fix(policy): authenticate peer CoRIM for SVN lookups - #230
Merged
Haitao Huang (haitaohuang) merged 3 commits intoAug 17, 2026
Conversation
Haitao Huang (haitaohuang)
force-pushed
the
squad/229-authenticated-peer-corim-svn-lookup
branch
from
August 15, 2026 04:34
a4b532b to
ffcafd1
Compare
| return Some((policy, issuer_chain, None)); | ||
| } | ||
|
|
||
| // New framing: a `u32` corim_len + corim bytes must follow exactly. |
Collaborator
Author
There was a problem hiding this comment.
no point saying something new/old in code comments
Transport and verify the peer signed CoRIM against its signer anchor, retain the local CRL as authoritative, and resolve both current and initial source hashes through the peer mapping. Refs: microsoft#229 Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
Add pinned Azure/corim installation, signing, and signer-anchor helpers for repository test generation. Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
Generate distinct source and destination CoRIMs with the official CLI. Only the source maps the shared mock TDINFO hash, so the EMU scenario requires lookup through the authenticated peer mapping. Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
Haitao Huang (haitaohuang)
force-pushed
the
squad/229-authenticated-peer-corim-svn-lookup
branch
from
August 15, 2026 04:48
ffcafd1 to
794d7d1
Compare
Haitao Huang (haitaohuang)
requested a review
from Ming-Wei Shih (mingweishih)
August 17, 2026 17:13
Ming-Wei Shih (mingweishih)
approved these changes
Aug 17, 2026
Haitao Huang (haitaohuang)
merged commit Aug 17, 2026
49920ae
into
microsoft:integration
60 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Compatibility
Legacy two-field peer blobs are still accepted. Peers sending the new CoRIM field must both use the updated decoder because older peers reject trailing bytes.
Closes #229