Igvmfilegen: Support CoRIM generation and patch command by mingweishih · Pull Request #3088 · microsoft/openvmm

Ming-Wei Shih (mingweishih) · 2026-03-20T22:28:26Z

This PR adds the support of writing CoRIM to an existing IGVM file, allowing for injecting the CoRIM files post build in the pipeline.

By IGVM design, a signed CoRIM is expected to be broken into payload and signed envelope with payload detached and written into CORIM_DOCUMENT and CORIM_SIGNATURE entries correspondingly. The idea is decoupling the payload generation and the signing process. However, given that the CoRIM detached signing might not always be supported by the signing infrastructure, the tool additionally supports taking a signed CoRIM as input and handles the decoupling before writing to the IGVM file.

Copilot

Pull request overview

Adds CoRIM (Concise Reference Integrity Manifest) patching/extraction capabilities to igvmfilegen, enabling post-build injection of CoRIM document/signature data into an existing IGVM file (including support for splitting bundled COSE_Sign1 inputs).

Changes:

Add new DumpCorim and PatchCorim CLI subcommands to inspect and patch CoRIM headers in IGVM files.
Introduce a new corim module implementing IGVM directive patching plus minimal COSE_Sign1 split/validation utilities (with unit tests).
Switch igvm/igvm_defs workspace deps to a git fork/branch that includes the required CoRIM header support.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
vm/loader/igvmfilegen/src/main.rs	Adds new CLI commands and implements CoRIM header dumping/patching entrypoints.
vm/loader/igvmfilegen/src/corim/mod.rs	Adds IGVM-level CoRIM patching logic and compatibility-mask helpers.
vm/loader/igvmfilegen/src/corim/cose.rs	Adds COSE_Sign1 parsing/splitting/validation helpers plus unit tests.
vm/loader/igvmfilegen/Cargo.toml	Adds `open_enum` dependency for the new COSE/CBOR helpers.
Cargo.toml	Switches `igvm` and `igvm_defs` from crates.io to a git fork/branch.
Cargo.lock	Updates lock entries for the new git-based `igvm` crates and incidental dependency resolution changes.

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 4 comments.

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 7 comments.

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 6 comments.

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 17 out of 18 changed files in this pull request and generated 4 comments.

Copilot

Pull request overview

Copilot reviewed 17 out of 18 changed files in this pull request and generated 8 comments.

+igvm = { git = "https://github.com/mingweishih/igvm", rev = "c389b9f", features = ["corim"] }
+igvm_defs = { git = "https://github.com/mingweishih/igvm", rev = "c389b9f", default-features = false }


Copilot

Pull request overview

Copilot reviewed 17 out of 18 changed files in this pull request and generated 3 comments.

Ming-Wei Shih (mingweishih) · 2026-06-12T21:03:57Z

Review responses

High-Impact issues:

igvm git pin - Leave as-is
The pinning is required because the PR consumes the upstream CoRIM support that has not been released yet. Will switch back to crate.io version once new release ships.
SNP SevVmsa size loosening - Leave as-is
The zero padding is introduced by upstream igvm (igvm: Update SevVmsa structure definition. Pad to full 4K. igvm#109). There is no impact on the measurement because SNP's calculation always operates on 4k pages.
libssl-dev in build_igvmfilegen.rs - Leave as-is
Kept for consistency with the existing build_vmgstool.rs pattern. Will revisit as a cleanup follow-up.

Behavior nuances worth surfacing

bundle/IGVM-doc mismatch produces an opaque crypto error - Fixed
Add explicit comparison between the CoRIM document from the bundle against the built-in one and provider clearer error message.
re-anchoring CorimDocument at the tail - Comment updated
igvm only enforces that CorimDocument appears before CorimSignature for the same mask. There are no constraints on ordering relative to other init headers.
VBS vs CoRIM algorithm difference. - Won't Fix
The comment is incorrect - VBS and CoRIM signing targets different payload.
test vs prod crypto backend - Won't Fix
Following the existing patterns.

Minor

unreachable! in build_endorsement_json. - Leave as-is
The suggestion requires significant refactoring. Not worth.
Platform CLI enum duplication. - Leave as-is
The duplication is intentional to isolate clap-derive concerns from the upstream IgvmPlatformType type.
pinning corim = "=0.1.3" - Leave as-is
Following the project pattern. The dependency is tracked by Cargo.lock that effectively does the pinning.
SNP_FAMILY_ID/SNP_IMAGE_ID byte-identity - Fixed
Add a test case to prevent any change to the identity values.

Test Coverage

CRC32 round-trip assertion. - Added test cases

Petri failures

failures are unrelated to this PR.

github-actions · 2026-06-12T23:31:54Z

1 Petri tests failed (1 unstable)

Copilot

Pull request overview

Copilot reviewed 23 out of 24 changed files in this pull request and generated 2 comments.

github-actions · 2026-06-18T02:31:13Z

3 Petri tests failed (2 unstable)

Copilot

Pull request overview

Copilot reviewed 23 out of 24 changed files in this pull request and generated 1 comment.

github-actions · 2026-06-22T23:16:39Z

1 Petri tests failed (0 unstable)

github-actions · 2026-06-30T02:03:05Z

1 Petri tests failed (0 unstable)

Copilot

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated no new comments.

github-actions · 2026-07-21T05:36:32Z

11 Petri tests failed (1 unstable)

Copilot

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated no new comments.

Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>

Copilot

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

vm/loader/igvmfilegen/src/platform_mask.rs:102

Doc comment says this returns a "lowercase" platform name, but the fallback path can return platform_{platform:?} via isolation_label, which is not necessarily lowercase (e.g., platform_Native, platform_SEV_SNP). Either normalize the fallback to lowercase or adjust the docs so callers don't rely on lowercase output.

/// Map a compatibility mask to a lowercase platform name suitable for use in
/// file names. Returns the platform's canonical short name (`"vbs"`, `"snp"`,
/// `"tdx"`) when the mask matches a known platform header; otherwise
/// `platform_<Debug>` for a matching header whose platform type has no
/// canonical short name, or `mask_0x<hex>` if the mask matches no platform
/// header at all.

github-actions · 2026-07-21T22:58:01Z

2 Petri tests failed (1 unstable)

Copilot AI review requested due to automatic review settings March 20, 2026 22:28

Copilot started reviewing on behalf of Ming-Wei Shih (mingweishih) March 20, 2026 22:29 View session

Copilot AI reviewed Mar 20, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings March 20, 2026 22:45

Copilot started reviewing on behalf of Ming-Wei Shih (mingweishih) March 20, 2026 22:46 View session

Copilot AI reviewed Mar 20, 2026

View reviewed changes

Comment thread vm/loader/igvmfilegen/src/corim/mod.rs Outdated

Comment thread vm/loader/igvmfilegen/src/main.rs Outdated

Copilot AI review requested due to automatic review settings March 24, 2026 18:00

Copilot started reviewing on behalf of Ming-Wei Shih (mingweishih) March 24, 2026 18:02 View session

Copilot AI reviewed Mar 24, 2026

View reviewed changes

Comment thread vm/loader/igvmfilegen/src/main.rs Outdated

Comment thread vm/loader/igvmfilegen/src/main.rs Outdated

Comment thread vm/loader/igvmfilegen/src/corim/mod.rs Outdated

Comment thread vm/loader/igvmfilegen/src/corim/mod.rs Outdated

Copilot AI review requested due to automatic review settings March 24, 2026 18:15

Copilot started reviewing on behalf of Ming-Wei Shih (mingweishih) March 24, 2026 18:16 View session

Copilot AI reviewed Mar 24, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings March 26, 2026 20:59

Copilot started reviewing on behalf of Ming-Wei Shih (mingweishih) March 26, 2026 21:00 View session

Copilot AI reviewed Mar 26, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings March 26, 2026 21:08

Copilot started reviewing on behalf of Ming-Wei Shih (mingweishih) March 26, 2026 21:10 View session

Copilot AI reviewed Mar 26, 2026

View reviewed changes

Comment thread vm/loader/igvmfilegen/src/corim_signature/mod.rs

Comment thread vm/loader/igvmfilegen/src/main.rs

Comment thread vm/loader/igvmfilegen/src/corim/cose.rs Outdated

Ben Hillis (benhillis) added the enhancement New feature or request label Apr 6, 2026

Copilot AI review requested due to automatic review settings May 29, 2026 18:46

Copilot started reviewing on behalf of Ming-Wei Shih (mingweishih) May 29, 2026 18:46 View session

Copilot AI reviewed May 29, 2026

View reviewed changes

Comment thread vm/loader/igvmfilegen/src/measurement_diag.rs

Comment thread vm/loader/igvmfilegen/src/main.rs Outdated

Comment thread vm/loader/igvmfilegen/src/main.rs Outdated

Comment thread Cargo.toml Outdated

Ming-Wei Shih (mingweishih) force-pushed the igvmfilegen_corim_write branch from 568d310 to 6c10547 Compare May 29, 2026 19:14

Copilot AI review requested due to automatic review settings May 29, 2026 19:24

Ming-Wei Shih (mingweishih) force-pushed the igvmfilegen_corim_write branch from 6c10547 to 6e2ff44 Compare May 29, 2026 19:24

Copilot started reviewing on behalf of Ming-Wei Shih (mingweishih) May 29, 2026 19:24 View session

Copilot AI reviewed May 29, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings May 30, 2026 05:12

Copilot started reviewing on behalf of Ming-Wei Shih (mingweishih) May 30, 2026 05:12 View session

Copilot AI reviewed May 30, 2026

View reviewed changes

Comment thread vm/loader/igvmfilegen/src/measurement_diag.rs

Comment thread vm/loader/igvmfilegen/src/main.rs

Comment thread Cargo.toml Outdated

Ming-Wei Shih (mingweishih) force-pushed the igvmfilegen_corim_write branch from 3a7b319 to eaf8b8f Compare June 12, 2026 18:30

Ming-Wei Shih (mingweishih) requested review from Copilot and Mike Ebersol (mebersol) June 12, 2026 23:34

Ming-Wei Shih (mingweishih) force-pushed the igvmfilegen_corim_write branch from eaf8b8f to fd8b2ed Compare June 17, 2026 20:48

Copilot started reviewing on behalf of Ming-Wei Shih (mingweishih) June 17, 2026 20:50 View session

Copilot AI reviewed Jun 17, 2026

View reviewed changes

Comment thread vm/loader/igvmfilegen/src/measurement_diag.rs

Comment thread vm/loader/igvmfilegen/src/main.rs Outdated

Ming-Wei Shih (mingweishih) force-pushed the igvmfilegen_corim_write branch from fd8b2ed to 224346f Compare June 17, 2026 21:00

Copilot AI review requested due to automatic review settings June 22, 2026 22:03

Ming-Wei Shih (mingweishih) force-pushed the igvmfilegen_corim_write branch from 224346f to bf3969b Compare June 22, 2026 22:03

Copilot started reviewing on behalf of Ming-Wei Shih (mingweishih) June 22, 2026 22:04 View session

Copilot AI reviewed Jun 22, 2026

View reviewed changes

Comment thread vm/loader/igvmfilegen/src/measurement_diag.rs