Verify a quoted public key using the verifier service Returns (public_key, app_info)
(&self, quoted_key: &QuotedPublicKey)
| 159 | /// Verify a quoted public key using the verifier service |
| 160 | /// Returns (public_key, app_info) |
| 161 | async fn verify_quoted_key(&self, quoted_key: &QuotedPublicKey) -> Result<(Vec<u8>, AppInfo)> { |
| 162 | let public_key = |
| 163 | hex::decode("ed_key.public_key).context("invalid hex in public_key")?; |
| 164 | |
| 165 | if quoted_key.quote.is_empty() { |
| 166 | bail!("empty quote for public key"); |
| 167 | } |
| 168 | |
| 169 | // Parse the GetQuoteResponse from the quote field |
| 170 | let quote_response: GetQuoteResponse = |
| 171 | serde_json::from_str("ed_key.quote).context("failed to parse quote response")?; |
| 172 | |
| 173 | // Build verification request |
| 174 | let verify_request = VerificationRequest { |
| 175 | quote: hex::encode("e_response.quote), |
| 176 | event_log: quote_response.event_log, |
| 177 | vm_config: quote_response.vm_config, |
| 178 | pccs_url: self.pccs_url.clone(), |
| 179 | }; |
| 180 | |
| 181 | // Call verifier |
| 182 | let verify_url = format!("{}/verify", self.verifier_url.trim_end_matches('/')); |
| 183 | let response = self |
| 184 | .client |
| 185 | .post(&verify_url) |
| 186 | .json(&verify_request) |
| 187 | .send() |
| 188 | .await |
| 189 | .context("failed to call verifier")?; |
| 190 | |
| 191 | if !response.status().is_success() { |
| 192 | bail!("verifier returned HTTP {}", response.status().as_u16()); |
| 193 | } |
| 194 | |
| 195 | let verify_response: VerificationResponse = response |
| 196 | .json() |
| 197 | .await |
| 198 | .context("failed to parse verifier response")?; |
| 199 | |
| 200 | if !verify_response.is_valid { |
| 201 | bail!( |
| 202 | "quote verification failed: {}", |
| 203 | verify_response.reason.unwrap_or_default() |
| 204 | ); |
| 205 | } |
| 206 | |
| 207 | // Verify report_data matches expected value |
| 208 | let expected_report_data = Self::compute_expected_report_data(&public_key); |
| 209 | let expected_hex = hex::encode(expected_report_data); |
| 210 | |
| 211 | let actual_report_data = verify_response |
| 212 | .details |
| 213 | .report_data |
| 214 | .context("verifier did not return report_data")?; |
| 215 | |
| 216 | if actual_report_data != expected_hex { |
| 217 | bail!( |
| 218 | "report_data mismatch: expected {}, got {}", |