Prepare new test images for image metadata enhencement about enclave-cc HOT 7 CLOSED

Thanks for the quick reply! Is the breaking change introduced by confidential-containers/image-rs@cf2d6d0?

Yes

Thanks. We will want to to update image-rs to a point without the breakages to get the dependency/perfomance updates. We just need to agree what sha the v0.4.0 will point to.

from enclave-cc.

Hi, there is a problem for enclave-cc. Now the test CI under reviewing uses eaa-kbc for confidential resource brokering (both image decryption keys and policy/signature verification key,.etc ). However currently verdictd does not support the same addressing mode as kbs uri. So there might be two options for us:

• Use a fixed version of Attestation-Agent and Verdictd in CI and a fixed rev of image-rs and keep @huliucheng1 's CI. When SGX verifier support is ready in Attestation Service, we can migrate from eaa-verdictd to CC-KBC, CC-KBS and update the image-rs version. The reason for this is that new image-rs(developing) and AA(reviewing) will use KBS URI to index resources, and currently confidential resource brokering is not a key problem enclave-cc faces.
• Refactor Verdictd to fit in KBS URI scheme. This can let the AA and image-rs version up-to-date. However this will take much effort to refactor verdictd, and might let us abondon CI that @huliucheng1 has already made great effort. It's unwise and ruthless.

I prefer option 1, although there will be a time before AS supports SGX verification during which we should use v0.3.0 AA and image-rs.

cc @hairongchen @mythi @haosanzi

from enclave-cc.

@Xynnn007 thanks for the heads-up and sorry for the late reply (it was triggered by @fidencio's PR :-)

I haven't followed the latest attestation-agent/image-rs changes. #110 triggers a test failure with an image I had encrypted using sample-kbs long time ago. Is this related to what you're describing above or something different?

#97 I'm not yet too worried about because it's still WIP and needs a lot of rework still.

from enclave-cc.

I haven't followed the latest attestation-agent/image-rs changes. #110 triggers a test failure with an image I had encrypted using sample-kbs long time ago. Is this related to what you're describing above or something different?

Yes, that is part of the things I've mentioned. We now have a unified format of AnnotationPacket in encrypted images in attestation-agent. The effection is all the images to be decrypted using previous eaa-kbc and sample-kbc will not pass.

A temporary solution is to still use the old version of image-rs (who imports attestation-agent as a dependency). And in future we can remake new test images with the new key provider which is still under development

from enclave-cc.

Thanks for the quick reply! Is the breaking change introduced by confidential-containers/image-rs@cf2d6d0?

from enclave-cc.

Thanks for the quick reply! Is the breaking change introduced by confidential-containers/image-rs@cf2d6d0?

Yes

from enclave-cc.

cc @fidencio

from enclave-cc.