Add verify cert callback function for DiceTcbInfo #2672

Wenxing-hou · 2024-04-24T02:31:34Z

Refer the spec: https://trustedcomputinggroup.org/wp-content/uploads/DICE-Attestation-Architecture-Version-1.1-Revision-18_pub.pdf ,
add verify cert callback function for cert DiceTcbInfo extension check.

xiaoyuruan · 2024-04-26T16:51:57Z

unit_test/test_spdm_callback/test_spdm_callback.c

+    void *spdm_root_cert_for_dicetcbinfo;
+    size_t spdm_root_cert_size_for_dicetcbinfo;
+
+    spdm_context = (void *)malloc(libspdm_get_context_size());


The code should handle cases where malloc fails and returns NULL.

Thanks. I have add the code to handle the failed case.

xiaoyuruan · 2024-04-26T17:10:49Z

unit_test/test_spdm_callback/spdm_cert_verify_callback.c

+    /*vendorInfo*/
+    result = libspdm_asn1_get_tag(&ptr, end, &obj_len,
+                                  LIBSPDM_CRYPTO_ASN1_CONTEXT_SPECIFIC + 8);
+    if (result) {


Why there is no check for vendorInfo and flags?

Because there is no vendorInfo and flags reference. The check will skip.

What if the verifier would like to check vendorInfo and/or flags against references?

Because there is no vendorInfo and flags reference. The check will skip.

Please note, this is only reference implementation.

In a real production, the integrator can decide to add more fields to check, or skip some fields.

xiaoyuruan · 2024-04-26T17:14:08Z

unit_test/test_spdm_callback/spdm_cert_verify_callback.c

+    int32_t length;
+    size_t obj_len;
+    uint8_t *end;
+


General: we can't assume that the adopter code will provide reference values for all TCBinfo components hardcoded above (m_libspdm_dice_tcbinfo_xyz). If a reference is not provided, this function should skip mem_equal() for that component, even if the component is present in the TcbInfo extension.

Yes. The code assume only follow reference will be provided. And the other components will be skip even if existing in cert.

/*vendor: INTC*/ /*model: S3M GNR*/ /*version: 000200000000008B*/ /*svn*/ /*layer*/ /*fwids*/ /*type*/

I was saying that the code should not require hardcoded references of these components (vendor, model, version, etc.). For example, the verifier can choose to hardcode reference for only "version" because the verifier only cares about version.

Please note, this test is only reference implementation, to demonstrate how to do the alias cert verification.

The integrator should decide what to do - input as parameter, or hardcode somewhere.

xiaoyuruan · 2024-04-26T17:48:41Z

unit_test/test_spdm_callback/spdm_cert_verify_callback.c

+                                      LIBSPDM_CRYPTO_ASN1_CONSTRUCTED);
+        if (result) {
+            /*verify Dice TCB info*/
+            result = libspdm_verify_cert_dicetcbinfo(tem_ptr, obj_len + (ptr - tem_ptr));


The "m_libspdm_must_have_dice_tcb_info" is a global that applies to all certs in the chain, but TcbInfo is usually present and required for some certs (e.g., Alias cert).

Please note, this is reference implementation. We cannot handle all difference use cases.

The integrator should choose what to do in the final production, based on their own use case.

jyao1 · 2024-04-29T01:16:52Z

@xiaoyuruan, I would like to provide a general comment: This is only reference implementation to demonstrate how to do the alias cert check. If you have one specific use case to cover, please describe it clearly. We can cover that. That is not a problem.

However, it is impossible to cover all use cases, which is NOT the goal of this PR.

xiaoyuruan · 2024-04-29T01:25:04Z

@xiaoyuruan, I would like to provide a general comment: This is only reference implementation to demonstrate how to do the alias cert check. If you have one specific use case to cover, please describe it clearly. We can cover that. That is not a problem.

However, it is impossible to cover all use cases, which is NOT the goal of this PR.

OK that's fine. Please document all assumptions of the implementation (maybe in the readme file?), so reviewers and verifier integrators have a proper expectation.
For example:

TcbInfo is required for either all certificates or none certificates (controlled by m_libspdm_must_have_dice_tcb_info).
If a TcbInfo component is present in cert, then there must be a reference hardcoded for this component.
etc.

steven-bellock · 2024-04-29T15:02:14Z

@Wenxing-hou @jyao1 please file a separate issue for OpenSSL's validation of certificates with critical OIDs.

jyao1 · 2024-04-30T01:55:29Z

@xiaoyuruan, I would like to provide a general comment: This is only reference implementation to demonstrate how to do the alias cert check. If you have one specific use case to cover, please describe it clearly. We can cover that. That is not a problem.
However, it is impossible to cover all use cases, which is NOT the goal of this PR.

OK that's fine. Please document all assumptions of the implementation (maybe in the readme file?), so reviewers and verifier integrators have a proper expectation. For example:

TcbInfo is required for either all certificates or none certificates (controlled by m_libspdm_must_have_dice_tcb_info).

If a TcbInfo component is present in cert, then there must be a reference hardcoded for this component.

etc.

Yes. That is good suggestion. We should add readme to document that.

I think current assumption is:

Reference TcbInfo.

Only one reference TcbInfo entry is provided by the integrator. (Multiple reference TcbInfo is NOT supported in this PR.)

Reported TcbInfo

The number of reported TcbInfo must match the number of reference TcbInfo.

TcbInfo Matching

Each of the reported TcbInfo must fully match each of the reference TcbInfo with same order.

TcbInfo Field

The reported TcbInfo must include all fields in the reference TcbInfo. If a field in the reference TcbInfo does not exist in the reported TcbInfo, the verification must fail.
The reported TcbInfo could include more fields which do not exist in the reference TcbInfo. The extra fields in the reported TcbInfo must be ignored and NOT validated, and they must not impact the final result.

@Wenxing-hou , please double check if above assumption is satisfied.
@xiaoyuruan , please review and comment if above assumption is OK.

Wenxing-hou · 2024-04-30T06:10:03Z

@xiaoyuruan, I would like to provide a general comment: This is only reference implementation to demonstrate how to do the alias cert check. If you have one specific use case to cover, please describe it clearly. We can cover that. That is not a problem.
However, it is impossible to cover all use cases, which is NOT the goal of this PR.

OK that's fine. Please document all assumptions of the implementation (maybe in the readme file?), so reviewers and verifier integrators have a proper expectation. For example:

TcbInfo is required for either all certificates or none certificates (controlled by m_libspdm_must_have_dice_tcb_info).

If a TcbInfo component is present in cert, then there must be a reference hardcoded for this component.

etc.

Yes. That is good suggestion. We should add readme to document that.

I think current assumption is:

Reference TcbInfo.

Only one reference TcbInfo entry is provided by the integrator. (Multiple reference TcbInfo is NOT supported in this PR.)

Reported TcbInfo

Reported TcbInfo must be in at least one certificate.

If none of the certificates includes TcbInfo, the verification must fail.

TcbInfo Matching

At least one reported TcbInfo must fully match the reference TcbInfo.

If none of the reported TcbInfos matches all fields in the reference TcbInfo, the verification must fail.

Once one of the reported TcbInfo fully matches, the verification must pass and the rests of reported TcbInfo must be ignored.

TcbInfo Field

The reported TcbInfo must include all fields in the reference TcbInfo. If a field in the reference TcbInfo does not exist in the reported TcbInfo, the verification must fail.

The reported TcbInfo could include more fields which do not exist in the reference TcbInfo. The extra fields in the reported TcbInfo must be ignored and NOT validated, and they must not impact the final result.

@Wenxing-hou , please double check if above assumption is satisfied. @xiaoyuruan , please review and comment if above assumption is OK.

Hi Jiewen. I have checked the code, the code logic match the implementation assumption.

libspdm/unit_test/test_spdm_callback/spdm_cert_verify_callback.c

Lines 249 to 277 in 642defe

    
           while (ptr < end) { 
        
               cert_dice_tcb_info_size = 0; 
        
               tem_ptr = ptr; 
        
               result = libspdm_asn1_get_tag(&ptr, end, &obj_len, 
        
                                             LIBSPDM_CRYPTO_ASN1_SEQUENCE | 
        
                                             LIBSPDM_CRYPTO_ASN1_CONSTRUCTED); 
        
               if (result) { 
        
                   /*verify Dice TCB info*/ 
        
                   result = libspdm_verify_cert_dicetcbinfo(tem_ptr, obj_len + (ptr - tem_ptr), 
        
                                                            &cert_dice_tcb_info_size); 
        
                   if (!result) { 
        
                       if (cert_dice_tcb_info_size == 0) { 
        
                           return false; 
        
                       } 
        
                   } else { 
        
                       if (cert_dice_tcb_info_size != 0) { 
        
                           cert_chain_have_matched_dice = true; 
        
                       } 
        
                   } 
        
                   /* Move to next cert*/ 
        
                   ptr += obj_len; 
        
               } else { 
        
                   return false; 
        
               } 
        
           } 
        
           if (m_libspdm_must_have_dice_tcb_info && !cert_chain_have_matched_dice) { 
        
               return false; 
        
           }

And I have added the Readme for the Callback function.

xiaoyuruan · 2024-04-30T18:57:39Z

unit_test/test_spdm_callback/spdm_cert_verify_callback.c

+                                      LIBSPDM_CRYPTO_ASN1_CONSTRUCTED);
+        if (result) {
+            /*verify Dice TCB info*/
+            result = libspdm_verify_cert_dicetcbinfo(tem_ptr, obj_len + (ptr - tem_ptr),


If libspdm_verify_cert_dicetcbinfo returns FALSE and cert_dice_tcb_info_size!=0, tracing this function further, I think there is an error ("store buffer too small"- not sure what it meant). Is it necessary to handle the error here?

Thanks.
Now libspdm_verify_cert_dicetcbinfo hard code the DiceTcbInfo buffer size, and the code categorizes the buffer error to invalid error.

libspdm/unit_test/test_spdm_callback/spdm_cert_verify_callback.c

Lines 56 to 66 in c1c1faa

spdm_dice_tcb_info_size = 256;

*spdm_get_dice_tcb_info_size = 0;

result = libspdm_x509_get_extension_data(cert, cert_size,

m_libspdm_tcg_dice_tcbinfo_oid,

sizeof(m_libspdm_tcg_dice_tcbinfo_oid),

spdm_dice_tcb_info, &spdm_dice_tcb_info_size);

if (!result) {

return false;

} else if (spdm_dice_tcb_info_size == 0) {

return true;

}

I don't think it is necessary to handle this issue.

jyao1 · 2024-05-01T00:38:50Z

unit_test/test_spdm_callback/README.md

+   2) **Reported TcbInfo**
+
+      - Reported TcbInfo must be in at least one certificate.
+      - If none of the certificates includes TcbInfo, the verification must fail.
+   3) **TcbInfo Matching**
+
+      - At least one reported TcbInfo must fully match the reference TcbInfo.
+      - If none of the reported TcbInfos matches all fields in the reference TcbInfo, the verification must fail.
+      - Once one of the reported TcbInfo fully matches, the verification must pass and the rests of reported TcbInfo must be ignored.


Please change to below:

2) Reported TcbInfo * The number of reported TcbInfo must match the number of reference TcbInfo. 3) TcbInfo Matching * Each of the reported TcbInfo must fully match each of the reference TcbInfo with same order.

jyao1 · 2024-05-07T01:55:08Z

unit_test/test_spdm_callback/spdm_cert_verify_callback.c

+            } else {
+                if (cert_dice_tcb_info_size != 0) {
+                    cert_chain_have_matched_dice = true;
+                    number_dice_tcb_info++;


This is NOT correct.

The rule is to make sure the TcbInfo number matches, not the right TcbInfo number matches.

Thanks.
I have updated the logic: change the number when the cert have DiceTcbInfo.

libspdm/unit_test/test_spdm_callback/spdm_cert_verify_callback.c

Lines 264 to 274 in 20640c8

if (!result) {

if (cert_dice_tcb_info_size == 0) {

return false;

}

number_dice_tcb_info++;

} else {

if (cert_dice_tcb_info_size != 0) {

cert_chain_have_matched_dice = true;

number_dice_tcb_info++;

}

}

jyao1 · 2024-05-10T01:33:58Z

please resolve conflict.

steven-bellock · 2024-05-10T01:42:32Z

I'll provide my comments tomorrow. Was busy today.

Wenxing-hou · 2024-05-10T01:46:26Z

please resolve conflict.

Thanks. I have fixed the conflict.

Wenxing-hou · 2024-05-10T01:46:40Z

I'll provide my comments tomorrow. Was busy today.

Thanks for your support.

PrithviAPai · 2024-05-10T05:01:18Z

@Wenxing-hou we have libspdm_verify_spdm_cert_chain_func where we can register libspdm_verify_spdm_cert_chain_with_dice as callback to verify the DICE certificates right ?

PrithviAPai · 2024-05-10T05:08:03Z

Also if we pass sample cert chain from libspdm unit test. Will this function verify that ?
We might have cases where on some devices we will have DICE certificates and rest without dice extension.

steven-bellock · 2024-05-10T18:25:00Z

So I think there are three separate issues / pull requests here.

