Enable remote backup related tests on HW

[Wenbo Yuan (wenbo-yuan)]

Enable CreateRemoteBackup, RestoreLocalBackup, ResealRemoteBackup, RestoreRemoteBackup on HW with a fake key report (because KeyReport command is not supported on HW for now)

[Copilot]

🟡 Changes recommended

There are a few verified issues in the updated/new test code (misleading documentation, duplicated comments, and missing safety checks) that should be corrected to keep the new HW-enabled test harness maintainable and robust.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR expands TBOR security-domain remote-backup test coverage to run on real hardware by introducing a synthetic (unsigned) KeyReport builder for backends that don’t yet implement TborKeyReport, while keeping the full authenticity-path checks emulator-only.

Changes:

• Add a test-only fake_key_report builder and use it to run SdCreateRemoteBackup, SdRestoreLocalBackup, SdRestoreRemoteBackup, and SdResealRemoteBackup on hardware.
• Introduce shared assertion helpers to accept backend-specific status differences (assert_fw_rejects_any + expect_fw_reject_oob_any).
• Update spec-coverage documentation and refactor test fixtures to use PotaFixture where needed.

File summaries

File	Description
ddi/tbor/types/tests/SPEC_COVERAGE.md	Documents HW+emu coverage for SD remote backup commands and notes emulator-only authenticity checks.
ddi/tbor/types/tests/harness/x509_fixture.rs	Exposes sha384 for reuse and adds PotaFixture helpers for provisioning flows.
ddi/tbor/types/tests/harness/mod.rs	Exposes the new fake_key_report harness module.
ddi/tbor/types/tests/harness/fake_key_report.rs	Adds a synthetic v2 KeyReport encoder for HW-backed tests lacking TborKeyReport.
ddi/tbor/types/tests/harness/ctx.rs	Adds expect_fw_reject_oob_any to handle backend-specific status variation.
ddi/tbor/types/tests/harness/assertions.rs	Adds assert_fw_rejects_any helper for allowed-status matching.
ddi/tbor/types/tests/commands/sd_sealing_key_gen.rs	Switches from file-level cfg to item-level cfg to avoid gating shared fixtures.
ddi/tbor/types/tests/commands/sd_create_remote_backup.rs	Makes CreateRemoteBackup tests backend-agnostic; uses real KeyReport on emu and synthetic report on HW; adds more negative tests.
ddi/tbor/types/tests/commands/sd_restore_remote_backup.rs	Enables restore-remote tests on HW via PotaFixture + backend-agnostic report generation.
ddi/tbor/types/tests/commands/sd_restore_local_backup.rs	Enables restore-local tests on HW via PotaFixture + backend-agnostic report generation.
ddi/tbor/types/tests/commands/sd_reseal_remote_backup.rs	Enables reseal tests on HW via backend-agnostic report generation.
ddi/tbor/types/tests/commands/sd_restore_peer_backup.rs	Threads policy into masked_key_and_report fixture calls.
ddi/tbor/types/tests/commands/sd_create_peer_backup.rs	Threads policy into masked_key_and_report fixture calls.

Review details

• Files reviewed: 13/13 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The changes are test-focused and the main functional approach (synthetic KeyReport on HW with emu-only authenticity checks) is sound, with only minor cleanup nits identified.

Review details

Suppressed comments (3)

Previously missed (3) — in code that hasn't changed since the last review.

ddi/tbor/types/tests/commands/sd_create_remote_backup.rs:557

• This comment is duplicated verbatim (same two lines repeated twice), which is distracting and makes future edits error-prone.
  ddi/tbor/types/tests/harness/fake_key_report.rs:55
• SEC1_PUB_LEN duplicates the same constant already defined in harness::x509_fixture (also 97). Duplicating wire-size constants across test modules risks silent drift if one gets updated.
  ddi/tbor/types/tests/harness/x509_fixture.rs:145
• The sha384 helper is now used for hashing non-certificate bytes (e.g. policy digests), but its doc comment still claims it is specifically for DER certificates / POTA thumbprints, which is misleading for current callers.

• Files reviewed: 13/13 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

New/updated documentation claims “synthetic/unsigned KeyReport” on hardware, but the tests and fixtures in this PR invoke the real KeyReport path, creating internal inconsistencies that should be reconciled before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (2)

ddi/tbor/types/tests/SPEC_COVERAGE.md:169

• The Notes column claims hardware uses a synthetic/unsigned KeyReport, but the corresponding test path (sd_create_remote_backup_roundtrip) obtains the report via the real KeyReport command (masked_key_and_report). Align this note with the actual fixture behavior.

| Happy path returns non-zero remote POK, local POK, and SDMK backups at their exact wire lengths | ✅ (emu + hw) | `sd_create_remote_backup::sd_create_remote_backup_roundtrip` | Hardware uses synthetic unsigned KeyReport |

ddi/tbor/types/tests/SPEC_COVERAGE.md:199

• This paragraph states hardware uses a synthetic KeyReport, but the hw-eligible restore-remote tests in this PR source the sender report from sd_create_remote_backup::masked_key_and_report, which issues the real KeyReport command. Please update this description to match the implementation.

The suite is ungated: the emulator uses a real KeyReport, while hardware uses
the same policy-bound synthetic KeyReport as Create Remote Backup.
Certificate-chain and report-signature authenticity remain emulator-only until
Manticore enables those checks.

• Files reviewed: 10/10 changed files
• Comments generated: 2
• Review effort level: Lite