Add native full-build v2 delta evidence

builder/src/evidence.rs

@@ -378,6 +378,53 @@ pub fn write_build_evidence_v2(
     tee_platform: &str,
     tee_image_measurement_hex_or_none: &str,
     out_evidence: &str,
+) -> ExitCode {
+    write_full_build_evidence_v2(
+        out_dir,
+        snapshot,
+        core_version,
+        builder_git_commit,
+        builder_binary,
+        tee_platform,
+        tee_image_measurement_hex_or_none,
+        out_evidence,
+        rootbundle::BuildKind::Snapshot,
+    )
+}
+
+pub fn write_delta_build_evidence_v2(
+    out_dir: &str,
+    to_snapshot: &str,
+    core_version: &str,
+    builder_git_commit: &str,
+    builder_binary: &str,
+    tee_platform: &str,
+    tee_image_measurement_hex_or_none: &str,
+    out_evidence: &str,
+) -> ExitCode {
+    write_full_build_evidence_v2(
+        out_dir,
+        to_snapshot,
+        core_version,
+        builder_git_commit,
+        builder_binary,
+        tee_platform,
+        tee_image_measurement_hex_or_none,
+        out_evidence,
+        rootbundle::BuildKind::Delta,
+    )
+}
+
+fn write_full_build_evidence_v2(
+    out_dir: &str,
+    snapshot: &str,
+    core_version: &str,
+    builder_git_commit: &str,
+    builder_binary: &str,
+    tee_platform: &str,
+    tee_image_measurement_hex_or_none: &str,
+    out_evidence: &str,
+    expected_build_kind: rootbundle::BuildKind,
 ) -> ExitCode {
     let result = (|| {
         let out_dir = Path::new(out_dir);
@@ -389,8 +436,12 @@ pub fn write_build_evidence_v2(
             .map_err(|e| format!("failed to read {}: {e}", payload_path.display()))?;
         let payload = rootbundle::RootBundlePayload::decode(&payload_bytes)
             .map_err(|e| format!("failed to decode {}: {e}", payload_path.display()))?;
-        if payload.build_kind != rootbundle::BuildKind::Snapshot {
-            return Err("full-build v2 evidence only supports snapshot payloads".into());
+        if payload.build_kind != expected_build_kind {
+            return Err(format!(
+                "full-build v2 evidence expected {}, got {}",
+                build_kind_label(expected_build_kind),
+                build_kind_label(payload.build_kind)
+            ));
         }
 
         let layout = dbpipeline::inspect_existing_onion_layout_v2(out_dir)
@@ -438,6 +489,8 @@ pub fn write_build_evidence_v2(
                 layout_fields.onion_entry_size, layout.entry_size
             ));
         }
+        verify_layout_anchor_and_seeds(&layout_fields, &layout)
+            .map_err(|e| format!("final Onion anchor/seed check failed: {e}"))?;
         let params = rootbundle::BuildParamsV2::current_snapshot(
             layout_fields.index_bins_per_table,
             layout_fields.chunk_bins_per_table,

