attestationconfigapi

Documentation

Overview

AttestationConfig API

The AttestationConfig API provides values for the attestation key in the Constellation config.

This package defines API types that represents objects of the AttestationConfig API. The types provide helper methods for validation and commonly used operations on the information contained in the objects. Especially the paths used for the API are defined in these helper methods.

Regarding the decision to implement new types over using the existing types from internal/config: AttesationCfg objects for AttestationCfg API need to hold some version information (for sorting, recognizing latest). Thus, existing config types (AWSNitroTPM, AzureSEVSNP, ...) can not be extended to implement apiObject interface. Instead, we need a separate type that wraps _all_ attestation types. In the codebase this is done using the AttestationCfg interface. The new type AttestationCfgGet needs to be located inside internal/config in order to implement UnmarshalJSON.

Copyright (c) Edgeless Systems GmbH

SPDX-License-Identifier: AGPL-3.0-only

The reporter contains the logic to determine a latest version for Azure SEVSNP based on cached version values observed on CVM instances.

Index

• Constants
• Variables
• func SortAzureSEVSNPVersionList(versions AzureSEVSNPVersionList)
• type AzureSEVSNPVersion
• type AzureSEVSNPVersionAPI
  • func (i AzureSEVSNPVersionAPI) JSONPath() string
  • func (i AzureSEVSNPVersionAPI) Validate() error
  • func (i AzureSEVSNPVersionAPI) ValidateRequest() error
• type AzureSEVSNPVersionList
  • func (i AzureSEVSNPVersionList) JSONPath() string
  • func (i AzureSEVSNPVersionList) Validate() error
  • func (i AzureSEVSNPVersionList) ValidateRequest() error
• type AzureSEVSNPVersionType
• type Client
  • func NewClient(ctx context.Context, cfg staticupload.Config, cosignPwd, privateKey []byte, ...) (*Client, apiclient.CloseFunc, error)
  • func (a Client) DeleteAzureSEVSNPVersion(ctx context.Context, versionStr string) error
  • func (a Client) List(ctx context.Context, attestation variant.Variant) ([]string, error)
  • func (c Client) UploadAzureSEVSNPVersionLatest(ctx context.Context, inputVersion, latestAPIVersion AzureSEVSNPVersion, ...) error
• type Fetcher
  • func NewFetcher() Fetcher
  • func NewFetcherWithClient(client apifetcher.HTTPClient, cdnURL string) Fetcher
  • func NewFetcherWithCustomCDNAndCosignKey(cdnURL, cosignKey string) Fetcher

Constants

const VersionFormat = "2006-01-02-15-04"

VersionFormat is the format of the version name in the S3 bucket.

Variables

var ErrNoNewerVersion = errors.New("input version is not newer than latest API version")

ErrNoNewerVersion is returned if the input version is not newer than the latest API version.

var ErrNoVersionsFound = errors.New("no versions found")

ErrNoVersionsFound is returned if no versions are found.

Functions

func SortAzureSEVSNPVersionList

func SortAzureSEVSNPVersionList(versions AzureSEVSNPVersionList)

SortAzureSEVSNPVersionList sorts the list of versions in reverse order.

Types

type AzureSEVSNPVersion

type AzureSEVSNPVersion struct {
	// Bootloader is the latest version of the Azure SEVSNP bootloader.
	Bootloader uint8 `json:"bootloader"`
	// TEE is the latest version of the Azure SEVSNP TEE.
	TEE uint8 `json:"tee"`
	// SNP is the latest version of the Azure SEVSNP SNP.
	SNP uint8 `json:"snp"`
	// Microcode is the latest version of the Azure SEVSNP microcode.
	Microcode uint8 `json:"microcode"`
}

AzureSEVSNPVersion tracks the latest version of each component of the Azure SEVSNP.

type AzureSEVSNPVersionAPI

type AzureSEVSNPVersionAPI struct {
	Version string `json:"-"`
	AzureSEVSNPVersion
}

AzureSEVSNPVersionAPI is the request to get the version information of the specific version in the config api.

func (AzureSEVSNPVersionAPI) JSONPath

func (i AzureSEVSNPVersionAPI) JSONPath() string

JSONPath returns the path to the JSON file for the request to the config api.

func (AzureSEVSNPVersionAPI) Validate

func (i AzureSEVSNPVersionAPI) Validate() error

Validate is a No-Op at the moment.

func (AzureSEVSNPVersionAPI) ValidateRequest

func (i AzureSEVSNPVersionAPI) ValidateRequest() error

ValidateRequest validates the request.

type AzureSEVSNPVersionList

type AzureSEVSNPVersionList []string

AzureSEVSNPVersionList is the request to list all versions in the config api.

func (AzureSEVSNPVersionList) JSONPath

func (i AzureSEVSNPVersionList) JSONPath() string

JSONPath returns the path to the JSON file for the request to the config api.

func (AzureSEVSNPVersionList) Validate

func (i AzureSEVSNPVersionList) Validate() error

Validate validates the response.

func (AzureSEVSNPVersionList) ValidateRequest

func (i AzureSEVSNPVersionList) ValidateRequest() error

ValidateRequest is a NoOp as there is no input.

type AzureSEVSNPVersionType

type AzureSEVSNPVersionType string

AzureSEVSNPVersionType is the type of the version to be requested.

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client manages (modifies) the version information for the attestation variants.

func NewClient

func NewClient(ctx context.Context, cfg staticupload.Config, cosignPwd, privateKey []byte, dryRun bool, versionWindowSize int, log *logger.Logger) (*Client, apiclient.CloseFunc, error)

NewClient returns a new Client.

func (Client) DeleteAzureSEVSNPVersion

func (a Client) DeleteAzureSEVSNPVersion(ctx context.Context, versionStr string) error

DeleteAzureSEVSNPVersion deletes the given version (without .json suffix) from the API.

func (Client) List

func (a Client) List(ctx context.Context, attestation variant.Variant) ([]string, error)

List returns the list of versions for the given attestation variant.

func (Client) UploadAzureSEVSNPVersionLatest

func (c Client) UploadAzureSEVSNPVersionLatest(ctx context.Context, inputVersion,
	latestAPIVersion AzureSEVSNPVersion, now time.Time, force bool,
) error

UploadAzureSEVSNPVersionLatest saves the given version to the cache, determines the smallest TCB version in the cache among the last cacheWindowSize versions and updates the latest version in the API if there is an update. force can be used to bypass the validation logic against the cached versions.

type Fetcher

type Fetcher interface {
	FetchAzureSEVSNPVersion(ctx context.Context, azureVersion AzureSEVSNPVersionAPI) (AzureSEVSNPVersionAPI, error)
	FetchAzureSEVSNPVersionList(ctx context.Context, attestation AzureSEVSNPVersionList) (AzureSEVSNPVersionList, error)
	FetchAzureSEVSNPVersionLatest(ctx context.Context) (AzureSEVSNPVersionAPI, error)
}

Fetcher fetches config API resources without authentication.

func NewFetcher

func NewFetcher() Fetcher

NewFetcher returns a new apifetcher.

func NewFetcherWithClient

func NewFetcherWithClient(client apifetcher.HTTPClient, cdnURL string) Fetcher

NewFetcherWithClient returns a new fetcher with custom http client.

func NewFetcherWithCustomCDNAndCosignKey

func NewFetcherWithCustomCDNAndCosignKey(cdnURL, cosignKey string) Fetcher

NewFetcherWithCustomCDNAndCosignKey returns a new fetcher with custom CDN URL.