Feat/temenos integration - #107
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d31934b84d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| let client = client_builder.build()?; | ||
|
|
||
| let jwks: JwkSet = client | ||
| .get(MAA_ATTESTATION_URL) |
There was a problem hiding this comment.
When ORACLE_DEV_ACCEPT_ALL=false and validating a real MAA token, this request is sent to the issuer base URL, but MAA signing keys are exposed via the JWT header jku / ${issuer}/certs (the removed verifier pinned and fetched that URL). The base endpoint is not the JWKS used for token verification, so deserializing it as JwkSet or finding the token kid will fail before any valid attestation can be accepted; fetch and pin the jku//certs endpoint instead.
Useful? React with 👍 / 👎.
| } | ||
|
|
||
| if let Err(e) = validate_attestation_jwt(&req.attestation_jwt, state.dev_accept_all) { | ||
| if let Err(e) = validate_attestation_jwt(&req.attestation_jwt, state.dev_accept_all, "13.72.83.138".to_string()).await { |
There was a problem hiding this comment.
For /attest requests from any attester other than 13.72.83.138, this passes a fixed host into validate_attestation_jwt. That value is used to build the DApp attestation URL and resolve the static attestation document for PCR15/root-hash checks, so the quote is checked against the wrong machine's document (or fails to connect), even though client_ip was extracted above and /validate uses it.
Useful? React with 👍 / 👎.
| let app_root_hash: serde_json::Value = serde_json::from_str(&policy_data.1).ok()?; | ||
| let pcr_values: serde_json::Value = serde_json::from_str(&policy_data.2).ok()?; |
There was a problem hiding this comment.
load_policies_from_dir stores policies as (tee_policy, pcrs, app_root_hash), but these lines deserialize policy_data.1 as app_root_hash and policy_data.2 as pcr_values. As a result, GET /policies labels PCR measurements as the app root hash and the app root hash as PCR values for every directory policy, which makes the endpoint misleading for operators or clients consuming it.
Useful? React with 👍 / 👎.
2 participants
No description provided.