Skip to content

Commit 221eb3c

Browse files
ThatSilentCoderEsteban Acosta Toribio esacost
ThatSilentCoder
and
Esteban Acosta Toribio esacost
authored
[#896] Add basic Platform Certificate Class Registry support to the ACA (#898)
* issue_896: first cut at changing the logic on the validator * issue_896: Added more javadocs, still going through the process and figuring out places where this will work. Can successfully debug provisioner+aca. * issue_896: slowly introducing component identifier v2 into multiple spots throughout out the app. Seems like we need to ensure that when we try to parse the pc from the identity claim, it needs to recognize the new kind of identifier. * issue_896: deleted abstract plat form config class, replaced it with plat config v1 (which already exists), moved attribuutes associated with v2 to the v2 class, when validating the aca will now verify if the platform config associated with the cert is v1 or v2. Made corrections to attributes names to better align with tcg docs. * issue_896:Added a new property to component info, made some more spelling corrections, deleted unused classes that were being referenced by componentinfo. pretty much done with the aca side of things. * issue_896:I believe I have finished the issue. Further testing needs to be done. Will put in a WIP PR for now. * issue_896: Made some more changes after viewing PR * issue_896: Changed v3 to v4 in the github actions yaml files. * issue_896: Fixed issues in one of the test classes, can now test other aspects of the SupplyChainCredentialValidator class. Will add more tests as more issues get fixed. * issue_896: Hopefully GITHUB actions will be more forgiving. * issue_896: Placed test task in the root build.gradle. Made more fixes to the test classes. * issue_896: Realized there might be more work needed for the validation part. Started adding more logic to validation. * issue_896: Last change before the long weekend. Hoping these changes will make github actions happy. * issue_896: Verifying that this part works. We will need to figure out a smart/efficient way of comparing the components from platform cert and device info report. * testing * v3_issue_896: Should work for this PR. * v3_issue_821: fixed the NPE issue we were getting during provisioning for missing component info. * v3_issue_896: my copy/paste skills need work. Fixed the issue that was causing the docker tests to fail. * v3_issue_896: trying to see if reverting the return call null will make a difference. * v3_issue_896: should fix issues with pc found on certain devices * v3_issue_896: part ii of should fix issues with pc found on certain devices --------- Co-authored-by: Esteban Acosta Toribio esacost <[email protected]>
1 parent 2d89f7b commit 221eb3c

File tree

52 files changed

+2043
-1554
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+2043
-1554
lines changed

