Skip to content

Add PCCS crate #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ameba23 wants to merge 20 commits into
base: main
Choose a base branch
from
Open

Add PCCS crate #3

Show file tree
Hide file tree
Changes from 11 commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
cbf336f
Add PCCS crate
ameba23 Mar 9, 2026
76cc306
Fix time reading in update loop
ameba23 Mar 9, 2026
a19f5fb
Refactor mock PCS server into separate module
ameba23 Mar 9, 2026
4ff46ce
Add ready method to await pre-warming, and fix tests to not actually …
ameba23 Mar 9, 2026
7745ae7
Fix pccs workspace dep
ameba23 Mar 9, 2026
c6f7d6b
Add example which demonstrates getting collateral from Intel PCS
ameba23 Mar 10, 2026
283a6e6
Improve logging for clarity
ameba23 Mar 10, 2026
b5f80f3
On fetching collateral from cache, do not verify a second time if ver…
ameba23 Mar 11, 2026
ca2b92b
Only convert timestamp to i64 internally in pccs crate
ameba23 Mar 11, 2026
09a0cc4
Improve refresh loop
ameba23 Mar 11, 2026
35ea2c7
Merge peg/add-attestation-crate
ameba23 Mar 11, 2026
293462c
Rename field pccs_url to url
ameba23 Mar 24, 2026
bbd524a
Typo
ameba23 Mar 24, 2026
fd546c7
Use fixed commit of dcap-qvl
ameba23 Mar 24, 2026
cc16825
Improve PCCS extract_next_update fn to find earliest update timestamp…
ameba23 Mar 25, 2026
7e7addf
Fmt
ameba23 Mar 25, 2026
2fc133d
Clippy
ameba23 Mar 25, 2026
1b6b429
Merge peg/add-attestation-crate
ameba23 Mar 25, 2026
aaa5c01
Fix yaml in tests following merge
ameba23 Mar 25, 2026
bda61c5
Merge branch 'main' of https://github.com/flashbots/attested-tls into…
0x416e746f6e Mar 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
166 changes: 164 additions & 2 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ members = [
"crates/attested-tls",
"crates/nested-tls",
"crates/attestation",
"crates/pccs",
]

[workspace.lints.rust]
Expand All @@ -20,3 +21,5 @@ unused_async = "warn"
rustls = { version = "0.23.37", default-features = false, features = ["brotli"] }
tokio = { version = "1.50.0", features = ["default"] }
tokio-rustls = { version = "0.26.4", default-features = false }
dcap-qvl = { git = "https://github.com/Phala-Network/dcap-qvl.git" }
Copy link
Copy Markdown
Member

@0x416e746f6e 0x416e746f6e Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

question:

should we pin this to some tag/sha?

Copy link
Copy Markdown
Collaborator Author

@ameba23 ameba23 Mar 24, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep good catch. I have pinned to current head of master, and as soon as they make the next release i would switch to that (as we need something which is not yet released).

pccs = { path = "crates/pccs" }
3 changes: 2 additions & 1 deletion crates/attestation/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ repository = "https://github.com/flashbots/attested-tls"
keywords = ["attestation", "CVM", "TDX"]

[dependencies]
pccs = { workspace = true }
tokio = { workspace = true, features = ["fs"] }
tokio-rustls = { workspace = true, default-features = false }
x509-parser = "0.18.0"
Expand All @@ -16,7 +17,7 @@ anyhow = "1.0.100"
pem-rfc7468 = { version = "0.7.0", features = ["std"] }
configfs-tsm = "0.0.2"
rand_core = { version = "0.6.4", features = ["getrandom"] }
dcap-qvl = { git = "https://github.com/flashbots/dcap-qvl.git", branch = "peg/azure-outdated-tcp-override", features = ["danger-allow-tcb-override"] }
dcap-qvl = { workspace = true, features = ["danger-allow-tcb-override"] }
hex = "0.4.3"
http = "1.3.1"
serde_json = "1.0.145"
Expand Down
9 changes: 5 additions & 4 deletions crates/attestation/src/azure/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ use base64::{Engine as _, engine::general_purpose::URL_SAFE as BASE64_URL_SAFE};
use dcap_qvl::QuoteCollateralV3;
use num_bigint::BigUint;
use openssl::{error::ErrorStack, pkey::PKey};
use pccs::Pccs;
use serde::{Deserialize, Serialize};
use thiserror::Error;
use x509_parser::prelude::*;
Expand Down Expand Up @@ -80,7 +81,7 @@ pub fn create_azure_attestation(input_data: [u8; 64]) -> Result<Vec<u8>, MaaErro
pub async fn verify_azure_attestation(
input: Vec<u8>,
expected_input_data: [u8; 64],
pccs_url: Option<String>,
pccs: Option<Pccs>,
override_azure_outdated_tcb: bool,
) -> Result<super::measurements::MultiMeasurements, MaaError> {
let now = std::time::SystemTime::now()
Expand All @@ -91,7 +92,7 @@ pub async fn verify_azure_attestation(
verify_azure_attestation_with_given_timestamp(
input,
expected_input_data,
pccs_url,
pccs,
None,
now,
override_azure_outdated_tcb,
Expand All @@ -105,7 +106,7 @@ pub async fn verify_azure_attestation(
async fn verify_azure_attestation_with_given_timestamp(
input: Vec<u8>,
expected_input_data: [u8; 64],
pccs_url: Option<String>,
pccs: Option<Pccs>,
collateral: Option<QuoteCollateralV3>,
now: u64,
override_azure_outdated_tcb: bool,
Expand All @@ -127,7 +128,7 @@ async fn verify_azure_attestation_with_given_timestamp(
let _dcap_measurements = verify_dcap_attestation_with_given_timestamp(
tdx_quote_bytes,
expected_tdx_input_data,
pccs_url,
pccs,
collateral,
now,
override_azure_outdated_tcb,
Expand Down
Loading
Loading