Fix challenge generation

Directory.Packages.props

@@ -6,20 +6,24 @@
     <PackageVersion Include="Amazon.Lambda.TestUtilities" Version="4.1.0" />
     <PackageVersion Include="Amazon.Lambda.APIGatewayEvents" Version="3.0.0" />
     <PackageVersion Include="Amazon.Lambda.AspNetCoreServer" Version="10.1.1" />
-    <PackageVersion Include="AWSSDK.Extensions.NETCore.Setup" Version="4.0.100.2" />
+    <PackageVersion Include="AWSSDK.Extensions.NETCore.Setup" Version="4.0.100.3" />
     <PackageVersion Include="Cake.Docker" Version="1.5.0" />
     <PackageVersion Include="Cake.Frosting" Version="6.2.0" />
     <PackageVersion Include="DnsClient" Version="1.8.0" />
     <PackageVersion Include="GitVersion.MsBuild" Version="6.8.1" />
     <PackageVersion Include="Microsoft.AspNetCore.Authentication.Certificate" Version="10.0.9" />
     <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.9" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.9" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.9" />
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.9" />
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.9" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.9" />
     <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.9" />
     <PackageVersion Include="Microsoft.IdentityModel.Tokens" Version="8.19.1" />
     <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.9" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
     <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.300" />
+    <PackageVersion Include="Moq" Version="4.20.72" />
     <PackageVersion Include="NSubstitute" Version="5.3.0" />
     <PackageVersion Include="NuGet.Packaging" Version="7.6.0" />
     <PackageVersion Include="NuGet.Protocol" Version="7.6.0" />

opencertserver.sln.DotSettings

@@ -1,3 +1,6 @@
 <wpf:ResourceDictionary xml:space="preserve" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" xmlns:s="clr-namespace:System;assembly=mscorlib" xmlns:ss="urn:shemas-jetbrains-com:settings-storage-xaml" xmlns:wpf="http://schemas.microsoft.com/winfx/2006/xaml/presentation">
 	<s:Boolean x:Key="/Default/CodeEditing/SuppressNullableWarningFix/Enabled/@EntryValue">False</s:Boolean>
-	<s:Boolean x:Key="/Default/UserDictionary/Words/=Certes/@EntryIndexedValue">True</s:Boolean></wpf:ResourceDictionary>
+	<s:Boolean x:Key="/Default/UserDictionary/Words/=Certes/@EntryIndexedValue">True</s:Boolean>
+	<s:Boolean x:Key="/Default/UserDictionary/Words/=Pccs/@EntryIndexedValue">True</s:Boolean></wpf:ResourceDictionary>
+	<s:Boolean x:Key="/Default/UserDictionary/Words/=RootCA/@EntryIndexedValue">True</s:Boolean></wpf:ResourceDictionary>
+	<s:Boolean x:Key="/Default/UserDictionary/Words/=CA/@EntryIndexedValue">True</s:Boolean></wpf:ResourceDictionary>

opencertserver.slnx

@@ -16,6 +16,7 @@
     <File Path="Docker.md" />
   </Folder>
   <Folder Name="/tests/">
+    <Project Path="tests/opencertserver.attestation.Tests/opencertserver.attestation.Tests.csproj" />
     <Project Path="tests/opencertserver.cli.tests/opencertserver.cli.tests.csproj" />
     <Project Path="tests/opencertserver.mcp.tests/opencertserver.mcp.tests.csproj" />
     <Project Path="tests\CertesSlim.tests\CertesSlim.tests.csproj" />
@@ -29,6 +30,9 @@
   </Folder>
   <Project Path="build\opencertserver.build\opencertserver.build.csproj" />
   <Project Path="src\opencertserver.cli\opencertserver.cli.csproj" />
+  <Project Path="src/opencertserver.attestation/opencertserver.attestation.csproj" />
+  <Project Path="src/OpenCertServer.Sgx.Native/OpenCertServer.Sgx.Native.csproj" />
+  <Project Path="src/OpenCertServer.Amd.Native/OpenCertServer.Amd.Native.csproj" />
   <Project Path="src\CertesSlim\CertesSlim.csproj" />
   <Project Path="src\opencertserver.acme.abstractions\opencertserver.acme.abstractions.csproj" />
   <Project Path="src\opencertserver.acme.aspnetclient\opencertserver.acme.aspnetclient.csproj" />

src/CertesSlim/AcmeContext.cs

@@ -1,12 +1,12 @@
 namespace CertesSlim;
 
-using CertesSlim.Acme;
-using CertesSlim.Acme.Resource;
-using CertesSlim.Extensions;
-using CertesSlim.Json;
+using Acme;
+using Acme.Resource;
+using Extensions;
+using Json;
 using Microsoft.IdentityModel.Tokens;
-using Identifier = CertesSlim.Acme.Resource.Identifier;
-using IdentifierType = CertesSlim.Acme.Resource.IdentifierType;
+using Identifier = Acme.Resource.Identifier;
+using IdentifierType = Acme.Resource.IdentifierType;
 
 /// <summary>
 /// Represents the context for ACME operations.

src/CertesSlim/Extensions/IAccountContextExtensions.cs

@@ -1,7 +1,7 @@
 namespace CertesSlim.Extensions;
 
-using CertesSlim.Acme;
-using CertesSlim.Acme.Resource;
+using Acme;
+using Acme.Resource;
 
 /// <summary>
 /// Extension methods for <see cref="IAccountContext"/>.

src/CertesSlim/Extensions/IAcmeContextExtensions.cs

@@ -1,6 +1,6 @@
 namespace CertesSlim.Extensions;
 
-using CertesSlim.Acme;
+using Acme;
 using Directory = CertesSlim.Acme.Resource.Directory;
 
 /// <summary>

src/OpenCertServer.Amd.Native/OpenCertServer.Amd.Native.csproj

@@ -0,0 +1,60 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <!--
+    OpenCertServer.Amd.Native
+    ═══════════════════════════════════════════════════════════════════════════
+    NuGet package that ships the AMD SEV-SNP user-space driver as a platform-
+    native asset:
+
+      runtimes/linux-x64/native/amd_snp_driver.so
+      runtimes/linux-arm64/native/amd_snp_driver.so
+
+    HOW TO POPULATE THE NATIVE BINARIES
+    ─────────────────────────────────────
+    The .so files are NOT committed to source control (they are owned by AMD).
+    Before packing, obtain the AMD SEV-SNP user-space library from:
+
+      https://github.com/AMDESE/AMDSEV (build from source)
+
+    Or install from your distro's AMD SEV-SNP packages, then:
+
+      cp /usr/lib/x86_64-linux-gnu/amd_snp_driver.so \
+         runtimes/linux-x64/native/amd_snp_driver.so
+
+    CI/CD: run fetch-native-amd.sh (in this directory) before dotnet pack.
+  -->
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <IsPackable>true</IsPackable>
+    <PackageId>OpenCertServer.Amd.Native</PackageId>
+    <Version>1.0.0</Version>
+    <Description>Native AMD SEV-SNP user-space driver (amd_snp_driver) packaged using .NET RID conventions.</Description>
+    <Authors>OpenCertServer</Authors>
+    <IncludeBuildOutput>false</IncludeBuildOutput>
+    <NoDefaultExcludes>true</NoDefaultExcludes>
+    <SuppressDependenciesWhenPacking>true</SuppressDependenciesWhenPacking>
+    <DevelopmentDependency>true</DevelopmentDependency>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <None Include="runtimes/linux-x64/native/amd_snp_driver.so"
+          Pack="true"
+          PackagePath="runtimes/linux-x64/native/amd_snp_driver.so"
+          Condition="Exists('runtimes/linux-x64/native/amd_snp_driver.so')" />
+    <None Include="runtimes/linux-arm64/native/amd_snp_driver.so"
+          Pack="true"
+          PackagePath="runtimes/linux-arm64/native/amd_snp_driver.so"
+          Condition="Exists('runtimes/linux-arm64/native/amd_snp_driver.so')" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Content Include="runtimes/linux-x64/native/amd_snp_driver.so"
+             CopyToOutputDirectory="PreserveNewest"
+             Condition="Exists('runtimes/linux-x64/native/amd_snp_driver.so')" />
+    <Content Include="runtimes/linux-arm64/native/amd_snp_driver.so"
+             CopyToOutputDirectory="PreserveNewest"
+             Condition="Exists('runtimes/linux-arm64/native/amd_snp_driver.so')" />
+  </ItemGroup>
+
+</Project>

src/OpenCertServer.Amd.Native/fetch-native-amd.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# fetch-native-amd.sh
+# ─────────────────────────────────────────────────────────────────────────────
+# Fetches the AMD SEV-SNP native driver library and places it in the correct
+# RID directory for NuGet packaging.
+#
+# Usage:
+#   cd src/OpenCertServer.Amd.Native
+#   ./fetch-native-amd.sh
+# ─────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+copy_if_found() {
+    local src="$1"
+    local dest="$2"
+    if [ -f "$src" ]; then
+        echo "[amd-native] Copying $src → $dest"
+        mkdir -p "$(dirname "$dest")"
+        cp "$src" "$dest"
+    fi
+}
+
+DEST_X64="$SCRIPT_DIR/runtimes/linux-x64/native/amd_snp_driver.so"
+
+copy_if_found "/usr/lib/x86_64-linux-gnu/amd_snp_driver.so" "$DEST_X64" || \
+copy_if_found "/usr/lib64/amd_snp_driver.so"                 "$DEST_X64" || true
+
+if [ ! -f "$DEST_X64" ]; then
+    echo "[amd-native] WARNING: amd_snp_driver.so not found."
+    echo "  Build from: https://github.com/AMDESE/AMDSEV"
+fi

src/OpenCertServer.Sgx.Native/OpenCertServer.Sgx.Native.csproj

@@ -0,0 +1,76 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <!--
+    OpenCertServer.Sgx.Native
+    ═══════════════════════════════════════════════════════════════════════════
+    NuGet package that ships libsgx_dcap_ql as a platform-native asset, using
+    the .NET RID convention so the runtime discovers it automatically:
+
+      runtimes/linux-x64/native/libsgx_dcap_ql.so
+      runtimes/linux-arm64/native/libsgx_dcap_ql.so
+
+    HOW TO POPULATE THE NATIVE BINARIES
+    ─────────────────────────────────────
+    The .so files are NOT committed to source control (they are owned by Intel).
+    Before packing, obtain them from Intel's DCAP package:
+
+      # Ubuntu/Debian
+      sudo apt-get install -y libsgx-dcap-ql-dev
+      cp /usr/lib/x86_64-linux-gnu/libsgx_dcap_ql.so \
+         runtimes/linux-x64/native/libsgx_dcap_ql.so
+
+    CI/CD: run fetch-native-sgx.sh (in this directory) before dotnet pack.
+  -->
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <IsPackable>true</IsPackable>
+    <PackageId>OpenCertServer.Sgx.Native</PackageId>
+    <Version>1.0.0</Version>
+    <Description>Native Intel SGX DCAP libraries (libsgx_dcap_ql) packaged using .NET RID conventions.</Description>
+    <Authors>OpenCertServer</Authors>
+
+    <!-- This package has no managed output — only native assets. -->
+    <IncludeBuildOutput>false</IncludeBuildOutput>
+    <!-- Prevent SDK from stripping runtimes/** from the package. -->
+    <NoDefaultExcludes>true</NoDefaultExcludes>
+    <!-- Suppress the warning about no managed assembly. -->
+    <SuppressDependenciesWhenPacking>true</SuppressDependenciesWhenPacking>
+    <!-- Prevent this package from requiring a specific TFM in consumers. -->
+    <DevelopmentDependency>true</DevelopmentDependency>
+  </PropertyGroup>
+
+  <!--
+    Native binaries are included in the NuGet package using PackagePath so
+    they land in runtimes/{rid}/native/. MSBuild / the .NET publish pipeline
+    copies the correct RID variant to the output directory automatically.
+
+    Files are only included when they actually exist (Condition), so the
+    project builds cleanly on macOS/Windows developer machines.
+  -->
+  <ItemGroup>
+    <None Include="runtimes/linux-x64/native/libsgx_dcap_ql.so"
+          Pack="true"
+          PackagePath="runtimes/linux-x64/native/libsgx_dcap_ql.so"
+          Condition="Exists('runtimes/linux-x64/native/libsgx_dcap_ql.so')" />
+    <None Include="runtimes/linux-arm64/native/libsgx_dcap_ql.so"
+          Pack="true"
+          PackagePath="runtimes/linux-arm64/native/libsgx_dcap_ql.so"
+          Condition="Exists('runtimes/linux-arm64/native/libsgx_dcap_ql.so')" />
+  </ItemGroup>
+
+  <!--
+    When this project is referenced directly (ProjectReference in the same
+    solution), copy any present native binaries into the consumer's output
+    directory under runtimes/{rid}/native so the .NET runtime can find them.
+  -->
+  <ItemGroup>
+    <Content Include="runtimes/linux-x64/native/libsgx_dcap_ql.so"
+             CopyToOutputDirectory="PreserveNewest"
+             Condition="Exists('runtimes/linux-x64/native/libsgx_dcap_ql.so')" />
+    <Content Include="runtimes/linux-arm64/native/libsgx_dcap_ql.so"
+             CopyToOutputDirectory="PreserveNewest"
+             Condition="Exists('runtimes/linux-arm64/native/libsgx_dcap_ql.so')" />
+  </ItemGroup>
+
+</Project>

src/OpenCertServer.Sgx.Native/fetch-native-sgx.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# fetch-native-sgx.sh
+# ─────────────────────────────────────────────────────────────────────────────
+# Fetches the Intel SGX DCAP native library and places it in the correct RID
+# directory so it will be included when this NuGet package is packed.
+#
+# Usage (on a Linux x64 CI agent with SGX DCAP available):
+#   cd src/OpenCertServer.Sgx.Native
+#   ./fetch-native-sgx.sh
+#
+# After running this script, build the NuGet package with:
+#   dotnet pack -c Release
+# ─────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+copy_if_found() {
+    local src="$1"
+    local dest="$2"
+    if [ -f "$src" ]; then
+        echo "[sgx-native] Copying $src → $dest"
+        mkdir -p "$(dirname "$dest")"
+        cp "$src" "$dest"
+    fi
+}
+
+# ── Linux x64 ────────────────────────────────────────────────────────────────
+DEST_X64="$SCRIPT_DIR/runtimes/linux-x64/native/libsgx_dcap_ql.so"
+
+# Try common install locations (libsgx-dcap-ql package on Ubuntu/Debian)
+copy_if_found "/usr/lib/x86_64-linux-gnu/libsgx_dcap_ql.so.1" "$DEST_X64" || \
+copy_if_found "/usr/lib/x86_64-linux-gnu/libsgx_dcap_ql.so"   "$DEST_X64" || \
+copy_if_found "/usr/lib64/libsgx_dcap_ql.so.1"                 "$DEST_X64" || \
+copy_if_found "/usr/lib64/libsgx_dcap_ql.so"                   "$DEST_X64" || true
+
+if [ ! -f "$DEST_X64" ]; then
+    echo "[sgx-native] WARNING: libsgx_dcap_ql.so not found."
+    echo "  Install the Intel DCAP package first:"
+    echo "    sudo apt-get install -y libsgx-dcap-ql"
+    echo "  Or download from https://github.com/intel/SGXDataCenterAttestationPrimitives"
+fi

src/opencertserver.acme.server/Endpoints/AccountEndpoints.cs

@@ -13,13 +13,13 @@ namespace OpenCertServer.Acme.Server.Endpoints;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
 using Microsoft.IdentityModel.Tokens;
-using OpenCertServer.Acme.Abstractions.Exceptions;
-using OpenCertServer.Acme.Abstractions.HttpModel.Requests;
+using Abstractions.Exceptions;
+using Abstractions.HttpModel.Requests;
 using OpenCertServer.Acme.Abstractions.Services;
-using OpenCertServer.Acme.Server.Configuration;
-using OpenCertServer.Acme.Server.Extensions;
-using OpenCertServer.Acme.Server.Filters;
-using Account = OpenCertServer.Acme.Abstractions.HttpModel.Account;
+using Configuration;
+using Extensions;
+using Filters;
+using Account = Abstractions.HttpModel.Account;
 
 public static class AccountEndpoints
 {
@@ -266,7 +266,7 @@ private static async Task<IResult> NewAccountHandler(
             // Consume the EAB key before creating the account so single-use keys
             // cannot be raced and a failed key save does not leave an orphan account.
             var eabStore = context.RequestServices
-                .GetRequiredService<OpenCertServer.Acme.Abstractions.Storage.IStoreExternalAccountKeys>();
+                .GetRequiredService<Abstractions.Storage.IStoreExternalAccountKeys>();
             var eabKey = await eabStore.LoadKey(externalAccountId, cancellationToken).ConfigureAwait(false);
             if (eabKey != null)
             {

src/opencertserver.acme.server/Endpoints/DirectoryEndpoints.cs

@@ -5,7 +5,8 @@ namespace OpenCertServer.Acme.Server.Endpoints;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Routing;
 using Microsoft.Extensions.Options;
-using OpenCertServer.Acme.Server.Configuration;
+using Abstractions.Model;
+using Configuration;
 
 public static class DirectoryEndpoints
 {
@@ -31,18 +32,13 @@ private static IResult GetDirectoryHandler(HttpContext context, IOptions<AcmeSer
                 NewAuthz    = null,
                 RevokeCert  = GetUrl("RevokeCert"),
                 KeyChange   = GetUrl("KeyChange"),
-                Meta = new OpenCertServer.Acme.Abstractions.HttpModel.DirectoryMetadata
+                Meta = new Abstractions.HttpModel.DirectoryMetadata
                 {
                     ExternalAccountRequired = options.ExternalAccountRequired,
                     CAAIdentities           = null,
                     TermsOfService          = options.TOS.RequireAgreement ? options.TOS.Url : null,
                     Website                 = options.WebsiteUrl,
-                    ChallengeTypesWithAdditionalContent =
-                    [
-                        "http-01",
-                        "dns-01",
-                        "device-attest-01"
-                    ]
+                    ChallengeTypesWithAdditionalContent = ChallengeTypes.AllTypes
                 }
             };
             AcmeInstruments.DirectorySuccesses.Add(1);