‎.github/workflows/create_aca_images.yml

+129-128
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# Updated: 02/11/2025
12
name: Create ACA Docker Image
23
on:
34
release:
@@ -17,7 +18,7 @@ env:
1718
PUBLIC_IMAGE_NAME: ghcr.io/nsacyber/hirs/aca
1819
PUBLIC_IMAGE_TAG_LATEST: ghcr.io/nsacyber/hirs/aca:latest
1920
TAG_LATEST: ${{ github.event_name == 'release' || inputs.also_tag_latest }} # The public docker image will be tagged 'latest' for releases, or if this option is manually selected.
20-
jobs:
21+
jobs:
2122
setup:
2223
runs-on: ubuntu-latest
2324
outputs:
@@ -27,158 +28,158 @@ jobs:
2728
WINDOWS_COMPAT_IMAGE_TAG: ${{ steps.setenv.outputs.WINDOWS_COMPAT_IMAGE_TAG }}
2829
PUBLIC_IMAGE_TAG: ${{ steps.setenv.outputs.PUBLIC_IMAGE_TAG }}
2930
steps:
30-
- name: Set env
31-
id: setenv
32-
shell: bash
33-
run: |
34-
# Parse docker image tag from GitHub tag if available
35-
if [ "${{ github.ref_type }}" = "tag" ]; then
36-
# tags start with refs/tags/. Also remove v if it exists.
37-
export IMAGE_TAG_VAR=${GITHUB_REF:10}
38-
export IMAGE_TAG_VAR=${IMAGE_TAG_VAR//v/}
39-
else
40-
# Not a tag, use the commit hash. Do not tag as latest.
41-
export IMAGE_TAG_VAR=${GITHUB_SHA:0:7}
42-
fi
43-
# To lowercase
44-
export IMAGE_TAG_VAR=${IMAGE_TAG_VAR,,}
45-
46-
# Save to output
47-
echo "IMAGE_TAG=$IMAGE_TAG_VAR" >> "$GITHUB_OUTPUT"
48-
echo "ROCKY_IMAGE_TAG=$IMAGE_NAME_ROCKY:$IMAGE_TAG_VAR" >> "$GITHUB_OUTPUT"
49-
echo "WINDOWS_IMAGE_TAG=$IMAGE_NAME_WINDOWS:$IMAGE_TAG_VAR" >> "$GITHUB_OUTPUT"
50-
echo "WINDOWS_COMPAT_IMAGE_TAG=$IMAGE_NAME_WINDOWS_COMPAT:$IMAGE_TAG_VAR" >> "$GITHUB_OUTPUT"
51-
echo "PUBLIC_IMAGE_TAG=$PUBLIC_IMAGE_NAME:$IMAGE_TAG_VAR" >> "$GITHUB_OUTPUT"
52-
- name: Print env
53-
run: |
54-
echo GITHUB_REF_NAME=${{ github.ref_name }}
55-
echo DOCKERFILE_ROCKY=$DOCKERFILE_ROCKY
56-
echo DOCKERFILE_WINDOWS=$DOCKERFILE_WINDOWS
57-
echo IMAGE_NAME_ROCKY=$IMAGE_NAME_ROCKY
58-
echo IMAGE_NAME_WINDOWS=$IMAGE_NAME_WINDOWS
59-
echo IMAGE_NAME_WINDOWS_COMPAT=$IMAGE_NAME_WINDOWS_COMPAT
60-
echo PUBLIC_IMAGE_NAME=$PUBLIC_IMAGE_NAME
61-
echo PUBLIC_IMAGE_TAG_LATEST=$PUBLIC_IMAGE_TAG_LATEST
62-
echo TAG_LATEST=$TAG_LATEST
63-
echo IMAGE_TAG=${{ steps.setenv.outputs.IMAGE_TAG }}
64-
echo ROCKY_IMAGE_TAG=${{ steps.setenv.outputs.ROCKY_IMAGE_TAG }}
65-
echo WINDOWS_IMAGE_TAG=${{ steps.setenv.outputs.WINDOWS_IMAGE_TAG }}
66-
echo WINDOWS_COMPAT_IMAGE_TAG=${{ steps.setenv.outputs.WINDOWS_COMPAT_IMAGE_TAG }}
67-
echo PUBLIC_IMAGE_TAG=${{ steps.setenv.outputs.PUBLIC_IMAGE_TAG }}
31+
- name: Set env
32+
id: setenv
33+
shell: bash
34+
run: |
35+
# Parse docker image tag from GitHub tag if available
36+
if [ "${{ github.ref_type }}" = "tag" ]; then
37+
# tags start with refs/tags/. Also remove v if it exists.
38+
export IMAGE_TAG_VAR=${GITHUB_REF:10}
39+
export IMAGE_TAG_VAR=${IMAGE_TAG_VAR//v/}
40+
else
41+
# Not a tag, use the commit hash. Do not tag as latest.
42+
export IMAGE_TAG_VAR=${GITHUB_SHA:0:7}
43+
fi
44+
# To lowercase
45+
export IMAGE_TAG_VAR=${IMAGE_TAG_VAR,,}
46+
47+
# Save to output
48+
echo "IMAGE_TAG=$IMAGE_TAG_VAR" >> "$GITHUB_OUTPUT"
49+
echo "ROCKY_IMAGE_TAG=$IMAGE_NAME_ROCKY:$IMAGE_TAG_VAR" >> "$GITHUB_OUTPUT"
50+
echo "WINDOWS_IMAGE_TAG=$IMAGE_NAME_WINDOWS:$IMAGE_TAG_VAR" >> "$GITHUB_OUTPUT"
51+
echo "WINDOWS_COMPAT_IMAGE_TAG=$IMAGE_NAME_WINDOWS_COMPAT:$IMAGE_TAG_VAR" >> "$GITHUB_OUTPUT"
52+
echo "PUBLIC_IMAGE_TAG=$PUBLIC_IMAGE_NAME:$IMAGE_TAG_VAR" >> "$GITHUB_OUTPUT"
53+
- name: Print env
54+
run: |
55+
echo GITHUB_REF_NAME=${{ github.ref_name }}
56+
echo DOCKERFILE_ROCKY=$DOCKERFILE_ROCKY
57+
echo DOCKERFILE_WINDOWS=$DOCKERFILE_WINDOWS
58+
echo IMAGE_NAME_ROCKY=$IMAGE_NAME_ROCKY
59+
echo IMAGE_NAME_WINDOWS=$IMAGE_NAME_WINDOWS
60+
echo IMAGE_NAME_WINDOWS_COMPAT=$IMAGE_NAME_WINDOWS_COMPAT
61+
echo PUBLIC_IMAGE_NAME=$PUBLIC_IMAGE_NAME
62+
echo PUBLIC_IMAGE_TAG_LATEST=$PUBLIC_IMAGE_TAG_LATEST
63+
echo TAG_LATEST=$TAG_LATEST
64+
echo IMAGE_TAG=${{ steps.setenv.outputs.IMAGE_TAG }}
65+
echo ROCKY_IMAGE_TAG=${{ steps.setenv.outputs.ROCKY_IMAGE_TAG }}
66+
echo WINDOWS_IMAGE_TAG=${{ steps.setenv.outputs.WINDOWS_IMAGE_TAG }}
67+
echo WINDOWS_COMPAT_IMAGE_TAG=${{ steps.setenv.outputs.WINDOWS_COMPAT_IMAGE_TAG }}
68+
echo PUBLIC_IMAGE_TAG=${{ steps.setenv.outputs.PUBLIC_IMAGE_TAG }}
6869
6970
rocky-image:
7071
needs: setup
7172
runs-on: ubuntu-latest
7273
env:
7374
TAG: ${{ needs.setup.outputs.ROCKY_IMAGE_TAG }}
7475
steps:
75-
- name: Checkout main
76-
uses: actions/checkout@v4
77-
78-
- name: Login to GitHub Container Registry
79-
uses: docker/login-action@v3
80-
with:
81-
registry: ghcr.io
82-
username: ${{ github.actor }}
83-
password: ${{ secrets.GITHUB_TOKEN }}
84-
85-
- name: Build and push a release Docker image for ${{ github.repository }}
86-
uses: docker/build-push-action@v5
87-
with:
88-
context: "{{defaultContext}}:.ci/docker"
89-
file: Dockerfile.${{env.DOCKERFILE_ROCKY}}
90-
build-args: REF=${{ github.ref_name }}
91-
tags: ${{env.TAG}}
92-
push: true
93-
76+
- name: Checkout main
77+
uses: actions/checkout@v4
78+
79+
- name: Login to GitHub Container Registry
80+
uses: docker/login-action@v4
81+
with:
82+
registry: ghcr.io
83+
username: ${{ github.actor }}
84+
password: ${{ secrets.GITHUB_TOKEN }}
85+
86+
- name: Build and push a release Docker image for ${{ github.repository }}
87+
uses: docker/build-push-action@v5
88+
with:
89+
context: "{{defaultContext}}:.ci/docker"
90+
file: Dockerfile.${{env.DOCKERFILE_ROCKY}}
91+
build-args: REF=${{ github.ref_name }}
92+
tags: ${{env.TAG}}
93+
push: true
94+
9495
windows-11-image:
9596
needs: setup
9697
runs-on: windows-latest
9798
env:
9899
