Igvmfilegen: Support patch-CoRIM command by mingweishih · Pull Request #3088 · microsoft/openvmm

mingweishih · 2026-03-20T22:28:26Z

This PR adds the support of writing CoRIM to an existing IGVM file, allowing for injecting the CoRIM files post build in the pipeline.
By IGVM design, a signed CoRIM is expected to be broke into payload and signed envelope with payload detached and wrote into CORIM_DOCUMENT and CORIM_SIGNATURE entries correspondingly. The idea is decoupling the payload generation and the signing process. However, given that the CoRIM detached signing might not always be supported by the signing infrastructure, the tool additionally supports taking a signed CoRIM as input and handles the decoupling before writing to the IGVM file.

Cherry-picked from igvm_sign_time_claim branch. Adds corim.rs module for reading/writing CoRIM document and signature headers in IGVM files, and patch-corim / dump-corim CLI subcommands. Uses igvm/igvm_defs from mingweishih/igvm corim-header branch. Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

Copilot

Pull request overview

Adds CoRIM (Concise Reference Integrity Manifest) patching/extraction capabilities to igvmfilegen, enabling post-build injection of CoRIM document/signature data into an existing IGVM file (including support for splitting bundled COSE_Sign1 inputs).

Changes:

Add new DumpCorim and PatchCorim CLI subcommands to inspect and patch CoRIM headers in IGVM files.
Introduce a new corim module implementing IGVM directive patching plus minimal COSE_Sign1 split/validation utilities (with unit tests).
Switch igvm/igvm_defs workspace deps to a git fork/branch that includes the required CoRIM header support.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
vm/loader/igvmfilegen/src/main.rs	Adds new CLI commands and implements CoRIM header dumping/patching entrypoints.
vm/loader/igvmfilegen/src/corim/mod.rs	Adds IGVM-level CoRIM patching logic and compatibility-mask helpers.
vm/loader/igvmfilegen/src/corim/cose.rs	Adds COSE_Sign1 parsing/splitting/validation helpers plus unit tests.
vm/loader/igvmfilegen/Cargo.toml	Adds `open_enum` dependency for the new COSE/CBOR helpers.
Cargo.toml	Switches `igvm` and `igvm_defs` from crates.io to a git fork/branch.
Cargo.lock	Updates lock entries for the new git-based `igvm` crates and incidental dependency resolution changes.

vm/loader/igvmfilegen/src/corim/mod.rs

vm/loader/igvmfilegen/src/corim/cose.rs

vm/loader/igvmfilegen/src/main.rs

Copilot · 2026-03-20T22:33:42Z

Cargo.toml

+igvm = { git = "https://github.com/chris-oo/igvm", branch = "corim-header" }
+igvm_defs = { git = "https://github.com/chris-oo/igvm", branch = "corim-header", default-features = false }


Switching igvm/igvm_defs from crates.io to a personal GitHub fork/branch has supply-chain and long-term maintenance implications. If this is intended as a temporary fork, add an explanatory comment (similar to nearby forked deps) and consider pinning to a specific rev (commit) in Cargo.toml to make the dependency source explicit and stable; alternatively, upstream the required changes and return to the published crate versions.

Suggested change

igvm = { git = "https://github.com/chris-oo/igvm", branch = "corim-header" }

igvm_defs = { git = "https://github.com/chris-oo/igvm", branch = "corim-header", default-features = false }

# Temporary fork of igvm/igvm_defs for CORIM header support.

# Pinned to a specific commit; upstream these changes and return to the

# crates.io igvm/igvm_defs crates when possible.

igvm = { git = "https://github.com/chris-oo/igvm", rev = "REPLACE_WITH_CORIM_HEADER_COMMIT_SHA" }

igvm_defs = { git = "https://github.com/chris-oo/igvm", rev = "REPLACE_WITH_CORIM_HEADER_COMMIT_SHA", default-features = false }

vm/loader/igvmfilegen/src/corim/mod.rs

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

vm/loader/igvmfilegen/src/corim/mod.rs

vm/loader/igvmfilegen/src/main.rs

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 4 comments.

vm/loader/igvmfilegen/src/main.rs

Copilot · 2026-03-24T18:08:10Z

vm/loader/igvmfilegen/src/corim/mod.rs

+    /// headers. This avoids using `IgvmFile::new_from_binary()` which
+    /// cannot parse CoRIM headers.


