api: for Azure attestationconfigapi use TCB values from SNP report instead of MAA token #2429

elchead · 2023-10-11T06:59:28Z

Context

Since the MAA version values are intransparent and were found to not be reliable for TCB version inference, we are now using the values from the SNP report instead.

Proposed change(s)

store the json output of verify on Azure and pass to the attestationconfigapi upload tool
check that Launch TCB, Committed TCB, and Reported TCB are equal
fix go-sev-guest library version to newer hash on main, because current release has debug prints

Additional info

AB#3447

Checklist

Update docs
Add labels (e.g., for changelog category)
Is PR title adequate for changelog?
Link to Milestone

netlify · 2023-10-11T06:59:46Z

✅ Deploy Preview for constellation-docs canceled.

Name	Link
🔨 Latest commit	`eef54ca`
🔍 Latest deploy log	https://app.netlify.com/sites/constellation-docs/deploys/652ea9d523f77a0008fd4fb4

elchead · 2023-10-11T06:59:58Z

Run: https://github.com/edgelesssys/constellation/actions/runs/6479025795/job/17591789611

elchead · 2023-10-11T09:08:21Z

The verify test currently only allows uploads to the API on main. Is this restriction necessary? It would be easier to test without it and also I don't see any no harm

internal/api/attestationconfigapi/cli/main.go

.github/actions/e2e_verify/action.yml

elchead · 2023-10-16T12:47:04Z

e2e succeeded https://github.com/edgelesssys/constellation/actions/runs/6533033933/job/17737387605.

This reverts commit 0a7cf08.

daniel-weisse

Only reviewed the Go code.
Looks mostly good to me

cli/internal/cmd/verify.go

go.mod

Signed-off-by: Daniel Weiße <[email protected]>

…pe (#2459) * Add missing quotation marks for region flag * Revert default Azure region to northeurope --------- Signed-off-by: Daniel Weiße <[email protected]>

* add field docs to the state file * mark only optional fields * tidy * use talos encoder

* create state file during config generate * use written file in `constellation create` * document creation of state file * remove accidentally added test * check error when writing state file

Co-authored-by: malt3 <[email protected]>

* custom byte slice marshalling Signed-off-by: Moritz Sanft <[email protected]> * byte slice compatibility Signed-off-by: Moritz Sanft <[email protected]> * other byte slice compat test Signed-off-by: Moritz Sanft <[email protected]> * add missing dep Signed-off-by: Moritz Sanft <[email protected]> * export byte type alias Signed-off-by: Moritz Sanft <[email protected]> * regenerate exported type Signed-off-by: Moritz Sanft <[email protected]> * test marshal and unmarshal together Signed-off-by: Moritz Sanft <[email protected]> --------- Signed-off-by: Moritz Sanft <[email protected]>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…nager Docker tag to v1.26.4 (#2466) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

mkosi now warns about what settings are defined in what sections. Soon, the config parsing might fail when settings are in the wrong sections.

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

#2473) * image: use systemd-dissect from the host when calculating measurements * ci: setup bazel and nix toolchains before merging os image measurements

github-actions · 2023-10-17T15:43:33Z

Coverage report

Package	Old	New	Trend
cli/internal/cmd	50.70%	50.60%	↘️
internal/api/attestationconfigapi/cli	6.80%	10.90%	↗️
internal/verify	[no test files]	[no test files]	🚧

elchead requested a review from derpsteb as a code owner October 11, 2023 06:59

elchead added the no changelog Change won't be listed in release changelog label Oct 11, 2023

elchead added this to the v2.13.0 milestone Oct 11, 2023

elchead force-pushed the feat/api/azure-use-tcb-values-for-version branch 2 times, most recently from 47b5b31 to 6d2d72a Compare October 11, 2023 07:47

elchead requested a review from malt3 as a code owner October 11, 2023 13:56

elchead force-pushed the feat/api/azure-use-tcb-values-for-version branch from eb523a8 to 5f5a2a3 Compare October 11, 2023 14:07

derpsteb reviewed Oct 12, 2023

View reviewed changes

internal/api/attestationconfigapi/cli/main.go Outdated Show resolved Hide resolved

derpsteb reviewed Oct 12, 2023

View reviewed changes

.github/actions/e2e_verify/action.yml Outdated Show resolved Hide resolved

elchead force-pushed the feat/api/azure-use-tcb-values-for-version branch from 71105d8 to 75895ec Compare October 16, 2023 07:13

elchead added 10 commits October 16, 2023 14:47

use snp report in verify test

36b3ea5

adjust e2e test

bdde0fa

test verify on branch

1004f2e

fixup! adjust e2e test

4bddbba

change go-sev-guest version to fix debug print

0e18df7

fixup! fixup! adjust e2e test

36511d5

add test for allEqual

9d3b821

format certificate as pem

f515924

fix fetcher for prod env

01bb3f6

Revert "test verify on branch"

