Enhance cocli corim command to skip over ASN header bytes

[lordaule]

Several vendors are distributing CoRIM manifest files which have ASN header bytes:

00000000  d9 01 f4 d9 01 f6 d2 84  58 29 a3 01 38 22 03 74  |........X)..8".t|
00000010  61 70 70 6c 69 63 61 74  69 6f 6e 2f 72 69 6d 2b  |application/rim+|
00000020  63 62 6f 72 08 4d a1 00  a1 00 68 53 6f 6c 69 64  |cbor.M....hSolid|

When feeding these files into cocli corim, an error is printed:

% cocli corim display -f PS10xx-G75YG100-E3S-16TB.cbor
Error: error decoding signed CoRIM from PS10xx-G75YG100-E3S-16TB.cbor: failed CBOR decoding for COSE-Sign1 signed CoRIM: cbor: invalid COSE_Sign1_Tagged object

This requires applications to manually strip the first 6 bytes before feeding the file into cocli.

Enhancement request: automatically skip and discard the first 6 bytes if the ASN pattern d9 01 f4 d9 01 f6 is detected.

[thomas-fossati]

Hi @lordaule, could you please check whether veraison/corim#133 fixes your concern?

cc @deeglaze

[lordaule]

% go install github.com/veraison/cocli@latest
go: downloading github.com/veraison/cocli v0.0.0-20241224033329-0d8fae8210ae

% cocli corim display -f PS10xx-G75YG100-E3S-16TB.cbor
Error: error decoding CoRIM (signed or unsigned) from PS10xx-G75YG100-E3S-16TB.cbor: expected map (CBOR Major Type 5), found Major Type 6

Looks like the error message slightly changed but it still doesn't work. If I manually strip off the first 6 bytes it works.

[thomas-fossati]

To test with the latest corim package you'll need to do something like:

• get latest sources:

git checkout main
git pull

• update veraison/corim dep:

go get github.com/veraison/corim@b690f86125b4c27c8c8451f8e8f2ea64db5ff2c2
go mod tidy

• make sure nothing is broken:

make test

• build the new cocli(1) and test it against your test vector:

go build -o cocli
./cocli corim display -f PS10xx-G75YG100-E3S-16TB.cbor

[lordaule]

I have been unsuccessful in building my own version, so instead I'm going to point at a failing file:
https://www.solidigm.com/support-page/drivers-downloads/ka-01851.html
There's a comment on that page:

Note that the leading IANA global contents tags (i.e., CoRIM and signed-CoRIM tags) must be removed prior to manipulating CoRIMs files with Veraison/Cocli.

It looks like there's code in corim/corim/signedcorim.go to remove the tags:

	// If a tagged-corim-type-choice #6.500 of tagged-signed-corim #6.502, strip the prefix.
	// This is a remnant of an older draft of the specification before
	// https://github.com/ietf-rats-wg/draft-ietf-rats-corim/pull/337
	corimTypeChoice := []byte("\xd9\x01\xf4\xd9\x01\xf6")
	buf, _ = bytes.CutPrefix(buf, corimTypeChoice)

It appears that either go install github.com/veraison/cocli@latest is not including that fix, or that code isn't actually working.

[kallal79]

Hi @thomas-fossati @lordaule

I’d like to request assignment to this issue. I’ve reviewed the CBOR decoding failure and the handling logic in signedcorim.go, and I’m confident I can help ensure robust detection and stripping of the ASN header bytes.

Please assign me so I can begin contributing a fix. Happy to align with any test vectors or validation steps you’d like covered.

Thanks!