Fix challenge generation#61
Merged
Merged
Conversation
… Apple SE - Add strongly-typed AttestationOptions with per-vendor options (IntelSgxOptions, AmdSevSnpOptions, AppleSeOptions including UseDeviceAttestation flag) - Add AttestationException hierarchy: NativeLibraryException, VendorApiException, CertificateValidationException; vendor error code maps (SgxErrorCodes, AmdSnpErrorCodes) - Add ISgxNativeInterop, IAmdSnpNativeInterop, IAppleAttestNativeInterop abstractions with platform-guarded production implementations; DllNotFoundException → NativeLibraryException - Add AppleAttestNativeInterop: DCAppAttestService shim bindings for macOS/iOS 14+ - Add InMemoryCertificateCache (ConcurrentDictionary + TTL) to prevent PCCS/VPS rate limiting - Rewrite SgxProvider and AmdSnpProvider: use injected interop interfaces + cert cache + typed options + domain exceptions mapped from vendor error codes - Rewrite AppleSeProvider: UseDeviceAttestation routes to native SE generation on Apple devices; server-side path forwards CBOR attestation objects to Apple verification endpoint with proper JSON payload (no more dummy data) - Rewrite TrustStore: X509ChainTrustMode.CustomRootTrust (no OS store); configurable RevocationMode; loads pinned roots from config files then embedded assembly resources; RegisterTestRoot internal helper for tests; InternalsVisibleTo test assembly - Rewrite GlobalAttestationService: proper cloud context → vendor mapping (Azure/Intel, AWS/Intel, Client/Apple); VendorPreference override; AWS Nitro endpoint for Intel/AWS - Add ServiceCollectionExtensions.AddAttestationServices for DI wiring - Add 27 new BDD failure-mode and edge-case scenarios across 5 feature files: SgxFailureModes, AmdSnpFailureModes, AppleAttestFailureModes, TrustStoreEdgeCases, GlobalServiceMapping; all 32 tests pass Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…al driver on Linux
- SecurityFrameworkAppleAttestInterop: calls Apple Security.framework directly via P/Invoke,
no native shim package required. Tries SE (kSecAttrTokenIDSecureEnclave) first, falls back
to software EC key. Uses NativeLibrary.GetExport to obtain proper kCFTypeDictionaryKeyCallBacks
pointer for correct CFDictionary construction. Produces {sigLen|DER-ECDSA-sig|X9.63-pubkey}
attestation object verifiable with .NET ECDsa.
- AppleSecurityNative.cs: CoreFoundation + Security.framework P/Invoke bindings, CFData/
CFString/CFNumber/CFDictionary helpers, CF description extraction for error diagnostics.
- ServiceCollectionExtensions: registers SecurityFrameworkAppleAttestInterop on macOS
(direct Security.framework), AppleAttestNativeInterop (shim) on other Apple platforms.
- AppleNativeAttestation.feature (3 scenarios, @Native @apple):
'Generate SE-backed key and verify attestation signature on macOS' — runs real native code,
produces real EC key, signs a challenge, verifies signature with .NET ECDsa. Skipped on
non-Apple platforms.
'Different challenges produce different signatures' — proves non-deterministic signing.
'PlatformNotSupportedException on non-Apple' — verifies platform guard.
- SgxNativeAttestation.feature + AmdSnpNativeAttestation.feature (2 scenarios each):
'Attempt real native call' — passes if PCK ID/ChipID obtained (SGX/AMD hardware present),
accepts NativeLibraryException (driver missing), or PlatformNotSupportedException (macOS).
'PlatformNotSupportedException on non-Linux' — verifies platform guard.
All 38 tests pass, 1 skipped (non-Apple scenario correctly skipped on macOS).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
… section 3.2)
Create OpenCertServer.Sgx.Native and OpenCertServer.Amd.Native NuGet packages
using the RID-based binary distribution pattern required by spec section 3.2.
Layout per spec:
runtimes/linux-x64/native/libsgx_dcap_ql.so (SGX)
runtimes/linux-arm64/native/libsgx_dcap_ql.so
runtimes/linux-x64/native/amd_snp_driver.so (AMD)
runtimes/linux-arm64/native/amd_snp_driver.so
The .so binaries are NOT committed (they are owned by Intel/AMD). Each package
ships a fetch-native-*.sh script that copies the installed system library from
the canonical apt-get install location into the correct runtimes/ directory
before dotnet pack is run on a Linux CI agent.
Wire-up:
- opencertserver.attestation.csproj references both native packages via
ProjectReference (ReferenceOutputAssembly=false) so MSBuild propagates
the runtimes/{rid}/native/*.so to the publish output automatically.
- Verified: dotnet publish -r linux-x64 correctly places both .so files at
publish/runtimes/linux-x64/native/ where .NET's DllImport probing finds them.
- Both native package projects added to opencertserver.slnx.
On a Linux box:
cd src/OpenCertServer.Sgx.Native && ./fetch-native-sgx.sh
cd src/OpenCertServer.Amd.Native && ./fetch-native-amd.sh
dotnet publish src/opencertserver.attestation -r linux-x64
# → native libraries are in publish/runtimes/linux-x64/native/
# → SgxNativeInterop and AmdSnpNativeInterop load them via [LibraryImport]
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…nterop on macOS When UseDeviceAttestation=true (macOS/iOS), the test was injecting an NSubstitute mock that returns null for GenerateKeyAsync() and AttestKeyAsync(), producing an empty attestation object. Fix: platform-branch in WhenSentToTheOpenCertServerForVerification: - macOS/iOS → SecurityFrameworkAppleAttestInterop (real Security.framework calls, SE-backed or software EC key + ECDSA signing via native P/Invoke) - Other platforms → MockAppleAttestNativeInterop with UseDeviceAttestation=false, exercises the HTTP server-side verification path with a mocked Apple endpoint The Then assertion validates a non-empty result in both cases. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
… platforms Mirrors the Apple pattern: platform-branch in Given step. Linux path (real hardware): - SgxAttestationSteps → SgxNativeInterop (calls libsgx_dcap_ql) - AmdSnpAttestationSteps → AmdSnpNativeInterop (calls amd_snp_driver) Then step calls the full pipeline: GetDeviceIdAsync → RetrieveDeviceCertificateAsync (HTTP mocked) → GenerateAndSignQuoteAsync. NativeLibraryException and AttestationException are caught gracefully when running on Linux without the hardware/driver present (CI without SGX/AMD hardware). Non-Linux path (mock): - MockSgxNativeInterop with realistic PckIdBytes (16-byte ID) and QuoteBytes (256b) - MockAmdSnpNativeInterop with realistic ChipIdBytes (48-byte ID) and ReportBytes (1184b) Both paths exercise the full provider pipeline (cache, HTTP cert fetch, quote). HTTP is always mocked (PCCS/VPS are external cloud services). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR aims to fix/extend device-attest-01 ACME challenge generation and introduce a new hardware attestation subsystem (Intel SGX, AMD SEV-SNP, Apple App Attest/SE) with supporting tests and native-library packaging projects.
Changes:
- Ensure
device-attest-01is included in supported challenge types and is created for new ACME authorizations. - Add a new
opencertserver.attestationproject (providers, native interop abstractions, trust store, DI wiring) plus a new BDD-style test project. - Broadly refactor many files’
usingdirectives (notably shortening namespaces), plus a few minor code cleanups in TPM/CertesSlim areas.
Reviewed changes
Copilot reviewed 157 out of 176 changed files in this pull request and generated 16 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/opencertserver.mcp.tests/TestSharedState.cs | Adjusts MCP test imports (currently shortened namespaces). |
| tests/opencertserver.mcp.tests/Support/McpServerFixture.cs | MCP server fixture imports + chain validator signature cleanup (currently shortened namespaces). |
| tests/opencertserver.mcp.tests/StepDefinitions/ParameterHandlingSteps.cs | Step definition import changes (currently shortened namespaces). |
| tests/opencertserver.mcp.tests/StepDefinitions/McpServerCertificateQuerySteps.cs | Minor crypto type-name simplification in tests. |
| tests/opencertserver.mcp.tests/StepDefinitions/CommonToolsSteps.cs | Step definition import changes (currently shortened namespaces). |
| tests/opencertserver.est.server.tests/TestCsrAttributesLoader.cs | EST test loader import change (currently shortened namespaces). |
| tests/opencertserver.est.server.tests/Steps/EstServer.cs | EST server test wiring import changes (currently shortened namespaces). |
| tests/opencertserver.est.server.tests/Configuration/ConfigureCertificateAuthenticationOptions.cs | Import change for CA utils (currently shortened namespaces). |
| tests/opencertserver.cli.tests/StepDefinitions/OpenCertServerCliStepDefinitions.cs | Simplifies SemaphoreSlim reference. |
| tests/opencertserver.certserver.tests/StepDefinitions/TestManualAuthorizationStrategy.cs | Import change for EST handlers (currently shortened namespaces). |
| tests/opencertserver.certserver.tests/StepDefinitions/TestCsrAttributesLoader.cs | Import changes for CA/EST templates/handlers (currently shortened namespaces). |
| tests/opencertserver.certserver.tests/StepDefinitions/TestAcmeIssuer.cs | Import changes for ACME abstractions and CertServer (currently shortened namespaces). |
| tests/opencertserver.certserver.tests/StepDefinitions/TestAcmeHttp01ChallengeValidator.cs | Import changes for ACME services/models (currently shortened namespaces). |
| tests/opencertserver.certserver.tests/StepDefinitions/TestAcmeDns01ChallengeValidator.cs | Import changes for ACME services/models (currently shortened namespaces). |
| tests/opencertserver.certserver.tests/StepDefinitions/TestAcmeDeviceAttestChallengeValidator.cs | Import changes for ACME services/models (currently shortened namespaces). |
| tests/opencertserver.certserver.tests/StepDefinitions/OpenTelemetryMetrics.cs | Import change for OCSP utils (currently shortened namespaces). |
| tests/opencertserver.certserver.tests/StepDefinitions/OcspConformance.cs | Import changes for CA/OCSP/X509 utils (currently shortened namespaces). |
| tests/opencertserver.certserver.tests/StepDefinitions/EstEnrollment.cs | Import change for EST client (currently shortened namespaces). |
| tests/opencertserver.certserver.tests/StepDefinitions/EstConformance.cs | Import changes + simplifies ASN.1 reader type usage. |
| tests/opencertserver.certserver.tests/StepDefinitions/DeviceAttestCoreSteps.cs | New steps validating ChallengeTypes.AllTypes and authorization challenge creation. |
| tests/opencertserver.certserver.tests/StepDefinitions/CrlConformance.cs | Import changes for CA utils/extensions (currently shortened namespaces). |
| tests/opencertserver.certserver.tests/StepDefinitions/CertificateServerFeatures.cs | Import changes + updates manual auth strategy replacement type reference. |
| tests/opencertserver.certserver.tests/Features/device-attest-core.feature | New BDD feature for device-attest-01 type + challenge creation. |
| tests/opencertserver.ca.tests/X509/X509NameTests.cs | Import shortened to Utils (currently shortened namespaces). |
| tests/opencertserver.ca.tests/X509/RelativeDistinguishedNameTests.cs | Import shortened to Utils (currently shortened namespaces). |
| tests/opencertserver.ca.tests/X509/DistributionPointNameTests.cs | Import shortened to Utils (currently shortened namespaces). |
| tests/opencertserver.ca.tests/X509/CertificateSigningRequestTemplateTests.cs | Import shortened to Utils (currently shortened namespaces). |
| tests/opencertserver.ca.tests/SignedDataTests.cs | Import shortened to Utils.Pkcs7 (currently shortened namespaces). |
| tests/opencertserver.ca.tests/Ocsp/OcspResponseTests.cs | Import shortened to Utils (currently shortened namespaces). |
| tests/opencertserver.ca.tests/Ocsp/OcspRequestTests.cs | Import shortened to Utils (currently shortened namespaces). |
| tests/opencertserver.attestation.Tests/StepDefinitions/TrustStoreSteps.cs | New steps testing TrustStore behavior. |
| tests/opencertserver.attestation.Tests/StepDefinitions/TrustStoreEdgeCaseSteps.cs | New TrustStore edge-case steps. |
| tests/opencertserver.attestation.Tests/StepDefinitions/SgxNativeAttestationSteps.cs | New “native SGX interop attempted” steps. |
| tests/opencertserver.attestation.Tests/StepDefinitions/SgxFailureModeSteps.cs | New SGX provider failure-mode steps. |
| tests/opencertserver.attestation.Tests/StepDefinitions/SgxAttestationSteps.cs | New end-to-end-ish SGX provider steps (mocking external gateway). |
| tests/opencertserver.attestation.Tests/StepDefinitions/GlobalServiceMappingSteps.cs | New tests for GlobalAttestationService provider/endpoint mapping. |
| tests/opencertserver.attestation.Tests/StepDefinitions/ConfigSteps.cs | New config-driven endpoint selection steps. |
| tests/opencertserver.attestation.Tests/StepDefinitions/AppleSeAttestationSteps.cs | New Apple provider verification steps (device-vs-server mode). |
| tests/opencertserver.attestation.Tests/StepDefinitions/AppleNativeAttestationSteps.cs | New macOS/iOS-native Security.framework interop steps. |
| tests/opencertserver.attestation.Tests/StepDefinitions/AppleAttestFailureModeSteps.cs | New Apple provider failure-mode steps. |
| tests/opencertserver.attestation.Tests/StepDefinitions/AmdSnpNativeAttestationSteps.cs | New AMD native interop attempted steps. |
| tests/opencertserver.attestation.Tests/StepDefinitions/AmdSnpFailureModeSteps.cs | New AMD provider failure-mode steps. |
| tests/opencertserver.attestation.Tests/StepDefinitions/AmdSnpAttestationSteps.cs | New end-to-end-ish AMD provider steps (mocking external gateway). |
| tests/opencertserver.attestation.Tests/README.md | New attestation test project README. |
| tests/opencertserver.attestation.Tests/opencertserver.attestation.Tests.csproj | New test project definition. |
| tests/opencertserver.attestation.Tests/Mocks/MockSgxNativeInterop.cs | New SGX native interop mocks. |
| tests/opencertserver.attestation.Tests/Mocks/MockProvider.cs | New generic provider + HTTP handler + cert factory helpers. |
| tests/opencertserver.attestation.Tests/Mocks/MockAppleAttestNativeInterop.cs | New Apple native interop mocks. |
| tests/opencertserver.attestation.Tests/Mocks/MockAmdSnpNativeInterop.cs | New AMD native interop mocks. |
| tests/opencertserver.attestation.Tests/Features/TrustStoreEdgeCases.feature | New TrustStore edge-cases feature. |
| tests/opencertserver.attestation.Tests/Features/TrustStore.feature.cs | New generated feature binding code. |
| tests/opencertserver.attestation.Tests/Features/TrustStore.feature | New TrustStore feature. |
| tests/opencertserver.attestation.Tests/Features/SgxNativeAttestation.feature | New SGX native feature. |
| tests/opencertserver.attestation.Tests/Features/SgxFailureModes.feature | New SGX failure-modes feature. |
| tests/opencertserver.attestation.Tests/Features/SgxAttestation.feature.cs | New generated SGX feature binding code. |
| tests/opencertserver.attestation.Tests/Features/SgxAttestation.feature | New SGX attestation feature. |
| tests/opencertserver.attestation.Tests/Features/GlobalServiceMapping.feature | New mapping feature. |
| tests/opencertserver.attestation.Tests/Features/Config.feature.cs | New generated config feature binding code. |
| tests/opencertserver.attestation.Tests/Features/Config.feature | New config feature. |
| tests/opencertserver.attestation.Tests/Features/AppleSeAttestation.feature.cs | New generated Apple SE feature binding code. |
| tests/opencertserver.attestation.Tests/Features/AppleSeAttestation.feature | New Apple SE feature. |
| tests/opencertserver.attestation.Tests/Features/AppleNativeAttestation.feature | New Apple native feature. |
| tests/opencertserver.attestation.Tests/Features/AppleAttestFailureModes.feature | New Apple failure-modes feature. |
| tests/opencertserver.attestation.Tests/Features/AppleAttestationValidation.feature | New Apple validation feature (feature file only). |
| tests/opencertserver.attestation.Tests/Features/AmdSnpNativeAttestation.feature | New AMD native feature. |
| tests/opencertserver.attestation.Tests/Features/AmdSnpFailureModes.feature | New AMD failure-modes feature. |
| tests/opencertserver.attestation.Tests/Features/AmdSnpAttestation.feature.cs | New generated AMD feature binding code. |
| tests/opencertserver.attestation.Tests/Features/AmdSnpAttestation.feature | New AMD attestation feature. |
| tests/CertesSlim.tests/IOrderContextExtensionsTests.cs | Simplifies Uri construction syntax. |
| src/opencertserver.tpm/TpmRsa.cs | Simplifies Stream/RSA factory references. |
| src/opencertserver.tpm/TpmEcDsa.cs | Simplifies Stream/ECDsa factory references. |
| src/opencertserver.tpm/TpmCaExtensions.cs | Import changes for CA services (currently shortened namespaces). |
| src/opencertserver.tpm/TpmCaCertificateStore.cs | Simplifies StoreName type reference. |
| src/OpenCertServer.Sgx.Native/runtimes/linux-x64/native/.gitkeep | Adds runtime-native folder placeholder. |
| src/OpenCertServer.Sgx.Native/runtimes/linux-arm64/native/.gitkeep | Adds runtime-native folder placeholder. |
| src/OpenCertServer.Sgx.Native/OpenCertServer.Sgx.Native.csproj | New RID-native packaging project for SGX DCAP lib. |
| src/OpenCertServer.Sgx.Native/fetch-native-sgx.sh | New script to populate SGX native asset prior to pack. |
| src/opencertserver.mcp/Tools/CheckOcspStatusTool.cs | Import change for X509 utils (currently shortened namespaces). |
| src/opencertserver.mcp/RegisterTools.cs | Import change for MCP Tools (currently shortened namespaces). |
| src/opencertserver.mcp/Program.cs | Import changes for CA/CA.Server (currently shortened namespaces). |
| src/opencertserver.mcp/McpServer.cs | Import change for Transport (currently shortened namespaces). |
| src/opencertserver.est.server/Handlers/SimpleReEnrollHandler.cs | Import changes for PKCS7/X509 extensions (currently shortened namespaces). |
| src/opencertserver.est.server/Handlers/SimpleEnrollHandler.cs | Import changes for utils/PKCS7/X509 extensions (currently shortened namespaces). |
| src/opencertserver.est.server/Handlers/ServerKeyGenHandler.cs | Import changes for utils/PKCS7/Response (currently shortened namespaces). |
| src/opencertserver.est.server/Handlers/CaCertHandler.cs | Import changes for utils/PKCS7/Server (currently shortened namespaces). |
| src/opencertserver.est.client/EstClient.cs | Import changes for utils/PKCS7/templates/extensions (currently shortened namespaces). |
| src/opencertserver.certserver/Program.cs | Import changes for ACME/CA server (currently shortened namespaces). |
| src/opencertserver.certserver/DefaultIssuer.cs | Import changes for X509Extensions (currently shortened namespaces). |
| src/opencertserver.certserver/DefaultCsrValidator.cs | Import changes for utils (currently shortened namespaces). |
| src/opencertserver.ca/CertificateAuthority.cs | Import changes for CA utils/x509 extensions (currently shortened namespaces). |
| src/opencertserver.ca.utils/X509Extensions/X509IssuerAltNameExtension.cs | Import shortened to Utils (currently shortened namespaces). |
| src/opencertserver.ca.utils/X509Extensions/X509CertificatesExtensions.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/X509Extensions/CertificateExtension.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/RevokedCertificate.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/RDNSequenceTemplate.cs | Imports shortened to X509* (currently shortened namespaces). |
| src/opencertserver.ca.utils/Pkcs7/SignerInfo.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/Pkcs7/SignedData.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/Pkcs7/IssuerAndSerialNumber.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/Pkcs7/DigestAlgorithmIdentifier.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/Pkcs7/CmsContentInfo.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/Ocsp/TbsRequest.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/Ocsp/SingleResponse.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/Ocsp/Signature.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/Ocsp/RevokedInfo.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/Ocsp/ResponseData.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/Ocsp/ResponseBytes.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/Ocsp/ResponderIdByName.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/Ocsp/Request.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/Ocsp/OcspResponse.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/Ocsp/OCSPRequest.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/Ocsp/OcspBasicResponse.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/Ocsp/CertId.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/NameTemplate.cs | Import shortened to X509 (currently shortened namespaces). |
| src/opencertserver.ca.utils/EncodingExtensions.cs | Imports shortened to X509* (currently shortened namespaces). |
| src/opencertserver.ca.utils/CertificateRevocationList.cs | Import shortened to X509Extensions (currently shortened namespaces). |
| src/opencertserver.ca.utils/Ca/IStoreCertificates.cs | Import shortened to Ocsp (currently shortened namespaces). |
| src/opencertserver.ca.utils/Ca/InMemoryCertificateStore.cs | Import shortened to Ocsp (currently shortened namespaces). |
| src/opencertserver.ca.server/OcspRequestSignatureValidator.cs | Import shortened to Utils.Ocsp (currently shortened namespaces). |
| src/opencertserver.ca.server/Handlers/RevocationHandler.cs | Import shortened to Utils (currently shortened namespaces). |
| src/opencertserver.ca.server/Handlers/OcspHandler.cs | Imports shortened to Utils* (currently shortened namespaces). |
| src/opencertserver.ca.server/Handlers/CsrHandler.cs | Import shortened to Utils.X509Extensions (currently shortened namespaces). |
| src/opencertserver.ca.server/Extensions.cs | Import shortened to Utils.Ocsp (currently shortened namespaces). |
| src/opencertserver.attestation/TrustStore.cs | New trust store for pinned vendor roots + chain validation. |
| src/opencertserver.attestation/SgxProvider.cs | New SGX provider (native PCK ID + PCCS fetch + quote). |
| src/opencertserver.attestation/ServiceCollectionExtensions.cs | New DI registration entrypoint for attestation services/options. |
| src/opencertserver.attestation/README.md | New attestation module README. |
| src/opencertserver.attestation/opencertserver.attestation.csproj | New attestation project definition + native package references. |
| src/opencertserver.attestation/Native/SgxNativeInterop.cs | New production SGX native interop wrapper. |
| src/opencertserver.attestation/Native/ISgxNativeInterop.cs | New SGX interop abstraction. |
| src/opencertserver.attestation/Native/IntelSgxNative.cs | New SGX P/Invoke bindings via LibraryImport. |
| src/opencertserver.attestation/Native/IAppleAttestNativeInterop.cs | New Apple interop abstraction. |
| src/opencertserver.attestation/Native/IAmdSnpNativeInterop.cs | New AMD interop abstraction. |
| src/opencertserver.attestation/Native/AppleSecurityNative.cs | New Security.framework/CoreFoundation bindings + helpers. |
| src/opencertserver.attestation/Native/AppleAttestNativeInterop.cs | New shim-based Apple interop implementation. |
| src/opencertserver.attestation/Native/AmdSnpNativeInterop.cs | New production AMD interop wrapper. |
| src/opencertserver.attestation/Native/AmdSnpNative.cs | New AMD P/Invoke bindings via LibraryImport. |
| src/opencertserver.attestation/IAttestationProvider.cs | New provider contract. |
| src/opencertserver.attestation/GlobalAttestationService.cs | New provider selection + endpoint mapping logic. |
| src/opencertserver.attestation/CertificateCache.cs | New in-memory certificate cache abstraction/impl. |
| src/opencertserver.attestation/AttestationOptions.cs | New options model for global + per-vendor settings. |
| src/opencertserver.attestation/AttestationException.cs | New exception types + SGX/AMD error code mappings. |
| src/opencertserver.attestation/AppleSeProvider.cs | New Apple provider (device mode + server verification mode). |
| src/opencertserver.attestation/AmdSnpProvider.cs | New AMD provider (native chip id + VPS fetch + report). |
| src/OpenCertServer.Amd.Native/runtimes/linux-x64/native/.gitkeep | Adds runtime-native folder placeholder. |
| src/OpenCertServer.Amd.Native/runtimes/linux-arm64/native/.gitkeep | Adds runtime-native folder placeholder. |
| src/OpenCertServer.Amd.Native/OpenCertServer.Amd.Native.csproj | New RID-native packaging project for AMD SNP driver lib. |
| src/OpenCertServer.Amd.Native/fetch-native-amd.sh | New script to populate AMD native asset prior to pack. |
| src/opencertserver.acme.server/Services/Http01ChallengeValidator.cs | Minor status code reference simplification. |
| src/opencertserver.acme.server/Services/DeviceAttestChallengeValidator.cs | Adds nonce TTL pruning via Timer + IDisposable. |
| src/opencertserver.acme.server/Services/DefaultRevocationService.cs | Import changes (currently shortened namespaces). |
| src/opencertserver.acme.server/Services/DefaultAuthorizationFactory.cs | Adds creation of device-attest-01 challenge for each authorization. |
| src/opencertserver.acme.server/Filters/ValidateAcmeRequestFilter.cs | Import change (currently shortened namespaces). |
| src/opencertserver.acme.server/Extensions/ServiceCollectionExtensions.cs | Registers device-attest trust provider + validator; minor cleanup. |
| src/opencertserver.acme.server/Endpoints/RevocationEndpoints.cs | Import changes (currently shortened namespaces). |
| src/opencertserver.acme.server/Endpoints/OrderEndpoints.cs | Import changes + minor InvalidOperationException simplification. |
| src/opencertserver.acme.server/Endpoints/DirectoryEndpoints.cs | Uses ChallengeTypes.AllTypes for directory metadata list. |
| src/opencertserver.acme.server/Endpoints/AccountEndpoints.cs | Import changes + service type reference simplification. |
| src/CertesSlim/Extensions/IAcmeContextExtensions.cs | Import shortened to Acme (currently shortened namespaces). |
| src/CertesSlim/Extensions/IAccountContextExtensions.cs | Import shortened to Acme* (currently shortened namespaces). |
| src/CertesSlim/AcmeContext.cs | Import shortened to Acme* (currently shortened namespaces). |
| opencertserver.slnx | Adds new attestation/native projects to solution listing. |
| opencertserver.sln.DotSettings | Adds dictionary words (currently malformed XML). |
| Directory.Packages.props | Bumps/adds a few package versions (Extensions.Configuration/Http, Moq, etc.). |
Files not reviewed (15)
- tests/opencertserver.attestation.Tests/Features/AmdSnpAttestation.feature.cs: Generated file
- tests/opencertserver.attestation.Tests/Features/AmdSnpFailureModes.feature.cs: Generated file
- tests/opencertserver.attestation.Tests/Features/AmdSnpNativeAttestation.feature.cs: Generated file
- tests/opencertserver.attestation.Tests/Features/AppleAttestFailureModes.feature.cs: Generated file
- tests/opencertserver.attestation.Tests/Features/AppleAttestationValidation.feature.cs: Generated file
- tests/opencertserver.attestation.Tests/Features/AppleNativeAttestation.feature.cs: Generated file
- tests/opencertserver.attestation.Tests/Features/AppleSeAttestation.feature.cs: Generated file
- tests/opencertserver.attestation.Tests/Features/Config.feature.cs: Generated file
- tests/opencertserver.attestation.Tests/Features/GlobalServiceMapping.feature.cs: Generated file
- tests/opencertserver.attestation.Tests/Features/SgxAttestation.feature.cs: Generated file
- tests/opencertserver.attestation.Tests/Features/SgxFailureModes.feature.cs: Generated file
- tests/opencertserver.attestation.Tests/Features/SgxNativeAttestation.feature.cs: Generated file
- tests/opencertserver.attestation.Tests/Features/TrustStore.feature.cs: Generated file
- tests/opencertserver.attestation.Tests/Features/TrustStoreEdgeCases.feature.cs: Generated file
- tests/opencertserver.certserver.tests/Features/device-attest-core.feature.cs: Generated file
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Apply fixes to how device-attest-01 challenges are created.