This test helper comment says IgvmFile::new_from_binary() cannot parse CoRIM headers, but the production patch_corim() implementation relies on parsing CorimDocument/CorimSignature via new_from_binary(). Please update the comment to reflect the current requirement/behavior (e.g., that you’re parsing raw headers to assert on binary layout rather than parser limitations).

Suggested change

/// headers. This avoids using `IgvmFile::new_from_binary()` which

/// cannot parse CoRIM headers.

/// headers. This intentionally parses the raw headers instead of using

/// `IgvmFile::new_from_binary()` so tests can assert on the exact binary

/// layout of the CoRIM-related variable headers and payload ranges.

vm/loader/igvmfilegen/src/corim/mod.rs

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 7 comments.

vm/loader/igvmfilegen/src/main.rs

Copilot · 2026-03-24T18:22:24Z

vm/loader/igvmfilegen/src/main.rs

+            let aligned_len = (hdr.length as usize + 7) & !7;
+            plat_offset = data_offset + aligned_len;


In the platform-header scan, aligned_len = (hdr.length as usize + 7) & !7 and plat_offset = data_offset + aligned_len are unchecked. A malformed hdr.length can overflow or fail to advance plat_offset, leading to an infinite loop or out-of-bounds reads. Mirror the overflow/next_offset validation you do in the main variable-header loop (checked_add + ensure next_offset > current).

Suggested change

let aligned_len = (hdr.length as usize + 7) & !7;

plat_offset = data_offset + aligned_len;

let raw_len = usize::try_from(hdr.length).map_err(|_| {

anyhow::anyhow!(

"Variable header at offset {} has length {} which does not fit in usize",

plat_offset,

hdr.length

)

})?;

let aligned_len = raw_len

.checked_add(7)

.map(|v| v & !7)

.ok_or_else(|| {

anyhow::anyhow!(

"Variable header at offset {} has length {} which overflows when aligned",

plat_offset,

hdr.length

)

})?;

let next_offset = data_offset.checked_add(aligned_len).ok_or_else(|| {

anyhow::anyhow!(

"Variable header at offset {} has length {} which overflows when computing next offset",

plat_offset,

hdr.length

)

})?;

if next_offset <= plat_offset {

bail!(

"Variable header at offset {} has non-advancing length {} (aligned to {})",

plat_offset,

hdr.length,

aligned_len

);

}

if next_offset > var_headers.len() {

bail!(

"Truncated variable header at offset {}: length {} (aligned {}) extends past end of table (len {})",

plat_offset,

hdr.length,

aligned_len,

var_headers.len()

);

}

plat_offset = next_offset;

vm/loader/igvmfilegen/src/main.rs

vm/loader/igvmfilegen/src/corim/mod.rs

Copilot · 2026-03-24T18:22:25Z

vm/loader/igvmfilegen/src/corim/cose.rs

+    match major {
+        CborMajorType::UNSIGNED_INT | CborMajorType::NEGATIVE_INT => Ok(off),
+        CborMajorType::BYTE_STRING | CborMajorType::TEXT_STRING => {
+            let end = off + arg as usize;


cbor_skip_item computes end = off + arg as usize without overflow checking. With attacker-controlled CBOR lengths this can wrap and cause incorrect offsets or later panics. Use checked_add (and return an error on overflow) when advancing offsets based on decoded lengths.

Suggested change

let end = off + arg as usize;

let Some(end) = off.checked_add(arg as usize) else {

anyhow::bail!(

"CBOR string length {arg} at offset {offset} overflows usize when added to offset"

);

};

vm/loader/igvmfilegen/src/main.rs

Copilot · 2026-03-24T18:22:26Z

vm/loader/igvmfilegen/src/corim/cose.rs

+        CborMajorType::ARRAY => {
+            for _ in 0..arg {
+                off = cbor_skip_item(data, off)?;
+            }
+            Ok(off)


cbor_skip_item is fully recursive for arrays/maps/tags. A deeply nested (but valid) CBOR input can cause stack overflow and abort the process, which is undesirable when handling untrusted inputs. Consider adding a maximum nesting depth parameter/limit or rewriting this as an iterative walk.

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 6 comments.

vm/loader/igvmfilegen/src/main.rs

Copilot · 2026-03-26T21:06:10Z

vm/loader/igvmfilegen/src/main.rs

+        platform: Option<Platform>,
+        /// Output directory to extract CoRIM payload data. For each matching CoRIM header,
+        /// the payload is written to a file named `corim_document_<N>.cbor` or
+        /// `corim_signature_<N>.cose`, where `<N>` is a zero-based index for that type.


