Updates the DCAP (Data Center Attestation Primitives) submodule to a newer commit, incorporating the latest PCCS (Provisioning Certificate Caching Service) and upstream changes
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Removed the `#undef __AVX__` line from the SGX-specific preprocessor block in the Abseil patch.
Change needs to be reintroduced in a different manner not impacting upgrades from 2.26 to 2.27 version
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Updated the dcap_source submodule commit reference from `838f26f690ab550ece234faa19c5b1a9b9e84284` to `8b78014ba7e5a0a2beeafb24a13bc903dbb3d640`
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Updates the DCAP submodule commit hash from `3ccb75837871e6685138ec1d3224e55de7bb0bd3` to `838f26f690ab550ece234faa19c5b1a9b9e84284`
---------
Signed-off-by: Krzysztof Sandowicz <krzysztof.sandowicz@intel.com>
Renamed the temporary extraction directory from `.libcbor` to `.tdx_cbor` in the TDX-specific build target to avoid conflicts
Added explicit `cbor_untrusted` phony target and declared it as a dependency for `ttls` and `utls` targets to ensure proper build ordering
Added cleanup rule for the cbor external directory
---------
Signed-off-by: Lukasz A Juzwiuk <lukasz.a.juzwiuk@intel.com>
- Removed OSes from README that were no longer supported
- Added newly supported OSes to README
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Upgraded base Docker image from Ubuntu 20.04 to 22.04
Updated Nix installer from version 2.9.0 to 2.18.0
Added xz-utils to the list of installed packages
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
This driver has been deprecated and no longer maintained by Intel. We recommend the SGX
community to use the SGX driver that was upstreamed into the Linux kernel.
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
New:
- Adding or removing a label which contains "skip-" will trigger a dispatch event,
- Adding a label which contains "refresh-" will trigger a dispatch event.
---------
Signed-off-by: Mateusz Bronk <mateusz.bronk@intel.com>
Updated Nix installation URL from version 2.9.0 to 2.18.0 to meet Nixpkgs minimum requirements
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Switches OpenSSL from version 3.1.6 to 3.0.17 (and from 3.0.13 to 3.0.17 in sample code)
Updates SGXSSL from 3.1.6_Rev1 to 3.0_Rev5 (that runs on OpenSSL 3.0.17)
Updates the dcap_source subproject commit reference to the one relying on OpenSSL 3.0.17 and SGXSSL 3.0_Rev5
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Initialize all Bigint pointer variables to NULL to prevent use of uninitialized values
Replace direct `return (STRTOG_NoMemory)` statements with `goto cleanup_and_return_nomem` to ensure proper resource cleanup
Add cleanup label with Bfree calls to release all allocated Bigint resources before returning
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
This PR fixes a dependency discrepancy for the libsgx-aesm-pce-plugin package between Debian and RPM packaging systems by adding a missing dependency.
---------
Signed-off-by: Sankaranarayanan Venkatasubramanian <sankaranarayanan.venkatasubramanian@intel.com>
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Follow-up of upstream DCAP repo change which added `{deb|rpm}_pccs_admin_tool_pkg` make targets.
Adds corresponding build targets to the top-level `Makefile` (the package is now included in the "local repo" archive).
---------
Signed-off-by: Mateusz Bronk <mateusz.bronk@intel.com>
Follow-up of upstream DCAP repo change which added `intel-tee-pcs-client-tool-*{.deb|.rpm}` packages.
Adds corresponding build targets to the top-level `Makefile` (the package is now included in the "local repo" archive).
---------
Signed-off-by: Mateusz Bronk <mateusz.bronk@intel.com>
Bumped C++ standard from 14 to 17 in the CMake configuration to enable newer OSes
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Ubuntu should be able to build RPM packages without depending on a RHEL/CentOS using rpm tools
---------
Signed-off-by: Sankaranarayanan Venkatasubramanian <sankaranarayanan.venkatasubramanian@intel.com>
Updates the DCAP submodule to a new commit after separating PCCS Admin Tool (into PCCS Admin Tool and PCS Client Tool), moving PCCS related files to a new repository and linking that repository to DCAP repo via submodule.
