Repository navigation
Conversation
…ck to no attestation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The Docker and Compose examples omit local attestation settings, causing the documented walkthrough to fail on non-CVM hosts.
1 open issue
What changed in this PR
This PR makes HTTP proxy and TCP tunnel commands fail at startup when automatic local attestation detection finds no supported platform, rather than silently proceeding without attestation.
Changes:
- Adds a shared generator builder requiring explicit
noneto disable local attestation. - Moves detection earlier in HTTP and TCP startup and adds validation tests.
- Documents the new default behavior and opt-out flags.
| File | Description |
|---|---|
| README.md | Explains automatic detection failures and explicit opt-out options. |
| crates/attested-tls-proxy/TCP_TUNNEL.md | Updates tunnel attestation option documentation. |
| crates/attested-tls-proxy/src/cli/tcp_tunnel.rs | Uses the shared builder before loading TLS credentials. |
| crates/attested-tls-proxy/src/cli/http.rs | Uses the shared builder before health-check and TLS setup. |
| crates/attested-tls-proxy/src/cli/attestation.rs | Adds platform validation, actionable errors, and unit tests. |
Review effort: Balanced
Comment on lines
+83
to
+85
| The HTTP and TCP tunnel client/server commands default to `auto` when the local | ||
| attestation type is omitted. If no supported attestation platform is detected, | ||
| startup fails. To run without local attestation, explicitly pass |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This changes the behavior of attestation platform detection when the attestation type is set to 'auto'.
We assume that if the caller wants to detect the platform, they want some sort of attestation. So if none is detected, we should bail with an error rather than proceeding without attestation as before. This addresses issues we have had with attestation detection failing when we do actually want attestation.