Skip to content

Conversation

@aneessahib
Copy link
Contributor

@aneessahib aneessahib commented Nov 21, 2022

Signed-off-by: aneessahib anees.a.sahib@intel.com

fixes #8


This change is Reviewable

Signed-off-by: aneessahib <anees.a.sahib@intel.com>
Copy link
Member

@mkow mkow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed 12 of 12 files at r1, all commit messages.
Reviewable status: all files reviewed, 1 unresolved discussion, not enough approvals from maintainers (3 more required), not enough approvals from different teams (2 more required, approved so far: ) (waiting on @aneessahib)


Examples/aks-attestation/aks-secret-prov-server.dockerfile line 32 at r1 (raw file):

ARG server_dcap_pf="n"
RUN if [ $server_dcap_pf="y" ]; then \
        sed -i "s|verify_measurements_callback,|NULL,|g" \

Please don't patch sources with sed. Also, why do you even need this?

Copy link
Contributor Author

@aneessahib aneessahib left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewable status: all files reviewed, 1 unresolved discussion, not enough approvals from maintainers (2 more required), not enough approvals from different teams (2 more required, approved so far: ) (waiting on @mkow)


Examples/aks-attestation/aks-secret-prov-server.dockerfile line 32 at r1 (raw file):

Previously, mkow (Michał Kowalczyk) wrote…

Please don't patch sources with sed. Also, why do you even need this?

This file is taken as is from https://github.com/gramineproject/contrib/blob/master/Curated-Apps/verifier/verifier.dockerfile.template

This change will force the verification logic to default to https://github.com/gramineproject/gramine/blob/da990909010a5989dc89c63f4c7a22d78fb3f5c6/tools/sgx/ra-tls/ra_tls_verify_dcap.c#L206, and this is more secure. ( verify_measurements_callback which only prints the different quote attributes)

Copy link
Contributor Author

@aneessahib aneessahib left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewable status: all files reviewed, 1 unresolved discussion, not enough approvals from maintainers (2 more required), not enough approvals from different teams (2 more required, approved so far: ) (waiting on @mkow)


Examples/aks-attestation/aks-secret-prov-server.dockerfile line 32 at r1 (raw file):

Previously, aneessahib (Anees Sahib) wrote…

This file is taken as is from https://github.com/gramineproject/contrib/blob/master/Curated-Apps/verifier/verifier.dockerfile.template

This change will force the verification logic to default to https://github.com/gramineproject/gramine/blob/da990909010a5989dc89c63f4c7a22d78fb3f5c6/tools/sgx/ra-tls/ra_tls_verify_dcap.c#L206, and this is more secure. ( verify_measurements_callback which only prints the different quote attributes)

btw - we should be ok to modify examples to suit our needs, no?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Update AKS-Attestation example after Gramine PR 884 is merged

2 participants