed to read object: %v", err)
+	}
+
+	var endorsementPB endorsement.VMLaunchEndorsement
+	if err := proto.Unmarshal(launchEndorsements, &endorsementPB); err != nil {
+		return &endorsement.VMGoldenMeasurement{}, fmt.Errorf("failed to unmarshal launch endorsement: %v", err)
+	}
+
+	var goldenUEFI endorsement.VMGoldenMeasurement
+	if err := proto.Unmarshal(endorsementPB.SerializedUefiGolden, &goldenUEFI); err != nil {
+		return &endorsement.VMGoldenMeasurement{}, fmt.Errorf("failed to unmarshal golden UEFI: %v", err)
+	}
+
+	return &goldenUEFI, nil
+}
+
+func GenerateAttestationPolicy(endorsement *endorsement.VMGoldenMeasurement, vcpuNum uint32) (*config.Config, error) {
+	attestationPolicy := config.Config{PcrConfig: &config.PcrConfig{}, Config: &check.Config{RootOfTrust: &check.RootOfTrust{}, Policy: &check.Policy{}}}
+	attestationPolicy.Config.Policy.Policy = endorsement.SevSnp.Policy
+	attestationPolicy.Config.Policy.Measurement = endorsement.SevSnp.Measurements[vcpuNum]
+	attestationPolicy.Config.RootOfTrust.DisallowNetwork = false
+	attestationPolicy.Config.RootOfTrust.CheckCrl = true
+	attestationPolicy.Config.RootOfTrust.Product = "Milan"
+	attestationPolicy.Config.RootOfTrust.ProductLine = "Milan"
+
+	return &attestationPolicy, nil
+}
+
+func DownloadOvmfFile(ctx context.Context, digest string) ([]byte, error) {
+	client, err := storage.NewClient(ctx)
+	if err != nil {
+		return []byte{}, fmt.Errorf("failed to create storage client: %v", err)
+	}
+
+	reader, err := client.Bucket(bucketName).Object(fmt.Sprintf(ovmfObjectName, digest)).NewReader(ctx)
+	if err != nil {
+		return []byte{}, fmt.Errorf("failed to create reader: %v", err)
+	}
+
+	defer reader.Close()
+
+	ovmf, err := io.ReadAll(reader)
+	if err != nil {
+		return []byte{}, fmt.Errorf("failed to read object: %v", err)
+	}
+
+	return ovmf, nil
+}

pkg/attestation/quoteprovider/mocks/QuoteProvider.go

@@ -1,7 +1,7 @@
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
 
-// Code generated by mockery v2.43.2. DO NOT EDIT.
+// Code generated by mockery v2.53.3. DO NOT EDIT.
 
 package mocks
 
@@ -82,7 +82,7 @@ func (_c *LeveledQuoteProvider_GetRawQuoteAtLevel_Call) RunAndReturn(run func([6
 	return _c
 }
 
-// IsSupported provides a mock function with given fields:
+// IsSupported provides a mock function with no fields
 func (_m *LeveledQuoteProvider) IsSupported() bool {
 	ret := _m.Called()
 
@@ -127,7 +127,7 @@ func (_c *LeveledQuoteProvider_IsSupported_Call) RunAndReturn(run func() bool) *
 	return _c
 }
 
-// Product provides a mock function with given fields:
+// Product provides a mock function with no fields
 func (_m *LeveledQuoteProvider) Product() *sevsnp.SevProduct {
 	ret := _m.Called()
 

pkg/attestation/quoteprovider/sev.go

@@ -142,7 +142,7 @@ func GetLeveledQuoteProvider() (client.LeveledQuoteProvider, error) {
 }
 
 func VerifyAttestationReportTLS(attestationPB *sevsnp.Attestation, reportData []byte) error {
-	config, err := copyConfig(config.AttestationPolicy.SnpCheck)
+	config, err := copyConfig(config.AttestationPolicy.Config)
 	if err != nil {
 		return errors.Wrap(fmt.Errorf("failed to create a copy of attestation policy"), err)
 	}

pkg/attestation/quoteprovider/sev_test.go

@@ -145,8 +145,8 @@ func TestVerifyAttestationReportUnknownProduct(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			config.AttestationPolicy.SnpCheck.RootOfTrust.ProductLine = ""
-			config.AttestationPolicy.SnpCheck.Policy.Product = nil
+			config.AttestationPolicy.Config.RootOfTrust.ProductLine = ""
+			config.AttestationPolicy.Config.Policy.Product = nil
 			err := VerifyAttestationReportTLS(tt.attestationReport, tt.reportData)
 			assert.True(t, errors.Contains(err, tt.err), fmt.Sprintf("expected error %v, got %v", tt.err, err))
 		})
@@ -192,23 +192,23 @@ func prepVerifyAttReport(t *testing.T) (*sevsnp.Attestation, []byte) {
 	rr, err := abi.ReportCertsToProto(file)
 	require.NoError(t, err)
 
-	config.AttestationPolicy = config.Config{SnpCheck: &check.Config{Policy: &check.Policy{}, RootOfTrust: &check.RootOfTrust{}}, PcrConfig: &config.PcrConfig{}}
+	config.AttestationPolicy = config.Config{Config: &check.Config{Policy: &check.Policy{}, RootOfTrust: &check.RootOfTrust{}}, PcrConfig: &config.PcrConfig{}}
 
 	attestationPolicyFile, err := os.ReadFile("../../../scripts/attestation_policy/attestation_policy.json")
 	require.NoError(t, err)
 
 	unmarshalOptions := protojson.UnmarshalOptions{DiscardUnknown: true}
 
-	err = unmarshalOptions.Unmarshal(attestationPolicyFile, config.AttestationPolicy.SnpCheck)
+	err = unmarshalOptions.Unmarshal(attestationPolicyFile, config.AttestationPolicy.Config)
 	require.NoError(t, err)
 
