In the measurement policy JSON format, you can omit the measurement constraints, which will mean 'allow any measurements with this attestation type' .
Unknown fields are also ignored, so a typo in the JSON field name such as measurments can silently turn a constrained policy into one that accepts any measurements for the selected attestation type.
Rejecting all unknown fields would catch this, but would make forwards compatibility harder - if we later add more fields, old versions break.
Another option would be to require that each record should explicitly specify one of:
- Measurement constraints, using measurement values or
dcap_image_hashes.
- An option explicitly allowing any measurements, such as
"allow_any_measurements": true.
We would then reject records containing neither, or conflicting choices. And continue accepting unknown fields for forward compatibility.
But - existing policies that intentionally omit constraints would stop working.
In the measurement policy JSON format, you can omit the measurement constraints, which will mean 'allow any measurements with this attestation type' .
Unknown fields are also ignored, so a typo in the JSON field name such as
measurmentscan silently turn a constrained policy into one that accepts any measurements for the selected attestation type.Rejecting all unknown fields would catch this, but would make forwards compatibility harder - if we later add more fields, old versions break.
Another option would be to require that each record should explicitly specify one of:
dcap_image_hashes."allow_any_measurements": true.We would then reject records containing neither, or conflicting choices. And continue accepting unknown fields for forward compatibility.
But - existing policies that intentionally omit constraints would stop working.