7916f57

This reverts commit 0a7cf08.

elchead force-pushed the feat/api/azure-use-tcb-values-for-version branch from 871c70c to 7916f57 Compare October 16, 2023 12:47

elchead requested a review from daniel-weisse October 16, 2023 12:48

elchead mentioned this pull request Oct 16, 2023

cli: read Azure SEV-SNP version values from launch TCB in constellation verify output #2357

Closed

4 tasks

daniel-weisse reviewed Oct 16, 2023

View reviewed changes

cli/internal/cmd/verify.go Outdated Show resolved Hide resolved

go.mod Outdated Show resolved Hide resolved

malt3 removed their request for review October 17, 2023 07:03

daniel feedback

62bb14f

daniel-weisse approved these changes Oct 17, 2023

View reviewed changes

daniel-weisse and others added 16 commits October 17, 2023 14:00

cli: refactor flag parsing code (#2425)

b3bb7de

Signed-off-by: Daniel Weiße <[email protected]>

ci: add missing quotation marks for region flag + revert to northeuro…

00c05bd

…pe (#2459) * Add missing quotation marks for region flag * Revert default Azure region to northeurope --------- Signed-off-by: Daniel Weiße <[email protected]>

cli: add field docs to the state file (#2453)

3985668

* add field docs to the state file * mark only optional fields * tidy * use talos encoder

cli: generate state file during constellation config generate (#2455)

139ff37

* create state file during config generate * use written file in `constellation create` * document creation of state file * remove accidentally added test * check error when writing state file

image: install rpms from lockfile

cf7af54

ci: update rpm lockfile once per week

9798382

image: update locked rpms (#2463)

db293d3

Co-authored-by: malt3 <[email protected]>

ci: fix PR label for rpm updates (#2464)

447ce65

deps: update fedora:38 Docker digest to 8285246 (#2467)

9318afc

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

deps: update docker.io/k8scloudprovider/openstack-cloud-controller-ma…

5d45a1f

…nager Docker tag to v1.26.4 (#2466) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

deps: update golang:1.21.3 Docker digest to 24a0937 (#2468)

79a13d2

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

deps: update cachix/install-nix-action action to v23 (#2469)

036dde4

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

image: move mkosi settings into their actual sections (#2471)

08a89e1

mkosi now warns about what settings are defined in what sections. Soon, the config parsing might fail when settings are in the wrong sections.

deps: update K8s constrained Azure versions (#2465)

048aefa

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

image: use systemd-dissect from the host when calculating measurements (

0ee1df9

#2473) * image: use systemd-dissect from the host when calculating measurements * ci: setup bazel and nix toolchains before merging os image measurements

elchead requested review from 3u13r and thomasten as code owners October 17, 2023 12:00

elchead added 3 commits October 17, 2023 14:14

Merge branch 'main' into feat/api/azure-use-tcb-values-for-version

29c8ffe

fix checks

c9fea04

test

eef54ca

elchead merged commit 5819a11 into main Oct 17, 2023
6 of 8 checks passed

elchead deleted the feat/api/azure-use-tcb-values-for-version branch October 17, 2023 15:36

burgerdev mentioned this pull request Apr 30, 2024

deps: upgrade to tink-go v2.1.0 #3054

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

api: for Azure attestationconfigapi use TCB values from SNP report instead of MAA token #2429

api: for Azure attestationconfigapi use TCB values from SNP report instead of MAA token #2429

elchead commented Oct 11, 2023 •

edited

Loading

netlify bot commented Oct 11, 2023 •

edited

Loading

elchead commented Oct 11, 2023

elchead commented Oct 11, 2023

elchead commented Oct 16, 2023

daniel-weisse left a comment

github-actions bot commented Oct 17, 2023

api: for Azure attestationconfigapi use TCB values from SNP report instead of MAA token #2429

api: for Azure attestationconfigapi use TCB values from SNP report instead of MAA token #2429

Conversation

elchead commented Oct 11, 2023 • edited Loading

Context

Proposed change(s)

Additional info

Checklist

netlify bot commented Oct 11, 2023 • edited Loading

✅ Deploy Preview for constellation-docs canceled.

elchead commented Oct 11, 2023

elchead commented Oct 11, 2023

elchead commented Oct 16, 2023

daniel-weisse left a comment

Choose a reason for hiding this comment

github-actions bot commented Oct 17, 2023

Coverage report

elchead commented Oct 11, 2023 •

edited

Loading

netlify bot commented Oct 11, 2023 •

edited

Loading