Flexible container attestation

A processor comprising:

• first circuitry to receive binary code and a plurality of parameters indicated by the binary code, the plurality of parameters including information corresponding to a secured container;
• and
• second circuitry to perform operations corresponding to the binary code, including to:
• access a hardware-based key;
• determine a measurement of contents of the secured container;
• generate a report according to a defined report format, wherein the defined report format includes:
• a field to include the measurement;
• a version of the secured container supported by a platform;
• a version of firmware to be used for the secured container;
• and
• a type of a central processing unit (CPU) to be used to execute the secured container;
• and
• store the report in memory.

At least one machine-readable storage medium storing binary code, the binary code to indicate a plurality of parameters, including information corresponding to a secured container, the binary code executable by a machine to cause the machine to perform operations corresponding to the binary code, including to:

• access a hardware-based key;
• determine a measurement of contents of the secured container;
• generate a report according to a defined report format, wherein the defined report format includes:
• a field to include the measurement;
• a version of the secured container supported by a platform;
• a version of firmware to be used for the secured container;
• and
• a type of a central processing unit (CPU) to be used to execute the secured container;
• and
• store the report in memory.

An apparatus comprising:

• a processor comprising:
• a cache;
• a fetch unit to fetch an instruction of an instruction set of the processor;
• a decoder coupled with the fetch unit, the decoder to decode the instruction;
• and
• circuitry coupled with the decoder, the circuitry to perform operations corresponding to the instruction, including to:
• obtain first measurements of contents and configuration of a trust domain to be launched on a computing platform, wherein the trust domain includes a software container in which software is to be run;
• obtain second measurements of the computing platform;
• obtain a data integrity code generated from a key accessible only to a particular processor of the computing platform;
• and
• generate an integrity-protected trust domain report structure for the trust domain, wherein the integrity-protected trust domain report structure has a defined report structure and comprises the first measurements, the second measurements, and the data integrity code generated from the key, wherein the key comprises a message authentication code (MAC) key.