Skip to content

Fix challenge generation#61

Merged
jjrdk merged 14 commits into
masterfrom
features/device-attest-01
Jul 9, 2026
Merged

Fix challenge generation#61
jjrdk merged 14 commits into
masterfrom
features/device-attest-01

Conversation

@jjrdk

@jjrdk jjrdk commented Jul 6, 2026

Copy link
Copy Markdown
Owner

Apply fixes to how device-attest-01 challenges are created.

@jjrdk jjrdk self-assigned this Jul 6, 2026
jjrdk and others added 9 commits July 7, 2026 18:25
… Apple SE

- Add strongly-typed AttestationOptions with per-vendor options (IntelSgxOptions,
  AmdSevSnpOptions, AppleSeOptions including UseDeviceAttestation flag)
- Add AttestationException hierarchy: NativeLibraryException, VendorApiException,
  CertificateValidationException; vendor error code maps (SgxErrorCodes, AmdSnpErrorCodes)
- Add ISgxNativeInterop, IAmdSnpNativeInterop, IAppleAttestNativeInterop abstractions
  with platform-guarded production implementations; DllNotFoundException → NativeLibraryException
- Add AppleAttestNativeInterop: DCAppAttestService shim bindings for macOS/iOS 14+
- Add InMemoryCertificateCache (ConcurrentDictionary + TTL) to prevent PCCS/VPS rate limiting
- Rewrite SgxProvider and AmdSnpProvider: use injected interop interfaces + cert cache +
  typed options + domain exceptions mapped from vendor error codes
- Rewrite AppleSeProvider: UseDeviceAttestation routes to native SE generation on Apple
  devices; server-side path forwards CBOR attestation objects to Apple verification endpoint
  with proper JSON payload (no more dummy data)
- Rewrite TrustStore: X509ChainTrustMode.CustomRootTrust (no OS store); configurable
  RevocationMode; loads pinned roots from config files then embedded assembly resources;
  RegisterTestRoot internal helper for tests; InternalsVisibleTo test assembly
- Rewrite GlobalAttestationService: proper cloud context → vendor mapping (Azure/Intel,
  AWS/Intel, Client/Apple); VendorPreference override; AWS Nitro endpoint for Intel/AWS
- Add ServiceCollectionExtensions.AddAttestationServices for DI wiring
- Add 27 new BDD failure-mode and edge-case scenarios across 5 feature files:
  SgxFailureModes, AmdSnpFailureModes, AppleAttestFailureModes, TrustStoreEdgeCases,
  GlobalServiceMapping; all 32 tests pass

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…al driver on Linux

- SecurityFrameworkAppleAttestInterop: calls Apple Security.framework directly via P/Invoke,
  no native shim package required. Tries SE (kSecAttrTokenIDSecureEnclave) first, falls back
  to software EC key. Uses NativeLibrary.GetExport to obtain proper kCFTypeDictionaryKeyCallBacks
  pointer for correct CFDictionary construction. Produces {sigLen|DER-ECDSA-sig|X9.63-pubkey}
  attestation object verifiable with .NET ECDsa.

- AppleSecurityNative.cs: CoreFoundation + Security.framework P/Invoke bindings, CFData/
  CFString/CFNumber/CFDictionary helpers, CF description extraction for error diagnostics.

- ServiceCollectionExtensions: registers SecurityFrameworkAppleAttestInterop on macOS
  (direct Security.framework), AppleAttestNativeInterop (shim) on other Apple platforms.

- AppleNativeAttestation.feature (3 scenarios, @Native @apple):
  'Generate SE-backed key and verify attestation signature on macOS' — runs real native code,
  produces real EC key, signs a challenge, verifies signature with .NET ECDsa. Skipped on
  non-Apple platforms.
  'Different challenges produce different signatures' — proves non-deterministic signing.
  'PlatformNotSupportedException on non-Apple' — verifies platform guard.

- SgxNativeAttestation.feature + AmdSnpNativeAttestation.feature (2 scenarios each):
  'Attempt real native call' — passes if PCK ID/ChipID obtained (SGX/AMD hardware present),
  accepts NativeLibraryException (driver missing), or PlatformNotSupportedException (macOS).
  'PlatformNotSupportedException on non-Linux' — verifies platform guard.

All 38 tests pass, 1 skipped (non-Apple scenario correctly skipped on macOS).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
… section 3.2)

Create OpenCertServer.Sgx.Native and OpenCertServer.Amd.Native NuGet packages
using the RID-based binary distribution pattern required by spec section 3.2.

Layout per spec:
  runtimes/linux-x64/native/libsgx_dcap_ql.so   (SGX)
  runtimes/linux-arm64/native/libsgx_dcap_ql.so
  runtimes/linux-x64/native/amd_snp_driver.so   (AMD)
  runtimes/linux-arm64/native/amd_snp_driver.so

The .so binaries are NOT committed (they are owned by Intel/AMD). Each package
ships a fetch-native-*.sh script that copies the installed system library from
the canonical apt-get install location into the correct runtimes/ directory
before dotnet pack is run on a Linux CI agent.

Wire-up:
- opencertserver.attestation.csproj references both native packages via
  ProjectReference (ReferenceOutputAssembly=false) so MSBuild propagates
  the runtimes/{rid}/native/*.so to the publish output automatically.
- Verified: dotnet publish -r linux-x64 correctly places both .so files at
  publish/runtimes/linux-x64/native/ where .NET's DllImport probing finds them.
- Both native package projects added to opencertserver.slnx.

On a Linux box:
  cd src/OpenCertServer.Sgx.Native && ./fetch-native-sgx.sh
  cd src/OpenCertServer.Amd.Native && ./fetch-native-amd.sh
  dotnet publish src/opencertserver.attestation -r linux-x64
  # → native libraries are in publish/runtimes/linux-x64/native/
  # → SgxNativeInterop and AmdSnpNativeInterop load them via [LibraryImport]

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…nterop on macOS

When UseDeviceAttestation=true (macOS/iOS), the test was injecting an NSubstitute
mock that returns null for GenerateKeyAsync() and AttestKeyAsync(), producing an
empty attestation object.

Fix: platform-branch in WhenSentToTheOpenCertServerForVerification:
- macOS/iOS → SecurityFrameworkAppleAttestInterop (real Security.framework calls,
  SE-backed or software EC key + ECDSA signing via native P/Invoke)
- Other platforms → MockAppleAttestNativeInterop with UseDeviceAttestation=false,
  exercises the HTTP server-side verification path with a mocked Apple endpoint

The Then assertion validates a non-empty result in both cases.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
… platforms

Mirrors the Apple pattern: platform-branch in Given step.

Linux path (real hardware):
- SgxAttestationSteps → SgxNativeInterop (calls libsgx_dcap_ql)
- AmdSnpAttestationSteps → AmdSnpNativeInterop (calls amd_snp_driver)
Then step calls the full pipeline: GetDeviceIdAsync → RetrieveDeviceCertificateAsync
(HTTP mocked) → GenerateAndSignQuoteAsync. NativeLibraryException and
AttestationException are caught gracefully when running on Linux without
the hardware/driver present (CI without SGX/AMD hardware).

Non-Linux path (mock):
- MockSgxNativeInterop with realistic PckIdBytes (16-byte ID) and QuoteBytes (256b)
- MockAmdSnpNativeInterop with realistic ChipIdBytes (48-byte ID) and ReportBytes (1184b)
Both paths exercise the full provider pipeline (cache, HTTP cert fetch, quote).
HTTP is always mocked (PCCS/VPS are external cloud services).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR aims to fix/extend device-attest-01 ACME challenge generation and introduce a new hardware attestation subsystem (Intel SGX, AMD SEV-SNP, Apple App Attest/SE) with supporting tests and native-library packaging projects.

Changes:

  • Ensure device-attest-01 is included in supported challenge types and is created for new ACME authorizations.
  • Add a new opencertserver.attestation project (providers, native interop abstractions, trust store, DI wiring) plus a new BDD-style test project.
  • Broadly refactor many files’ using directives (notably shortening namespaces), plus a few minor code cleanups in TPM/CertesSlim areas.

Reviewed changes

Copilot reviewed 157 out of 176 changed files in this pull request and generated 16 comments.

Show a summary per file
File Description
tests/opencertserver.mcp.tests/TestSharedState.cs Adjusts MCP test imports (currently shortened namespaces).
tests/opencertserver.mcp.tests/Support/McpServerFixture.cs MCP server fixture imports + chain validator signature cleanup (currently shortened namespaces).
tests/opencertserver.mcp.tests/StepDefinitions/ParameterHandlingSteps.cs Step definition import changes (currently shortened namespaces).
tests/opencertserver.mcp.tests/StepDefinitions/McpServerCertificateQuerySteps.cs Minor crypto type-name simplification in tests.
tests/opencertserver.mcp.tests/StepDefinitions/CommonToolsSteps.cs Step definition import changes (currently shortened namespaces).
tests/opencertserver.est.server.tests/TestCsrAttributesLoader.cs EST test loader import change (currently shortened namespaces).
tests/opencertserver.est.server.tests/Steps/EstServer.cs EST server test wiring import changes (currently shortened namespaces).
tests/opencertserver.est.server.tests/Configuration/ConfigureCertificateAuthenticationOptions.cs Import change for CA utils (currently shortened namespaces).
tests/opencertserver.cli.tests/StepDefinitions/OpenCertServerCliStepDefinitions.cs Simplifies SemaphoreSlim reference.
tests/opencertserver.certserver.tests/StepDefinitions/TestManualAuthorizationStrategy.cs Import change for EST handlers (currently shortened namespaces).
tests/opencertserver.certserver.tests/StepDefinitions/TestCsrAttributesLoader.cs Import changes for CA/EST templates/handlers (currently shortened namespaces).
tests/opencertserver.certserver.tests/StepDefinitions/TestAcmeIssuer.cs Import changes for ACME abstractions and CertServer (currently shortened namespaces).
tests/opencertserver.certserver.tests/StepDefinitions/TestAcmeHttp01ChallengeValidator.cs Import changes for ACME services/models (currently shortened namespaces).
tests/opencertserver.certserver.tests/StepDefinitions/TestAcmeDns01ChallengeValidator.cs Import changes for ACME services/models (currently shortened namespaces).
tests/opencertserver.certserver.tests/StepDefinitions/TestAcmeDeviceAttestChallengeValidator.cs Import changes for ACME services/models (currently shortened namespaces).
tests/opencertserver.certserver.tests/StepDefinitions/OpenTelemetryMetrics.cs Import change for OCSP utils (currently shortened namespaces).
tests/opencertserver.certserver.tests/StepDefinitions/OcspConformance.cs Import changes for CA/OCSP/X509 utils (currently shortened namespaces).
tests/opencertserver.certserver.tests/StepDefinitions/EstEnrollment.cs Import change for EST client (currently shortened namespaces).
tests/opencertserver.certserver.tests/StepDefinitions/EstConformance.cs Import changes + simplifies ASN.1 reader type usage.
tests/opencertserver.certserver.tests/StepDefinitions/DeviceAttestCoreSteps.cs New steps validating ChallengeTypes.AllTypes and authorization challenge creation.
tests/opencertserver.certserver.tests/StepDefinitions/CrlConformance.cs Import changes for CA utils/extensions (currently shortened namespaces).
tests/opencertserver.certserver.tests/StepDefinitions/CertificateServerFeatures.cs Import changes + updates manual auth strategy replacement type reference.
tests/opencertserver.certserver.tests/Features/device-attest-core.feature New BDD feature for device-attest-01 type + challenge creation.
tests/opencertserver.ca.tests/X509/X509NameTests.cs Import shortened to Utils (currently shortened namespaces).
tests/opencertserver.ca.tests/X509/RelativeDistinguishedNameTests.cs Import shortened to Utils (currently shortened namespaces).
tests/opencertserver.ca.tests/X509/DistributionPointNameTests.cs Import shortened to Utils (currently shortened namespaces).
tests/opencertserver.ca.tests/X509/CertificateSigningRequestTemplateTests.cs Import shortened to Utils (currently shortened namespaces).
tests/opencertserver.ca.tests/SignedDataTests.cs Import shortened to Utils.Pkcs7 (currently shortened namespaces).
tests/opencertserver.ca.tests/Ocsp/OcspResponseTests.cs Import shortened to Utils (currently shortened namespaces).
tests/opencertserver.ca.tests/Ocsp/OcspRequestTests.cs Import shortened to Utils (currently shortened namespaces).
tests/opencertserver.attestation.Tests/StepDefinitions/TrustStoreSteps.cs New steps testing TrustStore behavior.
tests/opencertserver.attestation.Tests/StepDefinitions/TrustStoreEdgeCaseSteps.cs New TrustStore edge-case steps.
tests/opencertserver.attestation.Tests/StepDefinitions/SgxNativeAttestationSteps.cs New “native SGX interop attempted” steps.
tests/opencertserver.attestation.Tests/StepDefinitions/SgxFailureModeSteps.cs New SGX provider failure-mode steps.
tests/opencertserver.attestation.Tests/StepDefinitions/SgxAttestationSteps.cs New end-to-end-ish SGX provider steps (mocking external gateway).
tests/opencertserver.attestation.Tests/StepDefinitions/GlobalServiceMappingSteps.cs New tests for GlobalAttestationService provider/endpoint mapping.
tests/opencertserver.attestation.Tests/StepDefinitions/ConfigSteps.cs New config-driven endpoint selection steps.
tests/opencertserver.attestation.Tests/StepDefinitions/AppleSeAttestationSteps.cs New Apple provider verification steps (device-vs-server mode).
tests/opencertserver.attestation.Tests/StepDefinitions/AppleNativeAttestationSteps.cs New macOS/iOS-native Security.framework interop steps.
tests/opencertserver.attestation.Tests/StepDefinitions/AppleAttestFailureModeSteps.cs New Apple provider failure-mode steps.
tests/opencertserver.attestation.Tests/StepDefinitions/AmdSnpNativeAttestationSteps.cs New AMD native interop attempted steps.
tests/opencertserver.attestation.Tests/StepDefinitions/AmdSnpFailureModeSteps.cs New AMD provider failure-mode steps.
tests/opencertserver.attestation.Tests/StepDefinitions/AmdSnpAttestationSteps.cs New end-to-end-ish AMD provider steps (mocking external gateway).
tests/opencertserver.attestation.Tests/README.md New attestation test project README.
tests/opencertserver.attestation.Tests/opencertserver.attestation.Tests.csproj New test project definition.
tests/opencertserver.attestation.Tests/Mocks/MockSgxNativeInterop.cs New SGX native interop mocks.
tests/opencertserver.attestation.Tests/Mocks/MockProvider.cs New generic provider + HTTP handler + cert factory helpers.
tests/opencertserver.attestation.Tests/Mocks/MockAppleAttestNativeInterop.cs New Apple native interop mocks.
tests/opencertserver.attestation.Tests/Mocks/MockAmdSnpNativeInterop.cs New AMD native interop mocks.
tests/opencertserver.attestation.Tests/Features/TrustStoreEdgeCases.feature New TrustStore edge-cases feature.
tests/opencertserver.attestation.Tests/Features/TrustStore.feature.cs New generated feature binding code.
tests/opencertserver.attestation.Tests/Features/TrustStore.feature New TrustStore feature.
tests/opencertserver.attestation.Tests/Features/SgxNativeAttestation.feature New SGX native feature.
tests/opencertserver.attestation.Tests/Features/SgxFailureModes.feature New SGX failure-modes feature.
tests/opencertserver.attestation.Tests/Features/SgxAttestation.feature.cs New generated SGX feature binding code.
tests/opencertserver.attestation.Tests/Features/SgxAttestation.feature New SGX attestation feature.
tests/opencertserver.attestation.Tests/Features/GlobalServiceMapping.feature New mapping feature.
tests/opencertserver.attestation.Tests/Features/Config.feature.cs New generated config feature binding code.
tests/opencertserver.attestation.Tests/Features/Config.feature New config feature.
tests/opencertserver.attestation.Tests/Features/AppleSeAttestation.feature.cs New generated Apple SE feature binding code.
tests/opencertserver.attestation.Tests/Features/AppleSeAttestation.feature New Apple SE feature.
tests/opencertserver.attestation.Tests/Features/AppleNativeAttestation.feature New Apple native feature.
tests/opencertserver.attestation.Tests/Features/AppleAttestFailureModes.feature New Apple failure-modes feature.
tests/opencertserver.attestation.Tests/Features/AppleAttestationValidation.feature New Apple validation feature (feature file only).
tests/opencertserver.attestation.Tests/Features/AmdSnpNativeAttestation.feature New AMD native feature.
tests/opencertserver.attestation.Tests/Features/AmdSnpFailureModes.feature New AMD failure-modes feature.
tests/opencertserver.attestation.Tests/Features/AmdSnpAttestation.feature.cs New generated AMD feature binding code.
tests/opencertserver.attestation.Tests/Features/AmdSnpAttestation.feature New AMD attestation feature.
tests/CertesSlim.tests/IOrderContextExtensionsTests.cs Simplifies Uri construction syntax.
src/opencertserver.tpm/TpmRsa.cs Simplifies Stream/RSA factory references.
src/opencertserver.tpm/TpmEcDsa.cs Simplifies Stream/ECDsa factory references.
src/opencertserver.tpm/TpmCaExtensions.cs Import changes for CA services (currently shortened namespaces).
src/opencertserver.tpm/TpmCaCertificateStore.cs Simplifies StoreName type reference.
src/OpenCertServer.Sgx.Native/runtimes/linux-x64/native/.gitkeep Adds runtime-native folder placeholder.
src/OpenCertServer.Sgx.Native/runtimes/linux-arm64/native/.gitkeep Adds runtime-native folder placeholder.
src/OpenCertServer.Sgx.Native/OpenCertServer.Sgx.Native.csproj New RID-native packaging project for SGX DCAP lib.
src/OpenCertServer.Sgx.Native/fetch-native-sgx.sh New script to populate SGX native asset prior to pack.
src/opencertserver.mcp/Tools/CheckOcspStatusTool.cs Import change for X509 utils (currently shortened namespaces).
src/opencertserver.mcp/RegisterTools.cs Import change for MCP Tools (currently shortened namespaces).
src/opencertserver.mcp/Program.cs Import changes for CA/CA.Server (currently shortened namespaces).
src/opencertserver.mcp/McpServer.cs Import change for Transport (currently shortened namespaces).
src/opencertserver.est.server/Handlers/SimpleReEnrollHandler.cs Import changes for PKCS7/X509 extensions (currently shortened namespaces).
src/opencertserver.est.server/Handlers/SimpleEnrollHandler.cs Import changes for utils/PKCS7/X509 extensions (currently shortened namespaces).
src/opencertserver.est.server/Handlers/ServerKeyGenHandler.cs Import changes for utils/PKCS7/Response (currently shortened namespaces).
src/opencertserver.est.server/Handlers/CaCertHandler.cs Import changes for utils/PKCS7/Server (currently shortened namespaces).
src/opencertserver.est.client/EstClient.cs Import changes for utils/PKCS7/templates/extensions (currently shortened namespaces).
src/opencertserver.certserver/Program.cs Import changes for ACME/CA server (currently shortened namespaces).
src/opencertserver.certserver/DefaultIssuer.cs Import changes for X509Extensions (currently shortened namespaces).
src/opencertserver.certserver/DefaultCsrValidator.cs Import changes for utils (currently shortened namespaces).
src/opencertserver.ca/CertificateAuthority.cs Import changes for CA utils/x509 extensions (currently shortened namespaces).
src/opencertserver.ca.utils/X509Extensions/X509IssuerAltNameExtension.cs Import shortened to Utils (currently shortened namespaces).
src/opencertserver.ca.utils/X509Extensions/X509CertificatesExtensions.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/X509Extensions/CertificateExtension.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/RevokedCertificate.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/RDNSequenceTemplate.cs Imports shortened to X509* (currently shortened namespaces).
src/opencertserver.ca.utils/Pkcs7/SignerInfo.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/Pkcs7/SignedData.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/Pkcs7/IssuerAndSerialNumber.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/Pkcs7/DigestAlgorithmIdentifier.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/Pkcs7/CmsContentInfo.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/Ocsp/TbsRequest.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/Ocsp/SingleResponse.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/Ocsp/Signature.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/Ocsp/RevokedInfo.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/Ocsp/ResponseData.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/Ocsp/ResponseBytes.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/Ocsp/ResponderIdByName.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/Ocsp/Request.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/Ocsp/OcspResponse.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/Ocsp/OCSPRequest.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/Ocsp/OcspBasicResponse.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/Ocsp/CertId.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/NameTemplate.cs Import shortened to X509 (currently shortened namespaces).
src/opencertserver.ca.utils/EncodingExtensions.cs Imports shortened to X509* (currently shortened namespaces).
src/opencertserver.ca.utils/CertificateRevocationList.cs Import shortened to X509Extensions (currently shortened namespaces).
src/opencertserver.ca.utils/Ca/IStoreCertificates.cs Import shortened to Ocsp (currently shortened namespaces).
src/opencertserver.ca.utils/Ca/InMemoryCertificateStore.cs Import shortened to Ocsp (currently shortened namespaces).
src/opencertserver.ca.server/OcspRequestSignatureValidator.cs Import shortened to Utils.Ocsp (currently shortened namespaces).
src/opencertserver.ca.server/Handlers/RevocationHandler.cs Import shortened to Utils (currently shortened namespaces).
src/opencertserver.ca.server/Handlers/OcspHandler.cs Imports shortened to Utils* (currently shortened namespaces).
src/opencertserver.ca.server/Handlers/CsrHandler.cs Import shortened to Utils.X509Extensions (currently shortened namespaces).
src/opencertserver.ca.server/Extensions.cs Import shortened to Utils.Ocsp (currently shortened namespaces).
src/opencertserver.attestation/TrustStore.cs New trust store for pinned vendor roots + chain validation.
src/opencertserver.attestation/SgxProvider.cs New SGX provider (native PCK ID + PCCS fetch + quote).
src/opencertserver.attestation/ServiceCollectionExtensions.cs New DI registration entrypoint for attestation services/options.
src/opencertserver.attestation/README.md New attestation module README.
src/opencertserver.attestation/opencertserver.attestation.csproj New attestation project definition + native package references.
src/opencertserver.attestation/Native/SgxNativeInterop.cs New production SGX native interop wrapper.
src/opencertserver.attestation/Native/ISgxNativeInterop.cs New SGX interop abstraction.
src/opencertserver.attestation/Native/IntelSgxNative.cs New SGX P/Invoke bindings via LibraryImport.
src/opencertserver.attestation/Native/IAppleAttestNativeInterop.cs New Apple interop abstraction.
src/opencertserver.attestation/Native/IAmdSnpNativeInterop.cs New AMD interop abstraction.
src/opencertserver.attestation/Native/AppleSecurityNative.cs New Security.framework/CoreFoundation bindings + helpers.
src/opencertserver.attestation/Native/AppleAttestNativeInterop.cs New shim-based Apple interop implementation.
src/opencertserver.attestation/Native/AmdSnpNativeInterop.cs New production AMD interop wrapper.
src/opencertserver.attestation/Native/AmdSnpNative.cs New AMD P/Invoke bindings via LibraryImport.
src/opencertserver.attestation/IAttestationProvider.cs New provider contract.
src/opencertserver.attestation/GlobalAttestationService.cs New provider selection + endpoint mapping logic.
src/opencertserver.attestation/CertificateCache.cs New in-memory certificate cache abstraction/impl.
src/opencertserver.attestation/AttestationOptions.cs New options model for global + per-vendor settings.
src/opencertserver.attestation/AttestationException.cs New exception types + SGX/AMD error code mappings.
src/opencertserver.attestation/AppleSeProvider.cs New Apple provider (device mode + server verification mode).
src/opencertserver.attestation/AmdSnpProvider.cs New AMD provider (native chip id + VPS fetch + report).
src/OpenCertServer.Amd.Native/runtimes/linux-x64/native/.gitkeep Adds runtime-native folder placeholder.
src/OpenCertServer.Amd.Native/runtimes/linux-arm64/native/.gitkeep Adds runtime-native folder placeholder.
src/OpenCertServer.Amd.Native/OpenCertServer.Amd.Native.csproj New RID-native packaging project for AMD SNP driver lib.
src/OpenCertServer.Amd.Native/fetch-native-amd.sh New script to populate AMD native asset prior to pack.
src/opencertserver.acme.server/Services/Http01ChallengeValidator.cs Minor status code reference simplification.
src/opencertserver.acme.server/Services/DeviceAttestChallengeValidator.cs Adds nonce TTL pruning via Timer + IDisposable.
src/opencertserver.acme.server/Services/DefaultRevocationService.cs Import changes (currently shortened namespaces).
src/opencertserver.acme.server/Services/DefaultAuthorizationFactory.cs Adds creation of device-attest-01 challenge for each authorization.
src/opencertserver.acme.server/Filters/ValidateAcmeRequestFilter.cs Import change (currently shortened namespaces).
src/opencertserver.acme.server/Extensions/ServiceCollectionExtensions.cs Registers device-attest trust provider + validator; minor cleanup.
src/opencertserver.acme.server/Endpoints/RevocationEndpoints.cs Import changes (currently shortened namespaces).
src/opencertserver.acme.server/Endpoints/OrderEndpoints.cs Import changes + minor InvalidOperationException simplification.
src/opencertserver.acme.server/Endpoints/DirectoryEndpoints.cs Uses ChallengeTypes.AllTypes for directory metadata list.
src/opencertserver.acme.server/Endpoints/AccountEndpoints.cs Import changes + service type reference simplification.
src/CertesSlim/Extensions/IAcmeContextExtensions.cs Import shortened to Acme (currently shortened namespaces).
src/CertesSlim/Extensions/IAccountContextExtensions.cs Import shortened to Acme* (currently shortened namespaces).
src/CertesSlim/AcmeContext.cs Import shortened to Acme* (currently shortened namespaces).
opencertserver.slnx Adds new attestation/native projects to solution listing.
opencertserver.sln.DotSettings Adds dictionary words (currently malformed XML).
Directory.Packages.props Bumps/adds a few package versions (Extensions.Configuration/Http, Moq, etc.).
Files not reviewed (15)
  • tests/opencertserver.attestation.Tests/Features/AmdSnpAttestation.feature.cs: Generated file
  • tests/opencertserver.attestation.Tests/Features/AmdSnpFailureModes.feature.cs: Generated file
  • tests/opencertserver.attestation.Tests/Features/AmdSnpNativeAttestation.feature.cs: Generated file
  • tests/opencertserver.attestation.Tests/Features/AppleAttestFailureModes.feature.cs: Generated file
  • tests/opencertserver.attestation.Tests/Features/AppleAttestationValidation.feature.cs: Generated file
  • tests/opencertserver.attestation.Tests/Features/AppleNativeAttestation.feature.cs: Generated file
  • tests/opencertserver.attestation.Tests/Features/AppleSeAttestation.feature.cs: Generated file
  • tests/opencertserver.attestation.Tests/Features/Config.feature.cs: Generated file
  • tests/opencertserver.attestation.Tests/Features/GlobalServiceMapping.feature.cs: Generated file
  • tests/opencertserver.attestation.Tests/Features/SgxAttestation.feature.cs: Generated file
  • tests/opencertserver.attestation.Tests/Features/SgxFailureModes.feature.cs: Generated file
  • tests/opencertserver.attestation.Tests/Features/SgxNativeAttestation.feature.cs: Generated file
  • tests/opencertserver.attestation.Tests/Features/TrustStore.feature.cs: Generated file
  • tests/opencertserver.attestation.Tests/Features/TrustStoreEdgeCases.feature.cs: Generated file
  • tests/opencertserver.certserver.tests/Features/device-attest-core.feature.cs: Generated file

Comment thread tests/opencertserver.mcp.tests/TestSharedState.cs
Comment thread tests/opencertserver.mcp.tests/Support/McpServerFixture.cs
Comment thread tests/opencertserver.mcp.tests/StepDefinitions/CommonToolsSteps.cs
Comment thread tests/opencertserver.est.server.tests/TestCsrAttributesLoader.cs
Comment thread src/opencertserver.attestation/SgxProvider.cs
Comment thread src/opencertserver.attestation/AmdSnpProvider.cs
Comment thread src/opencertserver.attestation/TrustStore.cs Outdated
Comment thread src/opencertserver.acme.server/Services/DeviceAttestChallengeValidator.cs Outdated
Comment thread src/opencertserver.attestation/AppleSeProvider.cs Outdated
jjrdk and others added 4 commits July 9, 2026 15:22
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
@jjrdk jjrdk merged commit a1d47a2 into master Jul 9, 2026
6 of 7 checks passed
@jjrdk jjrdk deleted the features/device-attest-01 branch July 9, 2026 14:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants