Skip to content

Fix TrustedServices empty reference ID handling and integration test base64 encoding #343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kallal79 wants to merge 3 commits into from
+12 −2
Closed

Fix TrustedServices empty reference ID handling and integration test base64 encoding #343

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
777571e
Fix integration tests: Convert URL-safe base64 nonces to standard bas…
kallal79 Sep 23, 2025
2f48d8c
fix: skip empty reference value IDs in TrustedServices.GetAttestation
kallal79 Sep 23, 2025
ac343f6
fix: Filter empty reference IDs at source instead of in loop
kallal79 Oct 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion integration-tests/utils/generators.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,9 +128,11 @@ def generate_evidence(scheme, evidence, nonce, signing, outname):

if scheme == 'psa' and nonce:
claims_file = f'{GENDIR}/claims/{scheme}.{evidence}.json'
# convert nonce from base64url to base64
translated_nonce = nonce.replace('-', '+').replace('_', '/')
update_json(
f'data/claims/{scheme}.{evidence}.json',
{f'{scheme}-nonce': nonce},
{f'{scheme}-nonce': translated_nonce},
claims_file,
)
elif scheme == 'cca' and nonce:
Expand Down
10 changes: 9 additions & 1 deletion vts/trustedservices/trustedservices_grpc.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -428,13 +428,21 @@ func (o *GRPC) GetAttestation(
return o.finalize(appraisal, err)
}

// Filter out empty reference IDs (can occur when no software components are provisioned)
filteredReferenceIDs := make([]string, 0, len(referenceIDs))
Copy link
Collaborator

@setrofim setrofim Oct 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This filtering shoudn't be necessary.

Copy link
Author

@kallal79 kallal79 Oct 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fix

for _, refID := range referenceIDs {
if refID != "" {
filteredReferenceIDs = append(filteredReferenceIDs, refID)
}
}

appraisal.EvidenceContext.Evidence, err = structpb.NewStruct(claims)
if err != nil {
err = fmt.Errorf("unserializable claims in result: %w", err)
return o.finalize(appraisal, err)
}

appraisal.EvidenceContext.ReferenceIds = referenceIDs
appraisal.EvidenceContext.ReferenceIds = filteredReferenceIDs

o.logger.Debugw("constructed evidence context",
"software-id", appraisal.EvidenceContext.ReferenceIds,
Expand Down