The expr comparison is performing a string comparison and is thus
broken for any GCC version >= 10, preventing use of -fstack-protector-strong
Since GCC 4.9 was released almost 10 years ago (Aug 2016), it is reasonable
to drop the conditional check and assume -fstack-protector-strong is always
available for GCC.
Cherry-picked from external/dcap_source commit 2d483e35e7ebd70d91d88cd4abfd4c097f2e634c
applied to sdk/tvl/Makefile.standalone (file moved from QuoteVerification/dcap_tvl/)
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Updates the dcap_source submodule to a newer commit
Updated the dcap_source submodule commit hash from 9781872 to b1e1aff
---------
Signed-off-by: Krzysztof Sandowicz <krzysztof.sandowicz@intel.com>
Changelogs for packages with modified content updated.
Following header files movement described:
- ADDED `sgx_dcap_constant_val.h` header (from TVL) that includes common QvE and QAE identity verification constants.
- ADDED sgx_dcap_qal_types.h header containing common QAL types extracted from sgx_dcap_qal.h that is a part of libsgx-dcap-quote-verify-dev package
---------
Signed-off-by: Krzysztof1 Wisniewski <krzysztof1.wisniewski@intel.com>
RPM: declare `Obsoletes`/`Conflicts` on `libsgx-dcap-quote-verify-devel < 1.26` to enable clean replacement during upgrades
DEB: add `Replaces`/`Breaks` on `libsgx-dcap-quote-verify-dev (<< 1.26)` so `apt` can resolve the transition automatically
Note: the corresponding changes to the development packages were done in the commit ed8405d
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
SGX Eclipse plugin was deprecated. Removal a source code of the plugin, Eclipse projects files and settings and Eclipse Public License-v1.0 from License.txt file.
---------
Signed-off-by: Lukasz Kalica <lukasz.kalica@intel.com>
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Bump `optimized_libs` and `prebuilt_ae` artifact filenames from `2.28` to `2.29`
Update the checksum config filename to `SHA256SUM_prebuilt_2.29.cfg`
Point the download base URL to the `2.29` directory
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Buffer not null terminated. Calling strncpy with maximum size argument on destination array with the same size might leave the destination string unterminated.
---------
Signed-off-by: Krzysztof1 Wisniewski <krzysztof1.wisniewski@intel.com>
DCAP-specific include file (QAL APIs header) moved back to DCAP.
Set DCAP submodule to version that contains reverted headers.
---------
Signed-off-by: Krzysztof1 Wisniewski <krzysztof1.wisniewski@intel.com>
- Partially reverts ed8405d0fd which included
`sgx_dcap_qal.h` in `libsgx-headers` and transferred ownership of its contents
to this repository.
- The QAL API definitions are now transferred back to DCAP, where the QAL implementation
lives.
- The common structure definitions ( `tee_policy_bundle_t`, `tee_policy_auth_result_t`) which
are shared between SGX (TVL) and DCAP repositories are extracted to a new header
`sgx_dcap_qal_types.h` and kept as part of the SGX repository, with the intent
to also be included by DCAP's 'sgx_dcap_qal.h`.
Additional changes:
--------------------
- SGX SDK installer package and `libsgx-headers` DEB/RPM package's BOM changes:
1) *REMOVE* an SGX-side copy of `sgx_dcap_qal.h` (QAL APIs)
This header is still available via `libsgx-dcap-quote-verify-dev` DEB/RPM package,
matching the exported API of the corresponding `libsgx_dcap_quoteverify.so` library.
2) *ADD* `sgx_dcap_qal_types.h` (QAL types, shared with TVL)
---------
Signed-off-by: Krzysztof1 Wisniewski <krzysztof1.wisniewski@intel.com>
Adds an explicit `return SGX_SUCCESS;` to `sgx_init_crypto_lib`.
Updates the function header comment to reflect the `cpuid_table` parameter.
Adds an include for `sgx_error.h` (though currently via a relative path).
---------
Signed-off-by: Lukasz Juzwiuk <lukasz.a.juzwiuk@intel.com>
distclean target should clean cbor directories as well due to cbor patch content change
Updated copyright header
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Add `-fPIC` to the `$(OBJS4)` (AVX2/CTD) C compilation rule in `sdk/trts/Makefile`.
Updated copyright header
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
This change removes code that has dependencies on EPID related code that was earlier removed
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Compatibility with CMake < 3.5 has been removed from CMake 3.25+. SGXSDK updated to require minimum cmake version set to 3.5. Ubuntu 26.04 switched to cmake 4.2.3 which no longer accept cmake versions lower than 3.5.
The Maintainer field in Debian packaging must follow RFC 2822 email address format.
---------
Signed-off-by: Krzysztof Sandowicz <krzysztof.sandowicz@intel.com>
SGX Protobuf version update to 33.4. Protobuf's dependency Abseil version update to 20250512.1.
---------
Signed-off-by: Anna Platasz <anna.platasz@intel.com>
This fixes `servtd_attest_preparation` target after `libcxxrt` got pushed to a standalone
submodule with one-off patching in 6d89d8ed5a.
* `libcxxrt` is also used in 'servtd_attest' skeleton target (for DCAP's servtd_attest).
Also added heuristic detection of `servtd_attest_preparation` run (pre-req for servtd_attest)
---------
Signed-off-by: Mateusz Bronk <mateusz.bronk@intel.com>
SGX SDK–related attestation headers and the TVL sources originating from DCAP
tag: 'DCAP_1.25' are now relocated:
FROM: the intermediate staging area: './external/from_dcap'
(created by the '[from DCAP][move 1/2]...') commit 5b0b8e9)
INTO: their target SGX SDK repository layout.
This is a follow-on commit that places relocated files in its final locations
and updates the build system accordingly.
Additional changes:
--------------------
- `libsgx-headers` DEB/RPM package now also contains the following 2 headers:
1) sgx_qve_header.h
2) sgx_dcap_qal.h
Leveling w/ SDK - both files were part of the SDK already.
- SDK installer package now also contains the `sgx_dcap_constant_val.h` header
(from TVL), including common QvE and QAE identity verification constants.
---------
Signed-off-by: Krzysztof1 Wisniewski <krzysztof1.wisniewski@intel.com>
SGX SDK–related attestation headers and the TVL sources are relocated from the
DCAP repository (at 229ec6b0d5f1a411b6c96436d664b9ecc018559a, tag: DCAP_1.25)
into the SGX SDK repository layout.
Background
----------
This commit consolidates SGX SDK source code into a single repository, reducing
its dependency count. Although these files historically lived in DCAP, they
already participate in the SDK build and release and have so far been fetched
via the './external/dcap_source' submodule.
Placing SDK-owned definitions directly in the SDK makes ownership explicit,
reduces coupling, and lowers the risk of accidental cross-component API changes.
The TVL is now considered part of the SGX SDK; while it was already distributed
as an SDK library, its sources now live alongside the rest of the SDK.
The DCAP project will continue to use the same definitions via its dependency on
an SDK installation (and 'libsgx-headers', where appropriate).
This preserves existing behavior, as SDK headers already take precedence
over DCAP-local copies.
Mechanics
---------
1. This commit is part of a series. It only imports the required files into the
intermediate './external/from_dcap' directory; the build system does not yet
consume them.
2. Source provenance is preserved. Imported commits originating from DCAP have
their commit subject prefixed with '[from DCAP]' for easier discovery.
Follow-up
---------
- A follow-on commit, marked '[move 2/2]', will place the files in their final
locations and update the build system accordingly.
- A corresponding cleanup change in the DCAP repository will remove the
relocated copies to maintain a single source of truth.
Note: This is a source-code reorganization only; no functional or packaging changes
are introduced.
Signed-off-by: Krzysztof Wisniewski <krzysztof1.wisniewski@intel.com>
Added several new structures to support TD Partitioning
Updated comments for the existing structure
---------
Signed-off-by: Feng Qiu <feng.qiu@intel.com>
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Revert the default behavior of `tcb_level_date_tag` to return the lower TCB date of platform TCB and QE TCB
Add separate `platform_tcb_level_date_tag` to indicate platform TCB level date
Update Appraisal QVL interface to use new `platform_tcb_level_date_tag` to get the platform TCB date
---------
Signed-off-by: Hongyan Jiang <hongyan.jiang@intel.com>
Missing security related compilation/linking flags added
Old C++11 standard removed as 14/17 should be used
---------
Signed-off-by: Anna Platasz <anna.platasz@intel.com>
Upgraded Intel DCAP Quote Verification Enclave to integrate OpenSSL/SgxSSL 3.0.14.
Removed Intel DCAP PCCS from repository.
Added Ubuntu* 24.04 LTS 64-bit Server support.
Fixed bugs.
Note that PCCS is not available from this release. Please follow DCAP installation guide to use
`PCCSAdminTool` to retrieve the attestation collaterals or use old version PCCS.
