Skip to main content

TEE / SEV-SNP

The TEE path runs PermawebOS in an AMD SEV-SNP environment and exposes evidence through the common ~measurement@1.0 interface plus the SNP backend device ~snp@1.0.

Use this path for server or VM deployments on SEV-SNP-capable hardware. Do not use the LapEE USB write flow or the LapEE provisioner unless the release note explicitly says a specific artifact is shared.

Setup​

Use the release note as the source of truth for:

  • artifact name and download path;
  • image hash and signature;
  • host or guest launch commands;
  • expected verifier policy inputs.

Evidence​

A verifier checks that:

  • the report comes from a genuine SEV-SNP environment;
  • debug and launch policy fields match the intended policy;
  • the launched firmware/kernel/initramfs/config match release expectations;
  • the report binds to the PermawebOS node identity.

TEE evidence is not LapEE TPM evidence. Keep verifier policy specific to the architecture being accepted.