diff --git a/.gitignore b/.gitignore index 0d87412..45105a6 100644 --- a/.gitignore +++ b/.gitignore @@ -12,6 +12,6 @@ /wasm-micro-runtime-*.tar.gz /DCAP_*.tar.gz *~ -/dcap-*-pccs-node-modules.tar.xz -/node-ffi-rs-*-vendor.tar.gz -/node-ffi-rs-*.tar.gz +/dcap-1.23-pccs-node-modules.tar.xz +/node-ffi-rs-1.2.6-vendor.tar.gz +/node-ffi-rs-1.2.6.tar.gz diff --git a/0000-Add-support-for-building-against-host-openssl-crypto.patch b/0000-Add-support-for-building-against-host-openssl-crypto.patch index dd01792..381ce62 100644 --- a/0000-Add-support-for-building-against-host-openssl-crypto.patch +++ b/0000-Add-support-for-building-against-host-openssl-crypto.patch @@ -1,7 +1,7 @@ From d4f132e1363779aef2c4209789ca364e27f45bb2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 13 Feb 2025 14:12:38 +0000 -Subject: [PATCH 00/16] Add support for building against host openssl crypto +Subject: [PATCH 00/15] Add support for building against host openssl crypto lib MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -212,5 +212,5 @@ index e756d468..ea8ca78c 100644 .PHONY: all -- -2.52.0 +2.49.0 diff --git a/0001-Add-support-for-building-against-host-tinyxml2-lib.patch b/0001-Add-support-for-building-against-host-tinyxml2-lib.patch index 64d17e8..3bc516f 100644 --- a/0001-Add-support-for-building-against-host-tinyxml2-lib.patch +++ b/0001-Add-support-for-building-against-host-tinyxml2-lib.patch @@ -1,7 +1,7 @@ From e372a1a009f1de14ea5ee01ec022633d88f6d234 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 13 Feb 2025 14:01:10 +0000 -Subject: [PATCH 01/16] Add support for building against host tinyxml2 lib +Subject: [PATCH 01/15] Add support for building against host tinyxml2 lib MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -80,5 +80,5 @@ index ed177c86..1dcb6f51 100644 sgx_sign: $(OBJS) enclaveparser -- -2.52.0 +2.49.0 diff --git a/0002-Add-support-for-building-against-host-CppMicroServic.patch b/0002-Add-support-for-building-against-host-CppMicroServic.patch index 742b79e..b7eff37 100644 --- a/0002-Add-support-for-building-against-host-CppMicroServic.patch +++ b/0002-Add-support-for-building-against-host-CppMicroServic.patch @@ -1,7 +1,7 @@ From 02f4535633d317894629f30daf0583fddcdf3f1c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 13 Feb 2025 14:01:10 +0000 -Subject: [PATCH 02/16] Add support for building against host CppMicroServices +Subject: [PATCH 02/15] Add support for building against host CppMicroServices lib MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -138,5 +138,5 @@ index da3e0b77..89b3e3ae 100644 cmake_minimum_required(VERSION ${US_CMAKE_MINIMUM_REQUIRED_VERSION}) cmake_policy(VERSION ${US_CMAKE_MINIMUM_REQUIRED_VERSION}) -- -2.52.0 +2.49.0 diff --git a/0003-Improve-make-debuggability.patch b/0003-Improve-make-debuggability.patch index 2f49bbd..13afe6d 100644 --- a/0003-Improve-make-debuggability.patch +++ b/0003-Improve-make-debuggability.patch @@ -1,7 +1,7 @@ From e607f7279049d2db090a2bef9c7943cdb55d9de6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 1 Mar 2024 12:53:26 +0000 -Subject: [PATCH 03/16] Improve make debuggability +Subject: [PATCH 03/15] Improve make debuggability MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -70,5 +70,5 @@ index d1ac38a1..5fb90c21 100644 .PHONY: clean -- -2.52.0 +2.49.0 diff --git a/0004-Support-disabling-use-of-git-for-ippcp-code.patch b/0004-Support-disabling-use-of-git-for-ippcp-code.patch index 154b484..63b8cc1 100644 --- a/0004-Support-disabling-use-of-git-for-ippcp-code.patch +++ b/0004-Support-disabling-use-of-git-for-ippcp-code.patch @@ -1,7 +1,7 @@ From 8d858334aeade0a0063456fa03cdbc3f6a55d51f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 13 Feb 2025 14:37:24 +0000 -Subject: [PATCH 04/16] Support disabling use of git for ippcp code +Subject: [PATCH 04/15] Support disabling use of git for ippcp code MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -45,5 +45,5 @@ index a57c22a9..d78ba90e 100644 .PHONY: clean -- -2.52.0 +2.49.0 diff --git a/0005-disable-openmp-protobuf-sample_crypto-builds.patch b/0005-disable-openmp-protobuf-sample_crypto-builds.patch index 48f5b80..94b2deb 100644 --- a/0005-disable-openmp-protobuf-sample_crypto-builds.patch +++ b/0005-disable-openmp-protobuf-sample_crypto-builds.patch @@ -1,7 +1,7 @@ From e10242ea154af19d527377c9ff885fa0c7e7ce41 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 18 Jun 2024 15:57:22 +0100 -Subject: [PATCH 05/16] disable openmp, protobuf & sample_crypto builds +Subject: [PATCH 05/15] disable openmp, protobuf & sample_crypto builds MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -463,5 +463,5 @@ index dfbca6d4..3bd08d5c 100644 $(MAKE) -C utls clean @$(RM) $(LIBTLIBC) $(LIBTCXX) $(LIBTSE) -- -2.52.0 +2.49.0 diff --git a/0006-Fix-compat-with-gcc-14.patch b/0006-Fix-compat-with-gcc-14.patch index 7c4e01f..3775e97 100644 --- a/0006-Fix-compat-with-gcc-14.patch +++ b/0006-Fix-compat-with-gcc-14.patch @@ -1,7 +1,7 @@ From f257662821800cfe5cdb38639a35361aac0802a3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 24 Jun 2024 17:36:13 +0100 -Subject: [PATCH 06/16] Fix compat with gcc 14 +Subject: [PATCH 06/15] Fix compat with gcc 14 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -30,5 +30,5 @@ index 9a335c81..399d63b2 100644 #include "sgx_urts.h" #include "arch.h" -- -2.52.0 +2.49.0 diff --git a/0007-Fix-escaping-of-regexes-in-sgx-asm-pp.patch b/0007-Fix-escaping-of-regexes-in-sgx-asm-pp.patch index 6997078..5e85e52 100644 --- a/0007-Fix-escaping-of-regexes-in-sgx-asm-pp.patch +++ b/0007-Fix-escaping-of-regexes-in-sgx-asm-pp.patch @@ -1,7 +1,7 @@ From 089dddf45cda329896d5d94202780209567fed9d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 2 Sep 2024 16:49:18 +0100 -Subject: [PATCH 07/16] Fix escaping of regexes in sgx-asm-pp +Subject: [PATCH 07/15] Fix escaping of regexes in sgx-asm-pp MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -278,5 +278,5 @@ index 2b02396b..0df3fc47 100644 # # File Operations - read/write -- -2.52.0 +2.49.0 diff --git a/0008-psw-prefer-dev-sgx_provision-dev-sgx_enclave.patch b/0008-psw-prefer-dev-sgx_provision-dev-sgx_enclave.patch index 4d1aa2f..d60b019 100644 --- a/0008-psw-prefer-dev-sgx_provision-dev-sgx_enclave.patch +++ b/0008-psw-prefer-dev-sgx_provision-dev-sgx_enclave.patch @@ -1,7 +1,7 @@ From 8967386d8e9eb0f7a11a7e6ce7f97b6b1daf39ef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 4 Oct 2024 16:33:20 +0100 -Subject: [PATCH 08/16] psw: prefer /dev/sgx_provision & /dev/sgx_enclave +Subject: [PATCH 08/15] psw: prefer /dev/sgx_provision & /dev/sgx_enclave MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -74,5 +74,5 @@ index 49f2b9aa..fc537a84 100644 } else if (driver_type == SGX_DRIVER_DCAP) -- -2.52.0 +2.49.0 diff --git a/0009-psw-fix-soname-for-libuae_service.so-library.patch b/0009-psw-fix-soname-for-libuae_service.so-library.patch index e18b688..c2f5807 100644 --- a/0009-psw-fix-soname-for-libuae_service.so-library.patch +++ b/0009-psw-fix-soname-for-libuae_service.so-library.patch @@ -1,7 +1,7 @@ From 6d0fee06ee6c87f8f89aac9947bb8b3df9930238 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 17 Jan 2025 15:38:56 +0000 -Subject: [PATCH 09/16] psw: fix soname for libuae_service.so library +Subject: [PATCH 09/15] psw: fix soname for libuae_service.so library MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -25,5 +25,5 @@ index bffbdc5b..81f5c4b7 100644 $(IPC_SRC:.cpp=.o) : $(IPC_COMMON_PROTO_DIR)/messages.pb.cc AEServicesImpl.o : $(IPC_COMMON_PROTO_DIR)/messages.pb.cc -- -2.52.0 +2.49.0 diff --git a/0010-pcl-remove-redundant-use-of-bool-type.patch b/0010-pcl-remove-redundant-use-of-bool-type.patch index 9643cff..f774ad9 100644 --- a/0010-pcl-remove-redundant-use-of-bool-type.patch +++ b/0010-pcl-remove-redundant-use-of-bool-type.patch @@ -1,7 +1,7 @@ From 26f9569bf1ea44bc2e937b8ccbb1141bb1f88274 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 6 Feb 2025 09:54:33 +0000 -Subject: [PATCH 10/16] pcl: remove redundant use of 'bool' type +Subject: [PATCH 10/15] pcl: remove redundant use of 'bool' type MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -45,5 +45,5 @@ index 5ad6efde..b78ca907 100644 #endif // #ifdef SE_SIM -- -2.52.0 +2.49.0 diff --git a/0011-sdk-honour-CFLAGS-LDFLAGS-set-from-environment.patch b/0011-sdk-honour-CFLAGS-LDFLAGS-set-from-environment.patch index 547254b..9bf9229 100644 --- a/0011-sdk-honour-CFLAGS-LDFLAGS-set-from-environment.patch +++ b/0011-sdk-honour-CFLAGS-LDFLAGS-set-from-environment.patch @@ -1,7 +1,7 @@ From 5e43013eff1a6d558f1bad189cae185b383c49f6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 27 Mar 2025 14:17:01 +0000 -Subject: [PATCH 11/16] sdk: honour CFLAGS/LDFLAGS set from environment +Subject: [PATCH 11/15] sdk: honour CFLAGS/LDFLAGS set from environment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -122,5 +122,5 @@ index ea8ca78c..dd716f2b 100644 $(BUILD_DIR): @$(MKDIR) $@ -- -2.52.0 +2.49.0 diff --git a/0012-psw-make-aesm_service-build-verbose.patch b/0012-psw-make-aesm_service-build-verbose.patch index 7a1f225..6203c03 100644 --- a/0012-psw-make-aesm_service-build-verbose.patch +++ b/0012-psw-make-aesm_service-build-verbose.patch @@ -1,7 +1,7 @@ From e9ca38a6045c2ad5d5277cb52bc175eb56ee7466 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 27 Mar 2025 16:07:10 +0000 -Subject: [PATCH 12/16] psw: make aesm_service build verbose. +Subject: [PATCH 12/15] psw: make aesm_service build verbose. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -25,5 +25,5 @@ index 89a15875..dbfa3fb6 100644 $(CP) $(CPPMICROSERVICES) source/build/bin/ endif -- -2.52.0 +2.49.0 diff --git a/0013-Fix-modern-C-function-prototype-compliance.patch b/0013-Fix-modern-C-function-prototype-compliance.patch index 298f3de..81a760f 100644 --- a/0013-Fix-modern-C-function-prototype-compliance.patch +++ b/0013-Fix-modern-C-function-prototype-compliance.patch @@ -1,7 +1,7 @@ From 0ef77c5de1ae80a8a1df4280af1dbd1fba6ebe46 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 31 Mar 2025 10:55:25 +0100 -Subject: [PATCH 13/16] Fix modern C function prototype compliance +Subject: [PATCH 13/15] Fix modern C function prototype compliance MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -39,5 +39,5 @@ index 8e4e7600..8c38bb68 100644 g_sys_ptrace = (ptrace_t)dlsym(RTLD_NEXT, "ptrace"); g_sys_waitpid = (waitpid_t)dlsym(RTLD_NEXT, "waitpid"); -- -2.52.0 +2.49.0 diff --git a/0014-Add-wrapper-for-nasm-to-fix-cmake-compat.patch b/0014-Add-wrapper-for-nasm-to-fix-cmake-compat.patch index 31e5eea..b1a5bd0 100644 --- a/0014-Add-wrapper-for-nasm-to-fix-cmake-compat.patch +++ b/0014-Add-wrapper-for-nasm-to-fix-cmake-compat.patch @@ -1,7 +1,7 @@ From 77f998c285d15d31ec9104d413b380f90fa91970 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 2 Apr 2025 17:11:25 +0100 -Subject: [PATCH 14/16] Add wrapper for nasm to fix cmake compat +Subject: [PATCH 14/15] Add wrapper for nasm to fix cmake compat MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -65,5 +65,5 @@ index d78ba90e..71a40247 100644 $(IPP_SOURCE)/build: ifeq ($(IPP_USE_GIT), 1) -- -2.52.0 +2.49.0 diff --git a/0015-fix-BOM-for-pccs-with-DCAP-1.23.patch b/0015-fix-BOM-for-pccs-with-DCAP-1.23.patch index 52cca01..aa52f20 100644 --- a/0015-fix-BOM-for-pccs-with-DCAP-1.23.patch +++ b/0015-fix-BOM-for-pccs-with-DCAP-1.23.patch @@ -1,7 +1,7 @@ From 595343c8d79a45760a30b30e1bd66f4079c61f52 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 27 Jun 2025 11:37:26 +0100 -Subject: [PATCH 15/16] fix BOM for pccs with DCAP 1.23 +Subject: [PATCH 15/15] fix BOM for pccs with DCAP 1.23 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -68,5 +68,5 @@ index d70745c9..73c687b3 100644 /external/dcap_source/QuoteGeneration/pccs/README.md /README.md 0 main STP +/external/dcap_source/QuoteGeneration/pccs/nodejs.cnf /nodejs.cnf 0 main STP -- -2.52.0 +2.49.0 diff --git a/0016-sdk-avoid-failure-due-to-attribute-regparam-with-GCC.patch b/0016-sdk-avoid-failure-due-to-attribute-regparam-with-GCC.patch deleted file mode 100644 index 8d81167..0000000 --- a/0016-sdk-avoid-failure-due-to-attribute-regparam-with-GCC.patch +++ /dev/null @@ -1,83 +0,0 @@ -From d03ce44f87441bcd42e4c20afcf038677accbcfc Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= -Date: Tue, 6 Jan 2026 18:31:32 +0000 -Subject: [PATCH 16/16] sdk: avoid failure due to attribute(regparam) with GCC - 16 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -GCC >= 16 now warns about use of attribute(regparam) on x86_64 targets. -The attribute was always ignored on x86_64, so only had effect on i686 -and thus the warning can be safely ignored. - -Signed-off-by: Daniel P. Berrangé ---- - psw/urts/linux/Makefile | 4 ++-- - sdk/simulation/trtssim/linux/Makefile | 4 ++-- - sdk/simulation/urtssim/linux/Makefile | 4 ++-- - sdk/trts/Makefile | 1 + - 4 files changed, 7 insertions(+), 6 deletions(-) - -diff --git a/psw/urts/linux/Makefile b/psw/urts/linux/Makefile -index 3d08ee5c..1e76d8d5 100644 ---- a/psw/urts/linux/Makefile -+++ b/psw/urts/linux/Makefile -@@ -36,10 +36,10 @@ CXXFLAGS += -DDISABLE_TRACE - CFLAGS += -DDISABLE_TRACE - endif - --CXXFLAGS += -fPIC -Werror -g -+CXXFLAGS += -fPIC -Werror -Wno-attributes -g - CXXFLAGS += $(ADDED_INC) - --CFLAGS += -fPIC -Werror -g -+CFLAGS += -fPIC -Werror -Wno-attributes -g - CFLAGS += $(ADDED_INC) - - VTUNE_DIR = $(LINUX_EXTERNAL_DIR)/vtune/linux -diff --git a/sdk/simulation/trtssim/linux/Makefile b/sdk/simulation/trtssim/linux/Makefile -index 16e2a96d..7e545c1a 100644 ---- a/sdk/simulation/trtssim/linux/Makefile -+++ b/sdk/simulation/trtssim/linux/Makefile -@@ -41,8 +41,8 @@ CPPFLAGS += -I$(COMMON_DIR)/inc/ \ - - CFLAGS += $(ENCLAVE_CFLAGS) - ASFLAGS := -DSE_SIM -Werror $(CFLAGS) --CFLAGS += -DSE_SIM -Werror -fasynchronous-unwind-tables --CXXFLAGS += -DSE_SIM -Werror $(ENCLAVE_CXXFLAGS)\ -+CFLAGS += -DSE_SIM -Werror -Wno-attributes -fasynchronous-unwind-tables -+CXXFLAGS += -DSE_SIM -Werror -Wno-attributes $(ENCLAVE_CXXFLAGS)\ - -fno-exceptions -fno-rtti - - SIM_DIR := $(CUR_DIR)/../.. -diff --git a/sdk/simulation/urtssim/linux/Makefile b/sdk/simulation/urtssim/linux/Makefile -index dd716f2b..5d64c8ac 100644 ---- a/sdk/simulation/urtssim/linux/Makefile -+++ b/sdk/simulation/urtssim/linux/Makefile -@@ -39,8 +39,8 @@ CXXFLAGS += -DDISABLE_TRACE - CFLAGS += -DDISABLE_TRACE - endif - --CXXFLAGS += -fPIC -DSE_SIM -Werror -g $(CET_FLAGS) --CFLAGS += -fPIC -DSE_SIM -Werror -g $(CET_FLAGS) -+CXXFLAGS += -fPIC -DSE_SIM -Werror -Wno-attributes -g $(CET_FLAGS) -+CFLAGS += -fPIC -DSE_SIM -Werror -Wno-attributes -g $(CET_FLAGS) - - CPPFLAGS += $(ADDED_INC) #for ubuntu 11 and later version - CPPFLAGS += -I$(COMMON_DIR)/inc \ -diff --git a/sdk/trts/Makefile b/sdk/trts/Makefile -index 5750aece..4766ef51 100644 ---- a/sdk/trts/Makefile -+++ b/sdk/trts/Makefile -@@ -39,6 +39,7 @@ CPPFLAGS += -I$(COMMON_DIR)/inc \ - - CXXFLAGS += $(ENCLAVE_CXXFLAGS) \ - -Werror \ -+ -Wno-attributes \ - -fno-exceptions \ - -fno-rtti - --- -2.52.0 - diff --git a/0100-Drop-use-of-bundled-pre-built-openssl.patch b/0100-Drop-use-of-bundled-pre-built-openssl.patch index 09c9d3b..9312740 100644 --- a/0100-Drop-use-of-bundled-pre-built-openssl.patch +++ b/0100-Drop-use-of-bundled-pre-built-openssl.patch @@ -1,7 +1,7 @@ -From cf39f86bcca57579013cee5967d39cdaca15cbc4 Mon Sep 17 00:00:00 2001 +From 9746d1048b23a3431d898f2375a8d849127ebde7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 26 Feb 2024 12:19:51 +0000 -Subject: [PATCH 100/129] Drop use of bundled pre-built openssl +Subject: [PATCH 100/120] Drop use of bundled pre-built openssl MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -188,5 +188,5 @@ index a20a3cd..c8e1d01 100644 debug: $(PCKCERTSEL_VERBOSE)$(MAKE) DEBUG=1 all -- -2.52.0 +2.49.0 diff --git a/0101-Improve-debuggability-of-build-system.patch b/0101-Improve-debuggability-of-build-system.patch index 39f5497..4c3f469 100644 --- a/0101-Improve-debuggability-of-build-system.patch +++ b/0101-Improve-debuggability-of-build-system.patch @@ -1,7 +1,7 @@ -From b36d8f61a5a18dc5edfbd632e5f2373bcf365b3e Mon Sep 17 00:00:00 2001 +From 50bbd267076608a9b0a3b5e23bcbc8bfadfb09d7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 1 Mar 2024 12:05:01 +0000 -Subject: [PATCH 101/129] Improve debuggability of build system +Subject: [PATCH 101/120] Improve debuggability of build system MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -128,5 +128,5 @@ index 894e616..7962d10 100644 .PHONY: qal qal: -- -2.52.0 +2.49.0 diff --git a/0102-Support-build-time-setting-of-enclave-load-directory.patch b/0102-Support-build-time-setting-of-enclave-load-directory.patch index a61c99e..eb37253 100644 --- a/0102-Support-build-time-setting-of-enclave-load-directory.patch +++ b/0102-Support-build-time-setting-of-enclave-load-directory.patch @@ -1,7 +1,7 @@ -From 9a185a6103e9637b785e498d4c4e4c990e7a3478 Mon Sep 17 00:00:00 2001 +From 2f0e63c015f83aa2248b8afa04c1928b6aa8b0fb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 26 Feb 2024 12:19:51 +0000 -Subject: [PATCH 102/129] Support build time setting of enclave load directory +Subject: [PATCH 102/120] Support build time setting of enclave load directory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -259,5 +259,5 @@ index d9c2bac..1065949 100644 App_Link_Flags += -lcurl -ldl -lpthread ifeq ($(STANDALONE), 1) -- -2.52.0 +2.49.0 diff --git a/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch b/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch index 7d1b234..7557473 100644 --- a/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch +++ b/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch @@ -1,7 +1,7 @@ -From b92d97f6037cb2e56d343cb979767d51655b097f Mon Sep 17 00:00:00 2001 +From 5fddd2225147e4372a6ff09350bdd495c3fdd4f8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 27 Feb 2024 15:46:41 +0000 -Subject: [PATCH 103/129] Look for versioned sgx_urts library in +Subject: [PATCH 103/120] Look for versioned sgx_urts library in PCKRetrievalTool MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -40,5 +40,5 @@ index d77a6eb..d195717 100644 } #endif -- -2.52.0 +2.49.0 diff --git a/0104-pccsadmin-only-import-pypac-module-on-Windows.patch b/0104-Don-t-import-pypac-in-pccsadmin.patch similarity index 52% rename from 0104-pccsadmin-only-import-pypac-module-on-Windows.patch rename to 0104-Don-t-import-pypac-in-pccsadmin.patch index 57cb5d6..067dd19 100644 --- a/0104-pccsadmin-only-import-pypac-module-on-Windows.patch +++ b/0104-Don-t-import-pypac-in-pccsadmin.patch @@ -1,35 +1,33 @@ -From eca1c479b23dd8e8c87e90988204c08b5e0c3edc Mon Sep 17 00:00:00 2001 +From d758e815930fe6ca3d19ab880c8cb839001746ce Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= -Date: Fri, 4 Oct 2024 17:41:37 +0100 -Subject: [PATCH 104/129] pccsadmin: only import 'pypac' module on Windows +Date: Tue, 27 Feb 2024 20:28:24 +0000 +Subject: [PATCH 104/120] Don't import pypac in pccsadmin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit -The PACSession object is only used in a code path that runs on -Windows, so don't try to import this on Linux, to avoid the -redundant dependency. +The code only uses the pypac module when executing on Windows +hosts. It should not be imported when packaged for Linux +environments to avoid a redundant python dependency. Signed-off-by: Daniel P. Berrangé --- - tools/PccsAdminTool/lib/intelsgx/pcs.py | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) + tools/PccsAdminTool/lib/intelsgx/pcs.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/PccsAdminTool/lib/intelsgx/pcs.py b/tools/PccsAdminTool/lib/intelsgx/pcs.py -index 9f1d224..046c781 100644 +index 9f1d224..af1e78e 100644 --- a/tools/PccsAdminTool/lib/intelsgx/pcs.py +++ b/tools/PccsAdminTool/lib/intelsgx/pcs.py -@@ -5,8 +5,9 @@ import json +@@ -5,7 +5,7 @@ import json import binascii from urllib import parse from OpenSSL import crypto -from pypac import PACSession ++#from pypac import PACSession from platform import system -+if system() == 'Windows': -+ from pypac import PACSession from lib.intelsgx.credential import Credentials from requests.adapters import HTTPAdapter - from urllib3.util import Retry -- -2.52.0 +2.49.0 diff --git a/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch b/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch index 060f39a..9e08f62 100644 --- a/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch +++ b/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch @@ -1,7 +1,7 @@ -From c8820c38a16ba9c572a6eafefd010b60ba037dde Mon Sep 17 00:00:00 2001 +From 1d85ecfb88b08772efdaeb241b09502383e1123c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 29 Feb 2024 14:21:36 +0000 -Subject: [PATCH 105/129] Look for PCKRetrievalTool config file in /etc/ +Subject: [PATCH 105/120] Look for PCKRetrievalTool config file in /etc/ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -39,5 +39,5 @@ index e423f38..36f219b 100644 if(strnlen(local_configuration_file_path ,MAX_PATH)+strnlen(LOCAL_NETWORK_SETTING,MAX_PATH)+sizeof(char) > MAX_PATH) { return false; -- -2.52.0 +2.49.0 diff --git a/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch b/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch index 64f5bb3..5538fb9 100644 --- a/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch +++ b/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch @@ -1,7 +1,7 @@ -From 06874f59bd6693f0f42a999dcfbdc0233d9a4bd2 Mon Sep 17 00:00:00 2001 +From ac4041d449135696b66c9d147d29f0967e2df1c3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 28 Mar 2025 16:00:27 +0000 -Subject: [PATCH 106/129] Honour CFLAGS/CXXFLAGS/LDFLAGS for various tools and +Subject: [PATCH 106/120] Honour CFLAGS/CXXFLAGS/LDFLAGS for various tools and libraries MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -205,5 +205,5 @@ index 4937fe9..83aefee 100644 LDFLAGS += '-Wl,-rpath,$$ORIGIN' CXXFLAGS += '-DSTANDALONE' -- -2.52.0 +2.49.0 diff --git a/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch b/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch index 6fd1e51..738678f 100644 --- a/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch +++ b/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch @@ -1,7 +1,7 @@ -From 44eefb7f574b33cb0cf5239948e7d633f1d71dd5 Mon Sep 17 00:00:00 2001 +From 95b111ae4a42f872e467a58058cfc87d5a5d089d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Oct 2024 14:42:29 +0100 -Subject: [PATCH 107/129] qgs: add space between program name & first arg in +Subject: [PATCH 107/120] qgs: add space between program name & first arg in usage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -35,5 +35,5 @@ index 478dbfe..3618b5a 100644 exit(1); } -- -2.52.0 +2.49.0 diff --git a/0108-qgs-protect-against-format-strings-in-QL-log-message.patch b/0108-qgs-protect-against-format-strings-in-QL-log-message.patch index 590648a..ebe3af5 100644 --- a/0108-qgs-protect-against-format-strings-in-QL-log-message.patch +++ b/0108-qgs-protect-against-format-strings-in-QL-log-message.patch @@ -1,7 +1,7 @@ -From 6c38e13fbee555045aec98f6e159531a385bce53 Mon Sep 17 00:00:00 2001 +From 0df9bd861d54722365e891911c18924af16cd732 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 4 Oct 2024 09:43:17 +0100 -Subject: [PATCH 108/129] qgs: protect against format strings in QL log +Subject: [PATCH 108/120] qgs: protect against format strings in QL log messages MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -35,5 +35,5 @@ index 77838c3..1e97b58 100644 } -- -2.52.0 +2.49.0 diff --git a/0109-qgs-add-debug-parameter-to-control-logging.patch b/0109-qgs-add-debug-parameter-to-control-logging.patch index eed8f9c..0d9a2f9 100644 --- a/0109-qgs-add-debug-parameter-to-control-logging.patch +++ b/0109-qgs-add-debug-parameter-to-control-logging.patch @@ -1,7 +1,7 @@ -From d1cbef970b8ee800a313b818927449a7dcf1a685 Mon Sep 17 00:00:00 2001 +From 480ac4becb93a54184c024fa1945c1a2890488fb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Oct 2024 16:57:35 +0100 -Subject: [PATCH 109/129] qgs: add --debug parameter to control logging +Subject: [PATCH 109/120] qgs: add --debug parameter to control logging MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -125,5 +125,5 @@ index 3618b5a..47f6c26 100644 exit(1); } -- -2.52.0 +2.49.0 diff --git a/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch b/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch index 1f30b24..b10409c 100644 --- a/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch +++ b/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch @@ -1,7 +1,7 @@ -From 64c49b04e7e22358f3afee834a434a6cfdff4a9b Mon Sep 17 00:00:00 2001 +From e559fba635b7736a54a446e25afc268b2a27513c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 8 Oct 2024 10:13:02 +0100 -Subject: [PATCH 110/129] pccsadmin: remove leftover debugging 'print(args)' +Subject: [PATCH 110/120] pccsadmin: remove leftover debugging 'print(args)' statement MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -29,5 +29,5 @@ index ffee326..8e447c5 100755 if args.command == 'put' and args.url and args.url.endswith("/appraisalpolicy"): if not args.fmspc or not args.input_file: -- -2.52.0 +2.49.0 diff --git a/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch b/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch index ff010b6..7900087 100644 --- a/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch +++ b/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch @@ -1,7 +1,7 @@ -From 32ac12f933e813b80348840821e1deaedf797a00 Mon Sep 17 00:00:00 2001 +From 6a2d951d6a1d21a1c45256c81eaf1acd6f010d46 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 17 Jan 2025 15:39:39 +0000 -Subject: [PATCH 111/129] Fix soname version for libsgx_qe3_logic.so library +Subject: [PATCH 111/120] Fix soname version for libsgx_qe3_logic.so library MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -51,5 +51,5 @@ index 9b8c936..c92d782 100644 $(BUILD_DIR): -- -2.52.0 +2.49.0 diff --git a/0112-Workaround-broken-GCC-15.patch b/0112-Workaround-broken-GCC-15.patch index e1d734b..6df7556 100644 --- a/0112-Workaround-broken-GCC-15.patch +++ b/0112-Workaround-broken-GCC-15.patch @@ -1,7 +1,7 @@ -From ac446d8943858e6dccec924451b8a8a3be4d9c4a Mon Sep 17 00:00:00 2001 +From 63e5a14cbae060060ee1de4eae177cc2f7b1f851 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 6 Feb 2025 20:08:59 +0000 -Subject: [PATCH 112/129] Workaround broken GCC 15 +Subject: [PATCH 112/120] Workaround broken GCC 15 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -36,5 +36,5 @@ index 15fbdd4..4400544 100644 private: struct alignas(A)_T_instantiator_ -- -2.52.0 +2.49.0 diff --git a/0113-Don-t-disable-cf-protection-for-qgs.patch b/0113-Don-t-disable-cf-protection-for-qgs.patch index 4c04f79..b115c34 100644 --- a/0113-Don-t-disable-cf-protection-for-qgs.patch +++ b/0113-Don-t-disable-cf-protection-for-qgs.patch @@ -1,7 +1,7 @@ -From fa8c4f150fe32dafd875c5f45a9e588775235e35 Mon Sep 17 00:00:00 2001 +From 3cb471cfd9309a61c6cacf99ef8959c8d6c3079c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 2 Apr 2025 18:39:31 +0100 -Subject: [PATCH 113/129] Don't disable cf-protection for qgs +Subject: [PATCH 113/120] Don't disable cf-protection for qgs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -27,5 +27,5 @@ index 8228bdf..5116d85 100644 DEPENDS = ${QGS_OBJS test_client.o:.o=.d} -- -2.52.0 +2.49.0 diff --git a/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch b/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch index 3059afe..c3aa197 100644 --- a/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch +++ b/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch @@ -1,7 +1,7 @@ -From 2d83da9d5f5fb7399b0d7ec6ac410a6bf52b2add Mon Sep 17 00:00:00 2001 +From 218ff444583b58dc122ac69507b50c6e9f711581 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Apr 2025 17:44:48 +0100 -Subject: [PATCH 114/129] Delete broken checks for GCC version that break +Subject: [PATCH 114/120] Delete broken checks for GCC version that break -fstack-protector-strong MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -201,5 +201,5 @@ index b6968c6..1d2106b 100644 ifdef DEBUG COMMON_FLAGS += -O0 -ggdb -DDEBUG -UNDEBUG -- -2.52.0 +2.49.0 diff --git a/0115-Use-distro-provided-rapidjson-package.patch b/0115-Use-distro-provided-rapidjson-package.patch index a3d14af..b367037 100644 --- a/0115-Use-distro-provided-rapidjson-package.patch +++ b/0115-Use-distro-provided-rapidjson-package.patch @@ -1,7 +1,7 @@ -From 40d434d75ff4978cd968b4d140af5aa8c8f602c2 Mon Sep 17 00:00:00 2001 +From 8c70d52e120ff2f2e878975db2ac7253b28319cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 26 Feb 2024 12:19:51 +0000 -Subject: [PATCH 115/129] Use distro provided rapidjson package +Subject: [PATCH 115/120] Use distro provided rapidjson package MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -170,5 +170,5 @@ index c8e1d01..6f1440a 100644 # the library shared object name LIB_NAME := libPCKCertSelection.a -- -2.52.0 +2.49.0 diff --git a/0116-Don-t-stomp-on-VERBOSE-variable.patch b/0116-Don-t-stomp-on-VERBOSE-variable.patch index be5bf22..205d410 100644 --- a/0116-Don-t-stomp-on-VERBOSE-variable.patch +++ b/0116-Don-t-stomp-on-VERBOSE-variable.patch @@ -1,7 +1,7 @@ -From 605d9bcc0003c869e785376bbc3dbecc670c934d Mon Sep 17 00:00:00 2001 +From 9313ac72fda37a90096979cabae7d4294ef7ba42 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 16 Apr 2025 11:48:52 +0100 -Subject: [PATCH 116/129] Don't stomp on "VERBOSE" variable +Subject: [PATCH 116/120] Don't stomp on "VERBOSE" variable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -97,5 +97,5 @@ index 3d474bb..0f593f5 100644 - $(VERBOSE) rm -vrf $(TARGET) $(SIGNING_MATERIAL) + $(CMD_VERBOSE) rm -vrf $(TARGET) $(SIGNING_MATERIAL) -- -2.52.0 +2.49.0 diff --git a/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch b/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch index f399aa5..a175203 100644 --- a/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch +++ b/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch @@ -1,7 +1,7 @@ -From d7299915f42cd068744ce02e358865085f2f12bf Mon Sep 17 00:00:00 2001 +From 22171373ad5c818b5a57339ba607ff9876e34939 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 2 May 2025 14:48:24 +0100 -Subject: [PATCH 117/129] qgs: add -m=MODE parameter for UNIX socket mode +Subject: [PATCH 117/120] qgs: add -m=MODE parameter for UNIX socket mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -99,5 +99,5 @@ index 47f6c26..4628b18 100644 io_service.run(); QGS_LOG_INFO("Quit main loop\n"); -- -2.52.0 +2.49.0 diff --git a/0118-Switch-default-PCCS-port-number-from-8081-to-10801.patch b/0118-Switch-default-PCCS-port-number-from-8081-to-10801.patch new file mode 100644 index 0000000..a87e3bd --- /dev/null +++ b/0118-Switch-default-PCCS-port-number-from-8081-to-10801.patch @@ -0,0 +1,174 @@ +From 2f42f8333820bb555778df38aaf27d02a5533ef6 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= +Date: Tue, 27 Feb 2024 15:46:41 +0000 +Subject: [PATCH 118/120] Switch default PCCS port number from 8081 to 10801 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Port 8081 is a very poor choice of port number, since it is +both assigned to existing softrware in /etc/services, and +a fairly common "alternative" HTTP port that application +developers use for ad-hoc services. + +Move it to 10801 which is not assigned in /etc/services and +thus unlikely to clash with other software. + +Signed-off-by: Daniel P. Berrangé +--- + QuoteGeneration/pccs/config/default.json | 2 +- + QuoteGeneration/qcnl/inc/qcnl_config.h | 2 +- + QuoteGeneration/qcnl/linux/sgx_default_qcnl.conf | 4 ++-- + QuoteGeneration/qcnl/linux/sgx_default_qcnl_dev.conf | 2 +- + tools/PCKRetrievalTool/App/App.cpp | 4 ++-- + tools/PCKRetrievalTool/network_setting.conf | 4 ++-- + tools/PccsAdminTool/pccsadmin.py | 12 ++++++------ + 7 files changed, 15 insertions(+), 15 deletions(-) + +diff --git a/QuoteGeneration/pccs/config/default.json b/QuoteGeneration/pccs/config/default.json +index 13e00e2..7be5c6e 100644 +--- a/QuoteGeneration/pccs/config/default.json ++++ b/QuoteGeneration/pccs/config/default.json +@@ -1,5 +1,5 @@ + { +- "HTTPS_PORT" : 8081, ++ "HTTPS_PORT" : 10801, + "hosts" : "127.0.0.1", + "uri": "https://api.trustedservices.intel.com/sgx/certification/v4/", + "ApiKey": "", +diff --git a/QuoteGeneration/qcnl/inc/qcnl_config.h b/QuoteGeneration/qcnl/inc/qcnl_config.h +index 71b9a99..b9f2262 100644 +--- a/QuoteGeneration/qcnl/inc/qcnl_config.h ++++ b/QuoteGeneration/qcnl/inc/qcnl_config.h +@@ -82,7 +82,7 @@ protected: + // TCB update type, "early" or "standard" + string tcb_update_type_; + +- QcnlConfig() : server_url_("https://localhost:8081/sgx/certification/v4/"), ++ QcnlConfig() : server_url_("https://localhost:10801/sgx/certification/v4/"), + use_secure_cert_(true), + collateral_service_url_(server_url_), + collateral_version_("3.0"), +diff --git a/QuoteGeneration/qcnl/linux/sgx_default_qcnl.conf b/QuoteGeneration/qcnl/linux/sgx_default_qcnl.conf +index 7df3995..af26a7e 100644 +--- a/QuoteGeneration/qcnl/linux/sgx_default_qcnl.conf ++++ b/QuoteGeneration/qcnl/linux/sgx_default_qcnl.conf +@@ -2,7 +2,7 @@ + // *** ATTENTION : This file is in JSON format so the keys are case sensitive. Don't change them. + + //PCCS server address +- "pccs_url": "https://localhost:8081/sgx/certification/v4/" ++ "pccs_url": "https://localhost:10801/sgx/certification/v4/" + + // To accept insecure HTTPS certificate, set this option to false + ,"use_secure_cert": true +@@ -37,7 +37,7 @@ + + // If local_pck_url is defined, the QCNL will try to retrieve PCK cert chain from local_pck_url first, + // and failover to pccs_url as