Enhance Always Encrypted VSM/HGS enclave attestation validation

[Ananya Garg (Ananya2)]

Summary

This change enhances the Always Encrypted v2 enclave attestation flow for the VSM/HGS provider (enclaveAttestationProtocol=HGS) by adding validation of the enclave public key binding, bringing it in line with the AAS provider.

The signed VBS enclave report carries a commitment to the enclave public key in its Enclave Data field. This change validates that the commitment matches the enclave public key used for the session, ensuring the verified attestation report corresponds to the key used during key exchange. The AAS path already performs an equivalent validation.

Notes

No public API or connection-string changes. Behavior is unchanged for genuine HGS/VBS deployments (verified end-to-end against a live HGS environment). AAS deployments are unaffected.

[Copilot]

Pull request overview

This pull request strengthens the Always Encrypted v2 VSM/HGS (enclaveAttestationProtocol=HGS) enclave attestation flow by validating that the signed VBS enclave report is bound to the enclave public key actually used for the session, aligning the HGS path with the existing AAS binding validation behavior.

Changes:

• Add enclave public key binding validation after successful VBS report signature verification (compare report data to SHA-256(enclavePK)).
• Add new negative/positive tests covering the binding check (genuine response succeeds; swapped enclave public key fails).
• Add a new driver error resource string for binding-validation failures.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
src/main/java/com/microsoft/sqlserver/jdbc/SQLServerVSMEnclaveProvider.java	Adds the enclave public key binding check using report data vs SHA-256(enclavePK) after signature verification.
src/main/java/com/microsoft/sqlserver/jdbc/SQLServerResource.java	Adds a new localized error string for enclave statement binding failures.
src/test/java/com/microsoft/sqlserver/jdbc/EnclavePackageTest.java	Adds helper tests that validate success on genuine data and failure on enclave PK substitution.
src/test/java/com/microsoft/sqlserver/jdbc/AlwaysEncrypted/EnclaveTest.java	Wires the new binding tests into the existing parameterized Always Encrypted enclave test suite.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 59.54%. Comparing base (40ad6d2) to head (d163951).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...ft/sqlserver/jdbc/SQLServerVSMEnclaveProvider.java	0.00%	13 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #2993      +/-   ##
============================================
+ Coverage     59.26%   59.54%   +0.27%     
- Complexity     5042     5120      +78     
============================================
  Files           153      153              
  Lines         36354    36367      +13     
  Branches       6652     6654       +2     
============================================
+ Hits          21544    21653     +109     
+ Misses        11050    11026      -24     
+ Partials       3760     3688      -72     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.