chore(deps): update weight-custody-manifest requirement from >=0.28.1 to >=0.28.2

[dependabot]

Updates the requirements on weight-custody-manifest to permit the latest version.

Release notes

Sourced from weight-custody-manifest's releases.

WCM 0.28.2 adds a conformance vector format for captures taken from real vendor silicon, and lets a manifest require hardware-reported platform state before the key broker releases a key.

Vendor vectors (kind: vendor, #116). The existing quote vectors use a synthetic PKI. A vendor vector names its root by the SHA-256 of the root's DER, carries the leaf and intermediates inline, and declares which binding its REPORT_DATA asserts. The runner derives six refusal mutations from every accepting capture, so a capture cannot arrive with only a happy path. validity.not_after is derived from the chain and a mismatch is refused (#127). schema/wcm-vendor-vector-v1.schema.json publishes the same rules for implementations in other languages. No captures are committed under the kind yet.

Platform state (#120). snp.py parses PLATFORM_INFO at offset 0x40. The new optional release_policy.platform_integrity can require alias_check_complete (AMD-SB-3015) and ciphertext_hiding, and the KBS denies with a reason naming the bit. Existing manifests keep a byte-identical signing pre-image.

Corrections to SPEC.md 3.6. The Azure SEV-SNP CVM this SDK validates against reports PLATFORM_INFO = 0x25 with ciphertext hiding clear, so it does not meet WCM's own precondition for the semi-trusted-operator claim. The GPU relay path and the description of per-device revocation are corrected too, and new threat T1.9 records the alias-check control and its time-of-check limit.

NVIDIA. NvidiaCcProvider ran end to end on a live H200 in CC mode inside an Intel TDX guest, with a wrong nonce, a tampered body and a stripped chain each refused. The path is now recorded as validated.

Publication (#114). Publishing checks the release tag, SDK version and main-branch ancestry, and scans the source tree and built archives. CodeQL now covers Python and GitHub Actions.

Thanks to Zoheb Shaik for the H200 session, the report-stability measurements, and the not_after fix in #129.

Validation: all ten required checks passed on the release PR (#133). Locally, with #129 merged, 713 tests passed and 4 were skipped, and a freshly built wheel passed all 91 reference conformance vectors. These checks do not establish production readiness or additional hardware assurance.

python -m pip install weight-custody-manifest==0.28.2

Changelog

Sourced from weight-custody-manifest's changelog.

0.28.2 - 2026-09-14

[conformance] validity.not_after on a vendor vector is derived from the certificate chain and a mismatch is refused (issue #127). The field was required and never checked, so it recorded a date rather than constraining one, and expired-at-now is the case that depends on it: a value rounded to the nearest day steps the clock past a date no certificate expires on, the capture still verifies, and the refusal passes having established nothing.

The binding expiry is the earliest in the chain rather than the leaf's, because a path is valid only while every certificate on it is. The committed GCP TDX capture settles that: its PCK intermediate expires 2033-05-21 and its leaf 2033-05-27.

[sdk] Expose the TDX platform floor (issue #117). snp.py parsed the fields a firmware-floor appraisal needs and tdx.py stopped at report_data and mrtd, so a caller wanting the same floor on Intel had to index into raw or skip the appraisal. TdxReport now carries TEE_TCB_SVN and TDATTRIBUTES, parsed once alongside mrtd, with offsets validated against a real GCP c3 TDX quote and cross-checked against this parser's own output on those bytes.

Only byte 0 of TEE_TCB_SVN, the SEAM module SVN, is appraised, and only bit 0 of TDATTRIBUTES. The rest of both fields is carried and not judged: this repository holds two captures reporting 0d 01 08 and 0d 01 04, the same SEAM SVN 13 with a different byte 2, so anything comparing the array whole would order them on a byte nobody can name. A test edits each carried byte and asserts the verdict does not move.

A new PlatformFloor is caller-supplied, as SEV-SNP's already is, with forbid_debug shared across vendors because it is one operator intent expressed twice. Construction rejects invalid configuration with ValueError: seam_svn accepts None or a non-boolean integer from 0 through 255, and forbid_debug requires a boolean. Results have three states, and not_evaluated always names its reason, so an unappraisable platform cannot read as green to anyone aggregating. There is no VMPL analogue on TDX and none is invented. Floor staleness is reported beside the verdict and never inside it, as a stateless per-appraisal observation ({"floor", "reported", "floor_behind"}) with no watermark kept, because a stored high-water mark needs somewhere to live and gives an attacker something to move.

[fixtures] A third Intel TDX capture (issue #117), contributed externally and labelled as such. tdx_quote_gcp_seam15.json is a genuine DCAP v4 quote from a GCP c3-standard-4 confidential VM, taken through configfs TSM directly rather than through a provider, with its kernel, instance type, zone, date and method recorded in the fixture and the run log beside it.

It reports TEE_TCB_SVN 0f 01 0a: SEAM SVN 15 against 13 on both existing captures, with byte 1 unchanged at 1 and byte 2 at 10 against their 8 and 4.

... (truncated)

Commits

• 0e87a60 chore(release): 0.28.2 (#133)
• f378107 fix(conformance): derive validity.not_after from the chain (#127) (#129)
• cc0d5f1 docs: rebuild the landing page around the chain (#132)
• 4647961 docs: bring the docs roadmap in line with the validated hardware matrix (#131)
• e06eeb0 feat(conformance): vendor-evidence vector format (#116) (#124)
• 603bc6b Read and gate hardware-reported platform state, and correct three SPEC 3.6 cl...
• 53b56d6 Gate package publication and harden disclosure checks (#114)
• 718d6e3 docs: make this site the single WCM home (#118)
• cc61206 docs: record the NVIDIA path as validated and name the report-stability trap ...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[imran-siddique]

Reviewed the bounded dependency update and passing CI. The updated dependency is exercised by the existing workflow.