-
Notifications
You must be signed in to change notification settings - Fork 3
chore(deps): update rust crate prost to 0.14 #114
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
chore(deps): update rust crate prost to 0.14 #114
Conversation
Git history will be rewritten to a fresh start Next backport will be done as a rebase operation (with "git push --force-with-lease" on the main downstream branch) Note: Prometheus first PR has been cherry-picked Signed-off-by: Leonardo Milleri <[email protected]>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Updated the VIRTEE SEV crate dependency in the verifier to version 6.1.0. This release adds support for newer versions of the AMD attestation report. Starting with version 3 of the report, we can identify the EPYC processor generation used by the host, allowing us to select the correct certificate chain for attestation verification. Additional TCB fields introduced with the Turin generation are now supported. We’ve also added logic to request the VCEK from the KDS for all supported generations. To prevent ambiguity during attestation, we have bumped the minimum supported attestation report version to 3. Reports from earlier versions lack the necessary information to determine the correct certificate chain. We removed some of the previous custom verification logic and now use the built-in verification methods provided by the SEV crate. This allows us to offload maintenance of verification logic and simplifies future updates—just a dependency bump should suffice. Lastly, we refactored the certificate chain logic. Previously, we carried two chains—one from stored certs and another from user-provided input. We’ve now simplified this to use a single chain: if the user provides certs via extended attestation, those are used; otherwise, the verifier defaults to the stored certificates. Vendored Certs are still being loaded using a static lazylock as a hashmap when SNP is initialized, that way the verifier can grab the appropriate cert chain when needed for attestation without the need of additional memory copies. Can just reference it whenever it's needed. Signed-off-by: DGonzalezVillal <[email protected]>
Since the az_snp_vtpm verifier depends on both the az_snp_vtpm crate and the VIRTEE SEV crate, bumping the VIRTEE SEV version introduces a mismatch between the attestation report types generated by the Azure crate and the SEV crate. This commit updates the az_snp_vtpm verifier to rely solely on the report and certificates provided by the Azure SNP crate to avoid this mismatch. Note: This change restores compatibility between az_snp_vtpm and the updated SEV crate, but does not add support for newer processor generations. To support those, the az_snp_vtpm crate will need to be updated to handle the newer attestation reports and integrate with the latest VIRTEE SEV release. Signed-off-by: DGonzalezVillal <[email protected]>
Bumping the guest components dependency to support the latest snp attestation. Also fixed async dependency issue between latest guest components and Trustee. Fixed attestation-service evidence.json for Generate Evidence Dynamically=False test. Added a rust test for that json evidence to confirm it's working without having to launch e2e testing. Also updated the test VLEK report and the test VLEK certificate to a supported version. Signed-off-by: DGonzalezVillal <[email protected]>
Update `az-snp-vtpm` and `az-tdx-vtpm` from `0.7.1` to `0.7.4` and fix attestation report verification. The key changes include: - Replaced the signature verification logic that used `offset_of` and `bincode::serialize` with the new `report.write_bytes()` method provided by sev 6.2.1. - Fixed report.chip_id usage by dereferencing array Signed-off-by: Yan Fu <[email protected]>
Co-authored-by: Magnus Kulke <[email protected]> Signed-off-by: Yan Fu <[email protected]>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Bumped sev version to 6.2.1. guest-components uses crate https://github.com/virtee/sev for interacting with the snp HW. guest-components v0.12.0 and v0.13.0 use sev version = "4.0.0" guest-components v0.14.0 uses sev version = "6.2.1" sev 6.2.1 introduces a fix for attestation report version >=3 Signed-off-by: Leonardo Milleri <[email protected]>
Backport SNP upstream PRs and fix attestation genoa cpu
Signed-off-by: Leonardo Milleri <[email protected]>
chore(deps): update dependency go to v1.25.0
…org-x-sys-0.x chore(deps): update module golang.org/x/sys to v0.36.0
|
/retest |
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
…s-0.x chore(deps): update rust crate serde_qs to 0.15.0
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
chore(deps): update rust crate rstest to 0.26.0
chore(deps): update konflux references
Restored a Pr from mintmaker Signed-off-by: Leonardo Milleri <[email protected]>
…-0.x Update regorus version
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
…ger-0.x chore(deps): update rust crate env_logger to 0.11.0
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
chore(deps): update rust crate config to 0.15.0
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
f77c015 to
6f5e127
Compare
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
|
PR needs rebase. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
This PR contains the following updates:
0.13->0.14Release Notes
tokio-rs/prost (prost)
v0.14.1Compare Source
PROST! is a Protocol Buffers implementation for the Rust Language.
prostgenerates simple, idiomatic Rust code fromproto2andproto3files.reruncommandsVersion 0.14.1 reverts the emission of
reruncommands. Other than this change, it is identical to 0.14.0.In version 0.14.0,
prost-buildbegan emittingreruncommands. While intended to improve build correctness, this change caused regressions for some users—for example, those generatingprotosfrom anincludesdirectory. These edge cases are difficult to address reliably, so the change has been rolled back in 0.14.1.For more details, see issue #1296.
Breaking changes
prost: Relax Message Debug trait bound (#1147)
BREAKING CHANGE:
trait Debugwas a supertrait oftrait Message. This is no longer required byprost. If your code relies ontrait Debugbeing implemented for everyimpl Message, you must now explicitly state that you require both Debug and Message. For example:where M: Debug + Messageprost: Remove prost-derive feature (#1247)
BREAKING CHANGE: Feature flag
prost-deriveis renamed toderive. Please rename any usage ofprost-derivefeature in yourCargo.toml.prost-build: Prevent repeated fields to be boxed (#1237)
BREAKING CHANGE: A repeated field that is manually marked as boxed was typed as
Vec<Box<T>>. Those fields are now simply typed asVec<T>to prevent double indirection. Theboxedconfiguration is effectively ignored for repeated fields.prost-build: Make
type_name_domaincumulative (#1228)BREAKING CHANGE: The configuration for domain names of messages is now cumulative. All calls to
prost_build::Config::type_name_domainare now concatenated. The previous behavior was that only the arguments of the last call were used. If you do multiple calls to type_name_domain, you need to remove all but the last call to maintain the same behavior.prost-build: Derive Eq and Hash trait for messages where possible (#1175)
BREAKING CHANGE:
prost-buildwill automatically derivetrait Eqandtrait Hashfor types where all field support those as well. If you manuallyimpl Eqand/orimpl Hashfor generated types, then you need to remove the manual implementation. If you usetype_attributetoderive(Eq)and/orderive(Hash), then you need to remove those.Features
Durationto/fromchrono::TimeDelta(#1236)gen(#1257)Dependencies
Documentation
prost-types/README.md(#1262)Styling
Testing
v0.14.0Compare Source
PROST! is a Protocol Buffers implementation for the Rust Language.
prostgenerates simple, idiomatic Rust code fromproto2andproto3files.Breaking changes
prost: Relax Message Debug trait bound (#1147)
BREAKING CHANGE:
trait Debugwas a supertrait oftrait Message. This is no longer required byprost. If your code relies ontrait Debugbeing implemented for everyimpl Message, you must now explicitly state that you require both Debug and Message. For example:where M: Debug + Messageprost: Remove prost-derive feature (#1247)
BREAKING CHANGE: Feature flag
prost-deriveis renamed toderive. Please rename any usage ofprost-derivefeature in yourCargo.toml.prost-build: Emit
reruncommands (#1140)BREAKING CHANGE: Previously
cargoassumed it had to rerunbuild.rsif any files in the project changed.prost-buildwill now emitreruncommands, which means only the explicitly marked files cause a rerun. If yourbuild.rsis dependent on any other file paths than those given toprost-build, then yourbuild.rsneeds to emitreruncommands as well.prost-build: Prevent repeated fields to be boxed (#1237)
BREAKING CHANGE: A repeated field that is manually marked as boxed was typed as
Vec<Box<T>>. Those fields are now simply typed asVec<T>to prevent double indirection. Theboxedconfiguration is effectively ignored for repeated fields.prost-build: Make
type_name_domaincumulative (#1228)BREAKING CHANGE: The configuration for domain names of messages is now cumulative. All calls to
prost_build::Config::type_name_domainare now concatenated. The previous behavior was that only the arguments of the last call were used. If you do multiple calls to type_name_domain, you need to remove all but the last call to maintain the same behavior.prost-build: Derive Eq and Hash trait for messages where possible (#1175)
BREAKING CHANGE:
prost-buildwill automatically derivetrait Eqandtrait Hashfor types where all field support those as well. If you manuallyimpl Eqand/orimpl Hashfor generated types, then you need to remove the manual implementation. If you usetype_attributetoderive(Eq)and/orderive(Hash), then you need to remove those.Features
Durationto/fromchrono::TimeDelta(#1236)gen(#1257)Dependencies
Documentation
prost-types/README.md(#1262)Styling
Testing
v0.13.5Compare Source
PROST! is a Protocol Buffers implementation for the Rust Language.
prostgenerates simple, idiomatic Rust code fromproto2andproto3files.Features
Documentation
Dependencies
Styling
map_or(#1221)Testing
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.This PR has been generated by MintMaker (powered by Renovate Bot).