[haitaohuang]

Summary

• zeroize rebind tokens and responder key/token temporaries
• zeroize owned SPDM VDM payloads and send buffers
• zeroize TLS receive buffers on success, failure, timeout, and cancellation
• preserve existing wire formats and protocol control flow

Testing

Previously validated during branch preparation:

• cargo fmt --check
• cargo xtask lib-test --crates migtd
• TLS and SPDM skip-RA EMU smoke tests
• TLS and SPDM rebind skip-RA tests

[haitaohuang]

CI status note: the previous CI attempt completed 56 checks successfully; all seven non-success jobs were infrastructure failures during Checkout sources (runner disconnects or checkout timeout), before compilation or tests ran.

The branch was retriggered without code/tree changes at d9f6e0c7, and the fresh checks are currently queued.

[haitaohuang]

CI status update: this attempt completed 62 checks successfully. The sole failed check, Build (vmcall-raw / v2 / tls / release), lost hosted-runner communication during Checkout sources, before compilation began. This is an infrastructure failure.

[haitaohuang]

CI status update for the fresh run: SPDM Migration (Skip RA) lost hosted-runner communication during Checkout sources. The migration test did not run, so this is an infrastructure failure.

[haitaohuang]

CI status update: Build (vmcall-vsock / v2 / tls / debug) also lost hosted-runner communication during Checkout sources. It did not reach compilation, so this is another infrastructure failure.

[haitaohuang]

CI status update: Build (vmcall-vsock / v2 / spdm / release) also lost hosted-runner communication during Checkout sources. It did not reach compilation, so this is another infrastructure failure.

[haitaohuang]

CI status update: the final failed job, Build (virtio-vsock / v2 / tls / debug), lost hosted-runner communication during Checkout sources. This attempt completed 59 checks successfully; none of the four failed jobs reached compilation or tests.

[haitaohuang]

CI status update: Policy v2 Key Rotation with IGVM Attest exceeded one hour in Checkout sources. Policy generation and the integration test never ran, so this is an infrastructure failure. Fourteen checks remain active.

[haitaohuang]

CI status update: three additional integration jobs failed during Checkout sources, before setup or tests ran:

• Rebind Prepare (Mock Report)
• SPDM Policy v2 with Mock Report
• CoRIM with Direct Signer Anchor and Certificate Rotation

These are infrastructure failures. Four checks remain active.

[haitaohuang]

CI status update: Build (virtio-vsock / v2 / tls / release) failed after one hour in Checkout sources. Compilation never started, so this is another infrastructure failure. One check remains active.

[haitaohuang]

CI status update: the final job, Build (vmcall-vsock / v1 / spdm / release), also failed after one hour in Checkout sources; compilation never began. The completed attempt had 57 successful checks and six infrastructure-only non-success jobs, so I retriggered CI with an unchanged-tree commit metadata refresh.