Affected by GO-2025-3455 and 3 other vulnerabilities

GO-2025-3455: Contrast's unauthenticated recovery allows Coordinator impersonation in github.com/edgelesssys/contrast

GO-2025-3718: Contrast workload secrets leak to logs on INFO level in github.com/edgelesssys/contrast

GO-2025-3807: Contrast vulnerability allows arbitrary host data Injection into container VOLUME mount points in github.com/edgelesssys/contrast

GO-2025-4078: Contrast has insecure LUKS2 persistent storage partitions may be opened and used in github.com/edgelesssys/contrast

authority

package

v0.7.1 Latest Latest Go to latest Published: Jun 24, 2024 License: AGPL-3.0 Imports: 21 Imported by: 0

Details

This section is empty.

This section is empty.

This section is empty.

type Authority struct {
	// contains filtered or unexported fields
}

Authority manages the manifest state of Contrast.

func New(reg *prometheus.Registry, log *slog.Logger) *Authority

New creates a new Authority instance.

func (m *Authority) GetCertBundle(peerPublicKeyHashStr string) (Bundle, error)

GetCertBundle retrieves the certificate bundle created for the peer identified by the given public key.

func (m *Authority) GetManifestsAndLatestCA() ([]*manifest.Manifest, *ca.CA)

GetManifestsAndLatestCA retrieves the manifest history and the currently active CA instance.

func (m *Authority) LatestManifest() (*manifest.Manifest, error)

LatestManifest retrieves the active manifest.

func (m *Authority) SNPValidateOpts(report *sevsnp.Report) (*validate.Options, error)

SNPValidateOpts returns SNP validation options from reference values.

It also ensures that the policy hash in the report's HOSTDATA is allowed by the current manifest.

func (m *Authority) SetManifest(mnfst *manifest.Manifest) error

SetManifest updates the active manifest.

func (m *Authority) ValidateCallback(_ context.Context, report *sevsnp.Report,
	_ asn1.ObjectIdentifier, _, _, peerPubKeyBytes []byte,
) error

ValidateCallback creates a certificate bundle for the verified client.

type Bundle struct {
	WorkloadCert   []byte
	MeshCA         []byte
	IntermediateCA []byte
	RootCA         []byte
}

Bundle is a set of PEM-encoded certificates for Contrast workloads.