[dependabot]

Updates the requirements on weight-custody-manifest to permit the latest version.

Release notes

Sourced from weight-custody-manifest's releases.

WCM 0.33.1

Two security fixes. Full detail in CHANGELOG.

• GHSA-5mg4-8gw3-3xmm: the GPU report verifier now reads measurement values from the signed SPDM opaque data and device certificate, instead of matching the pin against a requester-written GpuReport.measurement field that no signature covered.
• GHSA-99p4-597j-8m5m: canonicalize refuses any string or key that is not already NFC, instead of NFC-normalizing before signing. NFC input canonicalizes exactly as before, so existing signatures over NFC text keep verifying.

SDK on PyPI as weight-custody-manifest 0.33.1.

Changelog

Sourced from weight-custody-manifest's changelog.

0.33.1 - 2026-10-19

Fixed, security (GHSA-99p4-597j-8m5m). The canonicalizer NFC-normalized every string before signing, so the NFC and NFD spellings of a value, or two keys that normalize alike, produced one pre-image. On a byom-symmetric manifest whose builder identity spelled an accented character precomposed (U+00E9) and whose custodian spelled it decomposed (U+0065 U+0301), flipping only the custodian's spelling moved verify_manifest() from rejection to acceptance on unchanged signatures. canonicalize now refuses any string or key that is not already NFC instead of normalizing it. NFC input canonicalizes exactly as RFC 8785 does, so existing signatures over NFC text keep verifying; none of the 183 JSON and YAML files in this repository contain non-NFC text. A signature block over non-NFC text now fails with the refusal as its reason. Reported privately by @​solloek369-arch.

Fixed, security (GHSA-5mg4-8gw3-3xmm). With a GPU report verifier configured, the key broker matched required_gpu_measurement.rim_pin against GpuReport.measurement, a field the requester writes and no signature covers. The verifier checked the report's chain, signature and nonce but read no measurement from it, so one genuine signed report satisfied any pin: changing only that string moved the decision from refusal to release. The verifier now reads the driver version and VBIOS version from the SPDM opaque data inside the signed report, takes the architecture from the verified device certificate, and returns nvidia-rim:arch=<A>;driver=<D>;vbios=<V>, the identity tools/nvat_adapter.py already emits. The broker compares the pin against that value and ignores the structured claim. A verified report whose identity cannot be read (no SPDM response, a missing or repeated field, an unknown chip) is refused when a pin is set. Manifests pinned from nvat_adapter.py output need no change; a pin in any other form no longer matches a verified report. The path without a GPU verifier, reachable only when the manifest waives evidence verification and confidential-compute mode, still compares the structured field. This binds the pin to what the signed report states; it is not a RIM golden-value appraisal. Reported privately by @​solloek369-arch.

0.33.0 - 2026-10-18

Fixed, security (GHSA-x3w3-7mvg-hxw5), breaking. KeyBrokerService now defaults to require_channel_binding=True. A caller that constructed it without the flag got the model key back in the clear, so a relay that forwarded a live, valid quote could collect it. The shipped server and broker receiver already set the flag and are unaffected. Evidence must now carry an attested transport_public_key, and a release returns only sealed_key. EnclaveSession.from_release takes a new transport_private_key argument and opens the sealed key itself; before this it could not start custody from a sealed release at all. Pass require_channel_binding=False to restore the unsealed shape; the conformance runner keeps its per-vector setting. Reported by Muhammad Usama Sardar.

Added, security (GHSA-jr5r-w684-fg5m). Opt-in hardware-instance pinning. KeyBrokerService(allowed_platform_instances=...) and the server's

... (truncated)

Commits

• 9153f39 fix(security): weight-custody-manifest 0.33.1 (GPU measurement binding, refus...
• 042b168 build(deps): bump github/codeql-action/upload-sarif (#214)
• 0ddbe65 test: guard workflow OIDC permission drift (#210)
• c4c656b chore(release): 0.33.0 (#212)
• c8d39ad fix(challenge): avoid repeated dict prefix scans during expiry pruning (#209)
• 28a5b95 fix(kbs): seal released keys by default and add opt-in chip pinning (#211)
• 559b776 fix: explain missing Azure vTPM prerequisites when hardware is required (#201)
• 45aa944 feat: add opt-in required signer role bindings (#194)
• 5c5f993 docs(papers): add the published report sources (#208)
• 973abd1 docs(changelog): repoint the moved-demos link to integrations (#207)
• Additional commits viewable in compare view

[rajnisht7]

@dependabot rebase

[carloshvp]

Reviewed current head d1e4470bc686e245fd56360f6bb8e2a054ee45d3.

The human-facing dependency floor changes, but the generated CI lock still installs weight-custody-manifest==0.32.0. demos/requirements/ci.in includes ../requirements.txt, and the demos workflow installs only the hash-required requirements/ci.txt; its green job therefore does not exercise the dependency change in this PR. Regenerate the CI lock from its input, retain universal platform markers, and rerun the demos plus pip check against the resulting compatible released environment. Do not treat the old locked run as validation of the new floor.

Prepared with OpenAI Codex.

[carloshvp]

[P2] Regenerate the demo CI lock with this floor. CI still installs weight-custody-manifest==0.32.0 from demos/requirements/ci.txt, below this new requirement, because the workflow never installs this loose file. Update the generated lock and test that installed environment so users and CI exercise the same dependency contract.

[dinakarjs]

I regenerated demos/requirements/ci.txt with the documented universal Python 3.11 command and tested the actual WCM 0.33.1 environment. Hash-required installation, dependency consistency and all 47 demo tests pass, but sequential execution now exposes a real migration blocker: demo 6 prints gate released key : False and then EnclaveSession.from_release raises ValueError: cannot start custody: the release decision has no key. Inspection of the release decision identifies the failed channel_binding check: evidence has no transport_public_key. The unchanged CI lock previously hid this failure by installing 0.32.0.

Keep this upgrade blocked until the WCM demos supply and consume the supported channel-bound release, with refusal controls; do not disable channel binding to make them green. Regenerate the lock and rerun demos 1–10 against the final environment. This is a software/mock reproduction, not hardware evidence. Prepared with Codex.

[dinakarjs]

The migration blocker above now has a concrete DCO-signed repair: dinakarjs#11, commit 44876b6c3857a228f3d399617455ab4a506c5845. Demos 6/7/9 bind recipient transport keys and consume sealed releases without disabling channel binding. Demo 7 explicitly discloses its software-only quote/GPU-verification waiver, matching the existing mock profiles in demos 6/9.

Fresh WCM 0.33.1 hash-locked environment: all 56 tests and all ten demos pass. Nine focused controls cover valid/missing/wrong recipients; restoring the old demo code makes all three positive controls fail. The companion records the full scope and limits. Please adopt and rerun hosted CI; my changes-requested review stays until this upstream head is corrected and independently reviewed. No hardware/production assurance claim. Prepared with Codex.