Provision

Provision a new VM at runtime: record its root CA identity and issue storage secrets.

auth (signed mode) carries the X-Chutes-Signature header, only consulted when the matched measurement is a release candidate: it must be an RSA-SHA256 signature (openssl dgst) over the quote nonce by one of the measurement's authorized operator signing keys, proving possession (see authorize_rc_measurement). Ignored for published measurements.

The RTMR3-attested runtime entry point for new VMs (supersedes /luks/attest going forward). The VM presents its per-boot root CA as the mTLS client cert; the quote's REPORTDATA binds SHA256(that cert's pubkey), so the same cert_hash check that guards /luks/attest also proves CA possession — no bespoke quote logic is needed. require_luks_quote_nonce validates and consumes the runtime nonce; the handler verifies the quote (signature + all RTMR measurements incl. RTMR3), records server.vm_root_ca_cert (idempotent), and returns rotated passphrases, the k3s encryption key, and a confirm nonce.