Pr2

attestationreport/attestationreport.go

@@ -671,11 +671,19 @@ func Verify(arRaw, nonce, casPem []byte, policies []byte, polEng PolicyEngineSel
 		result.Success = false
 	}
 
-	// Check that every AppManifest has a corresponding AppDescription
+	// Extract app description names
 	appDescriptions := make([]string, 0)
 	for _, a := range metadata.DeviceDescription.AppDescriptions {
 		appDescriptions = append(appDescriptions, a.AppManifest)
 	}
+	// Extract app manifest names
+	appManifestNames := make([]string, 0)
+	for _, a := range metadata.AppManifests {
+		appManifestNames = append(appManifestNames, a.Name)
+	}
+
+	// Check that every AppManifest has a corresponding AppDescription
+	log.Tracef("Iterating app manifests length %v", len(metadata.AppManifests))
 	for _, a := range metadata.AppManifests {
 		r := Result{
 			Success:       true,
@@ -691,6 +699,27 @@ func Verify(arRaw, nonce, casPem []byte, policies []byte, polEng PolicyEngineSel
 		result.DevDescResult.CorrectApps = append(result.DevDescResult.CorrectApps, r)
 	}
 
+	// Check that every App Description has a corresponding App Manifest
+	log.Tracef("Iterating app descriptions length %v", len(metadata.DeviceDescription.AppDescriptions))
+	for _, desc := range metadata.DeviceDescription.AppDescriptions {
+		found := false
+		for _, manifest := range metadata.AppManifests {
+			if desc.AppManifest == manifest.Name {
+				found = true
+			}
+		}
+		if !found {
+			log.Tracef("No app manifest for app description: %v", desc.AppManifest)
+			r := Result{
+				Success:       false,
+				Got:           desc.AppManifest,
+				ExpectedOneOf: appManifestNames,
+			}
+			result.DevDescResult.CorrectApps = append(result.DevDescResult.CorrectApps, r)
+			result.Success = false
+		}
+	}
+
 	// Check that the Rtm Manifest is compatible with the OS Manifest
 	if contains(metadata.RtmManifest.Name, metadata.OsManifest.Rtms) {
 		result.DevDescResult.RtmOsCompatibility.Success = true
@@ -745,9 +774,16 @@ func Verify(arRaw, nonce, casPem []byte, policies []byte, polEng PolicyEngineSel
 
 	// Add additional information
 	result.Prover = metadata.DeviceDescription.Name
+	if result.Prover == "" {
+		result.Prover = "Unknown"
+	}
 	result.Created = time.Now().Format(time.RFC3339)
 
-	log.Tracef("Verification Result: %v", result.Success)
+	if result.Success {
+		log.Infof("SUCCESS: Verification for Prover %v (%v)", result.Prover, result.Created)
+	} else {
+		log.Infof("FAILED: Verification for Prover %v (%v)", result.Prover, result.Created)
+	}
 
 	return result
 }

example-setup/setup-full-ids

@@ -3,15 +3,10 @@
 set -euo pipefail
 
 trap '[ $? -eq 0 ] && exit 0; printf "%s failed\n" "$0"' EXIT
+dir="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd -P)"
+source "${dir}/utils.sh"
 export PATH=${PATH}:${HOME}/go/bin
 
-function abs_path() {
-  if [[ -d "$(dirname "$1")" ]]
-  then
-    echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" || true
-  fi
-}
-
 if [[ "$#" -ne 3 ]]; then
    echo "Usage: ./setup-full-ids <cmc-folder> <data-folder> <cbor|json>"
    exit 1

example-setup/setup-full-simple

@@ -3,15 +3,10 @@
 set -euo pipefail
 
 trap '[ $? -eq 0 ] && exit 0; printf "%s failed\n" "$0"' EXIT
+dir="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd -P)"
+source "${dir}/utils.sh"
 export PATH=${PATH}:${HOME}/go/bin
 
-abs_path() {
-  if [[ -d "$(dirname "$1")" ]]
-  then
-    echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" || true
-  fi
-}
-
 if [[ "$#" -ne 3 ]]; then
    echo "Usage: ./setup-full-simple <cmc-folder> <data-folder> <cbor|json>"
    exit

example-setup/sgx-setup-sample

@@ -3,31 +3,28 @@
 set -euo pipefail
 
 trap '[ $? -eq 0 ] && exit 0; printf "%s failed\n" "$0"' EXIT
+dir="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd -P)"
+source "${dir}/utils.sh"
 export PATH=${PATH}:${HOME}/go/bin
 
-abs_path() {
-  if [[ -d "$(dirname "$1")" ]]
-  then
-    echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" || true
-  fi
-}
-
-if [[ "$#" -ne 3 ]]; then
-   echo "Usage: ./setup-full-simple <cmc-folder> <data-folder> <cbor|json>"
+if [[ "$#" -ne 5 ]]; then
+   echo "Usage: ./setup-full-simple <cmc-folder> <data-folder> <cbor|json> <mrenclave> <mrsigner>"
    exit
 fi
 
 
 cmc="$(abs_path "${1}")"
 data="$(abs_path "${2}")"
 ser="${3}"
+mrenclave="${4}"
+mrsigner="${5}"
 
 if [[ ! -d "$cmc" ]]; then
   echo "cmc directory does not exist. Did you clone the repository? Abort.."
   exit 1
 fi
 
-if [[ ! -d "${data}" ]]; then 
+if [[ ! -d "${data}" ]]; then
     mkdir -p "${data}"
 fi
 
@@ -80,7 +77,7 @@ decoded=$(printf '%b' "$(echo "$cert_chain" | sed 's/SGX-PCK-Certificate-Issuer-
 root_ca=$(echo -e "$decoded" | sed -n '/-----END CERTIFICATE-----/,$p' | sed '1d')
 ca_fingerprint=$(openssl x509 -in <(echo "$root_ca") -noout -sha256 -fingerprint | awk -F= '{print $2}' | tr -d ': ' | tr '[:upper:]' '[:lower:]')
 
-# GET TCB Info 
+# GET TCB Info
 tcb_info="$(curl -s -X GET "https://api.trustedservices.intel.com/sgx/certification/v4/tcb?fmspc=$fmspc" | jq -c .)"
 echo "$tcb_info" > "${data}/metadata-raw/tcb_info.json"
 
@@ -98,7 +95,7 @@ jq --argjson tcb_info "$tcb_info" --argjson qe_identity "$qe_identity" --argjson
   "sgx": {
     "version": 3,
     "collateral": {
-      "teeType": 0, 
+      "teeType": 0,
       "tcbInfo": $tcb_info,
       "tcbInfoSize": $tcb_info_size,
       "qeIdentity": $qe_identity,

example-setup/update-app-manifest

@@ -3,24 +3,10 @@
 set -euo pipefail
 
 trap '[ $? -eq 0 ] && exit 0; printf "%s failed\n" "$0"' EXIT
+dir="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd -P)"
+source "${dir}/utils.sh"
 export PATH=${PATH}:${HOME}/go/bin
 
-abs_path() {
-  if [[ -d "$(dirname "$1")" ]]
-  then
-    echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" || true
-  fi
-}
-
-extendarr() {
-	local key=$1
-	shift
-  	local param=$1
-
-  	# Add new value
-  	json="$(echo "${json}" | jq ".${key} += [${param}]")"
-}
-
 if [[ "$#" -ne 2 ]]; then
    echo "Usage: ./update-app-manifest <data-folder> <cbor|json>"
    exit 1
@@ -39,9 +25,6 @@ fi
 
 echo "Using ${data} as directory for local data"
 
-# Load manifest
-json=$(cat "${data}/metadata-raw/app.manifest.json")
-
 # Calculate the IMA app reference values
 referenceValues=$(sudo calculate-ima-pcr -t 10 -i ima-ng -p /usr/bin)
 

example-setup/update-app-manifest-live

@@ -5,22 +5,6 @@ set -euo pipefail
 trap '[ $? -eq 0 ] && exit 0; printf "%s failed\n" "$0"' EXIT
 export PATH=${PATH}:${HOME}/go/bin
 
-abs_path() {
-  if [[ -d "$(dirname "$1")" ]]
-  then
-    echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" || true
-  fi
-}
-
-extendarr() {
-	local key=$1
-	shift
-  local param=$1
-
-  # Add new value
-  json="$(echo "${json}" | jq ".${key} += [${param}]")"
-}
-
 if [[ "$#" -ne 2 ]]; then
    echo "Usage: ./update-app-manifest-live <data-folder> <cbor|json>"
    exit 1

example-setup/update-full-ids

@@ -3,15 +3,10 @@
 set -euo pipefail
 
 trap '[ $? -eq 0 ] && exit 0; printf "%s failed\n" "$0"' EXIT
+dir="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd -P)"
+source "${dir}/utils.sh"
 export PATH=${PATH}:${HOME}/go/bin
 
-function abs_path() {
-  if [[ -d "$(dirname "$1")" ]]
-  then
-    echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" || true
-  fi
-}
-
 if [[ "$#" -ne 2 ]]; then
    echo "Usage: ./update-full-ids <data-folder> <cbor|json>"
    exit 1

example-setup/update-full-simple

@@ -3,16 +3,10 @@
 set -euo pipefail
 
 trap '[ $? -eq 0 ] && exit 0; printf "%s failed\n" "$0"' EXIT
+dir="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd -P)"
+source "${dir}/utils.sh"
 export PATH=${PATH}:${HOME}/go/bin
 
-abs_path() {
-  if [[ -d "$(dirname "$1")" ]]
-  then
-    echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" || true
-  fi
-}
-
-
 if [[ "$#" -ne 2 ]]; then
    echo "Usage: ./update-full-simple <data-folder> <cbor|json>"
    exit 1

example-setup/utils.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+abs_path() {
+  if [[ -d "$(dirname "$1")" ]]
+  then
+    echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" || true
+  fi
+}
+
+extendarr() {
+	local key=$1
+	shift
+  local param=$1
+
+  # Add new value
+  json="$(echo "${json}" | jq ".${key} += [${param}]")"
+}