The DumpCorim help says output filenames use a zero-based <N>, but the implementation increments document_count/signature_count before using them, producing 1-based numbering (e.g. corim_document_1.cbor). Please either start counts at 0 when formatting filenames/output, or update the help text to match the 1-based behavior.

Suggested change

/// `corim_signature_<N>.cose`, where `<N>` is a zero-based index for that type.

/// `corim_signature_<N>.cose`, where `<N>` is a 1-based index for that type.

Copilot · 2026-03-26T21:06:11Z

vm/loader/igvmfilegen/src/main.rs

+    fs_err::write(&output, &patched_igvm)
+        .context(format!("writing output IGVM file at {}", output.display()))?;


PatchCorim allows output to equal input for in-place edits, but the implementation writes directly to the target path. A crash/interruption during the write can corrupt the IGVM file. Consider writing to a temporary file in the same directory and then atomically renaming it into place (and/or only allowing in-place updates with an explicit --in-place flag).

vm/loader/igvmfilegen/src/corim/mod.rs

vm/loader/igvmfilegen/src/corim/cose.rs

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…vmfilegen_corim_write

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.

vm/loader/igvmfilegen/src/corim/mod.rs

Copilot · 2026-03-26T21:15:07Z

vm/loader/igvmfilegen/src/main.rs

+    /// Dump CoRIM (Concise Reference Integrity Manifest) headers and payloads from an IGVM file.
+    ///
+    /// This command scans the IGVM variable headers for CoRIM-related entries and prints or
+    /// extracts their contents. By default, all supported CoRIM headers for all platforms found
+    /// in the file are dumped. Use `--header-type` and `--platform` to narrow the selection.
+    ///
+    /// When `--output` is not specified, a human-readable summary of the selected CoRIM headers
+    /// is written to stdout. When `--output <dir>` is provided, the CoRIM payloads are written
+    /// to files in the given directory and the file paths are reported.
+    DumpCorim {


This PR adds new igvmfilegen CLI surface area (dump-corim, patch-corim), but the OpenVMM Guide still has an igvmfilegen entry with an empty link and no dev-tools page under Guide/src/dev_guide/dev_tools/. Please add/update the Guide page and wire it into Guide/src/SUMMARY.md so the new commands are discoverable.

vm/loader/igvmfilegen/src/corim/cose.rs

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

mingweishih added 4 commits March 18, 2026 22:26

igvmfilegen: Support patch CoRIM command

0cc6f16

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

x

e721aff

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

x

7a73dd6

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

Copilot AI review requested due to automatic review settings March 20, 2026 22:28

Copilot started reviewing on behalf of mingweishih March 20, 2026 22:29 View session

Copilot AI reviewed Mar 20, 2026

View reviewed changes

Update vm/loader/igvmfilegen/src/corim/cose.rs

1ac698e

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings March 20, 2026 22:45

Update vm/loader/igvmfilegen/src/main.rs

376601a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot started reviewing on behalf of mingweishih March 20, 2026 22:46 View session

Update vm/loader/igvmfilegen/src/main.rs

a10551a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI reviewed Mar 20, 2026

View reviewed changes

vm/loader/igvmfilegen/src/corim/mod.rs Show resolved Hide resolved

vm/loader/igvmfilegen/src/main.rs Outdated Show resolved Hide resolved

mingweishih added 2 commits March 21, 2026 00:23

update

a7fb55f

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

update

90b9df0

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

Copilot AI review requested due to automatic review settings March 24, 2026 18:00

Copilot started reviewing on behalf of mingweishih March 24, 2026 18:02 View session

Copilot AI reviewed Mar 24, 2026

View reviewed changes

Update vm/loader/igvmfilegen/src/main.rs

b29aa7d

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings March 24, 2026 18:15

Copilot started reviewing on behalf of mingweishih March 24, 2026 18:16 View session

Update vm/loader/igvmfilegen/src/corim/mod.rs

70a36d1

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI reviewed Mar 24, 2026

View reviewed changes

mingweishih and others added 5 commits March 24, 2026 18:47

cleanup

dd1cd20

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

x

7f2b148

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

update

b1ab26b

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

cleanup

36eb149

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

Apply suggestions from code review

2d92c70

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings March 26, 2026 20:59

Copilot started reviewing on behalf of mingweishih March 26, 2026 21:00 View session