---------
Signed-off-by: Pawel Krzysztof Blajer <pawel.krzysztof.blajer@intel.com>
Removes `SGX_WHITE_LIST_FILE` enum value and associated URL handling
Eliminates white list configuration parsing and storage
Removes the `update_white_list_by_url()` function and related network operations
---------
Signed-off-by: Krzysztof Sandowicz <krzysztof.sandowicz@intel.com>
* Bumped C++ standard from 14 to 17 in the CMake configuration
* Updated DCAP source submodule to a newer commit with -lpthread flag for GTEST
---------
Signed-off-by: GracjanX Klodkowski <gracjanx.klodkowski@intel.com>
In recent changes to DCAP submodule PCCS paths have been changed. This PR updates to newest submodule and adjusts paths.
---------
Signed-off-by: Pawel Krzysztof Blajer <pawel.krzysztof.blajer@intel.com>
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Adds a cross-platform filename extraction macro that works with both Unix and Windows path separators
Updates production logging to use the cleaner filename format instead of full file paths
Updates the dcap_source submodule to a newer commit
---------
Signed-off-by: Krzysztof Sandowicz <krzysztof.sandowicz@intel.com>
Configure the dcap_source submodule to track the same branch as the current repository instead of being pinned to the main branch
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
The workflow is dormant (skipped) by default (due to env var setting),
but can be enabled on select forks, allowing to intercept branch events
and run additional CI/CD tasks which are external to this repository.
Signed-off-by: Mateusz Bronk <mateusz.bronk@intel.com>
Several updates in DCAP submodule:
* Removing strip operation as debug info is later stripped while creating deb/rpm prod, dev and debug packages
* Bump brace-expansion from 1.1.11 to 1.1.12 in /QuoteGeneration/pccs
* Bump on-headers and morgan in /QuoteGeneration/pccs
* Bump tar-fs from 2.1.2 to 2.1.3 in /QuoteGeneration/pccs
* Update dcap components nuget License.txt to match Intel Simplified Software License (Version October 2022)
* Fix to ensure safe path buffer operations.
* Platform Manifest buffer limited to 256KB for PCKRetrievalTool
* Fixed paths to WDK
* Added fixes to building sgxssl.cmd
* Admin tools inf packaging process updated. Switched to latest prebuilt AE.
* Added path to libsgx_usgxssl
Signed-off-by: Gotowalski, Bartosz <bartosz.gotowalski@intel.com>
Intel® Software Guard Extensions (Intel® SGX) for Linux OS includes the following changes in version 2.26:
- Upgraded to OpenSSL 3.1.6.
- Removed support for the MbedTLS Trusted Library.
- Added support for Red Hat Enterprise Linux Server 9.4 (for x86_64) and SUSE Linux Enterprise Server 15.6 64-bits.
- Added support for the FIPS 140-3 Certifiable OpenSSL Provider as an experimental feature.
- Bug fixes.
Signed-off-by: Gotowalski, Bartosz <bartosz.gotowalski@intel.com>
Upgraded to OpenSSL 3.0.14.
Upgraded Intel(R) Integrated Performance Primitives (IPP) Cryptography library to version
2021.12.1.
Supported FIPS 140-3 Certifiable IPP Crypto based Trusted Library.
Upgraded Intel SGX Architecture Enclaves based on new IPP crypto library.
Upgraded Intel DCAP Quote Verification Enclave to integrate OpenSSL/SgxSSL 3.0.14.
Removed Intel DCAP PCCS from repository.
Added Ubuntu* 24.04 LTS 64-bit Server support.
Fixed bug.
Note that PCCS is not available from this release. Please follow DCAP installation guide to use
`PCCSAdminTool` to retrieve the attestation collaterals or use old version PCCS.
Signed-off-by: Li, Xun <xun.li@intel.com>
Current macros emit an ENDBR instruction between the function label and
corresponding cfi_start, which confuses binary analysis tools like llvm-bolt.
Also add missing cfi_start/end directives for other assembly functions.
See also: https://sourceware.org/binutils/docs/as/CFI-directives.html
Signed-off-by: Jo Van Bulck <jo.vanbulck@cs.kuleuven.be>
Bartosz Gotowalski