Is your feature request related to a problem? Please describe.
Yes. We recently added remote resources integration to the agent using the Key Broker Service (KBS). Currently, cocos-cli and the Manager only support generating and verifying attestation policies for the Manager's initial handshake (
attestation_policy.json
).
However, for remote resources, the KBS strictly controls access to encryption keys and requires its own policy verification to validate the Attestation Agent (AA) running inside the CVM. There is currently no automated way to generate this KBS-compatible policy derived from our build artifacts (like the calculated measurements), forcing users to manually construct policies or disable verification for testing.
relevant pr #575
Describe the feature you are requesting, as well as the possible use case(s) for it.
I request a new subcommand (e.g., cocos-cli policy kbs) that takes the existing
attestation_policy.json as input and generates a policy file in a format supported by the KBS (typically OPA Rego).
Use Case: A user builds a new algorithm image, uses the CLI to calculate its measurement, and generates the standard
attestation_policy.json
. They then run cocos-cli policy kbs to produce a policy.rego file. They upload this policy to their KBS, ensuring that the KBS only releases the decryption keys for the remote datasets/models to a CVM running that exact specific build.
Indicate the importance of this feature to you.
Must-have
Anything else?
The generated policy should align with the default CoCo Attestation Service (AS) policy engine (usually OPA) and ensure it validates against the reference_value or measurement present in our attestation config.
Is your feature request related to a problem? Please describe.
Yes. We recently added remote resources integration to the agent using the Key Broker Service (KBS). Currently, cocos-cli and the Manager only support generating and verifying attestation policies for the Manager's initial handshake (
attestation_policy.json
).
However, for remote resources, the KBS strictly controls access to encryption keys and requires its own policy verification to validate the Attestation Agent (AA) running inside the CVM. There is currently no automated way to generate this KBS-compatible policy derived from our build artifacts (like the calculated measurements), forcing users to manually construct policies or disable verification for testing.
relevant pr #575
Describe the feature you are requesting, as well as the possible use case(s) for it.
I request a new subcommand (e.g., cocos-cli policy kbs) that takes the existing
attestation_policy.json as input and generates a policy file in a format supported by the KBS (typically OPA Rego).
Use Case: A user builds a new algorithm image, uses the CLI to calculate its measurement, and generates the standard
attestation_policy.json
. They then run cocos-cli policy kbs to produce a policy.rego file. They upload this policy to their KBS, ensuring that the KBS only releases the decryption keys for the remote datasets/models to a CVM running that exact specific build.
Indicate the importance of this feature to you.
Must-have
Anything else?
The generated policy should align with the default CoCo Attestation Service (AS) policy engine (usually OPA) and ensure it validates against the reference_value or measurement present in our attestation config.