AS: tdx-quote verification unit test fails

[mkulke]

there is a tdx quote verification unit test that fails atm. the test is disabled by default, most likely because you need a PCCS configured on the test system.

cargo t -p verifier --no-default-features --features tdx-verifier -- verify_tdx_quote::case_2
    Finished test [unoptimized + debuginfo] target(s) in 0.21s
     Running unittests src/lib.rs (target/debug/deps/verifier-62425084b3596eb5)

running 1 test
test tdx::quote::tests::test_verify_tdx_quote::case_2 ... FAILED

failures:

---- tdx::quote::tests::test_verify_tdx_quote::case_2 stdout ----
thread 'tdx::quote::tests::test_verify_tdx_quote::case_2' panicked at attestation-service/verifier/src/tdx/quote.rs:540:9:
Err(tee_verify_quote failed: 0xe066)
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

failures:
    tdx::quote::tests::test_verify_tdx_quote::case_2

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 76 filtered out; finished in 0.02s

error: test failed, to rerun pass `-p verifier --lib`

We should either remove that test or maybe consider rewriting the logic slightly so that we can store all external dependencies as fixtures for the unit test and cover real verification in an e2e test

[Xynnn007]

I am diving into this.

[Xynnn007]

Well. This quote is generated on Alibaba cloud. GHA should connect to the PCCS of aliyun https://sgx-dcap-server.cn-beijing.aliyuncs.com/sgx/certification/v4/ to get proper collaterals.

[mkulke]

ok, this is what I assumed. Is there a way to store the response of PCCS as a fixture and make the unit tests use that (after refactoring the verification a bit to be able to use use output of tee_qv_get_collateral(quote) as a fixture? (e.g. change ecdsa_quote_verification(quote) signature to ecdsa_quote_verification(quote, signature))

[mythi]

I have requested a DCAP feature to be able to configure the PC(C)S settings more easily. With that, the test case can create a config file with the necessary {collateral_service=...} under, e.g., /tmp and use that so that the test passes. https://github.com/intel/SGXDataCenterAttestationPrimitives/issues/409

[Xynnn007]

@mkulke Yes. I thought I walked a big circle and finally got you at the beginning. Let me try to fix this in both ways -- I prefer to try changing pccs address first