builder/src/main.rs

@@ -75,6 +75,12 @@ fn main() -> ExitCode {
                 &args[10], &args[11],
             )
         }
+        Some("build-delta-root-bundle-payload-v2") if args.len() == 12 => {
+            root_payload::build_delta_root_bundle_payload_v2(
+                &args[2], &args[3], &args[4], &args[5], &args[6], &args[7], &args[8], &args[9],
+                &args[10], &args[11],
+            )
+        }
         Some("write-build-receipt") if args.len() == 6 => {
             receipt::write_build_receipt(&args[2], &args[3], &args[4], &args[5])
         }
@@ -84,6 +90,11 @@ fn main() -> ExitCode {
         Some("write-build-evidence-v2") if args.len() == 10 => evidence::write_build_evidence_v2(
             &args[2], &args[3], &args[4], &args[5], &args[6], &args[7], &args[8], &args[9],
         ),
+        Some("write-delta-build-evidence-v2") if args.len() == 10 => {
+            evidence::write_delta_build_evidence_v2(
+                &args[2], &args[3], &args[4], &args[5], &args[6], &args[7], &args[8], &args[9],
+            )
+        }
         Some("attest-existing-layout") if args.len() == 10 => evidence::attest_existing_layout(
             &args[2], &args[3], &args[4], &args[5], &args[6], &args[7], &args[8], &args[9],
         ),
@@ -259,9 +270,11 @@ fn usage(bin: &str) {
   {bin} build-root-bundle-payload <out-dir> <network-magic-hex> <chain_anchor.bin> <muhash-display-hex> <index-bins-per-table> <chunk-bins-per-table> <onion-entry-size> <issued-at-unix> <out-payload.bin>\n\
   {bin} build-root-bundle-payload-v2 <out-dir> <network-magic-hex> <chain_anchor.bin> <muhash-display-hex> <index-bins-per-table> <chunk-bins-per-table> <onion-entry-size> <issued-at-unix> <out-payload.bin>\n\
   {bin} build-delta-root-bundle-payload <out-dir> <network-magic-hex> <delta_anchor.bin> <from-muhash-display-hex> <to-muhash-display-hex> <index-bins-per-table> <chunk-bins-per-table> <onion-entry-size> <issued-at-unix> <out-payload.bin>\n\
+  {bin} build-delta-root-bundle-payload-v2 <out-dir> <network-magic-hex> <delta_anchor.bin> <from-muhash-display-hex> <to-muhash-display-hex> <index-bins-per-table> <chunk-bins-per-table> <onion-entry-size> <issued-at-unix> <out-payload.bin>\n\
   {bin} write-build-receipt <signed-root-bundle.bin> <snapshot.dat> <core-version> <out-receipt.txt>\n\
   {bin} write-build-evidence <out-dir> <snapshot.dat> <core-version> <builder-git-commit> <builder-bin> <tee-platform> <tee-image-measurement-hex-or-none> <out-evidence.bin>\n\
   {bin} write-build-evidence-v2 <out-dir> <snapshot.dat> <core-version> <builder-git-commit> <builder-bin> <tee-platform> <tee-image-measurement-hex-or-none> <out-evidence.bin>\n\
+  {bin} write-delta-build-evidence-v2 <out-dir> <to-snapshot.dat> <core-version> <builder-git-commit> <builder-bin> <tee-platform> <tee-image-measurement-hex-or-none> <out-evidence.bin>\n\
   {bin} attest-existing-layout <v1-proof-dir> <artifact-dir> <builder-git-commit> <builder-bin> <tee-platform> <tee-image-measurement-hex-or-none> <issued-at-unix> <out-v2-proof-dir>\n\
   {bin} inspect-build-evidence <build-evidence.bin>\n\
   {bin} verify-build-evidence <build-evidence.bin> [--snapshot <snapshot.dat>] [--builder-bin <path>] [--payload <root-bundle-payload.bin>] [--database-manifest <path>] [--all-artifacts-manifest <path>] [--server-db-manifest <path>] [--expected-muhash <hex>] [--expected-anchor-height <height>] [--expected-anchor-hash <hex>] [--expected-report-data <64-byte-hex>] [--sev-snp-report <report.bin>]\n\

builder/src/root_payload.rs

@@ -463,6 +463,104 @@ pub fn build_delta_root_bundle_payload(
     }
 }
 
+/// Build a delta root payload using the final, scanner-verified Onion v2
+/// layout. Kept separate from the v1 command so existing delta proof output
+/// remains byte-compatible unless explicitly upgraded.
+pub fn build_delta_root_bundle_payload_v2(
+    out_dir: &str,
+    network_magic_hex: &str,
+    delta_anchor_path: &str,
+    from_muhash_display_hex: &str,
+    to_muhash_display_hex: &str,
+    index_bins_per_table: &str,
+    chunk_bins_per_table: &str,
+    onion_entry_size: &str,
+    issued_at: &str,
+    out_payload: &str,
+) -> ExitCode {
+    let result = (|| {
+        let network_magic = parse_hex_array::<4>(network_magic_hex, "network-magic-hex")?;
+        let delta_anchor = rootbundle::DeltaAnchor::load(delta_anchor_path)
+            .map_err(|e| format!("failed to read delta anchor {delta_anchor_path}: {e}"))?;
+        let index_bins_per_table = parse_u32_arg(index_bins_per_table, "index-bins-per-table")?;
+        let chunk_bins_per_table = parse_u32_arg(chunk_bins_per_table, "chunk-bins-per-table")?;
+        let onion_entry_size = parse_u32_arg(onion_entry_size, "onion-entry-size")?;
+        let issued_at = parse_i64_arg(issued_at, "issued-at-unix")?;
+        let out_dir = Path::new(out_dir);
+        let layout = dbpipeline::inspect_existing_onion_layout_v2(out_dir)
+            .map_err(|e| format!("final Onion layout check failed: {e}"))?;
+        if layout.entry_size != onion_entry_size {
+            return Err(format!(
+                "onion entry size mismatch: requested {onion_entry_size}, scanner found {}",
+                layout.entry_size
+            ));
+        }
+        let from_muhash = parse_muhash_display_hex(from_muhash_display_hex)?;
+        let mut payload = root_bundle_payload_from_dir(
+            out_dir,
+            network_magic,
+            rootbundle::BuildKind::Delta,
+            delta_anchor.from,
+            delta_anchor.to,
+            to_muhash_display_hex,
+            index_bins_per_table,
+            chunk_bins_per_table,
+            onion_entry_size,
+            issued_at,
+            vec![rootbundle::NamedRoot {
+                label: "input/from-utxo-muhash".to_owned(),
+                root: from_muhash,
+            }],
+        )?;
+        let params = rootbundle::BuildParamsV2::current_snapshot(
+            index_bins_per_table,
+            chunk_bins_per_table,
+            layout.entry_size,
+            layout.total_packed_entries,
+            layout.index_bins_per_table,
+            layout.chunk_bins_per_table,
+        );
+        payload.params_hash = params.params_hash();
+        let (payload_bytes, payload_sha256) = write_payload_file(&payload, Path::new(out_payload))?;
+        Ok::<_, String>((payload, layout, payload_bytes, payload_sha256))
+    })();
+
+    match result {
+        Ok((payload, layout, payload_bytes, payload_sha256)) => {
+            println!("network_magic={}", hex::encode(payload.network_magic));
+            println!("build_kind=delta");
+            println!("from_anchor_height={}", payload.from_anchor.height);
+            println!(
+                "from_anchor_hash={}",
+                display_hash_hex(&payload.from_anchor.block_hash)
+            );
+            println!("anchor_height={}", payload.anchor.height);
+            println!(
+                "anchor_hash={}",
+                display_hash_hex(&payload.anchor.block_hash)
+            );
+            println!("muhash={to_muhash_display_hex}");
+            println!("params_hash={}", hex::encode(payload.params_hash));
+            println!("params_version=2");
+            println!("onion_total_packed_entries={}", layout.total_packed_entries);
+            println!("onion_index_bins_per_table={}", layout.index_bins_per_table);
+            println!("onion_chunk_bins_per_table={}", layout.chunk_bins_per_table);
+            println!("root_entries={}", payload.roots.len());
+            for root in &payload.roots {
+                println!("root:{}={}", root.label, hex::encode(root.root));
+            }
+            println!("payload_bytes={payload_bytes}");
+            println!("payload_sha256={}", hex::encode(payload_sha256));
+            println!("payload_path={out_payload}");
+            ExitCode::SUCCESS
+        }
+        Err(e) => {
+            eprintln!("error: {e}");
+            ExitCode::from(1)
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;