refactor(azure): remove legacy hardcoded intermediate certs#51
Conversation
Since flashbots#49 was merged, the attestation generator fetches all intermediate certs and included them in TpmAttest. Therefore we no longer need hardcoded intermediate certs in the source code, as we expect the intermediate certs to be provided by the attestation generator.
|
It looks like we still have a negative test which uses one of the old fixtures, which i think will now fail to verify (if i understand correctly): So the test passes as this is a negative test and an error is expected. But maybe this is a slightly bad/misleading test now, since that attestation cannot be verified in the happy path either. Probably we should remove legacy test assets which will no longer verify against this code, and switch this test to use your new observed attestation. |
|
I labelled this as 'breaks protocol' as it (if i understand correctly) removes support for legacy azure attestations. Its debatable as to whether that should be considered protocol breaking or whether its a question of what Azure deployments we support. And actually your last PR changed the attestation payload format, so that also needs to be labelled 'breaks protocol' too. As already mentioned we don't have production Azure instances currently so i am not concerned about this, and there is another protocol breaking change in an open PR, meaning our next release is likely to be protocol breaking (requiring both sides to be updated) anyway. |
Since #49 was merged, the attestation generator fetches all intermediate certs and includes them in TpmAttest. Therefore we no longer need intermediate certs hardcoded in the verification lib, as we expect the intermediate certs to be provided by the attestation generator.
See discussion here for more context.