Signed-off-by: Li, Xun <xun.li@intel.com>
Upgraded Intel DCAP Ring3 Abstraction Layer(R3AAL) library to support
ConfigFS-TSM as communication channel between host and guest for TDX remote
attestation.
Upgraded Intel DCAP Quote Verification Enclave to integrate OpenSSL/SgxSSL 3.0.13.
Upgraded new TDX attestation result “TD_RELAUNCH_ADVISED” in Intel DCAP Quote.
Verification Library(QVL) and Appraisal Engine.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Resigned all Intel SGX Architecture Enclaves.
Upgraded Intel SGX Quote Verification Enclave to integrate OpenSSL/SgxSSL 3.0.10.
Added Attestation Library support for Intel(R) TDX Migration TD.
Added Rust wrapper for low-level Quote Generation APIs.
Enabled `SE_TRACE` log in release binary.
Updated Rust QVL wrapper to use native Rust structure for quote verification
collateral.
Added a limitation in the DCAP QVL to only allow the user to set the QvE load
policy once.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Applied CVE-2023-1255, CVE-2023-0465, and CVE-2023-0466 patches to
SgxSSL/OpenSSL 1.1.1t.
Upgraded to Intel(R) Integrated Performance Primitives (IPP) Cryptography
library version 2021.7.
Upgraded Intel SGX Quote Verification Enclave to integrate updated SgxSSL.
Enhanced the attestation local cache functionality by giving users the option
to provide their own cache file.
Enabled QPL/QCNL log in DCAP samples.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Upgraded Intel SGX Quote Verification Enclave to integrate SgxSSL/OpenSSL
version 1.1.1t
Added new API in quote verification library to extract FMSPC
(Family-Model-SteppingPlatform-CustomSKU) value from ECDSA quote
Added Rust support for SGX ECDSA quote generation
Added Linux kernel 5.19 support in TDX R3AAL (Ring 3 Attestation Abstraction
Layer)
Removed Protobuf in TDX QGS (Quote Generation Service) and R3AAL (Ring 3
Attestation Abstraction Layer)
Fixed bugs
Signed-off-by: Li, Xun <xun.li@intel.com>
Upgraded Intel SGX Quote Verification Enclave to integrate SgxSSL/OpenSSL
version 1.1.1q.
Upgraded Intel SGX QE3 to make it backward compatible.
Improved ECDSA quote generation and verification performance by caching PCK
certificates and collaterals in memory and disk drive.
Added Java support for quote verification library.
Added new APIs to unify Intel SGX and TDX quote verification in Quote
Verification Library.
Added Advisory ID in ECDSA quote verification supplemental data.
Added Intel TDX support in RA-TLS (Remote Attestation based TLS) library.
Improved TDX quote generation throughput in vsock mode.
Added Rust support for TDX quote generation.
Added support for the Linux kernel APIs for the Enclave Dynamic Memory
Management (EDMM) features that are available with the Linux kernel v6.0 or
later. Refer to the SGX SDK developer reference for details on new trusted
APIs and enclave configuration for the EDMM features.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Enhanced QPL (Quote Provider Library) to support caching Intel PCK
(Provisioning Certificate Key) certificate chain in local memory, or
retrieving Intel PCK cert chain from local HTTP/S address.
Upgraded Intel ECDSA Quote Verification Enclave to integrate SgxSSL/OpenSSL
version 1.1.1m.
Introduced Intel ID enclave for QE identity generation.
Fixed bug.
Signed-off-by: Li, Xun <xun.li@intel.com>
Upgraded Intel(R) Integrated Performance Primitives (IPP) Cryptography library to version 2021 update 3.
Upgraded Intel(R) SGX Architecture Enclaves based on new IPP crypto library.
Added support in Intel(R) QPL to retrieve SGX ECDSA quote verification endorsements from Intel(R) PCS.
Updated SGX QVL and QvE to support CRL in different encoding.
Updated SGX QVL and QvE to support CRL in different encoding.
Fixed bugs.
Signed-off-by: Zhang Lili <lili.z.zhang@intel.com>
Upgraded Intel Quote Verification Enclave to integrate SgxSSL/OpenSSL version 1.1.1k.
Updated the DCAP driver V1.33 with stability fixes, released as V1.33.2. This is to
support legacy solutions not ready to transition to the latest DCAP driver V1.41 or
kernel 5.11+.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Upgraded OpenSSL and SgxSSL to latest version 1.1.1i in DCAP components
Added data base migration support in PCCS
Fixed bugs
Signed-off-by: Li, Xun <xun.li@intel.com>
Bartosz Gotowalski