Update ack branch to main so builds continue succeeding.

Squashed commit of the following: commit 1b24ec1 Author: Tiziano Santoro <[email protected]> Date: Thu Apr 4 00:50:26 2024 +0100 Update nix deps (#4979) Among other things, this update xz to v. 5.4.6 commit f68df2b Author: Tiziano Santoro <[email protected]> Date: Thu Apr 4 00:46:45 2024 +0100 Align with internal linter (#4978) b/332740854 commit 8bdd773 Author: jblebrun <[email protected]> Date: Wed Apr 3 21:43:20 2024 +0000 Update h2 to resolve vulnerability discovered by deny (#4977) https://rustsec.org/advisories/RUSTSEC-2024-0332 commit 5bc91be Author: jul-sh <[email protected]> Date: Wed Apr 3 16:05:06 2024 -0400 Directly issue kernel provenance for attestation measurements (#4976) * Directly issue kernel provenance attestation measurements Previously the provenance created by the SLSA builder was just for the bzImage. Not the artifact that would be measured in the attestation. With this PR the provenance subjects should include binaries measured in the attestation. Change-Id: I16e3234d0d65e3790319294c416c378cd7611681 * fix typo Change-Id: I3d078256d085ef05171e5997743d7497fc530ad0 commit 2ae6255 Author: Andri Saar <[email protected]> Date: Tue Apr 2 20:55:51 2024 +0000 Do a page state change operation before invoking `PVALIDATE` commit 8452885 Author: conradgrobler <[email protected]> Date: Wed Apr 3 17:54:04 2024 +0100 Ensure CPUID triggered the #VC exception (#4974) We want to make sure that the instruction pointer in a #VC exception really pointed to a CPUID instruction since it is the only #VC exception type we support. commit 4ad534f Author: thmsbinder <[email protected]> Date: Wed Apr 3 18:09:46 2024 +0200 Add and verify endorsement field for text reference value (#4973) The kernel command line reference value now follows the pattern from other reference values: skip, TR endorsement, or direct verification. When using TR endorsements in conjunction with the kernel command line the regex feature needs to be enabled. commit fa50670 Author: Patrick McGrath <[email protected]> Date: Tue Apr 2 10:43:22 2024 -0700 Unary gRPC transport template class (#4970) Implement unary transport class template for future Oak clients that use the unary interface. commit 65f6b46 Author: k-naliuka <[email protected]> Date: Fri Mar 29 00:33:37 2024 +0100 Add go and java options to the TcbVersion proto (#4969) commit cefb3c3 Author: Andri Saar <[email protected]> Date: Thu Mar 28 15:46:31 2024 +0000 Collect, and print out, some `PVALIDATE` stats in stage0 commit 579e92c Author: k-naliuka <[email protected]> Date: Wed Mar 27 20:49:53 2024 +0100 Refactor text reference values matching (#4965) Allow literal string comparison and make regex optional commit 121a6b0 Author: Ivan Petrov <[email protected]> Date: Wed Mar 27 19:13:14 2024 +0000 Sign group keys as part of Key Provisioning (#4961) This PR adds the ability to sign group keys in the attestation evidence as part of Key Provisioning. Ref #4442 commit 2a57cd6 Author: jul-sh <[email protected]> Date: Wed Mar 27 12:10:56 2024 -0400 Revert "Increase the size of the certificate in Stage0 DICE data (#4946)" (#4966) This reverts commit c869644, as it introduced a breaking change that broke imports. commit 57a8f73 Author: Ivan Petrov <[email protected]> Date: Wed Mar 27 15:29:07 2024 +0000 Add GroupEncryptionKeyHandle to C++ Containers SDK (#4964) Ref #4442 commit 863ee00 Author: k-naliuka <[email protected]> Date: Wed Mar 27 14:15:48 2024 +0100 Include regex in Bazel oak_crates_index (#4960) commit 83d881d Author: Tiziano Santoro <[email protected]> Date: Wed Mar 27 09:53:32 2024 +0000 Fix username and host when building kernel (#4963) b/330744888 Change-Id: Iac4a71c2d14238ccaca13c3997f47aa265a789ba
project-oak · Apr 5, 2024 · f24e62e · f24e62e
1 parent 55a8b6b
commit f24e62e
Show file tree

Hide file tree

Showing 97 changed files with 1,936 additions and 804 deletions.
diff --git a/.clang-format b/.clang-format
@@ -2,3 +2,10 @@ BasedOnStyle: Google
 ColumnLimit: 100
 DerivePointerAlignment: false
 PointerAlignment: Left
+---
+Language: Cpp
+ColumnLimit: 80
+---
+Language: Proto
+ColumnLimit: 80
+---
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/buildconfigs/oak_restricted_kernel_simple_io_init_rd_wrapper.toml b/buildconfigs/oak_restricted_kernel_simple_io_init_rd_wrapper.toml
@@ -6,4 +6,4 @@ command = [
   "just",
   "oak_restricted_kernel_simple_io_init_rd_wrapper",
 ]
-artifact_path = "./oak_restricted_kernel_wrapper/target/x86_64-unknown-none/release/oak_restricted_kernel_simple_io_init_rd_wrapper_bin"
+artifact_path = "./oak_restricted_kernel_wrapper/target/released_bin_with_components_oak_restricted_kernel_simple_io_init_rd/*"
diff --git a/cc/attestation/verification/insecure_attestation_verifier.cc b/cc/attestation/verification/insecure_attestation_verifier.cc
@@ -34,9 +34,10 @@ using ::oak::attestation::v1::Evidence;
 }  // namespace
 
 absl::StatusOr<AttestationResults> InsecureAttestationVerifier::Verify(
-    std::chrono::time_point<std::chrono::system_clock> now, const Evidence& evidence,
-    const Endorsements& endorsements) const {
-  absl::StatusOr<std::string> encryption_public_key = ExtractEncryptionPublicKey(evidence);
+    std::chrono::time_point<std::chrono::system_clock> now,
+    const Evidence& evidence, const Endorsements& endorsements) const {
+  absl::StatusOr<std::string> encryption_public_key =
+      ExtractEncryptionPublicKey(evidence);
   if (!encryption_public_key.ok()) {
     return encryption_public_key.status();
   }

diff --git a/cc/attestation/verification/insecure_attestation_verifier.h b/cc/attestation/verification/insecure_attestation_verifier.h
@@ -28,7 +28,8 @@
 
 namespace oak::attestation::verification {
 
-// Verifier implementation that doesn't verify attestation evidence and is used for testing.
+// Verifier implementation that doesn't verify attestation evidence and is used
+// for testing.
 class InsecureAttestationVerifier : public AttestationVerifier {
  public:
   // Doesn't perform attestation verification and just returns a success value.

diff --git a/cc/attestation/verification/utils.cc b/cc/attestation/verification/utils.cc
@@ -39,12 +39,15 @@ absl::StatusOr<std::string> ExtractPublicKey(absl::string_view certificate) {
   return std::string(public_key.begin(), public_key.end());
 }
 
-absl::StatusOr<std::string> ExtractEncryptionPublicKey(const Evidence& evidence) {
-  return ExtractPublicKey(evidence.application_keys().encryption_public_key_certificate());
+absl::StatusOr<std::string> ExtractEncryptionPublicKey(
+    const Evidence& evidence) {
+  return ExtractPublicKey(
+      evidence.application_keys().encryption_public_key_certificate());
 }
 
 absl::StatusOr<std::string> ExtractSigningPublicKey(const Evidence& evidence) {
-  return ExtractPublicKey(evidence.application_keys().signing_public_key_certificate());
+  return ExtractPublicKey(
+      evidence.application_keys().signing_public_key_certificate());
 }
 
 }  // namespace oak::attestation::verification
diff --git a/cc/client/client.cc b/cc/client/client.cc
@@ -51,26 +51,29 @@ using ::oak::transport::TransportWrapper;
 constexpr absl::string_view kEmptyAssociatedData = "";
 
 absl::StatusOr<std::unique_ptr<OakClient>> OakClient::Create(
-    std::unique_ptr<TransportWrapper> transport, AttestationVerifier& verifier) {
-  absl::StatusOr<EndorsedEvidence> endorsed_evidence = transport->GetEndorsedEvidence();
+    std::unique_ptr<TransportWrapper> transport,
+    AttestationVerifier& verifier) {
+  absl::StatusOr<EndorsedEvidence> endorsed_evidence =
+      transport->GetEndorsedEvidence();
   if (!endorsed_evidence.ok()) {
     return endorsed_evidence.status();
   }
 
-  absl::StatusOr<AttestationResults> attestation_results =
-      verifier.Verify(std::chrono::system_clock::now(), endorsed_evidence->evidence(),
-                      endorsed_evidence->endorsements());
+  absl::StatusOr<AttestationResults> attestation_results = verifier.Verify(
+      std::chrono::system_clock::now(), endorsed_evidence->evidence(),
+      endorsed_evidence->endorsements());
   if (!attestation_results.ok()) {
     return attestation_results.status();
   }
 
   switch (attestation_results->status()) {
     case AttestationResults::STATUS_SUCCESS:
-      return absl::WrapUnique(
-          new OakClient(std::move(transport), attestation_results->encryption_public_key()));
+      return absl::WrapUnique(new OakClient(
+          std::move(transport), attestation_results->encryption_public_key()));
     case AttestationResults::STATUS_GENERIC_FAILURE:
       return absl::FailedPreconditionError(
-          absl::StrCat("couldn't verify endorsed evidence: ", attestation_results->reason()));
+          absl::StrCat("couldn't verify endorsed evidence: ",
+                       attestation_results->reason()));
     case AttestationResults::STATUS_UNSPECIFIED:
     default:
       return absl::InternalError("illegal status code in attestation results");
@@ -93,13 +96,15 @@ absl::StatusOr<std::string> OakClient::Invoke(absl::string_view request_body) {
   }
 
   // Send request.
-  absl::StatusOr<EncryptedResponse> encrypted_response = transport_->Invoke(*encrypted_request);
+  absl::StatusOr<EncryptedResponse> encrypted_response =
+      transport_->Invoke(*encrypted_request);
   if (!encrypted_response.ok()) {
     return encrypted_response.status();
   }
 
   // Decrypt response.
-  absl::StatusOr<DecryptionResult> response = (*client_encryptor)->Decrypt(*encrypted_response);
+  absl::StatusOr<DecryptionResult> response =
+      (*client_encryptor)->Decrypt(*encrypted_response);
   if (!response.ok()) {
     return response.status();
   }

diff --git a/cc/client/client.h b/cc/client/client.h
@@ -47,7 +47,8 @@ class OakClient {
 
  private:
   std::unique_ptr<oak::transport::Transport> transport_;
-  // TODO(#4157): Store client encryptor once crypto sessions are implemented on the server.
+  // TODO(#4157): Store client encryptor once crypto sessions are implemented on
+  // the server.
   std::string server_encryption_public_key_;
 
   OakClient(std::unique_ptr<oak::transport::Transport> transport,

diff --git a/cc/client/client_test.cc b/cc/client/client_test.cc
@@ -65,25 +65,30 @@ class OakClientTest : public testing::Test {
   std::shared_ptr<EncryptionKeyProvider> encryption_key_;
 };
 
-// TODO(#3641): Send test remote attestation report to the client and add corresponding tests.
+// TODO(#3641): Send test remote attestation report to the client and add
+// corresponding tests.
 class TestTransport : public TransportWrapper {
  public:
   explicit TestTransport(std::shared_ptr<EncryptionKeyProvider> encryption_key)
       : encryption_key_(encryption_key) {}
 
-  absl::StatusOr<EndorsedEvidence> GetEndorsedEvidence() override { return EndorsedEvidence(); }
+  absl::StatusOr<EndorsedEvidence> GetEndorsedEvidence() override {
+    return EndorsedEvidence();
+  }
 
-  absl::StatusOr<EncryptedResponse> Invoke(const EncryptedRequest& encrypted_request) override {
+  absl::StatusOr<EncryptedResponse> Invoke(
+      const EncryptedRequest& encrypted_request) override {
     ServerEncryptor server_encryptor = ServerEncryptor(*encryption_key_);
     auto decrypted_request = server_encryptor.Decrypt(encrypted_request);
     if (!decrypted_request.ok()) {
       return decrypted_request.status();
     }
 
     if (decrypted_request->plaintext != kTestRequest) {
-      return absl::InvalidArgumentError(std::string("incorrect request, expected: ") +
-                                        std::string(kTestRequest) +
-                                        ", got : " + decrypted_request->plaintext);
+      return absl::InvalidArgumentError(
+          std::string("incorrect request, expected: ") +
+          std::string(kTestRequest) +
+          ", got : " + decrypted_request->plaintext);
     }
 
     return server_encryptor.Encrypt(kTestResponse, kTestAssociatedData);
@@ -95,11 +100,13 @@ class TestTransport : public TransportWrapper {
 
 class TestAttestationVerifier : public AttestationVerifier {
  public:
-  explicit TestAttestationVerifier(std::shared_ptr<EncryptionKeyProvider> encryption_key)
+  explicit TestAttestationVerifier(
+      std::shared_ptr<EncryptionKeyProvider> encryption_key)
       : encryption_key_(encryption_key) {}
 
   absl::StatusOr<::oak::attestation::v1::AttestationResults> Verify(
-      std::chrono::time_point<std::chrono::system_clock> now, const Evidence& evidence,
+      std::chrono::time_point<std::chrono::system_clock> now,
+      const Evidence& evidence,
       const Endorsements& endorsements) const override {
     AttestationResults attestation_results;
     attestation_results.set_status(AttestationResults::STATUS_SUCCESS);

diff --git a/cc/client/grpc_client_cli.cc b/cc/client/grpc_client_cli.cc
@@ -52,17 +52,19 @@ int main(int argc, char* argv[]) {
 
