Skip to main content

create_protector

underhill_attestation::runtime_sealing

Function create_protector 

Source 
pub fn create_protector(
    tee: &dyn TeeCall,
    config: &AttestationVmConfig,
    dek: &[u8; 32],
) -> Result<Vec<u8>, Error>
Expand description

Seal the unchanged active DEK into a new v3 protector using a fresh local report’s SVN and the configured policy. This does not rotate the DEK.

Disabled sealing, unsupported TEEs, TDX signer policy, missing or incompatible report SVN, and report/derivation/sealing failures return Err. No fallback policy or remote key release is attempted.

This stateless compatibility helper enforces no runtime TCB floor and does not validate the raw SNP comparison domain. Runtime recovery must use RuntimeTcbFloor::create_protector instead.