Copilot AI reviewed Mar 26, 2026

View reviewed changes

mingweishih and others added 2 commits March 26, 2026 21:07

x

ef5aeec

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

Update vm/loader/igvmfilegen/src/main.rs

17b3f91

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings March 26, 2026 21:08

Copilot started reviewing on behalf of mingweishih March 26, 2026 21:10 View session

mingweishih added 2 commits March 26, 2026 21:11

Merge remote-tracking branch 'origin/igvmfilegen_corim_write' into ig…

80a47aa

…vmfilegen_corim_write

x

7f50bca

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

Copilot AI reviewed Mar 26, 2026

View reviewed changes

update

e5d77b7

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

		igvm = { git = "https://github.com/chris-oo/igvm", branch = "corim-header" }
		igvm_defs = { git = "https://github.com/chris-oo/igvm", branch = "corim-header", default-features = false }

-igvm = { git = "https://github.com/chris-oo/igvm", branch = "corim-header" }
-igvm_defs = { git = "https://github.com/chris-oo/igvm", branch = "corim-header", default-features = false }
+# Temporary fork of igvm/igvm_defs for CORIM header support.
+# Pinned to a specific commit; upstream these changes and return to the
+# crates.io igvm/igvm_defs crates when possible.
+igvm = { git = "https://github.com/chris-oo/igvm", rev = "REPLACE_WITH_CORIM_HEADER_COMMIT_SHA" }
+igvm_defs = { git = "https://github.com/chris-oo/igvm", rev = "REPLACE_WITH_CORIM_HEADER_COMMIT_SHA", default-features = false }

		/// headers. This avoids using `IgvmFile::new_from_binary()` which
		/// cannot parse CoRIM headers.

-    /// headers. This avoids using `IgvmFile::new_from_binary()` which
-    /// cannot parse CoRIM headers.
+    /// headers. This intentionally parses the raw headers instead of using
+    /// `IgvmFile::new_from_binary()` so tests can assert on the exact binary
+    /// layout of the CoRIM-related variable headers and payload ranges.

		let aligned_len = (hdr.length as usize + 7) & !7;
		plat_offset = data_offset + aligned_len;

-            let aligned_len = (hdr.length as usize + 7) & !7;
-            plat_offset = data_offset + aligned_len;
+            let raw_len = usize::try_from(hdr.length).map_err(|_| {
+                anyhow::anyhow!(
+                    "Variable header at offset {} has length {} which does not fit in usize",
+                    plat_offset,
+                    hdr.length
+                )
+            })?;
+            let aligned_len = raw_len
+                .checked_add(7)
+                .map(|v| v & !7)
+                .ok_or_else(|| {
+                    anyhow::anyhow!(
+                        "Variable header at offset {} has length {} which overflows when aligned",
+                        plat_offset,
+                        hdr.length
+                    )
+                })?;
+            let next_offset = data_offset.checked_add(aligned_len).ok_or_else(|| {
+                anyhow::anyhow!(
+                    "Variable header at offset {} has length {} which overflows when computing next offset",
+                    plat_offset,
+                    hdr.length
+                )
+            })?;
+            if next_offset <= plat_offset {
+                bail!(
+                    "Variable header at offset {} has non-advancing length {} (aligned to {})",
+                    plat_offset,
+                    hdr.length,
+                    aligned_len
+                );
+            }
+            if next_offset > var_headers.len() {
+                bail!(
+                    "Truncated variable header at offset {}: length {} (aligned {}) extends past end of table (len {})",
+                    plat_offset,
+                    hdr.length,
+                    aligned_len,
+                    var_headers.len()
+                );
+            }
+            plat_offset = next_offset;

-            let end = off + arg as usize;
+            let Some(end) = off.checked_add(arg as usize) else {
+                anyhow::bail!(
+                    "CBOR string length {arg} at offset {offset} overflows usize when added to offset"
+                );
+            };

	/// `corim_signature_<N>.cose`, where `<N>` is a zero-based index for that type.
	/// `corim_signature_<N>.cose`, where `<N>` is a 1-based index for that type.

		fs_err::write(&output, &patched_igvm)
		.context(format!("writing output IGVM file at {}", output.display()))?;

Conversation

mingweishih commented Mar 20, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development