Seed `PolicyCalculator` state
- Dominant language
- Go
- Stars
- 673
- Forks
- 188
- PR merge metrics
- No merged PRs in 30d
Description
I'm implementing some TPM policies around `PolicyPCR` and `PolicyOR`, largely based off on the `systemd-pcrlock` implementation.
The problem is that the `PolicyOR` policy takes a list of hashes of potential policy states. In an easy case we are just building on top of an all `0x0` hash. However in more complicated scenarios we might do multiple policies before we get to the `PolicyOR` step. If we execute all of these steps on the TPM we can use `PolicyGetDigest` to get an hash of the current policies, but there is no way for us to use this digest and build a `PolicyCalculator` on top of it for the induvidual `PolicyOR` branches.
We could be careful and run all policy statements with `Update()` and `Execute()`, but that seems like a lot of work if we could instead build a calculator on top of an existing digest?
I'm thinking we could implementing something like `NewPolicyCalculatorWithState(alg TPMIAlgHash, state []byte)` or a `SetState(state []byte)` function. But I'm not completely sure if this is the correct approach here?
Contributor guide
Assessment
This issue has not been assessed yet.