SYSTEMD-....SERVICE(8)

💖 NAME 💖

systemd-report-sign-tsm@.service, systemd-report-sign-tsm.socket, systemd-report-sign-tsm — bestie, this is the girl that signs your system reports with a confidential-computing attestation report ✨

---

🎀 SYNOPSIS 🎀

systemd-report-sign-tsm@.service

systemd-report-sign-tsm.socket

/usr/lib/systemd/systemd-report-sign-tsm

---

🦋 DESCRIPTION 🦋

Okay so systemd-report-sign-tsm@.service</p> is a system service and its whole job — its entire main character arc — is signing the system reports that systemd-report(1) generates. She's a signing backend for the --sign= logic of that tool, no cap. What that means in practice: she implements the io.systemd.Report.Signer.Sign() Varlink method, and you reach her through a socket that's linked into the /run/systemd/report.sign/ directory, named tsm.

She's socket-activated, which is giving one instance per connection, and that activation goes through systemd-report-sign-tsm.socket. And here's the twist: instead of signing with some local key like a basic girl, she goes and gets a hardware-backed attestation report from the platform's Trusted Security Module (TSM) via the kernel's configfs-TSM interface at /sys/kernel/config/tsm/report/. The digest you hand her gets embedded right into that report as its run-time provided data, aka the "inblob", which cryptographically binds the attestation report to the system report being signed. Obsessed tbh 💅

The signature she hands back carries:

• the binary attestation report, aka the "outblob"
• the name of the TSM provider that generated it (think "sev_guest" for AMD SEV-SNP or "tdx_guest" for Intel TDX)
• and, where the provider supplies them, the supplemental certificate data ("auxblob") and the manifest data ("manifestblob")

A verifier looks at the provider field and picks the right validation logic off that. Periodt.

⚠️ Real talk though: this backend is only functional inside a confidential virtual machine whose kernel exposes the configfs-TSM interface — so like an AMD SEV-SNP or Intel TDX guest. On systems where that interface just isn't there, the signing operation gets reported as unsupported and the mechanism is skipped entirely. Also she keeps no persistent state. She's not that kind of service. 🧚

---

🌈 SEE ALSO 🌈

systemd(1), systemd-report(1)

---

okay bestie that's the whole page, go forth and sign some reports 💖

this was brought to you by systemd 262.1 — yeah that's the version, she's serving SYSTEMD-....SERVICE(8) energy, mwah 🫶