intel / intel/confidential-computing.tee.dcap
PCK cert not fetched if -i option not set
- Dominant language
- C
- Stars
- 326
- Forks
- 198
- PR merge metrics
- No merged PRs in 30d
Description
While trying to register a platform I used the `pcsclient.py fetch` command relying on default values for input and output files. After wasting time figuring out why the `platform_collateral.json` has an empty PCK cert list I eventually found in the code that the client fetches PCK certs only if `self.has_platform_list` is set:
https://github.com/intel/confidential-computing.tee.dcap/blob/fe55537da3b9c93e178fe475d469287c2c2f1691/tools/PcsClientTool/pcsclient.py#L175
It is defined as
https://github.com/intel/confidential-computing.tee.dcap/blob/fe55537da3b9c93e178fe475d469287c2c2f1691/tools/PcsClientTool/pcsclient.py#L152
which means that if you just want to use the default `platform_list.json` file as input, PCK certs won't be fetch.
Work around is to specify `-i` option, but code should probably be fixed.
Contributor guide
Research direction
Start in tools/PcsClientTool/pcsclient.py around the referenced lines 152 and 175, then run `pcsclient.py fetch` without `-i` using the default platform_list.json input. Confirm that the generated platform_collateral.json contains the fetched PCK certificate list, matching the behavior when `-i` is supplied.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100