Secure boot attestation in a cloud platform

A method, comprising:

• receiving, by a system comprising a processor, in association with a user account, an operating system image that is encrypted with a private key, a manifest generated from a first instance of a manifest generator tool that is configured to identify system provisioning artifacts from installing the operating system image that is encrypted with the private key, and a public key that corresponds to the private key;
• installing, by the system, the operating system image on a device;
• generating, by the system and with a second instance of a manifest generator tool, a first identification of system provisioning artifacts from the installing of the operating system image on the device;
• and
• sending, by the system, the first identification of system provisioning artifacts to an attestation service, wherein the attestation service is configured to compare the first identification of system provisioning artifacts with a second identification of system provisioning artifacts received in association with the user account, and send, for access via the user account, an indication of whether the first identification of system provisioning artifacts matches the second identification of system provisioning artifacts.

A non-transitory computer-readable medium comprising instructions that, in response to execution, cause a system comprising a processor to perform operations, comprising:

• receiving, as a result of usage of a user account, an operating system image that is encrypted with a private key, a manifest generated from a first instance of a manifest generator tool that is configured to identify system provisioning artifacts from installing the operating system image that is encrypted with the private key, and a public key that corresponds to the private key;
• installing the operating system image on equipment;
• generating, with a second instance of the manifest generator tool, a first identification of system provisioning artifacts from installing the operating system image on the equipment;
• and
• sending the first identification of system provisioning artifacts to an attestation service, wherein the attestation service is configured to compare the first identification of system provisioning artifacts with a second identification of system provisioning artifacts received in association with the user account, and send, for access via the user account, an indication of whether the first identification of system provisioning artifacts matches the second identification of system provisioning artifacts.