in legacy mode. +- //,"local_pck_url": "http://localhost:8081/sgx/certification/v4/" ++ //,"local_pck_url": "http://localhost:10801/sgx/certification/v4/" + + // If local_pck_url is not defined, set pck_cache_expire_hours to a none-zero value will enable local cache. + // The PCK certificates will be cached in memory and then to the disk drive. +diff --git a/QuoteGeneration/qcnl/linux/sgx_default_qcnl_dev.conf b/QuoteGeneration/qcnl/linux/sgx_default_qcnl_dev.conf +index 08ee41c..f398b7d 100644 +--- a/QuoteGeneration/qcnl/linux/sgx_default_qcnl_dev.conf ++++ b/QuoteGeneration/qcnl/linux/sgx_default_qcnl_dev.conf +@@ -8,7 +8,7 @@ + // It is recommended to use "3.1" for DCAP 1.12 release and later + + //PCCS server address +- "pccs_url": "https://localhost:8081/sgx/certification/v4/", ++ "pccs_url": "https://localhost:10801/sgx/certification/v4/", + + // To accept insecure HTTPS certificate, set this option to false + "use_secure_cert": false, +diff --git a/tools/PCKRetrievalTool/App/App.cpp b/tools/PCKRetrievalTool/App/App.cpp +index a34710d..17196e2 100644 +--- a/tools/PCKRetrievalTool/App/App.cpp ++++ b/tools/PCKRetrievalTool/App/App.cpp +@@ -67,7 +67,7 @@ uint32_t COMM_API sgx_tool_get_launch_token( + + void PrintHelp() { + printf("Usage: %s [OPTION] \n", VER_PRODUCTNAME_STR); +- printf("Example: %s -f pck_retrieval_result.csv -url https://localhost:8081 -user_token 123456 -use_secure_cert true -platform_id\n", VER_PRODUCTNAME_STR); ++ printf("Example: %s -f pck_retrieval_result.csv -url https://localhost:10801 -user_token 123456 -use_secure_cert true -platform_id\n", VER_PRODUCTNAME_STR); + printf( "\nOptions:\n"); + printf( " -f filename - output the retrieval result to the \"filename\"\n"); + printf( " -url cache_server_address - cache server's address \n"); +@@ -171,7 +171,7 @@ int parse_arg(int argc, const char *argv[]) + } + } + else if (strncmp(argv[i], "-defaulturl", 11) == 0) { +- server_url_string = "https://localhost:8081"; ++ server_url_string = "https://localhost:10801"; + continue; + } + else if (strncmp(argv[i], "-proxy_type",11) == 0) { +diff --git a/tools/PCKRetrievalTool/network_setting.conf b/tools/PCKRetrievalTool/network_setting.conf +index 7aa5d71..3600191 100644 +--- a/tools/PCKRetrievalTool/network_setting.conf ++++ b/tools/PCKRetrievalTool/network_setting.conf +@@ -1,9 +1,9 @@ + # ############################################################# + # PCCS server address + # support V3 version PCCS +-#PCCS_URL=https://localhost:8081/sgx/certification/v3/platforms ++#PCCS_URL=https://localhost:10801/sgx/certification/v3/platforms + # support V4 version PCCS +-#PCCS_URL=https://localhost:8081/sgx/certification/v4/platforms ++#PCCS_URL=https://localhost:10801/sgx/certification/v4/platforms + # To accept insecure HTTPS cert, set this option to FALSE + #USE_SECURE_CERT=TRUE + # When PCCS running in REQ mode, set "tcb update type": STANDARD, EARLY or ALL +diff --git a/tools/PccsAdminTool/pccsadmin.py b/tools/PccsAdminTool/pccsadmin.py +index 8e447c5..f286827 100755 +--- a/tools/PccsAdminTool/pccsadmin.py ++++ b/tools/PccsAdminTool/pccsadmin.py +@@ -16,7 +16,7 @@ from urllib.parse import unquote + import traceback + + PCS_SERVICE_URL = 'https://api.trustedservices.intel.com/sgx/certification/v4/' +-PCCS_SERVICE_URL = 'https://localhost:8081/sgx/certification/v4' ++PCCS_SERVICE_URL = 'https://localhost:10801/sgx/certification/v4' + + def main(): + parser = argparse.ArgumentParser(description="Administrator tool for PCCS") +@@ -26,7 +26,7 @@ def main(): + # subparser for get + parser_get = subparsers.add_parser('get', formatter_class=argparse.RawTextHelpFormatter) + # add optional arguments for get +- parser_get.add_argument("-u", "--url", help="The URL of the PCCS's GET platforms API; default: https://localhost:8081/sgx/certification/v4/platforms") ++ parser_get.add_argument("-u", "--url", help="The URL of the PCCS's GET platforms API; default: https://localhost:10801/sgx/certification/v4/platforms") + parser_get.add_argument("-o", "--output_file", help="The output file name for platform list; default: platform_list.json") + parser_get.add_argument("-s", "--source", help= + "reg - Get platforms from registration table.(default)\n" +@@ -37,12 +37,12 @@ def main(): + # subparser for put + description_put = ( + "This put command supports the following formats([] means optional):\n" +- "1. pccsadmin put [-u https://localhost:8081/sgx/certification/v4/platformcollateral] [-i collateral_file(*.json)]\n" +- "2. pccsamdin put -u https://localhost:8081/sgx/certification/v4/appraisalpolicy [-d] -f fmspc -i policy_file(*.jwt)" ++ "1. pccsadmin put [-u https://localhost:10801/sgx/certification/v4/platformcollateral] [-i collateral_file(*.json)]\n" ++ "2. pccsamdin put -u https://localhost:10801/sgx/certification/v4/appraisalpolicy [-d] -f fmspc -i policy_file(*.jwt)" + ) + parser_put = subparsers.add_parser('put', description=description_put, formatter_class=argparse.RawTextHelpFormatter) + # add optional arguments for put +- parser_put.add_argument("-u", "--url", help="The URL of the PCCS's API; default: https://localhost:8081/sgx/certification/v4/platformcollateral") ++ parser_put.add_argument("-u", "--url", help="The URL of the PCCS's API; default: https://localhost:10801/sgx/certification/v4/platformcollateral") + parser_put.add_argument("-i", "--input_file", help="The input file name for platform collaterals or appraisal policy;\ + \nFor /platformcollateral API, default is platform_collaterals.json;\ + \nFor /appraisalpolicy API, the filename of the jwt file must be provided explicitly.") +@@ -71,7 +71,7 @@ def main(): + # subparser for refresh + parser_refresh = subparsers.add_parser('refresh') + # add optional arguments for refresh +- parser_refresh.add_argument("-u", "--url", help="The URL of the PCCS's refresh API; default: https://localhost:8081/sgx/certification/v4/refresh") ++ parser_refresh.add_argument("-u", "--url", help="The URL of the PCCS's refresh API; default: https://localhost:10801/sgx/certification/v4/refresh") + parser_refresh.add_argument("-f", "--fmspc", help="Only refresh certificates for specified FMSPCs. Format: [FMSPC1, FMSPC2, ..., FMSPCn]") + parser_refresh.set_defaults(func=pccs_refresh) + +-- +2.49.0 + diff --git a/0118-pccs-sanitize-paths-to-all-resources.patch b/0119-Sanitize-paths-to-all-resources-in-PCCS-server.patch similarity index 96% rename from 0118-pccs-sanitize-paths-to-all-resources.patch rename to 0119-Sanitize-paths-to-all-resources-in-PCCS-server.patch index bd97e93..8134d1b 100644 --- a/0118-pccs-sanitize-paths-to-all-resources.patch +++ b/0119-Sanitize-paths-to-all-resources-in-PCCS-server.patch @@ -1,7 +1,7 @@ -From b108e8c9a0c9143e8fd930186c21d34d9cddaea7 Mon Sep 17 00:00:00 2001 +From 308e939ffc44c4720833aa518b0d19be1e01a186 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 27 Feb 2024 13:38:49 +0000 -Subject: [PATCH 118/129] pccs: sanitize paths to all resources +Subject: [PATCH 119/120] Sanitize paths to all resources in PCCS server MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -104,5 +104,5 @@ index 6f910ee..6eb9d15 100644 const migration = migrations.find(migration => migration.name === name); logger.debug(`Resolving migration: ${name}, found: ${migration ? migration.name : 'none'}`); -- -2.52.0 +2.49.0 diff --git a/0119-pccs-only-pass-ApiKey-if-it-is-set.patch b/0120-pccs-only-pass-ApiKey-if-it-is-set.patch similarity index 94% rename from 0119-pccs-only-pass-ApiKey-if-it-is-set.patch rename to 0120-pccs-only-pass-ApiKey-if-it-is-set.patch index d76e24b..9e97d21 100644 --- a/0119-pccs-only-pass-ApiKey-if-it-is-set.patch +++ b/0120-pccs-only-pass-ApiKey-if-it-is-set.patch @@ -1,7 +1,7 @@ -From 6c6e7427cf14455a56828db5c39f26ca8658a18d Mon Sep 17 00:00:00 2001 +From 512591ff394d7b04925893480519ebc1d29aefc7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 9 Jul 2025 16:41:59 +0100 -Subject: [PATCH 119/129] pccs: only pass ApiKey if it is set +Subject: [PATCH 120/120] pccs: only pass ApiKey if it is set MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -67,5 +67,5 @@ index 99ccea6..4f6c903 100644 } -- -2.52.0 +2.49.0 diff --git a/0120-pccsadmin-make-keyring-module-optional.patch b/0120-pccsadmin-make-keyring-module-optional.patch deleted file mode 100644 index a1fbfaf..0000000 --- a/0120-pccsadmin-make-keyring-module-optional.patch +++ /dev/null @@ -1,104 +0,0 @@ -From 2b540452538b12a47340b03d6118d3df281a6638 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= -Date: Thu, 4 Dec 2025 13:31:54 +0000 -Subject: [PATCH 120/129] pccsadmin: make 'keyring' module optional -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This is not available in some distros, and since it is merely a -convenience to avoid repeated password entry, it can be made -optional. - -Signed-off-by: Daniel P. Berrangé ---- - .../PccsAdminTool/lib/intelsgx/credential.py | 53 +++++++++++-------- - 1 file changed, 30 insertions(+), 23 deletions(-) - -diff --git a/tools/PccsAdminTool/lib/intelsgx/credential.py b/tools/PccsAdminTool/lib/intelsgx/credential.py -index 638cd88..cebecad 100644 ---- a/tools/PccsAdminTool/lib/intelsgx/credential.py -+++ b/tools/PccsAdminTool/lib/intelsgx/credential.py -@@ -1,4 +1,7 @@ --import keyring -+try: -+ import keyring -+except: -+ keyring = None - import getpass - - class Credentials: -@@ -8,11 +11,12 @@ class Credentials: - - def get_admin_token(self): - admin_token = "" -- try: -- print("Please note: A prompt may appear asking for your keyring password to access stored credentials.") -- admin_token = keyring.get_password(self.APPNAME, self.KEY_ADMINTOKEN) -- except keyring.errors.KeyringError as ke: -- admin_token = "" -+ if keyring is not None: -+ try: -+ print("Please note: A prompt may appear asking for your keyring password to access stored credentials.") -+ admin_token = keyring.get_password(self.APPNAME, self.KEY_ADMINTOKEN) -+ except keyring.errors.KeyringError as ke: -+ admin_token = "" - - while admin_token is None or admin_token == '': - admin_token = getpass.getpass(prompt="Please input your administrator password for PCCS service:") -@@ -25,21 +29,23 @@ class Credentials: - return admin_token - - def set_admin_token(self, token): -- try: -- print("Please note: A prompt may appear asking for your keyring password to access stored credentials.") -- keyring.set_password(self.APPNAME, self.KEY_ADMINTOKEN, token) -- except keyring.errors.PasswordSetError as ke: -- print("Failed to store admin token.") -- return False -+ if keyring is not None: -+ try: -+ print("Please note: A prompt may appear asking for your keyring password to access stored credentials.") -+ keyring.set_password(self.APPNAME, self.KEY_ADMINTOKEN, token) -+ except keyring.errors.PasswordSetError as ke: -+ print("Failed to store admin token.") -+ return False - return True - - def get_pcs_api_key(self): - pcs_api_key = "" -- try: -- print("Please note: A prompt may appear asking for your keyring password to access stored credentials.") -- pcs_api_key = keyring.get_password(self.APPNAME, self.KEY_PCS_APIKEY) -- except keyring.errors.KeyringError as ke: -- pcs_api_key = "" -+ if keyring is not None: -+ try: -+ print("Please note: A prompt may appear asking for your keyring password to access stored credentials.") -+ pcs_api_key = keyring.get_password(self.APPNAME, self.KEY_PCS_APIKEY) -+ except keyring.errors.KeyringError as ke: -+ pcs_api_key = "" - - while pcs_api_key is None or pcs_api_key == '': - pcs_api_key = getpass.getpass(prompt="Please input ApiKey for Intel PCS:") -@@ -52,10 +58,11 @@ class Credentials: - return pcs_api_key - - def set_pcs_api_key(self, apikey): -- try: -- print("Please note: A prompt may appear asking for your keyring password to access stored credentials.") -- keyring.set_password(self.APPNAME, self.KEY_PCS_APIKEY, apikey) -- except keyring.errors.PasswordSetError as ke: -- print("Failed to store PCS API key.") -- return False -+ if keyring is not None: -+ try: -+ print("Please note: A prompt may appear asking for your keyring password to access stored credentials.") -+ keyring.set_password(self.APPNAME, self.KEY_PCS_APIKEY, apikey) -+ except keyring.errors.PasswordSetError as ke: -+ print("Failed to store PCS API key.") -+ return False - return True --- -2.52.0 - diff --git a/0121-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch b/0121-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch deleted file mode 100644 index 0d8276a..0000000 --- a/0121-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch +++ /dev/null @@ -1,341 +0,0 @@ -From b9954581944446455876728bdab816090d773715 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= -Date: Thu, 4 Dec 2025 13:54:19 +0000 -Subject: [PATCH 121/129] pccsadmin: convert from asn1 to pyasn1 python module -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The pyasn1 module decodes using a formal object model so is more robust, -as well as being more widely available in distros. - -Signed-off-by: Daniel P. Berrangé ---- - tools/PccsAdminTool/lib/intelsgx/pckcert.py | 267 +++++++++++++------- - 1 file changed, 177 insertions(+), 90 deletions(-) - -diff --git a/tools/PccsAdminTool/lib/intelsgx/pckcert.py b/tools/PccsAdminTool/lib/intelsgx/pckcert.py -index 97aa278..eaed331 100644 ---- a/tools/PccsAdminTool/lib/intelsgx/pckcert.py -+++ b/tools/PccsAdminTool/lib/intelsgx/pckcert.py -@@ -1,76 +1,171 @@ - from cryptography import x509 - from cryptography.x509.oid import ObjectIdentifier - from cryptography.hazmat.backends import default_backend --import asn1 --import struct -+import pyasn1 -+from pyasn1.codec.der.decoder import decode as der_decoder -+from pyasn1.type import namedtype -+from pyasn1.type import namedval -+from pyasn1.type import opentype -+from pyasn1.type import univ -+ -+ -+id_cdp_extensionStr = '2.5.29.31' -+id_ce_sGXExtensionsStr = '1.2.840.113741.1.13.1' -+ -+id_ce_sGXExtensions = univ.ObjectIdentifier(id_ce_sGXExtensionsStr) -+ -+id_ce_sGXExtensions_pPID = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".1") -+id_ce_sGXExtensions_tCB = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2") -+id_ce_sGXExtensions_pCE_ID = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".3") -+id_ce_sGXExtensions_fMSPC = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".4") -+id_ce_sGXExtensions_sGXType = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".5") -+id_ce_sGXExtensions_platformInstanceID = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".6") -+id_ce_sGXExtensions_configuration = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".7") -+ -+id_ce_tCB_sGXTCBComp01SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.1") -+id_ce_tCB_sGXTCBComp02SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.2") -+id_ce_tCB_sGXTCBComp03SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.3") -+id_ce_tCB_sGXTCBComp04SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.4") -+id_ce_tCB_sGXTCBComp05SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.5") -+id_ce_tCB_sGXTCBComp06SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.6") -+id_ce_tCB_sGXTCBComp07SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.7") -+id_ce_tCB_sGXTCBComp08SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.8") -+id_ce_tCB_sGXTCBComp09SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.9") -+id_ce_tCB_sGXTCBComp10SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.10") -+id_ce_tCB_sGXTCBComp11SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.11") -+id_ce_tCB_sGXTCBComp12SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.12") -+id_ce_tCB_sGXTCBComp13SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.13") -+id_ce_tCB_sGXTCBComp14SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.14") -+id_ce_tCB_sGXTCBComp15SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.15") -+id_ce_tCB_sGXTCBComp16SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.16") -+id_ce_tCB_pCESVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.17") -+id_ce_tCB_cPUSVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.18") -+ -+id_ce_configuration_dynamicPlatform = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".7.1") -+id_ce_configuration_cachedKeys = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".7.2") -+id_ce_configuration_sMTEnabled = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".7.3") -+ -+ -+class SgxExtensionPPID(univ.OctetString): -+ pass -+ -+ -+class SgxCPUSVN(univ.OctetString): -+ pass -+ -+ -+tcbAttributeMap = { -+ id_ce_tCB_sGXTCBComp01SVN: univ.Integer(), -+ id_ce_tCB_sGXTCBComp02SVN: univ.Integer(), -+ id_ce_tCB_sGXTCBComp03SVN: univ.Integer(), -+ id_ce_tCB_sGXTCBComp04SVN: univ.Integer(), -+ id_ce_tCB_sGXTCBComp05SVN: univ.Integer(), -+ id_ce_tCB_sGXTCBComp06SVN: univ.Integer(), -+ id_ce_tCB_sGXTCBComp07SVN: univ.Integer(), -+ id_ce_tCB_sGXTCBComp08SVN: univ.Integer(), -+ id_ce_tCB_sGXTCBComp09SVN: univ.Integer(), -+ id_ce_tCB_sGXTCBComp10SVN: univ.Integer(), -+ id_ce_tCB_sGXTCBComp11SVN: univ.Integer(), -+ id_ce_tCB_sGXTCBComp12SVN: univ.Integer(), -+ id_ce_tCB_sGXTCBComp13SVN: univ.Integer(), -+ id_ce_tCB_sGXTCBComp14SVN: univ.Integer(), -+ id_ce_tCB_sGXTCBComp15SVN: univ.Integer(), -+ id_ce_tCB_sGXTCBComp16SVN: univ.Integer(), -+ id_ce_tCB_pCESVN: univ.Integer(), -+ id_ce_tCB_cPUSVN: SgxCPUSVN(), -+} -+ -+ -+class SgxExtensionTCBEntry(univ.Sequence): -+ componentType = namedtype.NamedTypes( -+ namedtype.NamedType('tCBId', univ.ObjectIdentifier()), -+ namedtype.NamedType('tCBValue', univ.Any(), -+ openType=opentype.OpenType('tCBId', -+ tcbAttributeMap)) -+ ) -+ -+ -+class SgxExtensionTCB(univ.SequenceOf): -+ componentType = SgxExtensionTCBEntry() -+ -+ -+class SgxExtensionPCEID(univ.OctetString): -+ pass -+ -+ -+class SgxExtensionFMSPC(univ.OctetString): -+ pass -+ -+ -+class SgxExtensionSGXType(univ.Enumerated): -+ namedValues = namedval.NamedValues( -+ ('standard', 0), -+ ('scalable', 1), -+ ('scalableWithIntegrity', 2) -+ ) -+ -+ -+class SgxExtensionPlatformInstanceID(univ.OctetString): -+ pass -+ -+ -+configurationAttributeMap = { -+ id_ce_configuration_dynamicPlatform: univ.Boolean(), -+ id_ce_configuration_cachedKeys: univ.Boolean(), -+ id_ce_configuration_sMTEnabled: univ.Boolean(), -+} -+ -+ -+class SgxExtensionConfigurationEntry(univ.Sequence): -+ componentType = namedtype.NamedTypes( -+ namedtype.NamedType('configurationId', univ.ObjectIdentifier()), -+ namedtype.NamedType('configurationValue', univ.Any(), -+ openType=opentype.OpenType('configurationId', -+ configurationAttributeMap)) -+ ) -+ -+ -+class SgxExtensionConfiguration(univ.SequenceOf): -+ componentType = SgxExtensionConfigurationEntry() -+ -+ -+extensionAttributeMap = { -+ id_ce_sGXExtensions_pPID: SgxExtensionPPID(), -+ id_ce_sGXExtensions_tCB: SgxExtensionTCB(), -+ id_ce_sGXExtensions_pCE_ID: SgxExtensionPCEID(), -+ id_ce_sGXExtensions_fMSPC: SgxExtensionFMSPC(), -+ id_ce_sGXExtensions_sGXType: SgxExtensionSGXType(), -+ id_ce_sGXExtensions_platformInstanceID: SgxExtensionPlatformInstanceID(), -+ id_ce_sGXExtensions_configuration: SgxExtensionConfiguration(), -+} -+ -+ -+class SgxExtensionEntry(univ.Sequence): -+ componentType = namedtype.NamedTypes( -+ namedtype.NamedType('sGXExtensionId', univ.ObjectIdentifier()), -+ namedtype.NamedType('sGXExtensionValue', univ.Any(), -+ openType=opentype.OpenType('sGXExtensionId', -+ extensionAttributeMap)) -+ ) -+ -+ -+class SgxExtension(univ.SequenceOf): -+ componentType = SgxExtensionEntry() - --# This is a very simplistic ASN1 parser. Production code should use --# something like ans1c to build a parser from the ASN1 spec file so --# that it can check and enforce data validity. - - class SgxPckCertificateExtensions: -- id_ce_sGXExtensions = '1.2.840.113741.1.13.1' -- id_ce_sGXExtensions_tCB= id_ce_sGXExtensions+".2" -- id_ce_sGXExtensions_configuration= id_ce_sGXExtensions+".7" -- id_cdp_extension = '2.5.29.31' -- decoder= asn1.Decoder() -- _data= {} -- ca= '' -- oids= { -- id_ce_sGXExtensions: 'sGXExtensions', -- id_ce_sGXExtensions+".1": 'pPID', -- id_ce_sGXExtensions_tCB: 'tCB', -- id_ce_sGXExtensions_tCB+".1": 'tCB-sGXTCBComp01SVN', -- id_ce_sGXExtensions_tCB+".2": 'tCB-sGXTCBComp02SVN', -- id_ce_sGXExtensions_tCB+".3": 'tCB-sGXTCBComp03SVN', -- id_ce_sGXExtensions_tCB+".4": 'tCB-sGXTCBComp04SVN', -- id_ce_sGXExtensions_tCB+".5": 'tCB-sGXTCBComp05SVN', -- id_ce_sGXExtensions_tCB+".6": 'tCB-sGXTCBComp06SVN', -- id_ce_sGXExtensions_tCB+".7": 'tCB-sGXTCBComp07SVN', -- id_ce_sGXExtensions_tCB+".8": 'tCB-sGXTCBComp08SVN', -- id_ce_sGXExtensions_tCB+".9": 'tCB-sGXTCBComp09SVN', -- id_ce_sGXExtensions_tCB+".10": 'tCB-sGXTCBComp10SVN', -- id_ce_sGXExtensions_tCB+".11": 'tCB-sGXTCBComp11SVN', -- id_ce_sGXExtensions_tCB+".12": 'tCB-sGXTCBComp12SVN', -- id_ce_sGXExtensions_tCB+".13": 'tCB-sGXTCBComp13SVN', -- id_ce_sGXExtensions_tCB+".14": 'tCB-sGXTCBComp14SVN', -- id_ce_sGXExtensions_tCB+".15": 'tCB-sGXTCBComp15SVN', -- id_ce_sGXExtensions_tCB+".16": 'tCB-sGXTCBComp16SVN', -- id_ce_sGXExtensions_tCB+".17": 'tCB-pCESVN', -- id_ce_sGXExtensions_tCB+".18": 'tCB-cPUSVN', -- id_ce_sGXExtensions+".3": 'pCE-ID', -- id_ce_sGXExtensions+".4": 'fMSPC', -- id_ce_sGXExtensions+".5": 'sGXType', -- id_ce_sGXExtensions+".6": 'platformInstanceID', -- id_ce_sGXExtensions_configuration: 'configuration', -- id_ce_sGXExtensions_configuration+".1": 'dynamicPlatform', -- id_ce_sGXExtensions_configuration+".2": 'cachedKeys', -- id_ce_sGXExtensions_configuration+".3": 'sMTEnabled' -- } -- -- def _parse_asn1(self, d, oid, lnr=asn1.Numbers.ObjectIdentifier): -- tag= self.decoder.peek() -- while tag: -- if tag.typ == asn1.Types.Constructed: -- self.decoder.enter() -- if ( lnr == asn1.Numbers.ObjectIdentifier ): -- d[self.oids[oid]]= {} -- self._parse_asn1(d[self.oids[oid]], oid, tag.nr) -- else: -- self._parse_asn1(d, oid, tag.nr) -- self.decoder.leave() -- elif tag.typ == asn1.Types.Primitive: -- tag, value= self.decoder.read() -- if ( tag.nr == asn1.Numbers.ObjectIdentifier ): -- oid= value -- else: -- d[self.oids[oid]]= value -- lnr= tag.nr -- tag= self.decoder.peek() -- return -+ -+ def __init__(self): -+ self.ca= '' -+ self._data= None -+ -+ def _parse_asn1(self, extensionData): -+ parsed, extra= der_decoder(extensionData, -+ asn1Spec=SgxExtension(), -+ decodeOpenTypes=True) -+ return parsed - - def parse_pem_certificate(self, pem): -- self._data= {} - cert= x509.load_pem_x509_certificate(pem, default_backend()) - issuerCN = cert.issuer.rfc4514_string() - if (issuerCN.find('Processor') != -1) : -@@ -81,63 +176,55 @@ class SgxPckCertificateExtensions: - self.ca = None - - sgxext= cert.extensions.get_extension_for_oid( -- ObjectIdentifier(self.id_ce_sGXExtensions) -+ ObjectIdentifier(id_ce_sGXExtensionsStr) - ) - -- self.decoder.start(sgxext.value.value) -- self._parse_asn1(self._data, self.id_ce_sGXExtensions) -+ self._data= self._parse_asn1(sgxext.value.value) - - def get_root_ca_crl(self, pem): -- self._data= {} - cert= x509.load_pem_x509_certificate(pem, default_backend()) - cdpext= cert.extensions.get_extension_for_oid( -- ObjectIdentifier(self.id_cdp_extension) -+ ObjectIdentifier(id_cdp_extensionStr) - ) - - return getattr(getattr(cdpext.value[0], "_full_name")[0], "value") - -- def data(self, field=None): -- if 'sGXExtensions' not in self._data: -- return None -- -- d= self._data['sGXExtensions'] -- -- if field: -- if field in d: -- return d[field] -+ def data(self, field): -+ if self._data is None: - return None - -- return d -+ ent = list(filter(lambda e: e['sGXExtensionId'] == field, self._data))[0] -+ return ent['sGXExtensionValue'] - - def _hex_data(self, field): - val= self.data(field) - if val is None: - return None -- return val.hex() -+ return bytes(val).hex() - - # Commonly-needed data fields - #------------------------------ - - def get_fmspc(self): -- return self._hex_data('fMSPC') -+ return self._hex_data(id_ce_sGXExtensions_fMSPC) - - def get_ca(self): - return self.ca - - def get_tcbm(self): -- tcb= self.data('tCB') -+ tcb= self.data(id_ce_sGXExtensions_tCB) - if tcb is None: - return None -- return tcb['tCB-cPUSVN'].hex() + self.get_pcesvn() -+ ent= list(filter(lambda e: e['tCBId'] == id_ce_tCB_cPUSVN, tcb))[0] -+ return bytes(ent["tCBValue"]).hex() + self.get_pcesvn() - - def get_pceid(self): -- return self._hex_data('pCE-ID') -+ return self._hex_data(id_ce_sGXExtensions_pCE_ID) - - def get_ppid(self): -- return self._hex_data('pPID') -+ return self._hex_data(id_ce_sGXExtensions_pPID) - - def get_pcesvn(self): -- tcb= self.data('tCB') -- # pCESVN should be packed little-endian -- pcesvn= struct.pack(' -Date: Mon, 8 Dec 2025 17:47:01 +0000 -Subject: [PATCH 122/129] pccsadmin: fully switch to pycryptography for CRL - verification -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The pyopenssl 24.3.0 removed the CRL object and its related -methods. pccsadmin was already using the pycryptography CRL -object for the verification task, so fully switch to use it -for loading the CRL to begin with. - -Signed-off-by: Daniel P. Berrangé ---- - tools/PccsAdminTool/lib/intelsgx/pcs.py | 13 ++++--------- - 1 file changed, 4 insertions(+), 9 deletions(-) - -diff --git a/tools/PccsAdminTool/lib/intelsgx/pcs.py b/tools/PccsAdminTool/lib/intelsgx/pcs.py -index 046c781..e68864d 100644 ---- a/tools/PccsAdminTool/lib/intelsgx/pcs.py -+++ b/tools/PccsAdminTool/lib/intelsgx/pcs.py -@@ -101,11 +101,6 @@ class PCS: - # Copy our list so we don't modify the original - pychain= pychain_in[:] - -- # PyOpenSSL doesn't have methods for verifying a CRL issuer, -- # so we need to translate from it to cryptography. -- -- crl= pycrl.to_cryptography() -- - # The chain_pem is our CRL issuer and the CA for the issuer. - # Verify that first. - -@@ -118,13 +113,13 @@ class PCS: - - signer_key= pycert.get_pubkey().to_cryptography_key() - -- if not crl.is_signature_valid(signer_key): -+ if not pycrl.is_signature_valid(signer_key): - self.error("Could not verify CRL signature") - return False - - # Check the crl issuer - -- if pycrl.get_issuer() != pycert.get_subject(): -+ if pycrl.issuer != pycert.get_subject(): - self.error("CRL issuer doesn't match issuer chain") - return False - -@@ -516,10 +511,10 @@ class PCS: - crl= response.content - if self.ApiVersion<3: - crl_str= str(crl, dec) -- pycrl= crypto.load_crl(crypto.FILETYPE_PEM, crl) -+ pycrl= x509.load_pem_x509_crl(crl) - else: - crl_str= binascii.hexlify(crl).decode(dec) -- pycrl= crypto.load_crl(crypto.FILETYPE_ASN1, crl) -+ pycrl= x509.load_der_x509_crl(crl) - - if not self.verify_crl_trust(pychain, pycrl): - self.error("Could not validate certificate using trust chain") --- -2.52.0 - diff --git a/0123-pccsadmin-use-more-of-pycryptography-instead-of-pyop.patch b/0123-pccsadmin-use-more-of-pycryptography-instead-of-pyop.patch deleted file mode 100644 index 4e066a2..0000000 --- a/0123-pccsadmin-use-more-of-pycryptography-instead-of-pyop.patch +++ /dev/null @@ -1,178 +0,0 @@ -From d14f914ea644d7c1b2312780688d55fbb13892bc Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= -Date: Mon, 8 Dec 2025 17:48:11 +0000 -Subject: [PATCH 123/129] pccsadmin: use more of pycryptography instead of - pyopenssl -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -pyopenssl docs are indicating that the 'crypto' module is liable to -see further deprecation, suggesting use of pycryptography instead. -pccsadmin code already uses pycryptography for CRLs, so extend this -to use it for loading certificates too. They are converted back to -pyopenssl objects for verification. - -Signed-off-by: Daniel P. Berrangé ---- - tools/PccsAdminTool/lib/intelsgx/pcs.py | 49 ++++++++++++++----------- - 1 file changed, 28 insertions(+), 21 deletions(-) - -diff --git a/tools/PccsAdminTool/lib/intelsgx/pcs.py b/tools/PccsAdminTool/lib/intelsgx/pcs.py -index e68864d..f6b58a6 100644 ---- a/tools/PccsAdminTool/lib/intelsgx/pcs.py -+++ b/tools/PccsAdminTool/lib/intelsgx/pcs.py -@@ -5,6 +5,10 @@ import json - import binascii - from urllib import parse - from OpenSSL import crypto -+from cryptography import x509 -+from cryptography.exceptions import InvalidSignature -+from cryptography.hazmat.primitives import hashes -+from cryptography.hazmat.primitives.asymmetric import ec - from platform import system - if system() == 'Windows': - from pypac import PACSession -@@ -17,6 +21,9 @@ certBegin= '-----BEGIN CERTIFICATE-----' - certEnd= '-----END CERTIFICATE-----' - certEndOffset= len(certEnd) - -+def CN(name): -+ return name.get_attributes_for_oid(x509.NameOID.COMON_NAME)[0].value -+ - class PCS: - BaseUrl= '' - ApiVersion= 3 -@@ -93,7 +100,7 @@ class PCS: - store= crypto.X509Store() - - for tcert in pychain: -- store.add_cert(tcert) -+ store.add_cert(crypto.X509.from_cryptography(tcert)) - - return store - -@@ -111,7 +118,7 @@ class PCS: - - # Now verify the CRL signature - -- signer_key= pycert.get_pubkey().to_cryptography_key() -+ signer_key= pycert.public_key() - - if not pycrl.is_signature_valid(signer_key): - self.error("Could not verify CRL signature") -@@ -119,7 +126,7 @@ class PCS: - - # Check the crl issuer - -- if pycrl.issuer != pycert.get_subject(): -+ if pycrl.issuer != pycert.subject: - self.error("CRL issuer doesn't match issuer chain") - return False - -@@ -129,7 +136,8 @@ class PCS: - store= self.init_cert_store(pychain) - - for pycert in pycerts: -- store_ctx= crypto.X509StoreContext(store, pycert) -+ store_ctx= crypto.X509StoreContext( -+ store, crypto.X509.from_cryptography(pycert)) - try: - store_ctx.verify_certificate() - except crypto.X509StoreContextError as e: -@@ -161,22 +169,21 @@ class PCS: - sig= bytes([0x30,len(r)+len(s)+4,2,len(r)]) + r + bytes([2,len(s)]) + s - - try: -- crypto.verify(pycert, sig, msg, "sha256") -- except crypto.Error as e: -+ pycert.public_key().verify( -+ sig, msg, ec.ECDSA(hashes.SHA256())) -+ except InvalidSignature as e: - self.error('Signature verification failed: {:s}'.format(str(e))) - return False - - return True - - def pem_to_pycert(self, cert_pem): -- return crypto.load_certificate(crypto.FILETYPE_PEM, cert_pem) -+ return x509.load_pem_x509_certificate(cert_pem.encode("utf-8")) - - def pems_to_pycerts(self, certs_pem): - pycerts= [] - for cert_pem in certs_pem: -- pycerts.append( -- crypto.load_certificate(crypto.FILETYPE_PEM, cert_pem) -- ) -+ pycerts.append(self.pem_to_pycert(cert_pem)) - return pycerts - - def parse_chain_pem(self, chain_pem): -@@ -209,9 +216,9 @@ class PCS: - cert0= chain_in[0] - cert1= chain_in[1] - -- if cert0.get_subject() == cert1.get_issuer(): -+ if cert0.subject == cert1.issuer: - return chain_in -- elif cert1.get_subject() == cert0.get_issuer(): -+ elif cert1.subject == cert0.issuer: - chain_in.reverse() - return chain_in - else: -@@ -224,7 +231,7 @@ class PCS: - for i in range(1, len(chain_in)): - cert= chain_in[i] - pcert= chain_in[i-1] -- if cert.get_issuer() != pcert.get_subject(): -+ if cert.issuer != pcert.subject: - sorted= False - break - -@@ -240,10 +247,10 @@ class PCS: - rootidx= -1 - for i in range(0, len(chain)): - cert= chain[i] -- subject= cert.get_subject() -- issuer= cert.get_issuer() -- cert_subjects[subject.CN]= cert -- print("cert: {:s} <- {:s}" . format(subject.CN, issuer.CN)) -+ subject= cert.subject -+ issuer= cert.issuer -+ cert_subjects[CN(subject)]= cert -+ print("cert: {:s} <- {:s}" . format(CN(subject), CN(issuer))) - - if subject == issuer: - if len(sorted_chain) > 0: -@@ -262,8 +269,8 @@ class PCS: - issuer_to= {} - - for cert in chain: -- issuer= cert.get_issuer().CN -- subject= cert.get_subject().CN -+ issuer= CN(cert.issuer) -+ subject= CN(cert.subject) - - if issuer in issued_by: - self.error('multiple certs issued by same cert in chain') -@@ -280,7 +287,7 @@ class PCS: - - if len(sorted_chain) > 0: - for cert in chain: -- issuer= cert.get_issuer().CN -+ issuer= CN(cert.issuer) - if issuer not in issued_by: - if len(sorted_chain) > 0: - self.error('multiple certs with no issuer') -@@ -296,7 +303,7 @@ class PCS: - cert= sorted_chain[0] - - while len(sorted_chain) < lchain: -- issuer_subject= cert.get_subject().der() -+ issuer_subject= CN(cert.subject) - - if issuer_subject not in issuer_to: - self.error('cert in chain with no issuer') --- -2.52.0 - diff --git a/0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch b/0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch deleted file mode 100644 index 5795c2b..0000000 --- a/0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch +++ /dev/null @@ -1,104 +0,0 @@ -From 9d3da2fd99ba2832fcaa4067dd5db3f7f349c306 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= -Date: Wed, 3 Dec 2025 17:59:09 +0000 -Subject: [PATCH 124/129] pccsadmin: prefer pycryptography over pyopenssl -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The only part of pccsadmin that still needs pyopenssl is certificate -verification. As of pycryptography 45.0.0, there are sufficient APIs -available to replace the remaining usage of pyopenssl. - -Since new pycryptography is still not widely available in distros, -keep pyopenssl code as a fallback. - -Signed-off-by: Daniel P. Berrangé ---- - tools/PccsAdminTool/lib/intelsgx/pcs.py | 60 +++++++++++++++++++------ - 1 file changed, 47 insertions(+), 13 deletions(-) - -diff --git a/tools/PccsAdminTool/lib/intelsgx/pcs.py b/tools/PccsAdminTool/lib/intelsgx/pcs.py -index f6b58a6..eeb2969 100644 ---- a/tools/PccsAdminTool/lib/intelsgx/pcs.py -+++ b/tools/PccsAdminTool/lib/intelsgx/pcs.py -@@ -4,11 +4,28 @@ import requests - import json - import binascii - from urllib import parse --from OpenSSL import crypto -+ - from cryptography import x509 - from cryptography.exceptions import InvalidSignature --from cryptography.hazmat.primitives import hashes -+from cryptography.hazmat.primitives import hashes, serialization - from cryptography.hazmat.primitives.asymmetric import ec -+ -+# Prefer pycryptography for cert verification if new -+# enough, but fallback to pyopenssl -+try: -+ # 'verification' module available from >= 42.0.0, but -+ # the required 'ExtensionPolicy' API is from >= 45.0.0 -+ from cryptography.x509 import verification -+ if not hasattr(verification, 'ExtensionPolicy'): -+ verification = None -+ else: -+ crypto = None -+except ImportError: -+ verification = None -+ -+if verification is None: -+ from OpenSSL import crypto -+ - from platform import system - if system() == 'Windows': - from pypac import PACSession -@@ -133,17 +150,34 @@ class PCS: - return True - - def verify_cert_trust(self, pychain, pycerts): -- store= self.init_cert_store(pychain) -- -- for pycert in pycerts: -- store_ctx= crypto.X509StoreContext( -- store, crypto.X509.from_cryptography(pycert)) -- try: -- store_ctx.verify_certificate() -- except crypto.X509StoreContextError as e: -- # Printing or logging the error details -- print(e) -- return False -+ if verification is not None: -+ store= verification.Store(pychain) -+ -+ builder= verification.PolicyBuilder().store(store) -+ builder= builder.extension_policies( -+ ee_policy=verification.ExtensionPolicy.permit_all(), -+ ca_policy=verification.ExtensionPolicy.webpki_defaults_ca()) -+ -+ verifier= builder.build_client_verifier() -+ for pycert in pycerts: -+ try: -+ verifier.verify(pycert,[]) -+ except verification.VerificationError as e: -+ # Printing or logging the error details -+ print(e) -+ return False -+ else: -+ store= self.init_cert_store(pychain) -+ -+ for pycert in pycerts: -+ store_ctx= crypto.X509StoreContext( -+ store, crypto.X509.from_cryptography(pycert)) -+ try: -+ store_ctx.verify_certificate() -+ except crypto.X509StoreContextError as e: -+ # Printing or logging the error details -+ print(e) -+ return False - - return True - --- -2.52.0 - diff --git a/0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch b/0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch deleted file mode 100644 index f8069ed..0000000 --- a/0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch +++ /dev/null @@ -1,75 +0,0 @@ -From 262c1cb978d31130d3558d2a29690b1eace52c64 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= -Date: Mon, 8 Dec 2025 17:56:59 +0000 -Subject: [PATCH 125/129] pccsadmin: add fallback for when pyopenssl is not - available -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -RHEL does not ship pyopenssl, however, the pycryptography that is -included is also too old to support certificate verification. Add -a further fallback that can invoke the 'openssl' command line tool -to verify certificates. - -Signed-off-by: Daniel P. Berrangé ---- - tools/PccsAdminTool/lib/intelsgx/pcs.py | 28 +++++++++++++++++++++++-- - 1 file changed, 26 insertions(+), 2 deletions(-) - -diff --git a/tools/PccsAdminTool/lib/intelsgx/pcs.py b/tools/PccsAdminTool/lib/intelsgx/pcs.py -index eeb2969..1368b57 100644 ---- a/tools/PccsAdminTool/lib/intelsgx/pcs.py -+++ b/tools/PccsAdminTool/lib/intelsgx/pcs.py -@@ -24,7 +24,14 @@ except ImportError: - verification = None - - if verification is None: -- from OpenSSL import crypto -+ try: -+ from OpenSSL import crypto -+ except ModuleNotFoundError: -+ # Fallback to spawning 'openssl' binary if -+ # pyopenssl is not available -+ crypto = None -+ import tempfile -+ import subprocess - - from platform import system - if system() == 'Windows': -@@ -166,7 +173,7 @@ class PCS: - # Printing or logging the error details - print(e) - return False -- else: -+ elif crypto is not None: - store= self.init_cert_store(pychain) - - for pycert in pycerts: -@@ -178,6 +185,23 @@ class PCS: - # Printing or logging the error details - print(e) - return False -+ else: -+ with tempfile.NamedTemporaryFile("wb") as chainfile: -+ for cert in pychain: -+ chainfile.write(cert.public_bytes(serialization.Encoding.PEM)) -+ chainfile.flush() -+ -+ for cert in pycerts: -+ with tempfile.NamedTemporaryFile("wb") as certfile: -+ certfile.write(cert.public_bytes(serialization.Encoding.PEM)) -+ certfile.flush() -+ -+ try: -+ subprocess.check_call(["openssl", "verify", -+ "-CAfile", chainfile.name, certfile.name], -+ stdout=subprocess.DEVNULL) -+ except subprocess.CalledProcessError as e: -+ return False - - return True - --- -2.52.0 - diff --git a/0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch b/0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch deleted file mode 100644 index 373af79..0000000 --- a/0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch +++ /dev/null @@ -1,120 +0,0 @@ -From 48f3dc21602f2f11f054c740c5efd4c34d5efae6 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= -Date: Thu, 4 Dec 2025 18:05:14 +0000 -Subject: [PATCH 126/129] pccsadmin: ignore errors trying to clear the keyring -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -On authentication errors with PCS, an attempt is made to clear the -keyring. This may fail if the user's login environment has no keyring -configured. The user would have declined to store the key when first -prompted, so there would be nothing to clear either in this case. - -Signed-off-by: Daniel P. Berrangé ---- - tools/PccsAdminTool/lib/intelsgx/pcs.py | 16 +++++++++++-- - tools/PccsAdminTool/pccsadmin.py | 32 +++++++++++++++++++++---- - 2 files changed, 42 insertions(+), 6 deletions(-) - -diff --git a/tools/PccsAdminTool/lib/intelsgx/pcs.py b/tools/PccsAdminTool/lib/intelsgx/pcs.py -index 1368b57..dd4eba4 100644 ---- a/tools/PccsAdminTool/lib/intelsgx/pcs.py -+++ b/tools/PccsAdminTool/lib/intelsgx/pcs.py -@@ -404,7 +404,13 @@ class PCS: - if response.status_code != 200: - print(str(response.content, 'utf-8')) - if response.status_code == 401: -- Credentials().set_pcs_api_key('') #reset ApiKey -+ try: -+ Credentials().set_pcs_api_key('') #reset ApiKey -+ except: -+ # If keyring is unavailable, we don't want to trigger -+ # traceback, as the user may have declined to save -+ # the key in the keyring earlier -+ pass - return None - - # Verify expected headers -@@ -479,7 +485,13 @@ class PCS: - if response.status_code != 200: - print(str(response.content, 'utf-8')) - if response.status_code == 401: -- Credentials().set_pcs_api_key('') #reset ApiKey -+ try: -+ Credentials().set_pcs_api_key('') #reset ApiKey -+ except: -+ # If keyring is unavailable, we don't want to trigger -+ # traceback, as the user may have declined to save -+ # the key in the keyring earlier -+ pass - return None - - # Verify expected headers -diff --git a/tools/PccsAdminTool/pccsadmin.py b/tools/PccsAdminTool/pccsadmin.py -index 8e447c5..dc5253b 100755 ---- a/tools/PccsAdminTool/pccsadmin.py -+++ b/tools/PccsAdminTool/pccsadmin.py -@@ -166,7 +166,13 @@ class PccsClient: - if response.status_code == 200: - self._write_output_file(output_file, response) - elif response.status_code == 401: # Authentication error -- self.credentials.set_admin_token('') -+ try: -+ self.credentials.set_admin_token('') -+ except: -+ # If keyring is unavailable, we don't want to trigger -+ # traceback, as the user may have declined to save -+ # the key in the keyring earlier -+ pass - print("Authentication failed.") - else: - self._handle_error(response) -@@ -196,7 +202,13 @@ class PccsClient: - if response.status_code == 200: - print("Collaterals uploaded successfully.") - elif response.status_code == 401: # Authentication error -- self.credentials.set_admin_token('') -+ try: -+ self.credentials.set_admin_token('') -+ except: -+ # If keyring is unavailable, we don't want to trigger -+ # traceback, as the user may have declined to save -+ # the key in the keyring earlier -+ pass - print("Authentication failed.") - else: - self._handle_error(response) -@@ -212,7 +224,13 @@ class PccsClient: - if response.status_code == 200: - print("Policy uploaded successfully with policy ID :" + response.text) - elif response.status_code == 401: # Authentication error -- self.credentials.set_admin_token('') -+ try: -+ self.credentials.set_admin_token('') -+ except: -+ # If keyring is unavailable, we don't want to trigger -+ # traceback, as the user may have declined to save -+ # the key in the keyring earlier -+ pass - print("Authentication failed.") - else: - self._handle_error(response) -@@ -245,7 +263,13 @@ class PccsClient: - if response.status_code == 200: - print("The cache database was refreshed successfully.") - elif response.status_code == 401: # Authentication error -- self.credentials.set_admin_token('') -+ try: -+ self.credentials.set_admin_token('') -+ except: -+ # If keyring is unavailable, we don't want to trigger -+ # traceback, as the user may have declined to save -+ # the key in the keyring earlier -+ pass - print("Authentication failed.") - else: - self._handle_error(response) --- -2.52.0 - diff --git a/0127-PCS-Client-Tool-Migrate-from-deprecated-pkg_resource.patch b/0127-PCS-Client-Tool-Migrate-from-deprecated-pkg_resource.patch deleted file mode 100644 index 8495d94..0000000 --- a/0127-PCS-Client-Tool-Migrate-from-deprecated-pkg_resource.patch +++ /dev/null @@ -1,51 +0,0 @@ -From f0222324f5896d08457ed0ffb3951081d66e0cf0 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= -Date: Tue, 6 Jan 2026 18:03:36 +0100 -Subject: [PATCH 127/129] [PCS Client Tool] Migrate from deprecated - pkg_resources to packaging -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Miro Hrončok - -Version 14.0 is the first version that had the Version class. - -Ref: https://setuptools.pypa.io/en/latest/pkg_resources.html - -Signed-off-by: Miro Hrončok ---- - tools/PccsAdminTool/lib/intelsgx/pcs.py | 2 +- - tools/PccsAdminTool/requirements.txt | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/tools/PccsAdminTool/lib/intelsgx/pcs.py b/tools/PccsAdminTool/lib/intelsgx/pcs.py -index dd4eba4..7596708 100644 ---- a/tools/PccsAdminTool/lib/intelsgx/pcs.py -+++ b/tools/PccsAdminTool/lib/intelsgx/pcs.py -@@ -39,7 +39,7 @@ if system() == 'Windows': - from lib.intelsgx.credential import Credentials - from requests.adapters import HTTPAdapter - from urllib3.util import Retry --from pkg_resources import parse_version -+from packaging.version import Version as parse_version - - certBegin= '-----BEGIN CERTIFICATE-----' - certEnd= '-----END CERTIFICATE-----' -diff --git a/tools/PccsAdminTool/requirements.txt b/tools/PccsAdminTool/requirements.txt -index 8a73667..65f6bf5 100644 ---- a/tools/PccsAdminTool/requirements.txt -+++ b/tools/PccsAdminTool/requirements.txt -@@ -1,8 +1,8 @@ - asn1>=2.4.1 - cryptography>=41.0.7 - keyring>=23.0.0 -+packaging>=14.0 - pyOpenSSL>=23.2.0,<24.3.0 - pypac>=0.14.0 - Requests>=2.31.0 --setuptools>=65.5.1 - urllib3>=1.26.18 --- -2.52.0 - diff --git a/0128-qgs-add-compat-for-boost-1.87-which-drops-asio-io_se.patch b/0128-qgs-add-compat-for-boost-1.87-which-drops-asio-io_se.patch deleted file mode 100644 index 9475d10..0000000 --- a/0128-qgs-add-compat-for-boost-1.87-which-drops-asio-io_se.patch +++ /dev/null @@ -1,44 +0,0 @@ -From a3633a45f16aa80e9be8542ea8702ec32dbf93cd Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= -Date: Thu, 15 Jan 2026 11:23:35 +0000 -Subject: [PATCH 128/129] qgs: add compat for boost 1.87 which drops - asio::io_service -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Jonathan Wakely - -The asio::io_service type was deprecated since 1.66 in 2017, -with asio::io_context being its drop-in replacement. - -Release 1.87 finally dropped the back-compat support for -asio::io_service entirely. - -To retain compat with old boost this change conditionally -re-adds the compat definition for asio::io_service. - -Signed-off-by: Daniel P. Berrangé ---- - QuoteGeneration/quote_wrapper/qgs/qgs_server.h | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/QuoteGeneration/quote_wrapper/qgs/qgs_server.h b/QuoteGeneration/quote_wrapper/qgs/qgs_server.h -index f3f5b9f..91eb41a 100644 ---- a/QuoteGeneration/quote_wrapper/qgs/qgs_server.h -+++ b/QuoteGeneration/quote_wrapper/qgs/qgs_server.h -@@ -36,6 +36,11 @@ - #include - #include - -+#if BOOST_VERSION >= 108700 -+// Asio no longer defines the deprecated io_service alias. -+namespace boost { namespace asio { using io_service = io_context; } } -+#endif -+ - namespace intel { namespace sgx { namespace dcap { namespace qgs { - - namespace asio = boost::asio; --- -2.52.0 - diff --git a/0129-qgs-add-compat-for-boost-1.89-which-deprecated-deadl.patch b/0129-qgs-add-compat-for-boost-1.89-which-deprecated-deadl.patch deleted file mode 100644 index 5a1f02c..0000000 --- a/0129-qgs-add-compat-for-boost-1.89-which-deprecated-deadl.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 3c73dad4bdab6d3c29f58ca5ca34628c7ef952b0 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= -Date: Thu, 15 Jan 2026 12:48:19 +0000 -Subject: [PATCH 129/129] qgs: add compat for boost 1.89 which deprecated - deadline_timer.hpp -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The asio::deadline_timer was deprecated in 1.89 and as a result -the deadline_timer.hpp file is no longer implicitly included by -asio.hpp. - -To retain compat with old and new boost the code must explicitly -include the deadline_timer.hpp - -Signed-off-by: Daniel P. Berrangé ---- - QuoteGeneration/quote_wrapper/qgs/qgs_server.h | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/QuoteGeneration/quote_wrapper/qgs/qgs_server.h b/QuoteGeneration/quote_wrapper/qgs/qgs_server.h -index 91eb41a..b56b263 100644 ---- a/QuoteGeneration/quote_wrapper/qgs/qgs_server.h -+++ b/QuoteGeneration/quote_wrapper/qgs/qgs_server.h -@@ -34,6 +34,7 @@ - - #include - #include -+#include - #include - - #if BOOST_VERSION >= 108700 --- -2.52.0 - diff --git a/linux-sgx.spec b/linux-sgx.spec index a62e6f0..71c7bbe 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -13,6 +13,16 @@ # /usr/bin/ld: /tmp/ccWKJhwL.ltrans0.ltrans.o: relocation R_X86_64_PC32 against symbol `_Z16aesm_thread_procPv' can not be used when making a shared object; recompile with -fPIC %global _lto_cflags %nil +# The nodejs sqlite3 module will trigger a warning +# +# ERROR 0001: file '/usr/lib/node_modules_22/pccs/node_modules/sqlite3/build/Release/node_sqlite3.node' contains a standard runpath '/usr/lib64' in [/usr/lib64] +# ERROR 0001: file '/usr/lib/node_modules_22/pccs/node_modules/sqlite3/build/Release/obj.target/node_sqlite3.node' contains a standard runpath '/usr/lib64' in [/usr/lib64] +# +# since these are harmless just disable the check for now +# rather than trying to figure out how to remove them + +%global __brp_check_rpaths %{nil} + ############################################################ # # Note about the approach to bundling... @@ -47,10 +57,11 @@ %global with_aesm 0 %global with_host_tinyxml2 0 -%global with_pccsadmin 1 +%global with_pccsadmin 0 %if 0%{?fedora} %global with_aesm 1 %global with_host_tinyxml2 1 +%global with_pccsadmin 1 %endif %global with_sysusers_scripts 0 @@ -91,7 +102,7 @@ # From DCAP git submodule %global wamr_version 1.0.0 # From SGX external/tinyxml2 -%global tinyxml2_version 10.0.0 +%global tinyxml2_version 7.0.0 # From SGX external/epid-sdk/CHANGELOG.md %global epid_version 6.0.0 @@ -269,11 +280,6 @@ Provides: bundled(jwt-cpp) = %{jwt_cpp_version} Source13: https://github.com/bytecodealliance/wasm-micro-runtime/archive/refs/tags/WAMR-%{wamr_version}.tar.gz#/wasm-micro-runtime-%{wamr_version}.tar.gz Provides: bundled(wasm-micro-runtime} = %{wamr_version} -Source14: https://github.com/leethomason/tinyxml2/archive/refs/tags/%{tinyxml2_version}.tar.gz#/tinyxml2-%{tinyxml2_version}.tar.gz -%if ! %{with_host_tinyxml2} -Provides: bundled(tinyxml2) = %{tinyxml2_version} -%endif - ############################################################ # Misc distro integration files SourceN in (40..59) @@ -319,9 +325,6 @@ Provides: bundled(vtune) = 2018 # Distro integration patches # 0000-0099 -> against linux-sgx.git -# -# Maintained in: https://github.com/berrange/linux-sgx/tree/dist-git-%{linux_sgx_version}-hostsw -# Patch0000: 0000-Add-support-for-building-against-host-openssl-crypto.patch Patch0001: 0001-Add-support-for-building-against-host-tinyxml2-lib.patch Patch0002: 0002-Add-support-for-building-against-host-CppMicroServic.patch @@ -342,15 +345,10 @@ Patch0012: 0012-psw-make-aesm_service-build-verbose.patch Patch0013: 0013-Fix-modern-C-function-prototype-compliance.patch Patch0014: 0014-Add-wrapper-for-nasm-to-fix-cmake-compat.patch Patch0015: 0015-fix-BOM-for-pccs-with-DCAP-1.23.patch -Patch0016: 0016-sdk-avoid-failure-due-to-attribute-regparam-with-GCC.patch # Optional patches Patch0050: 0050-Disable-inclusion-of-AESM-in-installer.patch - # 0100-0199 -> against SGXDataCenterAttestationPrimitives.git -# -# Maintained in https://github.com/berrange/SGXDataCenterAttestationPrimitives/tree/dist-git-%{dcap_version}-hostsw -# Patch0100: 0100-Drop-use-of-bundled-pre-built-openssl.patch Patch0101: 0101-Improve-debuggability-of-build-system.patch # https://github.com/intel/SGXDataCenterAttestationPrimitives/pull/437 @@ -358,7 +356,7 @@ Patch0102: 0102-Support-build-time-setting-of-enclave-load-directory.patch # https://github.com/intel/SGXDataCenterAttestationPrimitives/pull/434 Patch0103: 0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch # https://github.com/intel/SGXDataCenterAttestationPrimitives/pull/429 -Patch0104: 0104-pccsadmin-only-import-pypac-module-on-Windows.patch +Patch0104: 0104-Don-t-import-pypac-in-pccsadmin.patch Patch0105: 0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch Patch0106: 0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch # https://github.com/intel/SGXDataCenterAttestationPrimitives/pull/428 @@ -373,36 +371,17 @@ Patch0114: 0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch #Patch0115: 0115-Use-distro-provided-rapidjson-package.patch Patch0116: 0116-Don-t-stomp-on-VERBOSE-variable.patch Patch0117: 0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch -Patch0118: 0118-pccs-sanitize-paths-to-all-resources.patch -Patch0119: 0119-pccs-only-pass-ApiKey-if-it-is-set.patch -Patch0120: 0120-pccsadmin-make-keyring-module-optional.patch -Patch0121: 0121-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch -Patch0122: 0122-pccsadmin-fully-switch-to-pycryptography-for-CRL-ver.patch -Patch0123: 0123-pccsadmin-use-more-of-pycryptography-instead-of-pyop.patch -Patch0124: 0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch -Patch0125: 0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch -Patch0126: 0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch -# https://github.com/intel/confidential-computing.tee.dcap/pull/485 -Patch0127: 0127-PCS-Client-Tool-Migrate-from-deprecated-pkg_resource.patch -# https://github.com/intel/confidential-computing.tee.dcap/pull/487 -Patch0128: 0128-qgs-add-compat-for-boost-1.87-which-drops-asio-io_se.patch -Patch0129: 0129-qgs-add-compat-for-boost-1.89-which-deprecated-deadl.patch - +Patch0118: 0118-Switch-default-PCCS-port-number-from-8081-to-10801.patch +Patch0119: 0119-Sanitize-paths-to-all-resources-in-PCCS-server.patch +Patch0120: 0120-pccs-only-pass-ApiKey-if-it-is-set.patch # 0200-0299 -> against intel-sgx-ssl.git -# -# Maintained in https://github.com/berrange/intel-sgx-ssl/tree/dist-git-%{sgx_ssl_version} -# Patch0200: 0200-Enable-pointing-sgxssl-build-to-alternative-glibc-he.patch Patch0201: 0201-Workaround-missing-output-directory.patch Patch0202: 0202-Disable-various-EC-crypto-features.patch Patch0203: 0203-Disable-sm2-and-sm4-crypto-algorithms.patch - # 0300-0399 -> against ipp-crypto.git -# -# Maintained in https://github.com/berrange/ipp-crypto/tree/dist-git-%{ipp_crypto_version} -# Patch0300: 0300-Drop-min-openssl-from-3.0.8-to-3.0.7.patch Patch0301: 0301-Drop-Werror-from-build-flags.patch @@ -410,7 +389,6 @@ BuildRequires: sgx-rpm-macros BuildRequires: autoconf BuildRequires: automake BuildRequires: binutils -BuildRequires: chrpath BuildRequires: libtool BuildRequires: gcc BuildRequires: gcc-c++ @@ -431,11 +409,7 @@ BuildRequires: perl(IPC::Cmd) BuildRequires: nasm BuildRequires: nodejs BuildRequires: nodejs-devel -%if 0%{?rhel} == 9 -BuildRequires: npm -%else BuildRequires: nodejs-npm -%endif BuildRequires: nodejs-packaging BuildRequires: python-unversioned-command BuildRequires: sqlite-devel @@ -547,7 +521,7 @@ This package contains the Architectural Enclave Service Manager %package -n sgx-pccs Summary: SGX Provisioning Certificate Caching Service Requires: nodejs -Requires: sgx-common = %{version}-%{release} +Requires: sgx-mpa = %{version}-%{release} %description -n sgx-pccs SGX Provisioning Certificate Caching Service @@ -555,17 +529,12 @@ SGX Provisioning Certificate Caching Service %package -n sgx-pccs-admin Summary: SGX Provisioning Certificate Caching Service Admin Tool -Requires: python3-pyasn1 +Requires: python3-asn1 +Requires: python3-pyOpenSSL Requires: python3-cryptography -%if 0%{?fedora} Requires: python3-keyring -%endif Requires: python3-requests Requires: python3-urllib3 -Requires: python3-packaging -%if 0%{?rhel} -Requires: openssl -%endif Requires: sgx-libs = %{version}-%{release} # pccs admin tool can be used against a remote pccs # so don't force a hard dep @@ -759,15 +728,6 @@ rm -rf external/{dnnl,openmp,protobuf} sdk/sample_libcrypto ) -############################################################ -# tinyxml2 -%if ! %{with_host_tinyxml2} -( - cd external/tinyxml2 - tar zxf %{SOURCE14} --strip 1 -) -%endif - ############################################################ # prebuilt enclaves @@ -974,10 +934,9 @@ LDFLAGS="%{build_ldflags}" \ done # Keep brp-mangle-shebangs happy + perl -i -p -e 's,/usr/bin/env python,/usr/bin/env python3,' node_modules/ffi-napi/deps/libffi/generate-darwin-source-and-headers.py find node_modules -type f -exec chmod -x {} \; - chrpath --delete node_modules/sqlite3/build/Release/node_sqlite3.node - tar zxvf %{SOURCE55} ( cd node-ffi-rs-%{node_ffi_rs_version} @@ -1035,6 +994,7 @@ done # Dirs for host OS software %__install -d %{buildroot}%{_bindir} +%__install -d %{buildroot}%{_sbindir} %__install -d %{buildroot}%{_libdir}/pkgconfig %__install -d %{buildroot}%{_libexecdir} %__install -d %{buildroot}%{_datadir} @@ -1165,13 +1125,13 @@ ln -s ../../..%{_datadir}/aesmd/white_list_cert_to_be_verify.bin \ # XXX it looks for files relative to its binary, so we # need this wrapper. Patch the source and kill this -cat >> %{buildroot}%{_bindir}/aesmd <> %{buildroot}%{_sbindir}/aesmd <