intel / intel/confidential-computing.tee.dcap

PCK cert not fetched if -i option not set

Open Beginner friendly
#501 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
326
Forks
198
PR merge metrics
No merged PRs in 30d

Description

While trying to register a platform I used the `pcsclient.py fetch` command relying on default values for input and output files. After wasting time figuring out why the `platform_collateral.json` has an empty PCK cert list I eventually found in the code that the client fetches PCK certs only if `self.has_platform_list` is set:

https://github.com/intel/confidential-computing.tee.dcap/blob/fe55537da3b9c93e178fe475d469287c2c2f1691/tools/PcsClientTool/pcsclient.py#L175

It is defined as
https://github.com/intel/confidential-computing.tee.dcap/blob/fe55537da3b9c93e178fe475d469287c2c2f1691/tools/PcsClientTool/pcsclient.py#L152

which means that if you just want to use the default `platform_list.json` file as input, PCK certs won't be fetch.

Work around is to specify `-i` option, but code should probably be fixed.

Contributor guide

Open the contributing guide

Research direction

Start in tools/PcsClientTool/pcsclient.py around the referenced lines 152 and 175, then run `pcsclient.py fetch` without `-i` using the default platform_list.json input. Confirm that the generated platform_collateral.json contains the fetched PCK certificate list, matching the behavior when `-i` is supplied.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.