chore(tdx): drop setup-vendor-config, control PCCS via PCCS_URL env var#169
Merged
Conversation
Collaborator
|
@imlk0 ，您好，您的请求已接收，请耐心等待结果。 |
Collaborator
|
@imlk0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。 |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Collaborator
|
@imlk0 ，您好，您的请求已接收，请耐心等待结果。 |
Collaborator
|
@imlk0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。 |
Collaborator
|
@imlk0 ，您好，您的请求已接收，请耐心等待结果。 |
Collaborator
|
@imlk0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。 |
Collaborator
|
@imlk0 ，您好，您的请求已接收，请耐心等待结果。 |
Collaborator
|
@imlk0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。 |
The pure-Rust `builtin-as-tdx-rust` verifier fetches TDX/SGX collateral directly over HTTPS and reads the PCCS endpoint from the `PCCS_URL` environment variable (default: Alibaba Cloud PCCS); it does not touch `/etc/sgx_default_qcnl.conf`. The `setup-vendor-config` tool only edited that conf file for the legacy FFI QPL, so it is dead weight for the default Rust backend. - Delete `scripts/setup-vendor-config` and `docs/setup-vendor-config.md`. - Drop the COPY/chmod of the tool from `Dockerfile` (keep `jq` install). - Remove the `setup-vendor-config` CI job from `shell-scripts.yml` (shellcheck on `scripts/` is retained). - Rewrite the Builtin AS note in `docs/configuration.md` and its Chinese counterpart to document `PCCS_URL` control (default, URL forms, Alibaba Cloud public/VPC endpoints) instead of pointing at the conf file.
The builtin-as-tdx-rust (dcap-qvl) backend pulls in vendored openssl-sys, which builds OpenSSL from source; OpenSSL's Configure requires the IPC::Cmd Perl module that is missing from the minimal an8/alinux CI containers, causing `perl ./Configure` to abort with "Can't locate IPC/Cmd.pm" and failing the build / go-sdk-tests jobs. Install perl-IPC-Cmd (the standalone package providing IPC::Cmd on an8/al8; FindBin/File::Compare/File::Copy already ship with the base perl-interpreter) in: - go-sdk.yml (alinux3 container) - the RPM buildspec prepare phase (AnolisOS8) - the spec BuildRequires (covers test.yml's yum-builddep path)
…ilter go-sdk.yml was the only workflow with a `paths:` filter, gating the Go SDK tests on tng-go/**, tng/**, Cargo.toml, Cargo.lock, and the workflow file itself. That let regressions ship undetected: the Go SDK tests also run `cargo test --package tng-testsuite --features go-sdk`, so they transitively depend on tng-testsuite/, rats-cert/, and the tng binary, none of which were in the paths list. Align the `on:` block with the repo-wide convention (every other workflow triggers on push to master + tags v*.*.* and pull_request to master, no paths): remove the paths filter, drop the legacy sdk-go branch trigger (deleted on the remote), and add tags. Also add a CLAUDE.md section reminding contributors not to add `paths:` filters (or per-feature legacy branch triggers) to new workflows, with the rationale and the canonical `on:` block.
openssl-sys compiles OpenSSL from source (vendored). OpenSSL 3.5.x's Configure/Makefile.in generation needs the Time::Piece Perl module in addition to IPC::Cmd; without it the build fails with 'Can't locate Time/Piece.pm in @inc'. Declare perl(Time::Piece) as a BuildRequires so yum-builddep installs perl-Time-Piece (an8/al8).
cargo vendor packages the trustee git dependency (attestation-service) as just its crate dir (vendor/attestation-service-0.1.0/). Its build.rs compiles ../protos/reference.proto, but protos/ lives outside the package in the trustee repo, so cargo vendor omits it and the offline vendored build fails with 'protoc failed: ../protos/reference.proto: No such file or directory'. Non-vendored builds work because the full git checkout keeps protos/ as a sibling. Extract protos/ at the exact rev pinned in Cargo.lock from cargo's trustee git db into vendor/protos/ during create-tarball, so ../protos/ resolves from the vendored crate dir. Fails loudly if the rev/protos cannot be located.
Add Assisted-by: convention to Git Commit Requirements, replacing the forbidden Co-Authored-By form as the only accepted AI attribution. Document the AGENT_NAME:MODEL_VERSION [TOOL] format and note that the pre-push filter-branch sed preserves Assisted-by while stripping Co-Authored-By. Assisted-by: Claude:claude-opus-4-8
The earlier spec fix (BuildRequires perl(Time::Piece)) only covers paths that resolve deps via yum-builddep on the spec. Two CI paths install perl deps explicitly and still failed: - go-sdk.yml: 'cargo build' hits openssl-sys vendored Configure, which now needs Time::Piece in addition to IPC::Cmd -> 'Can't locate Time/Piece.pm'. - build-rpm.yml (GuanFu/an8 buildspec): rpmbuild's strict BuildRequires check rejects 'perl(Time::Piece) is needed by ...' before %build, since the prepare phase only installed perl-IPC-Cmd. Add perl-Time-Piece to both explicit install lists. clippy.yml is unaffected (it uses yum-builddep on the spec, which already resolves perl(Time::Piece)).
imlk0
force-pushed
the
builtin-tdx-verifier
branch
from
July 14, 2026 10:54
da3d2ca to
0ace238
Compare
Collaborator
|
@imlk0 ，您好，您的请求已接收，请耐心等待结果。 |
Collaborator
|
@imlk0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #862c827 (pure-Rust
builtin-as-tdx-rustDCAP verifier). The Rust backend fetches TDX/SGX collateral over HTTPS and reads the PCCS endpoint from thePCCS_URLenvironment variable (default: Alibaba Cloud PCCS); it does not touch/etc/sgx_default_qcnl.conf. Thesetup-vendor-configtool only edited that conf file for the legacy FFI QPL, so it is dead weight under the new default backend — remove it and documentPCCS_URLinstead.Changes
scripts/setup-vendor-configanddocs/setup-vendor-config.md.COPY/chmodof the tool fromDockerfile(keepjqinstall).setup-vendor-configCI job from.github/workflows/shell-scripts.yml; theshellcheckjob onscripts/is retained.docs/configuration.mdand its Chinese counterpart (docs/configuration_zh.md) to documentPCCS_URLcontrol — default endpoint, accepted URL forms (bare-host and path-suffixed, both normalized by the backend), and the Alibaba Cloud public/VPC endpoint table — instead of pointing at the conf file.Why
PCCS_URLis correctThe verifier's
fetch_collateralnormalizes the value (trim_end_matches('/')then strips a/sgx/certification/v4or/tdx/certification/v4suffix), so bothhttps://sgx-dcap-server.cn-hangzhou.aliyuncs.comandhttps://sgx-dcap-server.cn-hangzhou.aliyuncs.com/sgx/certification/v4/work. UnsetPCCS_URLfalls back tohttps://sgx-dcap-server.cn-beijing.aliyuncs.com.Notes
builtin-as-tdx-ffibackend (which reads/etc/sgx_default_qcnl.conf) is deprecated; this PR targets the default Rust backend.