-	config.AttestationPolicy.SnpCheck.Policy.Product = &sevsnp.SevProduct{Name: sevsnp.SevProduct_SEV_PRODUCT_MILAN}
-	config.AttestationPolicy.SnpCheck.Policy.FamilyId = rr.Report.FamilyId
-	config.AttestationPolicy.SnpCheck.Policy.ImageId = rr.Report.ImageId
-	config.AttestationPolicy.SnpCheck.Policy.Measurement = rr.Report.Measurement
-	config.AttestationPolicy.SnpCheck.Policy.HostData = rr.Report.HostData
-	config.AttestationPolicy.SnpCheck.Policy.ReportIdMa = rr.Report.ReportIdMa
-	config.AttestationPolicy.SnpCheck.RootOfTrust.ProductLine = sevProductNameMilan
+	config.AttestationPolicy.Config.Policy.Product = &sevsnp.SevProduct{Name: sevsnp.SevProduct_SEV_PRODUCT_MILAN}
+	config.AttestationPolicy.Config.Policy.FamilyId = rr.Report.FamilyId
+	config.AttestationPolicy.Config.Policy.ImageId = rr.Report.ImageId
+	config.AttestationPolicy.Config.Policy.Measurement = rr.Report.Measurement
+	config.AttestationPolicy.Config.Policy.HostData = rr.Report.HostData
+	config.AttestationPolicy.Config.Policy.ReportIdMa = rr.Report.ReportIdMa
+	config.AttestationPolicy.Config.RootOfTrust.ProductLine = sevProductNameMilan
 
 	return rr, rr.Report.ReportData
 }

pkg/attestation/vtpm/vtpm.go

@@ -42,6 +42,8 @@ var (
 	ErrNoHashAlgo = errors.New("hash algo is not supported")
 )
 
+type VtpmAttest func(teeNonce []byte, vTPMNonce []byte, teeAttestaion bool) ([]byte, error)
+
 type tpmWrapper struct {
 	io.ReadWriteCloser
 }
@@ -126,7 +128,7 @@ func VTPMVerify(quote []byte, pubKeyTLS []byte, teeNonce []byte, vtpmNonce []byt
 
 	err := proto.Unmarshal(quote, attestation)
 	if err != nil {
-		return fmt.Errorf("fail to unmarshal quote: %v", err)
+		return errors.Wrap(fmt.Errorf("failed to unmarshal quote"), err)
 	}
 
 	ak := attestation.GetAkPub()
@@ -142,7 +144,7 @@ func VTPMVerify(quote []byte, pubKeyTLS []byte, teeNonce []byte, vtpmNonce []byt
 
 	reportData, err := createTEEAttestationReportNonce(pubKeyTLS, ak, teeNonce)
 	if err != nil {
-		return fmt.Errorf("fail to calculate report data: %v", err)
+		return errors.Wrap(fmt.Errorf("failed to create TEE attestation report nonce"), err)
 	}
 
 	if err := quoteprovider.VerifyAttestationReportTLS(attestation.GetSevSnpAttestation(), reportData); err != nil {
@@ -151,7 +153,7 @@ func VTPMVerify(quote []byte, pubKeyTLS []byte, teeNonce []byte, vtpmNonce []byt
 
 	_, err = server.VerifyAttestation(attestation, server.VerifyOpts{Nonce: vtpmNonce, TrustedAKs: []crypto.PublicKey{cryptoPub}})
 	if err != nil {
-		return fmt.Errorf("verifying attestation: %w", err)
+		return errors.Wrap(fmt.Errorf("failed to verify attestation"), err)
 	}
 
 	s256, s384 := calculatePCRTLSKey(pubKeyTLS)
@@ -163,6 +165,11 @@ func VTPMVerify(quote []byte, pubKeyTLS []byte, teeNonce []byte, vtpmNonce []byt
 	return nil
 }
 
+// EmptyAttest is a dummy attestation function that returns an empty attestation report.
+func EmptyAttest(teeNonce []byte, vTPMNonce []byte, teeAttestaion bool) ([]byte, error) {
+	return []byte{}, nil
+}
+
 func publicKeyToBytes(pubKey interface{}) ([]byte, error) {
 	derBytes, err := x509.MarshalPKIXPublicKey(pubKey)
 	if err != nil {
@@ -196,7 +203,7 @@ func createTEEAttestationReportNonce(pubKeyTLS []byte, ak []byte, nonce []byte)
 func marshalQuote(attestation *attest.Attestation) ([]byte, error) {
 	out, err := proto.Marshal(attestation)
 	if err != nil {
-		return []byte{}, fmt.Errorf("failed to marshal vTPM attestation report: %v", err)
+		return []byte{}, errors.Wrap(fmt.Errorf("failed to marshal vTPM attestation report"), err)
 	}
 
 	return out, nil
@@ -211,7 +218,7 @@ func fetchVTPMQuote(nonce []byte) (*attest.Attestation, error) {
 
 	attestationKey, err := client.AttestationKeyRSA(rwc)
 	if err != nil {
-		return nil, fmt.Errorf("failed to create attestation key: %v", err)
+		return nil, errors.Wrap(fmt.Errorf("failed to create attestation key: %v", err), err)
 	}
 	defer attestationKey.Close()
 
@@ -222,12 +229,12 @@ func fetchVTPMQuote(nonce []byte) (*attest.Attestation, error) {
 
 	attestOpts.TCGEventLog, err = client.GetEventLog(rwc)
 	if err != nil {
-		return nil, fmt.Errorf("failed to retrieve TCG Event Log: %w", err)
+		return nil, errors.Wrap(fmt.Errorf("failed to retrieve TCG Event Log: %v", err), err)
 	}
 
 	attestation, err := attestationKey.Attest(attestOpts)
 	if err != nil {
-		return nil, fmt.Errorf("failed to collect attestation report: %v", err)
+		return nil, errors.Wrap(fmt.Errorf("failed to attest: %v", err), err)
 	}
 
 	return attestation, nil
@@ -241,7 +248,7 @@ func addTEEAttestation(attestation *attest.Attestation, nonce []byte) (*attest.A
 
 	extReport, err := abi.ReportCertsToProto(rawTeeAttestation)
 	if err != nil {
-		return attestation, fmt.Errorf("failed to export the TEE report: %v", err)
+		return attestation, errors.Wrap(fmt.Errorf("failed to convert TEE report to proto"), err)
 	}
 	attestation.TeeAttestation = &attest.Attestation_SevSnpAttestation{
 		SevSnpAttestation: extReport,
@@ -250,7 +257,7 @@ func addTEEAttestation(attestation *attest.Attestation, nonce []byte) (*attest.A
 	return attestation, nil
 }
 
-func checkExpectedPCRValues(attestation *attest.Attestation, ePcr256 []byte, ePcr384 []byte) error {
+func checkExpectedPCRValues(attestation *attest.Attestation, ePcr256, ePcr384 []byte) error {
 	quotes := attestation.GetQuotes()
 	for i := range quotes {
 		quote := quotes[i]
@@ -263,6 +270,9 @@ func checkExpectedPCRValues(attestation *attest.Attestation, ePcr256 []byte, ePc
 		case tpm.HashAlgo_SHA384:
 			pcrMap = config.AttestationPolicy.PcrConfig.PCRValues.Sha384
 			pcr15 = ePcr384
+		case tpm.HashAlgo_SHA1:
+			pcrMap = config.AttestationPolicy.PcrConfig.PCRValues.Sha1
+			pcr15 = []byte{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
 		default:
 			return errors.Wrap(ErrNoHashAlgo, fmt.Errorf("algo: %s", tpm.HashAlgo_name[int32(quote.Pcrs.Hash)]))
 		}
@@ -275,11 +285,11 @@ func checkExpectedPCRValues(attestation *attest.Attestation, ePcr256 []byte, ePc
 		for i, v := range pcrMap {
 			index, err := strconv.ParseInt(i, 10, 32)
 			if err != nil {
-				return fmt.Errorf("error converting PCR index to int32: %v\n", err)
+				return errors.Wrap(fmt.Errorf("error converting PCR index to int32"), err)
 			}
 			value, err := hex.DecodeString(v)
 			if err != nil {
-				return fmt.Errorf("error converting PCR value to byte: %v\n", err)
+				return errors.Wrap(fmt.Errorf("error converting PCR value to byte"), err)
 			}
 			if !bytes.Equal(quote.Pcrs.Pcrs[uint32(index)], value) {
 				return fmt.Errorf("for algo %s PCR[%d] expected %s but found %s", tpm.HashAlgo_name[int32(quote.Pcrs.Hash)], index, hex.EncodeToString(value), hex.EncodeToString(quote.Pcrs.Pcrs[uint32(index)]))

pkg/clients/grpc/atls.go

@@ -9,8 +9,10 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/pem"
 	"fmt"
 	"net"
+	"os"
 	"strconv"
 	"time"
 
@@ -26,9 +28,40 @@ func setupATLS(cfg AgentClientConfig) (credentials.TransportCredentials, error)
 		return nil, errors.Wrap(fmt.Errorf("failed to read Attestation Policy"), err)
 	}
 
+	var insecureSkipVerify bool = true
+	var rootCAs *x509.CertPool = nil
+
+	if len(cfg.ServerCAFile) > 0 {
+		insecureSkipVerify = false
+
+		// Read the certificate file
+		certPEM, err := os.ReadFile(cfg.ServerCAFile)
+		if err != nil {
+			return nil, errors.Wrap(fmt.Errorf("failed to read certificate file"), err)
+		}
+
+		// Decode the PEM block
+		block, _ := pem.Decode(certPEM)
+		if block == nil {
+			return nil, fmt.Errorf("failed to decode PEM block")
+		}
+
+		// Parse the certificate
+		cert, err := x509.ParseCertificate(block.Bytes)
+		if err != nil {
+			return nil, errors.Wrap(fmt.Errorf("failed to parse certificate"), err)
+		}
+
+		rootCAs = x509.NewCertPool()
+		rootCAs.AddCert(cert)
+	}
+
 	tlsConfig := &tls.Config{
-		InsecureSkipVerify:    true,
-		VerifyPeerCertificate: verifyPeerCertificateATLS,
+		InsecureSkipVerify: insecureSkipVerify,
+		RootCAs:            rootCAs,
+		VerifyPeerCertificate: func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
+			return verifyPeerCertificateATLS(rawCerts, verifiedChains, cfg)
+		},
 	}
 	return credentials.NewTLS(tlsConfig), nil
 }
@@ -52,7 +85,11 @@ func CustomDialer(ctx context.Context, addr string) (net.Conn, error) {
 	return conn, nil
 }
 
-func verifyPeerCertificateATLS(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
+func verifyPeerCertificateATLS(rawCerts [][]byte, verifiedChains [][]*x509.Certificate, cfg AgentClientConfig) error {
+	if len(cfg.ServerCAFile) > 0 {
+		return nil
+	}
+
 	cert, err := x509.ParseCertificate(rawCerts[0])
 	if err != nil {
 		return errors.Wrap(errCertificateParse, err)

pkg/clients/grpc/connect_test.go

@@ -251,13 +251,13 @@ func TestReadAttestationPolicy(t *testing.T) {
 				defer os.Remove(tt.manifestPath)
 			}
 
-			config := att.Config{SnpCheck: &check.Config{}, PcrConfig: &att.PcrConfig{}}
+			config := att.Config{Config: &check.Config{}, PcrConfig: &att.PcrConfig{}}
 			err := att.ReadAttestationPolicy(tt.manifestPath, &config)
 
 			assert.True(t, errors.Contains(err, tt.err), fmt.Sprintf("expected error %v, got %v", tt.err, err))
 			if tt.err == nil {
-				assert.NotNil(t, config.SnpCheck.Policy)
-				assert.NotNil(t, config.SnpCheck.RootOfTrust)
+				assert.NotNil(t, config.Config.Policy)
+				assert.NotNil(t, config.Config.RootOfTrust)
 			}
 		})
 	}

pkg/clients/grpc/mocks/client.go

@@ -0,0 +1,176 @@
+// Copyright (c) Ultraviolet
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by mockery v2.53.3. DO NOT EDIT.
+
+package mocks
+
+import (
+	google_golang_orggrpc "google.golang.org/grpc"
+
+	mock "github.com/stretchr/testify/mock"
+)
+
+// Client is an autogenerated mock type for the Client type
+type Client struct {
+	mock.Mock
+}
+
+type Client_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *Client) EXPECT() *Client_Expecter {
+	return &Client_Expecter{mock: &_m.Mock}
+}
+
+// Close provides a mock function with no fields
+func (_m *Client) Close() error {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Close")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func() error); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// Client_Close_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Close'
+type Client_Close_Call struct {
+	*mock.Call
+}
+
+// Close is a helper method to define mock.On call
+func (_e *Client_Expecter) Close() *Client_Close_Call {
+	return &Client_Close_Call{Call: _e.mock.On("Close")}
+}
+
+func (_c *Client_Close_Call) Run(run func()) *Client_Close_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *Client_Close_Call) Return(_a0 error) *Client_Close_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *Client_Close_Call) RunAndReturn(run func() error) *Client_Close_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Connection provides a mock function with no fields
+func (_m *Client) Connection() *google_golang_orggrpc.ClientConn {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Connection")
+	}
+
+	var r0 *google_golang_orggrpc.ClientConn
+	if rf, ok := ret.Get(0).(func() *google_golang_orggrpc.ClientConn); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*google_golang_orggrpc.ClientConn)
+		}
+	}
+
+	return r0
+}
+
+// Client_Connection_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Connection'
+type Client_Connection_Call struct {
+	*mock.Call
+}
+
+// Connection is a helper method to define mock.On call
+func (_e *Client_Expecter) Connection() *Client_Connection_Call {
+	return &Client_Connection_Call{Call: _e.mock.On("Connection")}
+}
+
+func (_c *Client_Connection_Call) Run(run func()) *Client_Connection_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *Client_Connection_Call) Return(_a0 *google_golang_orggrpc.ClientConn) *Client_Connection_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *Client_Connection_Call) RunAndReturn(run func() *google_golang_orggrpc.ClientConn) *Client_Connection_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Secure provides a mock function with no fields
+func (_m *Client) Secure() string {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Secure")
+	}
+
+	var r0 string
+	if rf, ok := ret.Get(0).(func() string); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(string)
+	}
+
+	return r0
+}
+
+// Client_Secure_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Secure'
+type Client_Secure_Call struct {
+	*mock.Call
+}
+
+// Secure is a helper method to define mock.On call
+func (_e *Client_Expecter) Secure() *Client_Secure_Call {
+	return &Client_Secure_Call{Call: _e.mock.On("Secure")}
+}
+
+func (_c *Client_Secure_Call) Run(run func()) *Client_Secure_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *Client_Secure_Call) Return(_a0 string) *Client_Secure_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *Client_Secure_Call) RunAndReturn(run func() string) *Client_Secure_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// NewClient creates a new instance of Client. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewClient(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *Client {
+	mock := &Client{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

pkg/progressbar/progress_test.go

@@ -77,7 +77,7 @@ func TestSendAlgorithm(t *testing.T) {
 			req, err = os.Open(req.Name())
 			assert.NoError(t, err)
 
-			algoStream := new(mocks.AgentService_AlgoClient)
+			algoStream := new(mocks.AgentService_AlgoClient[agent.AlgoRequest, agent.AlgoResponse])
 			algoStream.On("Send", mock.Anything).Return(tc.sendError)
 			algoStream.On("CloseAndRecv").Return(&agent.AlgoResponse{}, tc.closeRecvError)
 			mockStream := &mockAlgoStream{stream: algoStream}
@@ -141,7 +141,7 @@ func TestSendData(t *testing.T) {
 			dataset, err = os.Open(dataset.Name())
 			assert.NoError(t, err)
 
-			dataStream := new(mocks.AgentService_DataClient)
+			dataStream := new(mocks.AgentService_DataClient[agent.DataRequest, agent.DataResponse])
 			dataStream.On("Send", mock.Anything).Return(tc.sendError)
 			dataStream.On("CloseAndRecv").Return(&agent.DataResponse{}, tc.closeRecvError)
 			mockStream := &mockDataStream{stream: dataStream}

pkg/sdk/mocks/sdk.go

@@ -1,7 +1,7 @@
 // Copyright (c) Ultraviolet
 // SPDX-License-Identifier: Apache-2.0
 
-// Code generated by mockery v2.43.2. DO NOT EDIT.
+// Code generated by mockery v2.53.3. DO NOT EDIT.
 
 package mocks
 

scripts/attestation_policy/README.md

@@ -15,5 +15,5 @@ Then run the binary. Keep in mind that you have to specify the policy of the Gue
 cd ./target/release
 
