Enum Options 

pub(crate) enum Options {
    Dump {
        file_path: PathBuf,
    },
    DumpCorim {
        file_path: PathBuf,
        header_type: Option<CorimHeaderType>,
        platform: Option<Platform>,
        output: Option<PathBuf>,
    },
    Manifest {
        manifest: PathBuf,
        resources: PathBuf,
        output: PathBuf,
        debug_validation: bool,
        disable_secure_avic: bool,
        confidential_debug: bool,
    },
    AddSnpIdBlock {
        input: PathBuf,
        output: PathBuf,
        guest_svn: Option<u32>,
        manifest: Option<PathBuf>,
        id_block: Option<PathBuf>,
        id_signature: Option<PathBuf>,
        id_public_key: Option<PathBuf>,
    },
    PatchCorimSignature {
        input: PathBuf,
        output: PathBuf,
        corim_bundle: Option<PathBuf>,
        corim_signature: Option<PathBuf>,
        platform: Platform,
    },
}

Variants

Dump

Dumps the contents of an IGVM file in a human-readable format.

Accepts either a raw IGVM file or a vmfirmwareigvm resource DLL (vmfirmwareigvm.dll / vmfirmwarecvm.dll); for a DLL, the embedded IGVM is extracted automatically.

Fields

file_path: PathBuf

Dump file path

DumpCorim

Dump CoRIM (Concise Reference Integrity Manifest) headers and payloads from an IGVM file.

This command scans the IGVM variable headers for CoRIM-related entries and prints or extracts their contents. By default, all supported CoRIM headers for all platforms found in the file are dumped. Use --header-type and --platform to narrow the selection.

The input may be either a raw IGVM file or a vmfirmwareigvm resource DLL (vmfirmwareigvm.dll / vmfirmwarecvm.dll); for a DLL, the embedded IGVM is extracted automatically, so a shipped firmware DLL can be checked for a CoRIM directly.

A human-readable summary of the selected CoRIM headers is written to stdout. When --output <dir> is provided, the CoRIM payloads are also extracted to files in that directory and the file paths are reported.

Fields

file_path: PathBuf

Input IGVM file (or vmfirmwareigvm resource DLL) to read CoRIM headers and payloads from.

header_type: Option<CorimHeaderType>

Filter by CoRIM header type (e.g. document or signature). If not specified, all supported CoRIM header types in the IGVM file are included.

platform: Option<Platform>

Filter by platform type for which the CoRIM applies (see Platform enum). If not specified, CoRIM entries for all platforms present in the IGVM file are considered.

output: Option<PathBuf>

Output directory to extract CoRIM payload data. For each matching CoRIM header, the payload is written to a file named corim_{document,signature}_<platform>.<ext>, e.g. corim_document_vbs.cbor or corim_signature_snp.cose. If omitted, payload contents are not written as files and are instead described in the textual output on stdout.

Manifest

Build an IGVM file according to a manifest.

Also emits per-platform sibling files next to --output: <base>-{snp,tdx,vbs}.json (legacy identity documents) and <base>-{snp,tdx,vbs}.cbor (CoRIM launch endorsements) for every measurable platform in the manifest, and <base>-snp.idblock (the SEV-SNP ID block signing payload) for SNP.

Fields

manifest: PathBuf

Config manifest file path

resources: PathBuf

Resources file describing binary resources used to build the igvm file.

output: PathBuf

Output file path for the built igvm file

debug_validation: bool

Additional debug validation when building IGVM files

disable_secure_avic: bool

Override secure AVIC to disabled for debug SNP guest configs

confidential_debug: bool

Add the confidential debug flag to the measured OpenHCL command line, enabling confidential diagnostics on CVM guest configs even in release builds.

WARNING: This is security-sensitive. OpenHCL uses this flag to decide whether it can trust host-provided boot options for isolated guests. Only enable this flag if you understand the security implications.

AddSnpIdBlock

Add a SEV-SNP ID block to an existing IGVM file.

The IGVM file must contain an SEV-SNP platform header and a matching GuestPolicy. The SNP launch measurement is computed once and embedded as the ID block’s launch digest (ld); the ID block is not part of the measured page set, so the digest stays valid. Its presence signals the IGVM loader to set id_block_en at launch. Adding a second ID block is refused.

Two signing modes are supported:

• Out-of-band (production): pass --id-block <signing payload> (the <base>-snp.idblock emitted by manifest, which is the raw ID block bytes) together with --id-signature <sig.der> (a DER-encoded ECDSA signature produced by a file-content signer over those exact bytes, e.g. openssl dgst -sha384 -sign key.pem -out sig.der file.idblock) and --id-public-key <key.pem> (the signer’s X.509 certificate or SPKI public key, PEM or DER). No private key is held by this tool. The guest SVN comes from the signing payload.
• Temporary key (development/test): pass --guest-svn <N> to sign an OpenHCL identity, or --manifest <config.json> to source both the SVN and image identity from its SNP guest config. An ephemeral ECDSA P-384 key signs the block in-process.

Fields

input: PathBuf

Input IGVM file path

output: PathBuf

Output IGVM file path (can be the same as input to modify in place)

guest_svn: Option<u32>

Temporary-key mode: guest security version number to embed using the OpenHCL image identity. Mutually exclusive with the out-of-band inputs and with --manifest.

manifest: Option<PathBuf>

Temporary-key mode: source the guest SVN and image identity from the SNP guest config in this manifest instead of --guest-svn.

id_block: Option<PathBuf>

Out-of-band mode: path to the SNP ID block signing payload (<base>-snp.idblock emitted by manifest). Requires --id-signature and --id-public-key.

id_signature: Option<PathBuf>

Out-of-band mode: path to the DER-encoded ECDSA signature over the signing payload bytes. Requires --id-block.

id_public_key: Option<PathBuf>

Out-of-band mode: path to the signer’s public key (X.509 cert or SPKI public key, PEM or DER). Requires --id-block.

PatchCorimSignature

Patch a CoRIM signature into an existing IGVM file for a given platform.

The CoRIM document is generated automatically by manifest for every measurable platform, so this command only attaches the detached signature. Provide either a single bundled/signed CoRIM via --corim-bundle (the tool splits it and uses the detached signature; the IGVM file must already contain a matching CoRIM document) or an already-detached signature via --corim-signature (the document slot must already be populated in the IGVM file).

What is verified: this command checks that the supplied signature is a well-formed COSE_Sign1 envelope using PS384 (COSE alg -38, RSA-PSS with SHA-384) and that the signature math validates against the IGVM-embedded CoRIM document, using the public key carried in the envelope’s x5chain / x5bag header (RFC 9360).

What is NOT verified: certificate-chain trust. The signing certificate is taken from the envelope at face value – no validation against a trust root, no revocation check, no policy / EKU enforcement. The caller is responsible for ensuring the input signature originated from a trusted signer (e.g. by sourcing it only from a controlled signing pipeline). Verification here exists to catch accidental corruption and algorithm mismatches, not to establish trust.

Fields

input: PathBuf

Input IGVM file path

output: PathBuf

Output IGVM file path (can be the same as input to modify in place)

corim_bundle: Option<PathBuf>

Path to a bundled/signed CoRIM file (COSE_Sign1 with embedded payload). The tool will internally split it and use the detached signature; the IGVM file must already contain a matching CoRIM document. Mutually exclusive with --corim-signature.

Only PS384 (COSE alg -38, RSA-PSS with SHA-384) signatures are accepted; other algorithms are rejected at verify time.

corim_signature: Option<PathBuf>

Path to the CoRIM signature (COSE_Sign1 with nil payload) file. Requires that a corresponding document already exists in the file for the same compatibility mask.

Only PS384 (COSE alg -38, RSA-PSS with SHA-384) signatures are accepted; other algorithms are rejected at verify time.

platform: Platform

Platform type for the CoRIM headers

Trait Implementations

impl CommandFactory for Options

fn command<'b>() -> Command

Build a [Command] that can instantiate Self.

fn command_for_update<'b>() -> Command

Build a [Command] that can update self.

impl FromArgMatches for Options

fn from_arg_matches(__clap_arg_matches: &ArgMatches) -> Result<Self, Error>

Instantiate Self from [ArgMatches], parsing the arguments as needed.

fn from_arg_matches_mut( __clap_arg_matches: &mut ArgMatches, ) -> Result<Self, Error>

Instantiate Self from [ArgMatches], parsing the arguments as needed.

fn update_from_arg_matches( &mut self, __clap_arg_matches: &ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

fn update_from_arg_matches_mut<'b>( &mut self, __clap_arg_matches: &mut ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

impl Parser for Options

fn parse() -> Self

Parse from std::env::args_os(), [exit][Error::exit] on error.

fn try_parse() -> Result<Self, Error>

Parse from std::env::args_os(), return Err on error.

fn parse_from<I, T>(itr: I) -> Self

where I: IntoIterator<Item = T>, T: Into<OsString> + Clone,

Parse from iterator, [exit][Error::exit] on error.

fn try_parse_from<I, T>(itr: I) -> Result<Self, Error>

where I: IntoIterator<Item = T>, T: Into<OsString> + Clone,

Parse from iterator, return Err on error.

fn update_from<I, T>(&mut self, itr: I)

where I: IntoIterator<Item = T>, T: Into<OsString> + Clone,

Update from iterator, [exit][Error::exit] on error.

fn try_update_from<I, T>(&mut self, itr: I) -> Result<(), Error>

where I: IntoIterator<Item = T>, T: Into<OsString> + Clone,

Update from iterator, return Err on error.

impl Subcommand for Options

fn augment_subcommands<'b>(__clap_app: Command) -> Command

Append to [Command] so it can instantiate Self via [FromArgMatches::from_arg_matches_mut]

fn augment_subcommands_for_update<'b>(__clap_app: Command) -> Command

Append to [Command] so it can instantiate self via [FromArgMatches::update_from_arg_matches_mut]

fn has_subcommand(__clap_name: &str) -> bool

Test whether Self can parse a specific subcommand