feat(gcp-cvm): add GCP confidential image build kit

[Wilbert957]

Build a hardened, measured, remotely-attestable GCP (Intel TDX) confidential image for 0g-tapp from a stock Ubuntu 24.04 cloud image, using cryptpilot for measured FDE.

What's here

• gcp-cvm/build-gcp-tapp.sh — one-command pipeline: base provisioning (tapp-server + Docker + Intel SGX/libtdx-attest + config + DNS) → kernel swap (generic → gcp, for RTMR extend) → cryptpilot-convert → ESP grub sync → optional security hardening. Toggle with HARDEN=1|0.
• gcp-cvm/prepare-gcp-tapp.sh / gcp-cvm/fix-esp-grub.sh — stage-B-only (kernel + convert + ESP) and ESP-only helpers, reused by the main pipeline.
• gcp-cvm/cryptpilot-gcp-boot-fix.md — root-cause analysis + full reproducible SOP + integrity notes, covering the four problems we hit (boot crash from GCP's dual grub.cfg, read-only rootfs / RTMR-not-extended, runtime RTMR extend failure, broken DNS) and the convert-side issues to confirm with the cryptpilot maintainers.
• gcp-cvm/README.md, gcp-cvm/config_dir/fde.toml, root README.md pointer, .gitignore for *.deb/*.qcow2.

Two image variants (same base, same pipeline)

	hardened (HARDEN=1)	dev (HARDEN=0)
Purpose	production	debugging
ssh / cloud-init / google agents / snapd / …	removed	kept
google-guest-agent (GCP SSH key injection)	omitted by design → not SSH-reachable	installed → SSH works
kernel / gve / cryptpilot / tapp-server v0.1.0	identical	identical

google-guest-agent is a back-door-class component (it can push changes into the instance from outside the measured app), so the hardened image is intentionally not SSH-reachable; the dev image reinstalls it (+ a 169.254.169.254 metadata.google.internal /etc/hosts entry, needed because the build pins resolv.conf to public DNS) to restore SSH.

§0 reproducibility note

The regression was run from the truly-official Ubuntu cloud image, which revealed that the previously-used temp-fixed.qcow2 base was not a pristine "official + gVNIC" image — it also carried (1) the root partition resized to 20 GiB and (2) google-guest-agent. Both are now documented in §0 and handled by the build, so the image is reproducible from the official image alone.

Companion fix

The cryptpilot show-reference-value fix for never-booted images (empty grubenv / missing saved_entry) is openanolis/cryptpilot#128.

Binaries are gitignored; tapp-server is pulled from release v0.1.0.

🤖 Generated with Claude Code

[Wilbert957]

✅ Reviewed. Pure shell scripts + docs, no Rust code changes — no compilation impact.

• build-gcp-tapp.sh / prepare-gcp-tapp.sh / fix-esp-grub.sh: well-structured, proper set -euo pipefail, env-var overrides for all paths.
• Security hardening (§11): thorough purge of ssh/cloud-init/google-guest-agent/snapd/etc. Masking getty + MAC-agnostic netplan is correct.
• .gitignore correctly excludes *.qcow2 / *.deb / disk.raw.
• cryptpilot-gcp-boot-fix.md: detailed root-cause analysis + SOP.

One suggestion: cryptpilot-fde_0.7.0_amd64.deb is referenced but gitignored — consider adding a sha256sum check in the build script to verify the deb when present. Not blocking.

LGTM.

[Wilbert957]

Read through all three scripts + fde.toml + the smoke test. Agree with the LGTM — well-structured defensive shell (consistent set -euo pipefail, env overrides, required-arg checks, trap cleanup, guestfish layout asserts), clean two-variant design, and the QEMU/OVMF smoke test is a genuinely useful pre-flight. A few notes:

Worth confirming before treating any output as a production image

• config_dir/fde.toml hardcodes a literal passphrase:

  [data.encrypt.exec]
  command = "echo"
  args = ["-n", "test-passphrase"]

  Even if this data volume is inert here ([data] integrity = false + build uses --rootfs-no-encryption, so rootfs is verity-only), baking test-passphrase into the image-build config is a smell. Can we confirm it's never exercised, or swap it for a real key provider for prod?

Non-blocking / follow-up

• No checksum on downloaded inputs: tapp-server (wget) and FDE_PACKAGE (deb). The measured image catches post-build tampering, but a sha256sum on both inputs is cheap defense-in-depth (extends the deb suggestion already raised).
• build-gcp-tapp.sh mutates $IN in place (stage A operates on the input directly), whereas prepare-gcp-tapp.sh defaults to a protective copy. The trailing echo warns about it, but given the (in, out) signature this is a footgun — consider copying first or announcing the in-place destruction up front.
• Partition layout is hardcoded (base sda1; post-convert sda15=ESP / sda16=boot). Fine for GCP Ubuntu images, and the is-file/is-dir asserts fail loudly on mismatch rather than writing the wrong partition. OK as-is.

Naming nit (in favor): gcp-cvm/ is correct here — this genuinely builds a GCP-specific image, distinct from the verification side which is platform-agnostic. Don't let anyone "unify" it away.