 # Run with option --policy (policy is 64 bit number) 
-./attestation_policy --policy 196608
+./attestation_policy --policy 196608 --pcr ../../pcr_values.json
 ```

scripts/attestation_policy/src/main.rs

@@ -4,11 +4,7 @@ use serde::Serialize;
 use serde_json::Value;
 use sev::firmware::host::*;
 use std::arch::x86_64::__cpuid;
-use std::fs::{read_to_string, File};
-use std::io::Write;
-
-const ATTESTATION_POLICY_JSON: &str = "attestation_policy.json";
-const PCR_VALUES_JSON: &str = "pcr_values.json";
+use std::fs::read_to_string;
 
 const EXTENDED_FAMILY_SHIFT: u32 = 20;
 const EXTENDED_MODEL_SHIFT: u32 = 16;
@@ -118,8 +114,18 @@ fn main() {
                 .required(true)
                 .value_parser(value_parser!(u64)),
         )
+        .arg(
+            Arg::new("pcr")
+                .long("pcr")
+                .value_name("FILE")
+                .help("Optional path to the PCR values JSON file")
+                .required(false),
+        )
         .get_matches();
 
+    // If provided, get the PCR file path.
+    let pcr_path = matches.get_one::<String>("pcr");
+
     let mut firmware: Firmware = Firmware::open().unwrap();
     let status: SnpPlatformStatus = firmware.snp_platform_status().unwrap();
 
@@ -175,33 +181,27 @@ fn main() {
     let mut computation_value =
         serde_json::to_value(&computation).expect("Failed to convert computation to JSON");
 
-    // Read and parse the pcr_values.json file.
-    let pcr_content = read_to_string(PCR_VALUES_JSON).expect("Failed to read pcr_values.json");
-    let pcr_value: Value =
-        serde_json::from_str(&pcr_content).expect("Failed to parse pcr_values.json");
+    // If the PCR file path was provided, read and merge its JSON content.
+    if let Some(pcr_path) = pcr_path {
+        let pcr_content = read_to_string(pcr_path)
+            .unwrap_or_else(|_| panic!("Failed to read PCR file at {}", pcr_path));
+        let pcr_value: Value = serde_json::from_str(&pcr_content)
+            .unwrap_or_else(|_| panic!("Failed to parse PCR JSON file at {}", pcr_path));
 
-    // Merge the pcr_values into the main JSON object.
-    if let Value::Object(ref mut main_map) = computation_value {
-        if let Value::Object(pcr_map) = pcr_value {
-            // The keys in pcr_map (e.g., "pcr_values") will be added
-            main_map.extend(pcr_map);
+        if let Value::Object(ref mut main_map) = computation_value {
+            if let Value::Object(pcr_map) = pcr_value {
+                main_map.extend(pcr_map);
+            } else {
+                eprintln!("PCR file {} is not a JSON object.", pcr_path);
+            }
         } else {
-            eprintln!("{} is not a JSON object.", PCR_VALUES_JSON);
+            eprintln!("The computed JSON is not an object.");
         }
-    } else {
-        eprintln!("The computed JSON is not an object.");
     }
 
     // Serialize the merged JSON and write to file.
     let merged_json =
         serde_json::to_string_pretty(&computation_value).expect("Failed to serialize merged JSON");
-    let mut file =
-        File::create(ATTESTATION_POLICY_JSON).expect("Failed to create attestation policy file");
-    file.write_all(merged_json.as_bytes())
-        .expect("Failed to write merged JSON to file");
 
-    println!(
-        "AttestationPolicy JSON has been written to {}",
-        ATTESTATION_POLICY_JSON
-    );
+    println!("{}", merged_json);
 }

test/cvms/main.go

@@ -5,11 +5,13 @@ package main
 import (
 	"context"
 	"encoding/pem"
+	"flag"
 	"fmt"
 	"log"
 	"log/slog"
 	"os"
 	"strconv"
+	"strings"
 
 	mglog "github.com/absmach/magistrala/logger"
 	"github.com/caarlos0/env/v11"
@@ -32,10 +34,14 @@ const (
 )
 
 var (
-	algoPath    = "./test/manual/algo/lin_reg.py"
-	dataPaths   []string
-	attestedTLS = false
-	pubKeyFile  string
+	algoPath          string
+	dataPathString    string
+	dataPaths         []string
+	attestedTLSString string
+	attestedTLS       bool
+	pubKeyFile        string
+	caUrl             string
+	cvmId             string
 )
 
 type svc struct {
@@ -95,19 +101,65 @@ func (s *svc) Run(ctx context.Context, ipAddress string, sendMessage cvmsgrpc.Se
 }
 
 func main() {
-	if len(os.Args) < 4 {
-		log.Fatalf("usage: %s <algo-path> <public-key-path> <attested-tls-bool> <data-paths>", os.Args[0])
-	}
-	algoPath = os.Args[1]
-	pubKeyFile = os.Args[2]
-	attestedTLSParam, err := strconv.ParseBool(os.Args[3])
-	if err != nil {
-		log.Fatalf("usage: %s <algo-path> <public-key-path> <attested-tls-bool> <data-paths>, <attested-tls-bool> must be a bool value", os.Args[0])
-	}
-	attestedTLS = attestedTLSParam
+	flagSet := flag.NewFlagSet("tests/cvms/main.go", flag.ContinueOnError)
+	flagSet.StringVar(&algoPath, "algo-path", "", "Path to the algorithm")
+	flagSet.StringVar(&pubKeyFile, "public-key-path", "", "Path to the public key file")
+	flagSet.StringVar(&attestedTLSString, "attested-tls-bool", "", "Should aTLS be used, must be 'true' or 'false'")
+	flagSet.StringVar(&dataPathString, "data-paths", "", "Paths to data sources, list of string separated with commas")
+	flagSet.StringVar(&caUrl, "ca-url", "", "URL for certificate authority, must be specified if aTLS is used")
+	flagSet.StringVar(&cvmId, "cvm-id", "", "UUID for a CVM, must be specified if aTLS is used")
 
-	for i := 4; i < len(os.Args); i++ {
-		dataPaths = append(dataPaths, os.Args[i])
+	flagSetParseError := flagSet.Parse(os.Args[1:])
+	if flagSetParseError != nil {
+		log.Fatalf("Error parsing flagas: %v", flagSetParseError)
+	}
+
+	parsingError := !flagSet.Parsed()
+	var parsingErrorString strings.Builder
+
+	parsingErrorString.WriteString("\n")
+
+	if algoPath == "" {
+		parsingErrorString.WriteString("Algorithm path is required\n")
+		parsingError = true
+	}
+
+	if pubKeyFile == "" {
+		parsingErrorString.WriteString("Public key path is required\n")
+		parsingError = true
+	}
+
+	attestedTLSBoolValue, err := strconv.ParseBool(attestedTLSString)
+	if err != nil {
+		parsingErrorString.WriteString("Attested TLS flag is required and it must be a boolean value\n")
+		parsingError = true
+		attestedTLS = false
+	} else {
+		attestedTLS = attestedTLSBoolValue
+	}
+
+	if dataPathString == "" {
+		parsingErrorString.WriteString("Date source paths are required\n")
+		parsingError = true
+	} else {
+		dataPaths = strings.Split(dataPathString, ",")
+	}
+
+	if err == nil && attestedTLS && caUrl == "" {
+		parsingErrorString.WriteString("CA URL is required if attested TLS is used\n")
+		parsingError = true
+	}
+
+	if err == nil && attestedTLS && cvmId == "" {
+		parsingErrorString.WriteString("CVM UUID is required if attested TLS is used\n")
+		parsingError = true
+	}
+
+	if parsingError {
+		parsingErrorString.WriteString("Usage :\n")
+		flagSet.SetOutput(&parsingErrorString)
+		flagSet.PrintDefaults()
+		log.Fatal(parsingErrorString.String())
 	}
 
 	ctx, cancel := context.WithCancel(context.Background())
@@ -139,7 +191,7 @@ func main() {
 		return
 	}
 
-	gs := grpcserver.New(ctx, cancel, svcName, grpcServerConfig, registerAgentServiceServer, logger, nil, nil)
+	gs := grpcserver.New(ctx, cancel, svcName, grpcServerConfig, registerAgentServiceServer, logger, nil, nil, caUrl, cvmId)
 
 	g.Go(func() error {
 		return gs.Start()

test/manual/README.md

@@ -22,14 +22,11 @@ Agent is started automatically in the VM when launched but requires configuratio
 For attested TLS, you will have to calculate the VM's measurement, which can be done using cli. This information is also contained in the Attestation Policy file.
 
 ```bash
-# Define the path to the OVMF, KERNEL, INITRD and CMD Kernel line arguments.
-OVMF_CODE="/home/cocosai/ovmf/Build/AmdSev/DEBUG_GCC5/FV/OVMF.fd"
-INITRD="/home/cocosai/initramfs.cpio.gz"
-KERNEL="/home/cocosai/bzImage"
-LINE="earlyprintk=serial console=ttyS0"
+# Define the path to the IGVM file that contains the vTPM and the OVMF.
+IGVM="<path to the IGVM file>" 
 
-# Call sev-snp-measure
-./build/cocos-cli sevsnpmeasure --mode snp --vcpus 4 --vcpu-type EPYC-v4 --ovmf $OVMF_CODE --kernel $KERNEL --initrd $INITRD --append "$LINE"
+# Call igvmmeasure
+./build/cocos-cli igvmmeasure $IGVM
 ```
 
 To speed up the verification process of attested TLS, download the ARK and ASK certificates using the CLI tool. The CLI tool will download the certificates under your home directory in the `.cocos` directory.
@@ -48,6 +45,10 @@ export AGENT_GRPC_URL=localhost:7002
 cd scripts/attestation_policy
 make
 sudo ./target/release/attestation_policy --policy 196608 # Default value of the policy should be 196608
+
+# In order to include the golden (good) PCR values in the attestation policy, call the attestation policy script with the "--pcr" option.
+sudo ./target/release/attestation_policy --policy 196608 --pcr ./pcr_values.json
+
 # The output file attestation_policy.json will be generated in the directory from which the executable has been called.
 cd ../..
 
@@ -81,6 +82,12 @@ export AGENT_GRPC_ATTESTED_TLS=true
 # Product name must be Milan or Genoa
 ./build/cocos-cli attestation validate '<attesation>' --report_data '<report_data>' --product <product_name>
 
+# Other options for attestation validation using the CLI are:
+# validate <attestationreportfilepath> --report_data <reportdata> --product <product data> //default
+# validate --mode snp <attestationreportfilepath> --report_data <reportdata> --product <product data>
+# validate --mode vtpm <attestationreportfilepath> --nonce <noncevalue> --format <formatvalue>  --output <outputvalue>
+# validate --mode snp-vtpm <attestationreportfilepath> --nonce <noncevalue> --format <formatvalue>  --output <outputvalue>
+
 # Run the CLI program with algorithm input
 ./build/cocos-cli algo test/manual/algo/lin_reg.py <private_key_file_path> -a python -r test/manual/algo/requirements.py
 # 2023/09/21 10:43:53 Uploading algorithm binary: test/manual/algo/lin_reg.bin

test/manual/algo/README.md

@@ -38,31 +38,121 @@ python3 test/manual/algo/lin_reg.py predict results.zip  test/manual/data
 
 This will make inference on the results of the linear regression model.
 
-To run the examples in the secure VM (SVM) by the Agent, you can use the following command:
+To run the examples in the confidential VM (CVM) or a regular VM by the Agent, you can use the following command:
 
 ```bash
-go run ./test/computations/main.go ./test/manual/algo/lin_reg.py public.pem false ./test/manual/data/iris.csv
+go run ./test/cvms/main.go ./test/manual/algo/lin_reg.py public.pem false ./test/manual/data/iris.csv
 ```
 
-This command is run from the root directory of the project. This will start the computation server.
+This command is run from the root directory of the project. This will start the CVM server.
 
-In another window, you can run the following command:
+For a regular VM, in another window, run the following command:
+```bash
+sudo find / -name OVMF_CODE.fd
+# => /usr/share/OVMF/OVMF_CODE.fd
+OVMF_CODE=/usr/share/OVMF/OVMF_CODE.fd
+
+sudo find / -name OVMF_VARS.fd
+# => /usr/share/OVMF/OVMF_VARS.fd
+
+# Create a local copy of OVMF_VARS.
+cp /usr/share/OVMF/OVMF_VARS.fd .
+
+OVMF_VARS=./OVMF_VARS.fd
+
+# Create a directory for the environment file and the certificates for cloud certificates.
+mkdir env
+mkdir certs
+
+# Enter the env directory and create the environemnt file.
+cd env
+touch environment
+
+# Define Computations endpoint URL for agent.
+# Make sure the Computation endpoint is running (like Cocos Prism).
+echo AGENT_CVM_GRPC_URL=localhost:7001 >> ./environment
+# Define log level for the agent.
+echo AGENT_LOG_LEVEL=debug >> ./environment
+cd ..
+
+KERNEL=<path to kernel built with HAL>
+INITRD=<path to initial RAM file system built with HAL>
+APPEND="earlyprintk=serial console=ttyS0"
+QEMU_BIN=<path to QEMU binary>
+ENV_PATH=./env
+CERTH_PATH=./certs
+
+$QEMU_BIN -enable-kvm \
+    -smp 4 \
+    -m 8G,slots=5,maxmem=10G \
+    -cpu EPYC-v4 \
+    -machine q35 \
+    -no-reboot \
+    -drive if=pflash,format=raw,unit=0,file=$OVMF_CODE,readonly=on \
+    -drive if=pflash,format=raw,unit=1,file=$OVMF_VARS \
+    -netdev user,id=vmnic,hostfwd=tcp::7020-:7002 \
+    -device virtio-net-pci,disable-legacy=on,iommu_platform=true,netdev=vmnic \
+    -initrd $INITRD \
+    -kernel $KERNEL -append $APPEND \
+    -nographic \
+    -monitor pty \
+    -monitor unix:monitor,server,nowait \
+    -fsdev local,id=env_fs,path=$ENV_PATH,security_model=mapped \
+    -device virtio-9p-pci,fsdev=env_fs,mount_tag=env_share \
+    -fsdev local,id=cert_fs,path=$CERTH_PATH,security_model=mapped \
+    -device virtio-9p-pci,fsdev=cert_fs,mount_tag=certs_share
+```
+
+For a CVM, in another window, run the following command:
 
 ```bash
-sudo \
-MANAGER_QEMU_SMP_MAXCPUS=4 \
-MANAGER_GRPC_URL=localhost:7001 \
-MANAGER_LOG_LEVEL=debug \
-MANAGER_QEMU_USE_SUDO=false \
-MANAGER_QEMU_ENABLE_SEV=false \
-MANAGER_QEMU_SEV_CBITPOS=51 \
-MANAGER_QEMU_ENABLE_SEV_SNP=false \
-MANAGER_QEMU_OVMF_CODE_FILE=/usr/share/edk2/x64/OVMF_CODE.fd \
-MANAGER_QEMU_OVMF_VARS_FILE=/usr/share/edk2/x64/OVMF_VARS.fd \
-go run main.go
+# Create a directory for the environment file and the certificates for cloud certificates.
+mkdir env
+mkdir certs
+
+# Enter the env directory and create the environemnt file.
+cd env
+touch environment
+
+# Define Computations endpoint URL for agent.
+# Make sure the Computation endpoint is running (like Cocos Prism).
+echo AGENT_CVM_GRPC_URL=localhost:7001 >> ./environment
+# Define log level for the agent.
+echo AGENT_LOG_LEVEL=debug >> ./environment
+cd ..
+
+KERNEL=<path to kernel built with HAL>
+INITRD=<path to initial RAM file system built with HAL>
+APPEND="earlyprintk=serial console=ttyS0"
+IGVM=<path to IGVM file>
+QEMU_BIN=<path to QEMU binary>
+ENV_PATH=./env
+CERTH_PATH=./certs
+
+$QEMU_BIN -enable-kvm \
+    -enable-kvm \
+    -cpu EPYC-v4 \
+    -machine q35 \
+    -smp 4,maxcpus=16 \
+    -m 8G,slots=5,maxmem=30G \
+    -netdev user,id=vmnic,hostfwd=tcp::7020-:7002 \
+    -device virtio-net-pci,disable-legacy=on,iommu_platform=true,netdev=vmnic,romfile= \
+    -machine confidential-guest-support=sev0,memory-backend=ram1,igvm-cfg=igvm0 \
+    -object memory-backend-memfd,id=ram1,size=8G,share=true,prealloc=false,reserve=false \
+    -object sev-snp-guest,id=sev0,cbitpos=51,reduced-phys-bits=1 \
+    -object igvm-cfg,id=igvm0,file=$IGVM \
+    -initrd $INITRD \
+    -kernel $KERNEL -append $APPEND \
+    -nographic \
+    -monitor pty \
+    -monitor unix:monitor,server,nowait \
+    -fsdev local,id=env_fs,path=$ENV_PATH,security_model=mapped \
+    -device virtio-9p-pci,fsdev=env_fs,mount_tag=env_share \
+    -fsdev local,id=cert_fs,path=$CERTH_PATH,security_model=mapped \
+    -device virtio-9p-pci,fsdev=cert_fs,mount_tag=certs_share
 ```
 
-This command is run from the [manager main directory](../../../cmd/manager/). This will start the manager. Make sure you have already built the [qemu image](../../../hal/linux/README.md).
+Make sure you have already built the [qemu image](../../../hal/linux/README.md) and the IGVM file from the COCONUT-SVSM [repository](https://github.com/coconut-svsm/svsm/blob/main/Documentation/docs/installation/INSTALL.md).
 
 In another window, you can run the following command:
 
@@ -115,7 +205,7 @@ Here we will use the docker with the linear regression example (`lin_reg.py`). T
 cocos
 ```
 
-The docker image must have a `cocos` directory containing the `datasets` and `results` directories. The Agent will run this image inside the SVM and will mount the datasets and results onto the `/cocos/datasets` and `/cocos/results` directories inside the image. The docker image must also contain the command that will be run when the docker container is run.
+The docker image must have a `cocos` directory containing the `datasets` and `results` directories. The Agent will run this image inside the CVM and will mount the datasets and results onto the `/cocos/datasets` and `/cocos/results` directories inside the image. The docker image must also contain the command that will be run when the docker container is run.
 
 Run the build command and then save the docker image as a `tar` file.
 
@@ -125,29 +215,121 @@ docker build -t linreg .
 docker save linreg > linreg.tar
 ```
 
-To run the examples in the secure VM (SVM) by the Agent, you can use the following command in cocos root directory `/cocos`:
+To run the examples in the confidential VM (CVM) or a regular VM by the Agent, you can use the following command:
 
 ```bash
-go run ./test/computations/main.go ./test/manual/algo/linreg.tar public.pem false ./test/manual/data/iris.csv
+go run ./test/cvms/main.go ./test/manual/algo/lin_reg.py public.pem false ./test/manual/data/iris.csv
 ```
 
-In another window, you can run the following command in the `cmd/manager` directory:
+This command is run from the root directory of the project. This will start the CVM server.
+
+For a regular VM, in another window, run the following command:
+```bash
+sudo find / -name OVMF_CODE.fd
+# => /usr/share/OVMF/OVMF_CODE.fd
+OVMF_CODE=/usr/share/OVMF/OVMF_CODE.fd
+
+sudo find / -name OVMF_VARS.fd
+# => /usr/share/OVMF/OVMF_VARS.fd
+
+# Create a local copy of OVMF_VARS.
+cp /usr/share/OVMF/OVMF_VARS.fd .
+
+OVMF_VARS=./OVMF_VARS.fd
+
+# Create a directory for the environment file and the certificates for cloud certificates.
+mkdir env
+mkdir certs
+
+# Enter the env directory and create the environemnt file.
+cd env
+touch environment
+
+# Define Computations endpoint URL for agent.
+# Make sure the Computation endpoint is running (like Cocos Prism).
+echo AGENT_CVM_GRPC_URL=localhost:7001 >> ./environment
+# Define log level for the agent.
+echo AGENT_LOG_LEVEL=debug >> ./environment
+cd ..
+
+KERNEL=<path to kernel built with HAL>
+INITRD=<path to initial RAM file system built with HAL>
+APPEND="earlyprintk=serial console=ttyS0"
+QEMU_BIN=<path to QEMU binary>
+ENV_PATH=./env
+CERTH_PATH=./certs
+
+$QEMU_BIN -enable-kvm \
+    -smp 4 \
+    -m 8G,slots=5,maxmem=10G \
+    -cpu EPYC-v4 \
+    -machine q35 \
+    -no-reboot \
+    -drive if=pflash,format=raw,unit=0,file=$OVMF_CODE,readonly=on \
+    -drive if=pflash,format=raw,unit=1,file=$OVMF_VARS \
+    -netdev user,id=vmnic,hostfwd=tcp::7020-:7002 \
+    -device virtio-net-pci,disable-legacy=on,iommu_platform=true,netdev=vmnic \
+    -initrd $INITRD \
+    -kernel $KERNEL -append $APPEND \
+    -nographic \
+    -monitor pty \
+    -monitor unix:monitor,server,nowait \
+    -fsdev local,id=env_fs,path=$ENV_PATH,security_model=mapped \
+    -device virtio-9p-pci,fsdev=env_fs,mount_tag=env_share \
+    -fsdev local,id=cert_fs,path=$CERTH_PATH,security_model=mapped \
+    -device virtio-9p-pci,fsdev=cert_fs,mount_tag=certs_share
+```
+
+For a CVM, in another window, run the following command:
 
 ```bash
-sudo \
-MANAGER_QEMU_SMP_MAXCPUS=4 \
-MANAGER_GRPC_URL=localhost:7001 \
-MANAGER_LOG_LEVEL=debug \
-MANAGER_QEMU_USE_SUDO=false  \
-MANAGER_QEMU_ENABLE_SEV=false \
-MANAGER_QEMU_SEV_CBITPOS=51 \
-MANAGER_QEMU_ENABLE_SEV_SNP=false \
-MANAGER_QEMU_OVMF_CODE_FILE=/usr/share/edk2/x64/OVMF_CODE.fd \
-MANAGER_QEMU_OVMF_VARS_FILE=/usr/share/edk2/x64/OVMF_VARS.fd \
-go run main.go
+# Create a directory for the environment file and the certificates for cloud certificates.
+mkdir env
+mkdir certs
+
+# Enter the env directory and create the environemnt file.
+cd env
+touch environment
+
+# Define Computations endpoint URL for agent.
+# Make sure the Computation endpoint is running (like Cocos Prism).
+echo AGENT_CVM_GRPC_URL=localhost:7001 >> ./environment
+# Define log level for the agent.
+echo AGENT_LOG_LEVEL=debug >> ./environment
+cd ..
+
+KERNEL=<path to kernel built with HAL>
+INITRD=<path to initial RAM file system built with HAL>
+APPEND="earlyprintk=serial console=ttyS0"
+IGVM=<path to IGVM file>
+QEMU_BIN=<path to QEMU binary>
+ENV_PATH=./env
+CERTH_PATH=./certs
+
+$QEMU_BIN -enable-kvm \
+    -enable-kvm \
+    -cpu EPYC-v4 \
+    -machine q35 \
+    -smp 4,maxcpus=16 \
+    -m 8G,slots=5,maxmem=30G \
+    -netdev user,id=vmnic,hostfwd=tcp::7020-:7002 \
+    -device virtio-net-pci,disable-legacy=on,iommu_platform=true,netdev=vmnic,romfile= \
+    -machine confidential-guest-support=sev0,memory-backend=ram1,igvm-cfg=igvm0 \
+    -object memory-backend-memfd,id=ram1,size=8G,share=true,prealloc=false,reserve=false \
+    -object sev-snp-guest,id=sev0,cbitpos=51,reduced-phys-bits=1 \
+    -object igvm-cfg,id=igvm0,file=$IGVM \
+    -initrd $INITRD \
+    -kernel $KERNEL -append $APPEND \
+    -nographic \
+    -monitor pty \
+    -monitor unix:monitor,server,nowait \
+    -fsdev local,id=env_fs,path=$ENV_PATH,security_model=mapped \
+    -device virtio-9p-pci,fsdev=env_fs,mount_tag=env_share \
+    -fsdev local,id=cert_fs,path=$CERTH_PATH,security_model=mapped \
+    -device virtio-9p-pci,fsdev=cert_fs,mount_tag=certs_share
 ```
 
-This command is run from the [manager main directory](../../../cmd/manager/). This will start the manager. Make sure you have already built the [qemu image](../../../hal/linux/README.md).
+Make sure you have already built the [qemu image](../../../hal/linux/README.md) and the IGVM file from the COCONUT-SVSM [repository](https://github.com/coconut-svsm/svsm/blob/main/Documentation/docs/installation/INSTALL.md).
 
 In another window, specify what kind of algorithm you want the Agent to run (docker):