Testing that Integrator-provided callbacks are registered properly.
- For example there is currently no coverage for libspdm_register_verify_spdm_cert_chain_func.
- This would be tested in either test_spdm_callback or (if possible) in issue 2 below.
Testing that libspdm properly calls and handles the output of Integrator-provided functions.
- For example there is currently no coverage for verify_peer_spdm_cert_chain in GET_CERTIFICATE and encapsulated GET_CERTIFICATE.
- This would be tested in the unit tests for the corresponding SPDM message. For example test_spdm_requester/get_certificate.c.
- Note that the callback function used for testing need not be elaborate. It can just return true or false.
Sample implementation of a callback function.
- This belongs, at a minimum, in os_stub/ or maybe make a new example_code/ directory or in the spdm-emu repository.

Wenxing-hou · 2024-05-11T01:36:41Z

@Wenxing-hou we have libspdm_verify_spdm_cert_chain_func where we can register libspdm_verify_spdm_cert_chain_with_dice as callback to verify the DICE certificates right ?

Yes, the libspdm_verify_spdm_cert_chain_with_dice as callback need to register to libspdm_verify_spdm_cert_chain_func .
Please use the function libspdm_register_verify_spdm_cert_chain_func to register.
In the libspdm_register_verify_spdm_cert_chain_func comment, you can know:
This function must be called after libspdm_init_context, and before any SPDM communication.

Thanks.

Wenxing-hou · 2024-05-11T01:40:12Z

Also if we pass sample cert chain from libspdm unit test. Will this function verify that ? We might have cases where on some devices we will have DICE certificates and rest without dice extension.

Please refer to the Readme.md:
https://github.com/DMTF/libspdm/blob/7d13678fec5b5c3479956b7c67cde2cf7cb053cb/unit_test/test_spdm_callback/README.md#implementation-assumption

Thanks.

Wenxing-hou · 2024-05-11T01:43:06Z

So I think there are three separate issues / pull requests here.

Testing that Integrator-provided callbacks are registered properly.

For example there is currently no coverage for libspdm_register_verify_spdm_cert_chain_func.

This would be tested in either test_spdm_callback or (if possible) in issue 2 below.

Testing that libspdm properly calls and handles the output of Integrator-provided functions.

For example there is currently no coverage for verify_peer_spdm_cert_chain in GET_CERTIFICATE and encapsulated GET_CERTIFICATE.

This would be tested in the unit tests for the corresponding SPDM message. For example test_spdm_requester/get_certificate.c.

Note that the callback function used for testing need not be elaborate. It can just return true or false.

Sample implementation of a callback function.

This belongs, at a minimum, in os_stub/ or maybe make a new example_code/ directory or in the spdm-emu repository.

Thanks for your suggestion. I will do the corresponding work based on your feedback.

steven-bellock · 2024-05-11T02:22:57Z

Let's make sure @jyao1 approves first.

jyao1 · 2024-05-13T01:50:02Z

So I think there are three separate issues / pull requests here.

Testing that Integrator-provided callbacks are registered properly.

For example there is currently no coverage for libspdm_register_verify_spdm_cert_chain_func.

This would be tested in either test_spdm_callback or (if possible) in issue 2 below.

Agree. Please file a new issue.

Testing that libspdm properly calls and handles the output of Integrator-provided functions.

For example there is currently no coverage for verify_peer_spdm_cert_chain in GET_CERTIFICATE and encapsulated GET_CERTIFICATE.

This would be tested in the unit tests for the corresponding SPDM message. For example test_spdm_requester/get_certificate.c.

Note that the callback function used for testing need not be elaborate. It can just return true or false.

Agree. Please file a new issue.

Sample implementation of a callback function.

This belongs, at a minimum, in os_stub/ or maybe make a new example_code/ directory or in the spdm-emu repository.

Agree. Please move this to os_stub/spdm_cert_verify_callback_sample. Please only do this in this PR.

Wenxing-hou · 2024-05-13T05:32:47Z

So I think there are three separate issues / pull requests here.

Testing that Integrator-provided callbacks are registered properly.

For example there is currently no coverage for libspdm_register_verify_spdm_cert_chain_func.

This would be tested in either test_spdm_callback or (if possible) in issue 2 below.

Agree. Please file a new issue.

Testing that libspdm properly calls and handles the output of Integrator-provided functions.

For example there is currently no coverage for verify_peer_spdm_cert_chain in GET_CERTIFICATE and encapsulated GET_CERTIFICATE.

This would be tested in the unit tests for the corresponding SPDM message. For example test_spdm_requester/get_certificate.c.

Note that the callback function used for testing need not be elaborate. It can just return true or false.

Agree. Please file a new issue.

Sample implementation of a callback function.

This belongs, at a minimum, in os_stub/ or maybe make a new example_code/ directory or in the spdm-emu repository.

Agree. Please move this to os_stub/spdm_cert_verify_callback_sample. Please only do this in this PR.

For the first feedback, I have submitted the issue: #2695
For the second feedback, I have submitted the issue: #2696
For the third feedback, I have move this to os_stub/spdm_cert_verify_callback_sample. Thanks!

steven-bellock · 2024-05-19T23:10:37Z

os_stub/spdm_cert_verify_callback_sample/spdm_cert_verify_callback.c

+ *  License: BSD 3-Clause License. For full text see link: https://github.com/DMTF/libspdm/blob/main/LICENSE.md
+ **/
+
+#include <stdarg.h>


Trim the headers to those that are actually used.

Thanks. I have deleted the unused header.

os_stub/spdm_cert_verify_callback_sample/spdm_cert_verify_callback.c

steven-bellock · 2024-05-19T23:15:37Z

os_stub/spdm_cert_verify_callback_sample/spdm_cert_verify_callback_internal.h

+ *  License: BSD 3-Clause License. For full text see link: https://github.com/DMTF/libspdm/blob/main/LICENSE.md
+ **/
+
+#ifndef __SPDM_CERT_VERIFY_CALLBACK_INTERNAL_H__


__SPDM_CERT_VERIFY_CALLBACK_INTERNAL_H__ -> SPDM_CERT_VERIFY_CALLBACK_INTERNAL_H

Thanks. I have fixed the MACRO.

steven-bellock · 2024-05-19T23:16:13Z

os_stub/spdm_cert_verify_callback_sample/spdm_cert_verify_callback_internal.h

+
+#include "library/spdm_crypt_lib.h"
+#include "spdm_crypt_ext_lib/spdm_crypt_ext_lib.h"
+#include "spdm_crypt_ext_lib/cryptlib_ext.h"


Trim the headers to those that are actually used.

Thanks. I have deleted the unused header.

steven-bellock · 2024-05-19T23:17:04Z

unit_test/test_spdm_callback/README.md

@@ -0,0 +1,37 @@
+## This is reference implementation to verify CertChain DiceTcbInfo extension.


This file should be in os_stub/spdm_cert_verify_callback_sample.

Thanks. I have moved the README to os_stub.

steven-bellock · 2024-05-19T23:20:36Z

unit_test/test_spdm_callback/test_spdm_callback.c

@@ -0,0 +1,140 @@
+/**


This directory should be called unit_test/test_spdm_sample.

Thanks. I have changed the folder name.

steven-bellock · 2024-05-20T23:19:14Z

unit_test/test_spdm_sample/test_spdm_sample.c

+    free(file_data);
+}
+
+int libspdm_crypt_lib_setup(void **state)


All these instances of *_crypt_lib_* need to be renamed to *_spdm_sample_*.

Thanks. I have changed the name.

Refer the spec https://trustedcomputinggroup.org/resource/dice-attestation-architecture/ add verify cert callback function for Cert extentison DiceTcbInfo check. Signed-off-by: Wenxing Hou <[email protected]>

Wenxing-hou force-pushed the add_DiceTcbInfo branch 2 times, most recently from 3cef1fd to 488a782 Compare April 24, 2024 02:44

jyao1 added the test For tests and testing infrastructure label Apr 25, 2024

jyao1 requested a review from steven-bellock April 25, 2024 01:47

xiaoyuruan reviewed Apr 26, 2024

View reviewed changes

Wenxing-hou force-pushed the add_DiceTcbInfo branch from 488a782 to 7ab3f43 Compare April 28, 2024 03:19

Wenxing-hou force-pushed the add_DiceTcbInfo branch 2 times, most recently from 89ce60a to 17ab69d Compare April 29, 2024 02:47

Wenxing-hou force-pushed the add_DiceTcbInfo branch 4 times, most recently from 9c56e14 to 642defe Compare April 30, 2024 06:07

Wenxing-hou force-pushed the add_DiceTcbInfo branch 3 times, most recently from 3b21c2f to c1c1faa Compare April 30, 2024 06:23

jyao1 approved these changes Apr 30, 2024

View reviewed changes

xiaoyuruan reviewed Apr 30, 2024

View reviewed changes

jyao1 reviewed May 1, 2024

View reviewed changes

Wenxing-hou force-pushed the add_DiceTcbInfo branch from c1c1faa to 234ecf4 Compare May 6, 2024 07:57

jyao1 reviewed May 7, 2024

View reviewed changes

Wenxing-hou force-pushed the add_DiceTcbInfo branch 2 times, most recently from 20640c8 to c9312da Compare May 9, 2024 02:21

Wenxing-hou force-pushed the add_DiceTcbInfo branch from c9312da to 7d13678 Compare May 10, 2024 01:44

Wenxing-hou force-pushed the add_DiceTcbInfo branch from 7d13678 to be35cca Compare May 13, 2024 03:27

This was referenced May 13, 2024

Need add test for that Integrator-provided verify cert callbacks are registered properly #2695

Open

Need add test for that libspdm properly calls and handles the verify cert callback functions #2696

Open

Wenxing-hou requested a review from jyao1 May 13, 2024 06:54

steven-bellock requested changes May 19, 2024

View reviewed changes

Wenxing-hou force-pushed the add_DiceTcbInfo branch from be35cca to f40a9d7 Compare May 20, 2024 05:08

Wenxing-hou requested a review from steven-bellock May 20, 2024 05:49

steven-bellock reviewed May 20, 2024

View reviewed changes

Add verify cert callback function for DiceTcbInfo.

e08a2d2

Refer the spec https://trustedcomputinggroup.org/resource/dice-attestation-architecture/ add verify cert callback function for Cert extentison DiceTcbInfo check. Signed-off-by: Wenxing Hou <[email protected]>

Wenxing-hou force-pushed the add_DiceTcbInfo branch from f40a9d7 to e08a2d2 Compare May 21, 2024 02:35

steven-bellock approved these changes May 21, 2024

View reviewed changes

jyao1 merged commit 5fb242b into DMTF:main May 21, 2024
97 checks passed

Wenxing-hou deleted the add_DiceTcbInfo branch June 25, 2024 03:09

	spdm_dice_tcb_info_size = 256;
	*spdm_get_dice_tcb_info_size = 0;
	result = libspdm_x509_get_extension_data(cert, cert_size,
	m_libspdm_tcg_dice_tcbinfo_oid,
	sizeof(m_libspdm_tcg_dice_tcbinfo_oid),
	spdm_dice_tcb_info, &spdm_dice_tcb_info_size);
	if (!result) {
	return false;
	} else if (spdm_dice_tcb_info_size == 0) {
	return true;
	}

	if (!result) {
	if (cert_dice_tcb_info_size == 0) {
	return false;
	}
	number_dice_tcb_info++;
	} else {
	if (cert_dice_tcb_info_size != 0) {
	cert_chain_have_matched_dice = true;
	number_dice_tcb_info++;
	}
	}

		@@ -0,0 +1,37 @@
		## This is reference implementation to verify CertChain DiceTcbInfo extension.

Add verify cert callback function for DiceTcbInfo #2672

Add verify cert callback function for DiceTcbInfo #2672

Conversation

Wenxing-hou commented Apr 24, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

xiaoyuruan Apr 26, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jyao1 commented Apr 29, 2024

xiaoyuruan commented Apr 29, 2024

steven-bellock commented Apr 29, 2024

jyao1 commented Apr 30, 2024 • edited Loading

Wenxing-hou commented Apr 30, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jyao1 May 7, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jyao1 commented May 10, 2024

steven-bellock commented May 10, 2024

Wenxing-hou commented May 10, 2024

Wenxing-hou commented May 10, 2024

PrithviAPai commented May 10, 2024

PrithviAPai commented May 10, 2024

steven-bellock commented May 10, 2024

Wenxing-hou commented May 11, 2024

Wenxing-hou commented May 11, 2024

Wenxing-hou commented May 11, 2024

steven-bellock commented May 11, 2024

jyao1 commented May 13, 2024 • edited Loading

Wenxing-hou commented May 13, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

xiaoyuruan Apr 26, 2024 •

edited

Loading

jyao1 commented Apr 30, 2024 •

edited

Loading

jyao1 May 7, 2024 •

edited

Loading

jyao1 commented May 13, 2024 •

edited

Loading

Wenxing-hou commented May 13, 2024 •

edited

Loading