From e8e7666a733571920c78c1f55d515a61711edb66 Mon Sep 17 00:00:00 2001 From: Thomas Fossati Date: Tue, 3 Sep 2024 16:26:56 +0200 Subject: [PATCH 1/2] chore: copyright update Signed-off-by: Thomas Fossati --- provisioning/api/handler.go | 2 +- provisioning/provisioner/provisioner.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/provisioning/api/handler.go b/provisioning/api/handler.go index b62f0aa0..d4b2e811 100644 --- a/provisioning/api/handler.go +++ b/provisioning/api/handler.go @@ -1,4 +1,4 @@ -// Copyright 2022-2023 Contributors to the Veraison project. +// Copyright 2022-2024 Contributors to the Veraison project. // SPDX-License-Identifier: Apache-2.0 package api diff --git a/provisioning/provisioner/provisioner.go b/provisioning/provisioner/provisioner.go index d8e570e0..507a710e 100644 --- a/provisioning/provisioner/provisioner.go +++ b/provisioning/provisioner/provisioner.go @@ -1,4 +1,4 @@ -// Copyright 2022-2023 Contributors to the Veraison project. +// Copyright 2022-2024 Contributors to the Veraison project. // SPDX-License-Identifier: Apache-2.0 package provisioner From 458b41614c9ff0eb2a4e01deb713a559947ec5d4 Mon Sep 17 00:00:00 2001 From: Thomas Fossati Date: Tue, 3 Sep 2024 16:27:27 +0200 Subject: [PATCH 2/2] fix(scheme): allow CCA plaform-only verifier Do not return an overall warning status if no realm reference values have been provisioned. Instead, return "no claims". Fix #265 Signed-off-by: Thomas Fossati --- scheme/arm-cca/evidence_handler_test.go | 5 ++--- scheme/arm-cca/realm.go | 13 ++++++++++++- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/scheme/arm-cca/evidence_handler_test.go b/scheme/arm-cca/evidence_handler_test.go index f37e4b98..570a8be1 100644 --- a/scheme/arm-cca/evidence_handler_test.go +++ b/scheme/arm-cca/evidence_handler_test.go @@ -102,10 +102,9 @@ func Test_AppraiseEvidence_Realm(t *testing.T) { // nolint: dupl { desc: "No realm endorsements", input: "test/realm/no-realm-endorsements.json", - expectedStatus: ear.TrustTierWarning, - expectedExec: ear.UnrecognizedRuntimeClaim, + expectedStatus: ear.TrustTierNone, + expectedExec: ear.NoClaim, }, - { desc: "No matching rim measurements", input: "test/realm/rim-mismatch-endorsements.json", diff --git a/scheme/arm-cca/realm.go b/scheme/arm-cca/realm.go index 5b54e228..0dfe473d 100644 --- a/scheme/arm-cca/realm.go +++ b/scheme/arm-cca/realm.go @@ -35,10 +35,16 @@ func realmAppraisal( // If crypto verification (including chaining) completes correctly, // we can safely assume the Realm instance to be trustworthy trustVector.InstanceIdentity = ear.TrustworthyInstanceClaim - trustVector.Executables = ear.UnrecognizedRuntimeClaim + // By default, make no claims with regard to realm executables (i.e., RIM, + // PV and REMs). This is to support a platform-only CCA verifier. + // If we have been provisioned with realm executable reference values, they + // will be checked in the loop below and the trust vector updated accordingly. + trustVector.Executables = ear.NoClaim + partial := true for _, endorsement := range realmEndorsements { if matchRim(claims, &endorsement) { + partial = false err := matchRpv(claims, &endorsement) switch err { // Note, If an Endorser does not use RPV it indicates, one Realm per RIM, which is a match @@ -74,6 +80,11 @@ func realmAppraisal( } appraisal.UpdateStatusFromTrustVector() + // This is a kludge to work around EAR inability to express "partial" verification semantics. + if *appraisal.Status == ear.TrustTierAffirming && partial { + noClaimStatus := ear.TrustTierNone + appraisal.Status = &noClaimStatus + } appraisal.VeraisonAnnotatedEvidence = &claimsMap return &appraisal, nil