'\" t
.TH "SYSTEMD\-REPORT\-SIGN\-TSM@\&.SERVICE" "8" "" "systemd 262" "systemd-report-sign-tsm@.service"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
systemd-report-sign-tsm@.service, systemd-report-sign-tsm.socket, systemd-report-sign-tsm \- Sign system reports with a confidential\-computing attestation report
.SH "SYNOPSIS"
.PP
systemd\-report\-sign\-tsm@\&.service
.PP
systemd\-report\-sign\-tsm\&.socket
.PP
/usr/lib/systemd/systemd\-report\-sign\-tsm
.SH "DESCRIPTION"
.PP
\fBsystemd\-report\-sign\-tsm@\&.service\fR
is a system service that signs system reports generated by
\fBsystemd-report\fR(1)\&. It is a signing backend for the
\fB\-\-sign=\fR
logic of that tool: it implements the
\fBio\&.systemd\&.Report\&.Signer\&.Sign()\fR
Varlink method and is reached via a socket linked into the
/run/systemd/report\&.sign/
directory, named
tsm\&.
.PP
The service is socket\-activated (one instance per connection) via
systemd\-report\-sign\-tsm\&.socket\&. Rather than signing with a local key, it obtains a hardware\-backed attestation report from the platform\*(Aqs Trusted Security Module (TSM) through the kernel\*(Aqs configfs\-TSM interface at
/sys/kernel/config/tsm/report/\&. The digest passed to it is embedded into the report as its run\-time provided data ("inblob"), cryptographically binding the attestation report to the system report being signed\&.
.PP
The returned signature carries the binary attestation report (the
"outblob"), the name of the TSM provider that generated it (for example
"sev_guest"
for AMD SEV\-SNP or
"tdx_guest"
for Intel TDX), and, where the provider supplies them, supplemental certificate ("auxblob") and manifest ("manifestblob") data\&. A verifier selects the appropriate validation logic based on the provider field\&.
.PP
This backend is only functional inside a confidential virtual machine whose kernel exposes the configfs\-TSM interface (such as AMD SEV\-SNP or Intel TDX guests)\&. On systems where the interface is unavailable the signing operation is reported as unsupported and the mechanism is skipped\&. The service keeps no persistent state\&.
.SH "SEE ALSO"
.PP
\fBsystemd\fR(1), \fBsystemd-report\fR(1)