Initial commit #1

alicefr · 2025-08-28T14:59:58Z

Create first version of the pin.
The test.sh script tries to encrypt and unlock a device and can be used for some manual testing.
In order to perform the encryption, you need to have trustee running and set its url in the data.json. Additionally, you also need to upload the secret, and you can use the test-secret-trustee as example.
I have uploaded the secret using the kbs-client from trustee:

$ target/debug/kbs-client --url http://localhost:8080  config --auth-private-key kbs/config/private.key  set-resource --path conf-cluster/root/machine --resource-file test-secret-trustee

Clevis expect to have the encrypt and decrypt scripts, so I have created those scripts in my local enviroment:

cat /usr/local/sbin/clevis-encrypt-trustee
#!/bin/bash

/home/afrosi/src/clevis-pin-trustee/target/debug/clevis-pin-trustee encrypt "$@"

and

cat /usr/local/sbin/clevis-decrypt-trustee
#!/bin/bash

/home/afrosi/src/clevis-pin-trustee/target/debug/clevis-pin-trustee decrypt "$@"

Clevis looks for the scripts automatically based on the name of the pin

alicefr · 2025-08-28T15:11:17Z

src/main.rs

+    resource_tag: &str,
+) -> Result<String> {
+    //let output = StdCommand::new("trustee-attester")
+    let output = StdCommand::new("/home/afrosi/src/trustee/target/debug/kbs-client")


need to fix this

travier

Not tested but looking good. Comments can be addressed as a follow up PR as well. Let's not forget to add a LICENSE to this repo immediately as well.

data.json

travier · 2025-08-28T15:11:32Z

data.json

+	"resource_repository": "conf-cluster",
+	"resource_type": "root"


We can probably have only one "path" variable here and have the logic of figuring out what is in there be in another tool.

I split it because of the tag/id, this needs to be part of the path as well, so would you prefer to have a partial path here?

src/main.rs

travier · 2025-08-28T15:16:25Z

src/main.rs

+}
+
+fn main() -> Result<()> {
+    let matches = Command::new("clevis-pin-trustee")


You can use the derive pattern with structures to make this easier to read. See https://github.com/confidential-clusters/compute-pcrs/blob/main/cli/src/main.rs#L10 for an example.

src/main.rs

sarroutbi

In general, changes LGTM. The only comment is that the logic for fetching the key, decoding it, and creating a Jwk is nearly identical in both the encrypt and decrypt functions.

You might create a helper function to handle this logic

Containerize the build of the pin. Signed-off-by: Alice Frosi <[email protected]>

alicefr · 2025-09-03T07:29:38Z

@travier @uril as far as I understand we need to pass to the trustee-agent the certificate for the trustee sever, am I right? If so, don't we need here an array of certificates like for the urls? If so, then I would merge the urls together with the certificate for the pin configuration. Like:

{
  "servers": [
      {
         "url": "http://trustee1:8080",
          "cert": "",
      },
      {
         "url": "http://trustee2:8080",
          "cert": "",
      },   
  ],
  "resource_path": "conf-cluster/<id>/root",
}

alicefr · 2025-09-03T07:31:18Z

The pin configuration depends on the discussion in coreos/ignition#2099

uril · 2025-09-03T16:12:07Z

@alicefr Yes, we do want a list of (KBSURL, https-certificate).

uril · 2025-09-03T19:56:01Z

Nice ! I added some minor comments.

src/main.rs

test.sh

Cargo.toml

Signed-off-by: Alice Frosi <[email protected]>

travier

Looking good. Some nits but we can also fix them later

travier · 2025-09-12T13:38:38Z

Containerfile

@@ -0,0 +1,10 @@
+FROM docker.io/library/rust:trixie as build


Let's use a Fedora image here to do the build. We can do what we did in compure-pcrs.

travier · 2025-09-12T13:38:47Z

clevis-decrypt-trustee

@@ -0,0 +1,3 @@
+#!/bin/bash


Hum, why do we need that? Let's place the binaries in the right place directly?

data.json

travier · 2025-09-12T13:40:22Z

src/main.rs

+    const MAX_ATTEMPTS: u32 = 3;
+    const DELAY: Duration = Duration::from_secs(5);


This is fine for now but we'll need to make this either bigger or configurable.

Cargo.toml

travier · 2025-09-12T13:43:09Z

We can import CI from https://github.com/confidential-clusters/compute-pcrs/blob/main/.github/workflows/rust.yml and https://github.com/confidential-clusters/compute-pcrs/blob/main/.github/workflows/buildroot.yml

travier

Let's start with that and we'll iterate

alicefr commented Aug 28, 2025

View reviewed changes

travier reviewed Aug 28, 2025

View reviewed changes

src/main.rs Show resolved Hide resolved

sarroutbi reviewed Aug 29, 2025

View reviewed changes

alicefr force-pushed the initial-commit branch from f14f8cc to 121a2c6 Compare August 29, 2025 14:37

Initial commit

0dd1152

alicefr force-pushed the initial-commit branch from 121a2c6 to 0dd1152 Compare August 29, 2025 14:57

alicefr mentioned this pull request Aug 29, 2025

Investigate clevis pins for attestation and the disk encryption trusted-execution-clusters/investigations#13

Open

Build pin in a container

df53e98

Containerize the build of the pin. Signed-off-by: Alice Frosi <[email protected]>

uril reviewed Sep 3, 2025

View reviewed changes

src/main.rs Outdated Show resolved Hide resolved

src/main.rs Outdated Show resolved Hide resolved

test.sh Show resolved Hide resolved

alicefr force-pushed the initial-commit branch 2 times, most recently from 53671e6 to 5f76990 Compare September 9, 2025 13:40

travier reviewed Sep 12, 2025

View reviewed changes

Cargo.toml Outdated Show resolved Hide resolved

travier reviewed Sep 12, 2025

View reviewed changes

Cargo.toml Outdated Show resolved Hide resolved

Add encrypt/decrypt wrapping scripts

49591e2

Signed-off-by: Alice Frosi <[email protected]>

alicefr force-pushed the initial-commit branch from 5f76990 to 49591e2 Compare September 12, 2025 13:28

travier approved these changes Sep 12, 2025

View reviewed changes

travier added 5 commits September 16, 2025 15:13

data.json: Cleanup indentation

3763094

Licenses: Clarify licenses used by the project

02633e7

src: cargo fmt

996d224

src: Fix clippy lints

45f83e1

github/workflows: Add basic CI workflows

4cee730

travier approved these changes Sep 16, 2025

View reviewed changes

travier merged commit 23a7988 into latchset:main Sep 16, 2025

		"resource_repository": "conf-cluster",
		"resource_type": "root"

		const MAX_ATTEMPTS: u32 = 3;
		const DELAY: Duration = Duration::from_secs(5);

Initial commit #1

Initial commit #1

Uh oh!

Conversation

alicefr commented Aug 28, 2025 • edited by travier Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alicefr Aug 28, 2025

Choose a reason for hiding this comment

Uh oh!

travier left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

travier Aug 28, 2025

Choose a reason for hiding this comment

Uh oh!

alicefr Aug 29, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

travier Aug 28, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sarroutbi left a comment

Choose a reason for hiding this comment

Uh oh!

alicefr commented Sep 3, 2025

Uh oh!

alicefr commented Sep 3, 2025

Uh oh!

uril commented Sep 3, 2025

Uh oh!

uril commented Sep 3, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

travier left a comment

Choose a reason for hiding this comment

Uh oh!

travier Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

travier Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

travier Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

travier commented Sep 12, 2025

Uh oh!

travier left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

alicefr commented Aug 28, 2025 •

edited by travier

Loading