TAG: ${{ needs.setup.outputs.WINDOWS_IMAGE_TAG }}
99100
steps:
100-
- name: Checkout main
101-
uses: actions/checkout@v4
102-
103-
- name: Login to GitHub Container Registry
104-
uses: docker/login-action@v3
105-
with:
106-
registry: ghcr.io
107-
username: ${{ github.actor }}
108-
password: ${{ secrets.GITHUB_TOKEN }}
109-
110-
- name: Build the docker image for ${{ github.repository }}
111-
run: |
112-
cd ./.ci/docker
113-
docker build --build-arg REF=${{ github.ref_name }} -f ./Dockerfile.${{env.DOCKERFILE_WINDOWS}} -t ${{env.TAG}} .
114-
115-
- name: Push the docker image
116-
run: |
117-
docker push ${{env.TAG}}
118-
101+
- name: Checkout main
102+
uses: actions/checkout@v4
103+
104+
- name: Login to GitHub Container Registry
105+
uses: docker/login-action@v4
106+
with:
107+
registry: ghcr.io
108+
username: ${{ github.actor }}
109+
password: ${{ secrets.GITHUB_TOKEN }}
110+
111+
- name: Build the docker image for ${{ github.repository }}
112+
run: |
113+
cd ./.ci/docker
114+
docker build --build-arg REF=${{ github.ref_name }} -f ./Dockerfile.${{env.DOCKERFILE_WINDOWS}} -t ${{env.TAG}} .
115+
116+
- name: Push the docker image
117+
run: |
118+
docker push ${{env.TAG}}
119+
119120
windows-compat-image: # This job uses a different runner and build arg than the other windows job.
120121
needs: setup
121122
runs-on: windows-2019
122123
env:
123124
TAG: ${{ needs.setup.outputs.WINDOWS_COMPAT_IMAGE_TAG }}
124125
steps:
125-
- name: Checkout main
126-
uses: actions/checkout@v4
127-
128-
- name: Login to GitHub Container Registry
129-
uses: docker/login-action@v3
130-
with:
131-
registry: ghcr.io
132-
username: ${{ github.actor }}
133-
password: ${{ secrets.GITHUB_TOKEN }}
134-
135-
- name: Build the docker image for ${{ github.repository }}
136-
run: |
137-
cd ./.ci/docker
138-
docker build --build-arg REF=${{ github.ref_name }} -f ./Dockerfile.${{env.DOCKERFILE_WINDOWS}} -t ${{env.TAG}} --build-arg BASE_IMAGE_TAG=lts-windowsservercore-1809 .
139-
140-
- name: Push the docker image
141-
run: |
142-
docker push ${{env.TAG}}
143-
144-
126+
- name: Checkout main
127+
uses: actions/checkout@v4
128+
129+
- name: Login to GitHub Container Registry
130+
uses: docker/login-action@v4
131+
with:
132+
registry: ghcr.io
133+
username: ${{ github.actor }}
134+
password: ${{ secrets.GITHUB_TOKEN }}
135+
136+
- name: Build the docker image for ${{ github.repository }}
137+
run: |
138+
cd ./.ci/docker
139+
docker build --build-arg REF=${{ github.ref_name }} -f ./Dockerfile.${{env.DOCKERFILE_WINDOWS}} -t ${{env.TAG}} --build-arg BASE_IMAGE_TAG=lts-windowsservercore-1809 .
140+
141+
- name: Push the docker image
142+
run: |
143+
docker push ${{env.TAG}}
144+
145+
145146
manifest:
146-
needs: [setup, rocky-image, windows-11-image, windows-compat-image]
147+
needs: [ setup, rocky-image, windows-11-image, windows-compat-image ]
147148
runs-on: ubuntu-latest
148149
env:
149150
IMAGE1: ${{ needs.setup.outputs.ROCKY_IMAGE_TAG }}
150151
IMAGE2: ${{ needs.setup.outputs.WINDOWS_IMAGE_TAG }}
151152
IMAGE3: ${{ needs.setup.outputs.WINDOWS_COMPAT_IMAGE_TAG }}
152153
PUB: ${{ needs.setup.outputs.PUBLIC_IMAGE_TAG }}
153154
steps:
154-
- name: Print env
155-
run: |
156-
echo IMAGE1=${{env.IMAGE1}}
157-
echo IMAGE2=${{env.IMAGE2}}
158-
echo IMAGE3=${{env.IMAGE3}}
159-
echo PUB=${{env.PUB}}
160-
161-
- name: Checkout main
162-
uses: actions/checkout@v4
163-
164-
- name: Login to GitHub Container Registry
165-
uses: docker/login-action@v3
166-
with:
167-
registry: ghcr.io
168-
username: ${{ github.actor }}
169-
password: ${{ secrets.GITHUB_TOKEN }}
170-
171-
- name: Create a new manifest
172-
run: |
173-
docker manifest create ${{env.PUB}} --amend ${{env.IMAGE1}} --amend ${{env.IMAGE2}} --amend ${{env.IMAGE3}}
174-
175-
- name: Push the new manifest
176-
run: |
177-
docker manifest push ${{env.PUB}}
178-
179-
- name: Create and push manifest latest if selected
180-
if: env.TAG_LATEST != 'false'
181-
run: |
182-
docker manifest create $PUBLIC_IMAGE_TAG_LATEST --amend $IMAGE1 --amend $IMAGE2 --amend $IMAGE3
183-
docker manifest push $PUBLIC_IMAGE_TAG_LATEST
155+
- name: Print env
156+
run: |
157+
echo IMAGE1=${{env.IMAGE1}}
158+
echo IMAGE2=${{env.IMAGE2}}
159+
echo IMAGE3=${{env.IMAGE3}}
160+
echo PUB=${{env.PUB}}
161+
162+
- name: Checkout main
163+
uses: actions/checkout@v4
164+
165+
- name: Login to GitHub Container Registry
166+
uses: docker/login-action@v4
167+
with:
168+
registry: ghcr.io
169+
username: ${{ github.actor }}
170+
password: ${{ secrets.GITHUB_TOKEN }}
171+
172+
- name: Create a new manifest
173+
run: |
174+
docker manifest create ${{env.PUB}} --amend ${{env.IMAGE1}} --amend ${{env.IMAGE2}} --amend ${{env.IMAGE3}}
175+
176+
- name: Push the new manifest
177+
run: |
178+
docker manifest push ${{env.PUB}}
179+
180+
- name: Create and push manifest latest if selected
181+
if: env.TAG_LATEST != 'false'
182+
run: |
183+
docker manifest create $PUBLIC_IMAGE_TAG_LATEST --amend $IMAGE1 --amend $IMAGE2 --amend $IMAGE3
184+
docker manifest push $PUBLIC_IMAGE_TAG_LATEST
184185

‎.github/workflows/dotnet_provisioner_unit_tests.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
1+
# Updated: 02/11/2025
12
name: Dotnet Provisioner Unit Tests
23

34
on: push
45
env:
5-
DOTNET_VERSION: '6.0'
6+
DOTNET_VERSION: '8.0'
67
jobs:
78
dotnet_provisioner_unit_tests:
89
name: Restore and Run Unit Tests
@@ -97,7 +98,7 @@ jobs:
9798

9899
Evaluator:
99100
name: Evaluate Tests
100-
needs: [dotnet_provisioner_unit_tests]
101+
needs: [ dotnet_provisioner_unit_tests ]
101102
runs-on: ubuntu-latest
102103
continue-on-error: false
103104
steps:

0 commit comments

Comments
 (0)