   // Create gRPC client stub.
   LOG(INFO) << "connecting to: " << address;
-  std::shared_ptr<Channel> channel = CreateChannel(address, InsecureChannelCredentials());
+  std::shared_ptr<Channel> channel =
+      CreateChannel(address, InsecureChannelCredentials());
   std::shared_ptr<oak::session::v1::StreamingSession::Stub> stub =
       StreamingSession::NewStub(channel);
   ClientContext context;
-  std::unique_ptr<ClientReaderWriter<RequestWrapper, ResponseWrapper>> channel_reader_writer =
-      stub->Stream(&context);
+  std::unique_ptr<ClientReaderWriter<RequestWrapper, ResponseWrapper>>
+      channel_reader_writer = stub->Stream(&context);
 
   // Create Oak Client.
   LOG(INFO) << "creating Oak Client";
   std::unique_ptr<GrpcStreamingTransport> transport =
-      std::make_unique<GrpcStreamingTransport>(std::move(channel_reader_writer));
+      std::make_unique<GrpcStreamingTransport>(
+          std::move(channel_reader_writer));
   InsecureAttestationVerifier verifier = InsecureAttestationVerifier();
   absl::StatusOr<std::unique_ptr<OakClient>> oak_client =
       OakClient::Create(std::move(transport), verifier);

diff --git a/cc/containers/hello_world_trusted_app/app_service.cc b/cc/containers/hello_world_trusted_app/app_service.cc
@@ -38,23 +38,27 @@ using ::oak::crypto::v1::EncryptedResponse;
 constexpr absl::string_view kEmptyAssociatedData = "";
 
 grpc::Status TrustedApplicationImpl::Hello(grpc::ServerContext* context,
-                                           const HelloRequest* request, HelloResponse* response) {
+                                           const HelloRequest* request,
+                                           HelloResponse* response) {
   ServerEncryptor server_encryptor(*encryption_key_handle_);
   absl::StatusOr<DecryptionResult> decrypted_request =
       server_encryptor.Decrypt(request->encrypted_request());
   if (!decrypted_request.ok()) {
-    return grpc::Status(static_cast<grpc::StatusCode>(decrypted_request.status().code()),
-                        std::string(decrypted_request.status().message()));
+    return grpc::Status(
+        static_cast<grpc::StatusCode>(decrypted_request.status().code()),
+        std::string(decrypted_request.status().message()));
   }
 
-  std::string greeting = absl::StrCat("Hello from the trusted side, ", decrypted_request->plaintext,
-                                      "! Btw, the Trusted App has a config with a length of ",
-                                      application_config_.size(), " bytes.");
+  std::string greeting = absl::StrCat(
+      "Hello from the trusted side, ", decrypted_request->plaintext,
+      "! Btw, the Trusted App has a config with a length of ",
+      application_config_.size(), " bytes.");
   absl::StatusOr<EncryptedResponse> encrypted_response =
       server_encryptor.Encrypt(greeting, kEmptyAssociatedData);
   if (!encrypted_response.ok()) {
-    return grpc::Status(static_cast<grpc::StatusCode>(encrypted_response.status().code()),
-                        std::string(encrypted_response.status().message()));
+    return grpc::Status(
+        static_cast<grpc::StatusCode>(encrypted_response.status().code()),
+        std::string(encrypted_response.status().message()));
   }
 
   *response->mutable_encrypted_response() = *std::move(encrypted_response);

diff --git a/cc/containers/hello_world_trusted_app/app_service.h b/cc/containers/hello_world_trusted_app/app_service.h
@@ -28,14 +28,17 @@
 
 namespace oak::oak_containers_hello_world_trusted_app {
 
-class TrustedApplicationImpl : public containers::example::TrustedApplication::Service {
+class TrustedApplicationImpl
+    : public containers::example::TrustedApplication::Service {
  public:
-  TrustedApplicationImpl(std::unique_ptr<::oak::crypto::EncryptionKeyHandle> encryption_key_handle,
-                         absl::string_view application_config)
+  TrustedApplicationImpl(
+      std::unique_ptr<::oak::crypto::EncryptionKeyHandle> encryption_key_handle,
+      absl::string_view application_config)
       : encryption_key_handle_(std::move(encryption_key_handle)),
         application_config_(application_config) {}
 
-  grpc::Status Hello(grpc::ServerContext* context, const containers::example::HelloRequest* request,
+  grpc::Status Hello(grpc::ServerContext* context,
+                     const containers::example::HelloRequest* request,
                      containers::example::HelloResponse* response) override;
 
  private: