Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-05-06 08:15:48 -04:00
Code Issues Projects Releases Packages Wiki Activity

azure: allow a set of idkeydigest values (#991)

Browse source
This commit is contained in:
3u13r 2023-01-18 16:49:55 +01:00 • committed by GitHub
parent a3db3c8424
commit 632090c21b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
26 changed files with 360 additions and 197 deletions
Download patch file Download diff file Expand all files Collapse all files

11
cli/internal/cloudcmd/validators.go
View file

@ -18,6 +18,7 @@ import (
"github.com/edgelesssys/constellation/v2/internal/attestation/azure/snp"
"github.com/edgelesssys/constellation/v2/internal/attestation/azure/trustedlaunch"
"github.com/edgelesssys/constellation/v2/internal/attestation/gcp"
"github.com/edgelesssys/constellation/v2/internal/attestation/idkeydigest"
"github.com/edgelesssys/constellation/v2/internal/attestation/measurements"
"github.com/edgelesssys/constellation/v2/internal/attestation/qemu"
"github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider"
@ -30,7 +31,7 @@ import (
type Validator struct {
provider cloudprovider.Provider
pcrs measurements.M
idkeydigest []byte
idkeydigests idkeydigest.IDKeyDigests
enforceIDKeyDigest bool
azureCVM bool
validator atls.Validator
@ -50,12 +51,8 @@ func NewValidator(provider cloudprovider.Provider, conf *config.Config) (*Valida
if v.provider == cloudprovider.Azure {
v.azureCVM = *conf.Provider.Azure.ConfidentialVM
if v.azureCVM {
idkeydigest, err := hex.DecodeString(conf.Provider.Azure.IDKeyDigest)
if err != nil {
return nil, fmt.Errorf("bad config: decoding idkeydigest from config: %w", err)
}
v.enforceIDKeyDigest = *conf.Provider.Azure.EnforceIDKeyDigest
v.idkeydigest = idkeydigest
v.idkeydigests = conf.Provider.Azure.IDKeyDigests
}
}
@ -153,7 +150,7 @@ func (v *Validator) updateValidator(cmd *cobra.Command) {
v.validator = gcp.NewValidator(v.pcrs, log)
case cloudprovider.Azure:
if v.azureCVM {
v.validator = snp.NewValidator(v.pcrs, v.idkeydigest, v.enforceIDKeyDigest, log)
v.validator = snp.NewValidator(v.pcrs, v.idkeydigests, v.enforceIDKeyDigest, log)
} else {
v.validator = trustedlaunch.NewValidator(v.pcrs, log)
}