Skip to content

Add PCCS crate #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ameba23 wants to merge 11 commits into
base: peg/add-attestation-crate
Choose a base branch
from
Open

Add PCCS crate #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
cbf336f
Add PCCS crate
ameba23 Mar 9, 2026
76cc306
Fix time reading in update loop
ameba23 Mar 9, 2026
a19f5fb
Refactor mock PCS server into separate module
ameba23 Mar 9, 2026
4ff46ce
Add ready method to await pre-warming, and fix tests to not actually …
ameba23 Mar 9, 2026
7745ae7
Fix pccs workspace dep
ameba23 Mar 9, 2026
c6f7d6b
Add example which demonstrates getting collateral from Intel PCS
ameba23 Mar 10, 2026
283a6e6
Improve logging for clarity
ameba23 Mar 10, 2026
b5f80f3
On fetching collateral from cache, do not verify a second time if ver…
ameba23 Mar 11, 2026
ca2b92b
Only convert timestamp to i64 internally in pccs crate
ameba23 Mar 11, 2026
09a0cc4
Improve refresh loop
ameba23 Mar 11, 2026
35ea2c7
Merge peg/add-attestation-crate
ameba23 Mar 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
166 changes: 164 additions & 2 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ members = [
"crates/attested-tls",
"crates/nested-tls",
"crates/attestation",
"crates/pccs",
]

[workspace.lints.rust]
Expand All @@ -20,3 +21,5 @@ unused_async = "warn"
rustls = { version = "0.23.37", default-features = false, features = ["brotli"] }
tokio = { version = "1.50.0", features = ["default"] }
tokio-rustls = { version = "0.26.4", default-features = false }
dcap-qvl = { git = "https://github.com/Phala-Network/dcap-qvl.git" }
Copy link
Member

@0x416e746f6e 0x416e746f6e Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

question:

should we pin this to some tag/sha?

pccs = { path = "crates/pccs" }
3 changes: 2 additions & 1 deletion crates/attestation/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ repository = "https://github.com/flashbots/attested-tls"
keywords = ["attestation", "CVM", "TDX"]

[dependencies]
pccs = { workspace = true }
tokio = { workspace = true, features = ["fs"] }
tokio-rustls = { workspace = true, default-features = false }
x509-parser = "0.18.0"
Expand All @@ -16,7 +17,7 @@ anyhow = "1.0.100"
pem-rfc7468 = { version = "0.7.0", features = ["std"] }
configfs-tsm = "0.0.2"
rand_core = { version = "0.6.4", features = ["getrandom"] }
dcap-qvl = { git = "https://github.com/flashbots/dcap-qvl.git", branch = "peg/azure-outdated-tcp-override", features = ["danger-allow-tcb-override"] }
dcap-qvl = { workspace = true, features = ["danger-allow-tcb-override"] }
hex = "0.4.3"
http = "1.3.1"
serde_json = "1.0.145"
Expand Down
9 changes: 5 additions & 4 deletions crates/attestation/src/azure/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ use base64::{Engine as _, engine::general_purpose::URL_SAFE as BASE64_URL_SAFE};
use dcap_qvl::QuoteCollateralV3;
use num_bigint::BigUint;
use openssl::{error::ErrorStack, pkey::PKey};
use pccs::Pccs;
use serde::{Deserialize, Serialize};
use thiserror::Error;
use x509_parser::prelude::*;
Expand Down Expand Up @@ -80,7 +81,7 @@ pub fn create_azure_attestation(input_data: [u8; 64]) -> Result<Vec<u8>, MaaErro
pub async fn verify_azure_attestation(
input: Vec<u8>,
expected_input_data: [u8; 64],
pccs_url: Option<String>,
pccs: Option<Pccs>,
override_azure_outdated_tcb: bool,
) -> Result<super::measurements::MultiMeasurements, MaaError> {
let now = std::time::SystemTime::now()
Expand All @@ -91,7 +92,7 @@ pub async fn verify_azure_attestation(
verify_azure_attestation_with_given_timestamp(
input,
expected_input_data,
pccs_url,
pccs,
None,
now,
override_azure_outdated_tcb,
Expand All @@ -105,7 +106,7 @@ pub async fn verify_azure_attestation(
async fn verify_azure_attestation_with_given_timestamp(
input: Vec<u8>,
expected_input_data: [u8; 64],
pccs_url: Option<String>,
pccs: Option<Pccs>,
collateral: Option<QuoteCollateralV3>,
now: u64,
override_azure_outdated_tcb: bool,
Expand All @@ -127,7 +128,7 @@ async fn verify_azure_attestation_with_given_timestamp(
let _dcap_measurements = verify_dcap_attestation_with_given_timestamp(
tdx_quote_bytes,
expected_tdx_input_data,
pccs_url,
pccs,
collateral,
now,
override_azure_outdated_tcb,
Expand Down
Loading
Loading