dcap-qvl 0.4.0

This crate implements the quote verification logic for DCAP (Data Center Attestation Primitives) in pure Rust.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120

//! # dcap-qvl
//!
//! This crate implements the quote verification logic for DCAP (Data Center Attestation Primitives) in pure Rust. It supports both SGX (Software Guard Extensions) and TDX (Trust Domain Extensions) quotes.
//!
//! # Features
//! - Verify SGX and TDX quotes
//! - Get collateral from PCCS
//! - Extract information from quotes
//!
//! # Usage
//! Add the following dependency to your `Cargo.toml` file to use this crate:
//! ```toml
//! [dependencies]
//! dcap-qvl = "0.1.0"
//! ```
//!
//! # Example
//!
//! ```no_run
//! use dcap_qvl::collateral::CollateralClient;
//! use dcap_qvl::verify::verify;
//! use dcap_qvl::PHALA_PCCS_URL;
//!
//! #[tokio::main]
//! async fn main() {
//!     let quote = std::fs::read("quote").expect("quote file not found");
//!
//!     // Use default Phala PCCS, or override with custom URL
//!     let pccs_url = std::env::var("PCCS_URL").unwrap_or_else(|_| PHALA_PCCS_URL.to_string());
//!     let collateral = CollateralClient::with_default_http(pccs_url)
//!         .expect("failed to build HTTP client")
//!         .fetch(&quote)
//!         .await
//!         .expect("failed to get collateral");
//!
//!     let now = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_secs();
//!     let report = verify(&quote, &collateral, now).expect("failed to verify quote");
//!     println!("{:?}", report);
//! }
//! ```

#![cfg_attr(all(not(test), not(feature = "std")), no_std)]

#[macro_use]
extern crate alloc;

use scale::{Decode, Encode};
use serde::{Deserialize, Serialize};

#[cfg(feature = "borsh_schema")]
use borsh::BorshSchema;
#[cfg(feature = "borsh")]
use borsh::{BorshDeserialize, BorshSerialize};

#[derive(Encode, Decode, Clone, PartialEq, Eq, Debug, Serialize, Deserialize)]
#[cfg_attr(feature = "borsh", derive(BorshSerialize, BorshDeserialize))]
#[cfg_attr(feature = "borsh_schema", derive(BorshSchema))]
pub struct QuoteCollateralV3 {
    pub pck_crl_issuer_chain: String,
    #[serde(with = "serde_bytes")]
    pub root_ca_crl: Vec<u8>,
    #[serde(with = "serde_bytes")]
    pub pck_crl: Vec<u8>,
    pub tcb_info_issuer_chain: String,
    pub tcb_info: String,
    #[serde(with = "serde_bytes")]
    pub tcb_info_signature: Vec<u8>,
    pub qe_identity_issuer_chain: String,
    pub qe_identity: String,
    #[serde(with = "serde_bytes")]
    pub qe_identity_signature: Vec<u8>,
    /// PCK certificate chain (PEM format).
    /// For cert_type 5: extracted from quote during collateral fetch.
    /// For cert_type 3: fetched from PCCS using encrypted PPID.
    /// Used by verify() for offline verification.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub pck_certificate_chain: Option<String>,
}

#[cfg(feature = "report")]
pub mod collateral;

#[cfg(feature = "report")]
pub use collateral::PHALA_PCCS_URL;

pub mod config;
#[cfg(feature = "default-x509")]
pub mod configs;
pub mod crypto;
pub mod oids;
#[cfg(feature = "default-x509")]
pub mod signature;
#[cfg(feature = "default-x509")]
pub mod x509;

mod constants;
pub mod intel;
mod qe_identity;
pub mod tcb_info;
mod utils;

pub use constants::INTEL_QE_VENDOR_ID;

pub mod quote;
pub mod verify;

#[cfg(feature = "python")]
pub mod python;

#[cfg(feature = "go")]
mod ffi;

#[cfg(feature = "python")]
use pyo3::prelude::*;

#[cfg(feature = "python")]
#[pymodule]
fn _dcap_qvl(m: &Bound<'_, PyModule>) -> PyResult<()> {
    python::register_module(m)
}