refactor(quote): move TCB level logic to a dedicated module

- Extracted `TcbLevel` functionality from `sgx` module to `quote::tcblevel`.
- Updated all references to import `TcbLevel` and related utilities from `quote::tcblevel`.
- Updated copyright headers to reflect the new year range.

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>

crates/teepot-vault/bin/tee-stress-client/src/main.rs

@@ -11,7 +11,7 @@ use anyhow::{Context, Result};
 use clap::Parser;
 use serde::{Deserialize, Serialize};
 use std::time::Duration;
-use teepot::sgx::{parse_tcb_levels, EnumSet, TcbLevel};
+use teepot::quote::tcblevel::{parse_tcb_levels, EnumSet, TcbLevel};
 use teepot_vault::{
     client::vault::VaultConnection,
     server::{

crates/teepot-vault/bin/tee-vault-admin/src/main.rs

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
-// Copyright (c) 2023-2024 Matter Labs
+// Copyright (c) 2023-2025 Matter Labs
 
 //! Server to handle requests to the Vault TEE
 
@@ -17,7 +17,7 @@ use digest::get_digest;
 use rustls::ServerConfig;
 use sign::post_sign;
 use std::{net::Ipv6Addr, sync::Arc};
-use teepot::sgx::{parse_tcb_levels, EnumSet, TcbLevel};
+use teepot::quote::tcblevel::{parse_tcb_levels, EnumSet, TcbLevel};
 use teepot_vault::{
     json::http::{SignRequest, VaultCommandRequest, DIGEST_URL},
     server::{

crates/teepot-vault/bin/tee-vault-unseal/src/main.rs

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
-// Copyright (c) 2023-2024 Matter Labs
+// Copyright (c) 2023-2025 Matter Labs
 
 //! Server to initialize and unseal the Vault TEE.
 
@@ -22,7 +22,7 @@ use std::path::PathBuf;
 use std::sync::{Arc, RwLock};
 use std::time::Duration;
 use teepot::pki::make_self_signed_cert;
-use teepot::sgx::{parse_tcb_levels, EnumSet, TcbLevel};
+use teepot::quote::tcblevel::{parse_tcb_levels, EnumSet, TcbLevel};
 use teepot_vault::client::{AttestationArgs, TeeConnection};
 use teepot_vault::json::http::{Init, Unseal};
 use teepot_vault::json::secrets::AdminConfig;

crates/teepot-vault/src/client/mod.rs

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
-// Copyright (c) 2023-2024 Matter Labs
+// Copyright (c) 2023-2025 Matter Labs
 
 //! Helper functions for CLI clients to verify Intel SGX enclaves and other TEEs.
 
@@ -25,11 +25,12 @@ use rustls::{
 };
 use sha2::{Digest, Sha256};
 use std::{sync::Arc, time, time::Duration};
-use teepot::{quote::Report, sgx::Quote};
 pub use teepot::{
+    quote::tcblevel::{parse_tcb_levels, EnumSet, TcbLevel},
     quote::{verify_quote_with_collateral, QuoteVerificationResult},
-    sgx::{parse_tcb_levels, sgx_ql_qv_result_t, EnumSet, TcbLevel},
+    sgx::sgx_ql_qv_result_t,
 };
+use teepot::{quote::Report, sgx::Quote};
 use tracing::{debug, error, info, trace, warn};
 use x509_cert::{
     der::{Decode as _, Encode as _},

crates/teepot-vault/src/client/vault.rs

@@ -30,10 +30,11 @@ use std::{
 };
 use teepot::quote::error::QuoteContext;
 pub use teepot::{
-    quote::{verify_quote_with_collateral, QuoteVerificationResult},
-    sgx::{
-        parse_tcb_levels, sgx_gramine_get_quote, sgx_ql_qv_result_t, Collateral, EnumSet, TcbLevel,
+    quote::{
+        tcblevel::{parse_tcb_levels, EnumSet, TcbLevel},
+        verify_quote_with_collateral, QuoteVerificationResult,
     },
+    sgx::{sgx_gramine_get_quote, sgx_ql_qv_result_t, Collateral},
 };
 use tracing::{debug, error, info, trace};
 

crates/teepot-vault/src/server/attestation.rs

@@ -9,10 +9,13 @@ use serde::{Deserialize, Serialize};
 
 pub use teepot::{
     quote::{
-        attestation::get_quote_and_collateral, error::QuoteContext, get_quote,
+        attestation::get_quote_and_collateral,
+        error::QuoteContext,
+        get_quote,
+        tcblevel::{parse_tcb_levels, EnumSet, TcbLevel},
         verify_quote_with_collateral, QuoteVerificationResult,
     },
-    sgx::{parse_tcb_levels, Collateral, EnumSet, TcbLevel},
+    sgx::Collateral,
 };
 
 /// Options and arguments needed to attest a TEE