Can SEV SNP launch digest be used as a measured boot without vTPM?

[tianyishan]

I am a beginner at SEV-SNP.
What properties will I need if I want to create a chain of trust to ensure the integrity of CVM OS?
From my understanding, the launch digest will hash the memory of the initial pages that boot the CVM.
Can I use this alone as proof of measured boot? If not, why is it not enough?

Thank you for reading this!

[salzg]

Long story short: The Launch Digest by default only encompasses the initial memory contents, i.e. the guest firmware. Anything else beyond that requires some extra tinkering.

In detail: I recommend checking out the following paper: https://systex24.github.io/papers/systex24-final21.pdf