Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix tdx quote5 #95

Merged
merged 2 commits into from
Mar 25, 2024
Merged

Fix tdx quote5 #95

merged 2 commits into from
Mar 25, 2024

Conversation

imlk0
Copy link
Collaborator

@imlk0 imlk0 commented Mar 25, 2024

  1. Due to compilation dependencies on two new header files, sgx_quote_5.h and sgx_quote_4.h, where sgx_quote_5.h is not available in the intel-headers deb package, it is necessary to switch to the one provided by intel-sgx-sdk. First, install the latest version 2.23.100.2 of intel-sgx-sdk:

    Uninstall the previous version:

    /opt/intel/sgxsdk/uninstall.sh

    Then install:

    wget https://download.01.org/intel-sgx/latest/linux-latest/distro/ubuntu20.04-server/sgx_linux_x64_sdk_2.23.100.2.bin
    chmod +x sgx_linux_x64_sdk_2.23.100.2.bin
    echo -e 'no\n/opt/intel\n' | sgx_linux_x64_sdk_2.23.100.2.bin
  2. When verifying the quote in tdx-verifier, tdx_qv_verify_quote() calls dlopen() to dynamically load libdcap_quoteprov.so, hence it requires installing libsgx-dcap-default-qpl:

    apt install libsgx-dcap-default-qpl
  3. The collateral (aka endorsements) required for verifying tdx quote is unable to be obtained from the PCCS service from Alibaba Cloud. So it is required to enable the following line in /etc/sgx_default_qcnl.conf to enable tdx-verifier to obtain collateral from Intel's Intel PCS service.

    "collateral_service": "https://api.trustedservices.intel.com/sgx/certification/v4/"

@imlk0
Copy link
Collaborator Author

imlk0 commented Mar 25, 2024

@jiazhang0 This PR requires the latest SGX SDK and DCAP libraries. And will be merged after the container image runetest/compilation-testing is updated. I'm working on it now.

@imlk0
Copy link
Collaborator Author

imlk0 commented Mar 25, 2024

Merged since #96 is already merged and all CI checking passed

@imlk0 imlk0 merged commit 4bdbd20 into inclavare-containers:master Mar 25, 2024
10 checks passed
@imlk0 imlk0 deleted the fix-tdx-quote5 branch March 26, 2024 01:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants