dcap-qvl 0.4.0

This crate implements the quote verification logic for DCAP (Data Center Attestation Primitives) in pure Rust.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

"""Tests for async collateral API surface.

IMPORTANT: By default, these tests do **not** perform any network I/O.

To run the real (network) collateral retrieval smoke tests, set:

  DCAP_QVL_RUN_NETWORK_TESTS=1

in your environment.
"""

from __future__ import annotations

import inspect
import os

import pytest

from ._async_utils import is_async_callable


dcap_qvl = pytest.importorskip("dcap_qvl")

RUN_NETWORK = os.getenv("DCAP_QVL_RUN_NETWORK_TESTS") == "1"


def test_get_collateral_exported() -> None:
    assert hasattr(dcap_qvl, "get_collateral")
    assert callable(dcap_qvl.get_collateral)


@pytest.mark.asyncio
async def test_get_collateral_returns_awaitable() -> None:
    # Requires a running event loop for some PyO3 async exports.
    # Use an invalid URL and await to completion so no pending task survives
    # interpreter teardown.
    ret = dcap_qvl.get_collateral(
        pccs_url="://invalid-url",
        raw_quote=b"short",
    )
    assert inspect.isawaitable(ret)
    with pytest.raises(ValueError):
        await ret


@pytest.mark.asyncio
@pytest.mark.skipif(
    not RUN_NETWORK,
    reason="Network test disabled (set DCAP_QVL_RUN_NETWORK_TESTS=1 to enable)",
)
async def test_get_collateral_network_smoke() -> None:
    # Intel PCS / PCCS — uses the bundled cert_type 5 SGX sample.
    with open("sample/sgx_quote", "rb") as f:
        raw_quote = f.read()
    collateral = await dcap_qvl.get_collateral(
        pccs_url="https://api.trustedservices.intel.com",
        raw_quote=raw_quote,
    )

    # Just sanity-check shape/types (do NOT assert exact contents)
    assert collateral is not None
    assert isinstance(collateral.root_ca_crl, (bytes, bytearray))
    assert isinstance(collateral.pck_crl, (bytes, bytearray))
    assert isinstance(collateral.tcb_info, str)
    assert isinstance(collateral.qe_identity, str)