Skip to content

Add Pluton attestation APIs - #7262

Open
nguyenteresaMSFT wants to merge 5 commits into
Azure:mainfrom
nguyenteresaMSFT:main
Open

Add Pluton attestation APIs#7262
nguyenteresaMSFT wants to merge 5 commits into
Azure:mainfrom
nguyenteresaMSFT:main

Conversation

@nguyenteresaMSFT

Copy link
Copy Markdown

Implementing changes for Pluton attestation support.

Copilot AI review requested due to automatic review settings July 28, 2026 20:06
@github-actions github-actions Bot added Attestation Community Contribution Community members are working on the issue customer-reported Issues that are reported by GitHub users external to the Azure organization. labels Jul 28, 2026
@github-actions

Copy link
Copy Markdown

Thank you for your contribution @nguyenteresaMSFT! We will review the pull request and get back to you soon.

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 2 pipeline(s).
8 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds initial Pluton attestation support to the Azure Security Attestation C++ client library by introducing a new AttestPluton public API and factoring shared TPM/Pluton request/response handling into a common helper.

Changes:

  • Added AttestationClient::AttestPluton plus corresponding AttestPlutonOptions and PlutonAttestationResult public types.
  • Refactored TPM attestation implementation to use a shared AttestBackend<ResultT> helper for both TPM and Pluton.
  • Generalized the TPM payload (de)serializer naming for reuse across TPM and Pluton.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file
File Description
sdk/attestation/azure-security-attestation/src/private/attestation_deserializers_private.hpp Renames the TPM serializer struct for shared TPM/Pluton usage.
sdk/attestation/azure-security-attestation/src/private/attestation_deserializers_private.cpp Updates serializer implementation to match the new shared serializer name.
sdk/attestation/azure-security-attestation/src/attestation_client.cpp Introduces AttestBackend helper and adds AttestPluton implementation.
sdk/attestation/azure-security-attestation/inc/azure/attestation/attestation_client.hpp Exposes AttestPluton publicly and declares the private AttestBackend helper.
sdk/attestation/azure-security-attestation/inc/azure/attestation/attestation_client_options.hpp Adds AttestPlutonOptions.
sdk/attestation/azure-security-attestation/inc/azure/attestation/attestation_client_models.hpp Adds PlutonAttestationResult.

Comment thread sdk/attestation/azure-security-attestation/src/attestation_client.cpp Outdated
*/
Response<Models::PlutonAttestationResult> AttestPluton(
std::vector<uint8_t> const& dataToAttest,
AttestPlutonOptions const& options = AttestPlutonOptions{},

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I want to confirm: All the default options in the AttestPlutonOptions are going to be ignored by the client? In other words, there is no semantic difference between an option being empty and the options being not present.

Normally options bags are expressed as azure_core::Nullable<AttestPlutonOptions> to make the difference between "no options specified" and "options were specified and these are the values".

I understand that there are no options today but there may be options in the future and making this field non-Nullable constrains the values that can be put in the Options bag.

@nguyenteresaMSFT nguyenteresaMSFT Jul 30, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, since this is the same approach used for AttestTpmOptions, I decided to keep this implementation for consistency.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Attestation Community Contribution Community members are working on the issue customer-reported Issues that are reported by GitHub users external to the Azure organization.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants