Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update AKS attestation example to use Gramine 1.3.1 #14

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

aneessahib
Copy link
Contributor

@aneessahib aneessahib commented Nov 21, 2022

Signed-off-by: aneessahib [email protected]

fixes #8


This change is Reviewable

Copy link
Member

@mkow mkow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed 12 of 12 files at r1, all commit messages.
Reviewable status: all files reviewed, 1 unresolved discussion, not enough approvals from maintainers (3 more required), not enough approvals from different teams (2 more required, approved so far: ) (waiting on @aneessahib)


Examples/aks-attestation/aks-secret-prov-server.dockerfile line 32 at r1 (raw file):

ARG server_dcap_pf="n"
RUN if [ $server_dcap_pf="y" ]; then \
        sed -i "s|verify_measurements_callback,|NULL,|g" \

Please don't patch sources with sed. Also, why do you even need this?

Copy link
Contributor Author

@aneessahib aneessahib left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewable status: all files reviewed, 1 unresolved discussion, not enough approvals from maintainers (2 more required), not enough approvals from different teams (2 more required, approved so far: ) (waiting on @mkow)


Examples/aks-attestation/aks-secret-prov-server.dockerfile line 32 at r1 (raw file):

Previously, mkow (Michał Kowalczyk) wrote…

Please don't patch sources with sed. Also, why do you even need this?

This file is taken as is from https://github.com/gramineproject/contrib/blob/master/Curated-Apps/verifier/verifier.dockerfile.template

This change will force the verification logic to default to https://github.com/gramineproject/gramine/blob/da990909010a5989dc89c63f4c7a22d78fb3f5c6/tools/sgx/ra-tls/ra_tls_verify_dcap.c#L206, and this is more secure. ( verify_measurements_callback which only prints the different quote attributes)

Copy link
Contributor Author

@aneessahib aneessahib left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewable status: all files reviewed, 1 unresolved discussion, not enough approvals from maintainers (2 more required), not enough approvals from different teams (2 more required, approved so far: ) (waiting on @mkow)


Examples/aks-attestation/aks-secret-prov-server.dockerfile line 32 at r1 (raw file):

Previously, aneessahib (Anees Sahib) wrote…

This file is taken as is from https://github.com/gramineproject/contrib/blob/master/Curated-Apps/verifier/verifier.dockerfile.template

This change will force the verification logic to default to https://github.com/gramineproject/gramine/blob/da990909010a5989dc89c63f4c7a22d78fb3f5c6/tools/sgx/ra-tls/ra_tls_verify_dcap.c#L206, and this is more secure. ( verify_measurements_callback which only prints the different quote attributes)

btw - we should be ok to modify examples to suit our needs, no?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Update AKS-Attestation example after Gramine PR 884 is merged
2 participants