Skip to content

Ensure PPCIE verification exits non-zero on failure#148

Open
fallintoplace wants to merge 3 commits into
NVIDIA:mainfrom
fallintoplace:fix/ppcie-verification-exit-codes
Open

Ensure PPCIE verification exits non-zero on failure#148
fallintoplace wants to merge 3 commits into
NVIDIA:mainfrom
fallintoplace:fix/ppcie-verification-exit-codes

Conversation

@fallintoplace

Copy link
Copy Markdown

Summary

  • Replace bare sys.exit() failure paths in PPCIE v1/v2 verification flows with typed exceptions
  • Add explicit top-level handling in verification() to exit with status code 1 on PPCIE verification failures
  • Preserve existing status updates while removing implicit-success exits

Notes

  • This addresses security/CI misclassification where failure paths could return exit 0

@amshinde

amshinde commented Jul 9, 2026

Copy link
Copy Markdown
Collaborator

@fallintoplace Thank you for your contribution!
A couple of things before we can merge:

  • Sign-off required — the commits are missing a Signed-off-by line. We require DCO sign-off on all commits. Please see our Contributing guide (https://github.com/NVIDIA/nvtrust/blob/main/CONTRIBUTE.md).
  • Regression tests — these changes address important bug fixes. Could you add regression tests to cover them?

self.check_if_attestation_report_vbios_version_matches() and \
self.check_if_attestation_report_signature_verified() and \
self.check_if_gpu_attestation_report_cert_chain_fwid_matched and \
self.check_if_gpu_attestation_report_cert_chain_fwid_matched() and \

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch!

(cherry picked from commit 941ce0b)
Signed-off-by: Minh Vu <vuhoangminh97@gmail.com>
(cherry picked from commit b4f9215)
Signed-off-by: Minh Vu <vuhoangminh97@gmail.com>
Signed-off-by: Minh Vu <vuhoangminh97@gmail.com>
(cherry picked from commit fcf72109e899c0e54be92210fe9852358c27582d)
Signed-off-by: Minh Vu <vuhoangminh97@gmail.com>
@fallintoplace fallintoplace force-pushed the fix/ppcie-verification-exit-codes branch from b4f9215 to 5d6a007 Compare July 9, 2026 17:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants