feat(attestation)!: pin verification to archived collateral with VerifyMode

crates/attestation/README.md

@@ -21,6 +21,14 @@ returns `ExpectedMeasurements::Image`, while an allow-any DCAP policy returns
 `ExpectedMeasurements::Dcap` with an empty register map. Successful
 verification without attestation returns `None`.
 
+`VerifiedAttestation` also carries an `EndorsementSnapshot`: the DCAP
+collateral bundle the verification consumed and the instant its freshness
+checks were evaluated at. Archived beside the evidence, it lets
+`AttestationVerifier::verify_attestation_archived` reproduce the verdict later,
+against that bundle and at that instant, without fetching anything whose answer
+could have changed since. This is for re-verifying archived evidence, not for
+verifying live evidence with collateral obtained out of band.
+
 Matched expected measurements can be transported in an HTTP header using
 `ExpectedMeasurements::to_header_format` and reconstructed with
 `ExpectedMeasurements::from_header_format`. See

crates/attestation/src/azure/attester/mod.rs

@@ -20,7 +20,6 @@ use super::{
     ak_certificate::verify_ak_cert_with_azure_roots,
     ensure_azure_attestation_payload_size,
     tpm_quote::TpmQuote,
-    unix_time_now_secs,
 };
 
 /// Used in attestation type detection to check if we are on Azure
@@ -48,6 +47,10 @@ const AIA_CA_ISSUERS_ACCESS_METHOD_OID: &str = "1.3.6.1.5.5.7.48.2";
 /// need network access or AIA-fetching logic. This keeps verification
 /// deterministic and easier to reuse in constrained verifier environments
 /// such as TEEs, onchain verification, or zero-knowledge proof generation.
+fn unix_time_now_secs() -> Result<u64, MaaError> {
+    Ok(std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH)?.as_secs())
+}
+
 pub fn create_azure_attestation(input_data: [u8; 64]) -> Result<Vec<u8>, MaaError> {
     let hcl_report_bytes = vtpm::get_report_with_report_data(&input_data)?;
 

crates/attestation/src/azure/mod.rs

@@ -15,7 +15,12 @@ use thiserror::Error;
 use tpm_quote::TpmQuote;
 pub use tpm_quote::TpmQuoteError;
 pub use tpms_attest::AttestError;
-pub use verify::{get_measurements, verify_azure_attestation, verify_azure_attestation_sync};
+pub use verify::{
+    get_measurements,
+    verify_azure_attestation,
+    verify_azure_attestation_archived,
+    verify_azure_attestation_sync,
+};
 
 /// The attestation evidence payload that gets sent over the channel
 #[derive(Debug, Serialize, Deserialize)]
@@ -103,10 +108,6 @@ where
     Ok(certificates)
 }
 
-fn unix_time_now_secs() -> Result<u64, MaaError> {
-    Ok(std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH)?.as_secs())
-}
-
 /// An error when generating or verifying a Microsoft Azure vTPM attestation
 /// (MAA is short for Microsoft Azure Attestation)
 #[derive(Error, Debug)]