Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

An experiment in TEEP support #21

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

An experiment in TEEP support #21

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions datamodels/attestation-results/grammar/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ check:: check-json check-json-examples
check:: check-cbor check-cbor-examples
check:: check-veraison-cbor check-veraison-cbor-examples
check:: check-veraison-json check-veraison-json-examples
check:: check-teep-json check-teep-json-examples

# $1: label
# $2: cddl fragments
Expand Down Expand Up @@ -74,4 +75,15 @@ VERAISON_JSON_EXAMPLES := $(wildcard examples/veraison-json-*.diag)

$(eval $(call cddl_check_template,veraison-json,$(VERAISON_JSON_FRAGS),$(VERAISON_JSON_EXAMPLES)))

TEEP_JSON_FRAGS := attestation-result.cddl
TEEP_JSON_FRAGS += json-labels.cddl
TEEP_JSON_FRAGS += generic-non-empty.cddl
TEEP_JSON_FRAGS += teep.cddl
TEEP_JSON_FRAGS += teep-json-labels.cddl
TEEP_JSON_FRAGS += coswid-version-scheme.cddl

TEEP_JSON_EXAMPLES := $(wildcard examples/teep-json-*.diag)

$(eval $(call cddl_check_template,teep-json,$(TEEP_JSON_FRAGS),$(TEEP_JSON_EXAMPLES)))

clean: ; $(RM) $(CLEANFILES)
12 changes: 12 additions & 0 deletions datamodels/attestation-results/grammar/coswid-version-scheme.cddl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
$version-scheme /= multipartnumeric
$version-scheme /= multipartnumeric-suffix
$version-scheme /= alphanumeric
$version-scheme /= decimal
$version-scheme /= semver
$version-scheme /= int / text
multipartnumeric = 1
multipartnumeric-suffix = 2
alphanumeric = 3
decimal = 4
semver = 16384

19 changes: 19 additions & 0 deletions datamodels/attestation-results/grammar/examples/teep-json-1.diag
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
{
"eat_profile": "tag:github.com/veraison/ar4si,2022-10-17",
"ear.status": "affirming",
"ear.trustworthiness-vector": {
"instance-identity": 2,
"configuration": 2,
"executables": 2,
"hardware": 2
},
"iat": 1666529284,
"ear.appraisal-policy-id": "https://veraison.example/policy/1/60a0068d",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a note: at the moment, we do not expose policies externally via a URL. The policy ID utilised internally and reported in the result is a URI, with the scheme defined by the policy agent used (and therefore the expected rules format), and the tenant ID as the authority. So, at the moment, this would look more like "opa://7".

Once we define veraison/services#16, that might change (e.g. we may fine an API endpoint for accessing policies, or require that an external URL is supplied on registration)...

"ear.teep.claims": {
"nonce": "80FH7byS7VjfARIq0_KLqu6B9j-F79QtV6p",
"ueid": "AQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAh",
"oemid": "Av8B",
"hwmodel": "fJYq",
"hwversion": ["1.2.5", 16384]
}
}
5 changes: 5 additions & 0 deletions datamodels/attestation-results/grammar/teep-cbor-labels.cddl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
ear.teep.claims = 65000

; TODO

; vim: set tw=70 ts=2 et:
38 changes: 38 additions & 0 deletions datamodels/attestation-results/grammar/teep-json-labels.cddl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
ear.teep.claims = "ear.teep.claims"

eat.nonce = "nonce"
eat.ueid = "ueid"
eat.oemid = "oemid"
eat.hardware-model = "hwmodel"
eat.hardware-version = "hwversion"
eat.manifests = "manifests"

eat.nonce-type = tstr .size (10..74)

eat.ueid-type = base64-url-text ; cddl(1)-unsupported: .size (12..44)

eat.oemid-type = oemid-pen / oemid-ieee / oemid-random

eat.hardware-model-type = base64-url-text ; cddl(1)-unsupported: .size (4..44)

eat.hardware-version-type = [
version: tstr,
? scheme: $version-scheme
]

eat.manifests-type = [ + manifest-format ]

manifest-format = [
content-type: coap-content-format,
content-format: base64-url-text / text
]

coap-content-format = uint .le 65535

oemid-pen = int
oemid-ieee = base64-url-text ; cddl(1)-unsupported: .size 4
oemid-random = base64-url-text ; cddl(1)-unsupported: .size 24

base64-url-text = tstr .regexp "[A-Za-z0-9_=-]+"

; vim: set tw=70 ts=2 et:
14 changes: 14 additions & 0 deletions datamodels/attestation-results/grammar/teep.cddl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
$$ear-extension //= (
ear.teep.claims => ear-teep-claims
)

ear-teep-claims = non-empty<{
? eat.nonce => eat.nonce-type
? eat.ueid => eat.ueid-type
? eat.oemid => eat.oemid-type
? eat.hardware-model => eat.hardware-model-type
? eat.hardware-version => eat.hardware-version-type
? eat.manifests => eat.manifests-type
}>

; vim: set tw=70 ts=2 et: