chore(deps): update cmcp-runtime requirement from >=0.4.0 to >=0.4.1

[dependabot]

Updates the requirements on cmcp-runtime to permit the latest version.

Release notes

Sourced from cmcp-runtime's releases.

cmcp v0.4.1

Anyone running 0.4.0 should upgrade.

Security

This release fixes GHSA-943q-hvhp-mrx2 (high), reported and fixed by Noah Ingwers.

On 0.4.0, verify_gateway_measurement() could return verified=True for a correctly signed TPM2_NV_Certify pair that does not refer to cMCP's configured TPM_NT_EXTEND object or its complete 32-byte range. The verifier compared the two signed TPM Names only with each other and never against trusted verifier policy, and a collector-claimed digest could produce a positive result when no expected digest was configured. An actor able to use an otherwise accepted AK could therefore certify attacker-arranged values from an ordinary or unapproved NV object and receive an authorization-grade verdict. No signature forgery was required.

Appraisal now requires a complete GatewayNvAppraisalPolicy supplied by the verifier: the exact authorized written TPM Name, offset zero, 32-byte extent, and expected gateway digest. Both attestations and the envelope copy must match it, and digest-only legacy calls fail closed. The producer side validates the complete public area and TPM-returned Name before any read, extend, or certify.

Scope limit, stated rather than implied. The startup NV-certify pair is not carried by the ordinary TRACE schema and verify_trace_claim() does not call verify_gateway_measurement(). This was a genuine false positive in the standalone verifier, not an end-to-end bypass in the ordinary request path. That is why it is scored high rather than critical. We are keeping the reporter's own scoring.

Breaking change

Callers of the appraisal primitive that omitted the full policy now fail closed. This is intentional.

Credit

Our thanks to Noah Ingwers, who found this while auditing the parser migration in #601, reported it with a genuine swtpm reproduction corpus covering both a same-handle ordinary object and a partial-range case, and supplied the complete fix with live TPM validation. A researcher acknowledgements section has been added to SECURITY.md.

Everything else

0.4.1 also carries the work accumulated on main since 0.4.0. See CHANGELOG.md for the full list.

Changelog

Sourced from cmcp-runtime's changelog.

[0.4.1] - 2026-09-02

Anyone running 0.4.0 should upgrade. On 0.4.0 verify_gateway_measurement() could return verified=True for a correctly signed TPM2_NV_Certify pair that does not refer to cMCP's configured TPM_NT_EXTEND object or its complete 32-byte range (GHSA-943q-hvhp-mrx2). The verifier compared the two signed TPM Names only with each other and never against trusted verifier policy, so an accepted AK could certify attacker-arranged values from an ordinary NV object and receive an authorization-grade verdict. No signature forgery was required. Reported and fixed by Noah Ingwers.

The appraisal API is intentionally breaking: callers that omit the full GatewayNvAppraisalPolicy now fail closed.

Changed

• TPM NV-certify wire parsing now delegates to Agent Manifest 0.11.2 instead of maintaining a second TPMS_ATTEST/TPMS_NV_CERTIFY_INFO parser in cMCP. The public parse_nv_certify return shape and ValueError contract remain intact. The shared parser also makes cMCP accept valid size-prefixed TPM2B_ATTEST transport framing, reject undeclared bytes after nvContents, and verify AK signatures over the canonical inner TPMS_ATTEST rather than over the transport length prefix. A genuine swtpm-produced two-certify reference pair exercises Agent Manifest's configured-root chain helper plus the signature, transcript, explicitly authorized test Name/range, and extend-relation path. The synthetic fixture CA is test trust only and makes no full-PKIX, hardware-provenance, or vendor-enrollment claim.

• Removed AGT/agent_os from the production dependency graph. cMCP now owns the runtime call and response enforcement path; AGT remains isolated to CI and release governance verification. Legacy agent_os_version bundle metadata is still readable but is no longer enforced.

Fixed

• Gateway NV appraisal accepted an evidence-selected NV object and certified range as the configured gateway measurement. verify_gateway_measurement authenticated the AK chain, both signatures, phase bindings, and post = SHA256(pre || digest), but only required the two signed Names to equal each other. It did not compare either Name or signed offset/extent with trusted verifier policy, and a collector-claimed digest could produce verified=True when no expected digest was supplied. An accepted AK could therefore certify attacker-arranged values from an ordinary or otherwise unapproved NV object and receive an authorization-grade verdict without proving use of cMCP's configured TPM_NT_EXTEND public template.

  Appraisal now requires a complete GatewayNvAppraisalPolicy supplied by the verifier: the exact signed TPM Name, offset zero, 32-byte extent, and expected gateway digest. Both attestations and the envelope copy must match that policy; digest-only legacy calls fail closed. The producer also validates the complete public area and TPM-returned Name before any read, extend, or certify; a newly

... (truncated)

Commits

• b68e84a chore(release): 0.4.1 (#604)
• 534e5e5 security(tpm): bind NV appraisal to trusted policy (#602)
• 415b50d refactor(tpm): delegate NV certify parsing to Agent Manifest (#601)
• e168d3e fix(proxy): unpinned upstream servers pooled behind one shared HTTP client (#...
• d9fc737 chore(deps): bump anchore/sbom-action from 0.24.0 to 0.24.2 (#599)
• 73a80d3 fix(opaque): fail closed on incomplete managed appraisal (#600)
• 0626bf3 chore(deps): bump github/codeql-action from 4.37.8 to 4.37.9 (#598)
• 7b40ea6 fix(embodied-action): use the existing RFC 8785/JCS canonicalizer instead of ...
• 2c0a601 initial commit (#590)
• 92c22e2 initial commit (#589)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[imran-siddique]

Reviewed f364221.

This raises the cMCP minimum from 0.4.0 to 0.4.1 without imposing a new upper bound. Reviewed the industrial example workflow: same-repository PRs install this requirements file and validate the committed artifacts. Current CI and runtime smoke checks pass.