Endorsement Store Interface Implementation by shefali-kamal · Pull Request #435 · veraison/services

shefali-kamal · 2026-08-04T12:49:31Z

This PR implements following:

contains the implementation of endorsement store plugin interface
converted coserv proxy plugins to endorsement store plugins
make changes in vts to use the endorsement store plugins
vts now uses a composite store made up of corimstore and store plugins as fallback

Address issue #431

setrofim

I don't think the notion of a "media type" makes sense in the context of the store backend. We don't really want to be selecting the backend based on it. I also don't like the somewhat arbitrary distinction between "primary" and "fallback" backends.

Suggestion: store backends are identified solely by name; for the sake of reusing existing plugin loader/manager the media type APIs implemented via a shim to to just return the name, and this is hidden as much as possible. Store configuration contains a list of backend names, which specifies which frontend plugins will actually be actively used by the store frontend. When servicing requests, the frontend tries the backends in the order specified until.

setrofim · 2026-08-05T09:18:32Z

+
+func NewStore() *DefaultStore {
+	logger := log.Named(PluginName)
+	logger.Debug("initializing default store")


This log line belongs inside DefaultStore.Init() below, not here.

setrofim · 2026-08-05T09:21:33Z

+
+func (s *DefaultStore) Init(params *plugin.Parameters) error {
+	if params == nil {
+		panic("parameters are required for corimstore")


Return an error rather than panic here.

setrofim · 2026-08-05T09:22:42Z

+
+	store, err := corimstore.Open(context.Background(), cfg.StoreConfig())
+	if err != nil {
+		panic(err)


Return the error rather than panic.

setrofim · 2026-08-05T09:22:47Z

+	// initialize it here.
+	if strings.Contains(cfg.DSN, ":memory:") {
+		if err := store.Init(); err != nil {
+			panic(err)


Return the error rather than panic.

setrofim · 2026-08-05T09:29:57Z

+	return SchemeName
+}
+
+func (s *DefaultStore) GetSupportedMediaTypes() map[string][]string {


I don't think the concept of a "supported media type" really makes sense for a store backend. I think we may want a different plugin interface for this.

Since store plugins can also serve CoSERV queries, the supported media types can be the CoSERV media types they support.

That's not really clear from the API though, and even with the old CoSERV implementations this was a bit of a hack. Now that we're officially adding a new type of plugins, unrelated to attestation schemes, I think the general plugin API needs to be rethought, rather than piggybacking on the exiting IPluggable definition that was created with attestation schemes in mind.

setrofim · 2026-08-05T09:35:30Z

+	return res, err
+}
+
+func (s *DefaultStore) ExecuteCoservQuery(mediaType, query string) (*coserv.Coserv, error) {


Why does this take a mediaType? It does not appear to be used, and also clashes with remaining store API that takea label instead. The media type should be resolved to a label by the time the request reaches the store.

setrofim · 2026-08-05T09:36:21Z

 }

-func (s CoservProxyHandler) GetEndorsements(tenantID string, query string) ([]byte, error) {
+func (s CoservProxyHandler) ExecuteCoservQuery(mediaType, query string) (*coserv.Coserv, error) {


Ditto here. the media type should be resolved by this point.

yogeshbdeshpande · 2026-08-07T08:25:02Z


-	if err := o.CoservProxyPluginManager.Close(); err != nil {
-		o.logger.Errorf("coserv plugin manager shutdown failed: %v", err)
+	// FIXME: close stores while closing store manager


Why do we need Line 174..?

Should not the Sore manager be responsible for closing the Stores!

That's correct. But with the current implementation of the store manager, it is not possible. This is because the pluggable interface lacks a Close method, which can be called at the end (similar to the Init method that gets called at the start). The StoreManager.Close method calls the plugin.Client.Kill method on the store plugin client, which terminates the plugin process, without closing the file descriptors and other resources that are in use by the plugin process. The note here was for myself and this should be fixed before the pull request can be merged.

yogeshbdeshpande · 2026-08-07T08:26:11Z


 	coservProxyDerived := c.assembleCoservMediaTypes(
-		c.CoservProxyPluginManager.GetRegisteredMediaTypes(),
+		c.StoreManager.GetRegisteredMediaTypes(),


Agree with Sergei, the Store should not have a Media Type.

The functionality must be changed!

yogeshbdeshpande

Have started reviewing it, will complete by the end of the day today!

thomas-fossati

Thanks for this!

I have inlined a few comments.

thomas-fossati · 2026-08-12T07:35:11Z

+		if err != nil {
+			o.logger.Warnw("could not find in store", "valID", valID, "error", err)


When joining the dots between L526-527 and L532-533, it looks like any store errors will be seen as ENOTFOUND from the pov of the caller. If that's the case, the caller (L446) will log and move on. So, imagine the case where the DB is down, valueTriples stays empty, getValueTriples returns ENOTFONUD, the caller logs a warning and proceeds with nil endorsements into AppraiseEvidence. I don't think it's what we want, right?

All errors other than ENOTFOUND from all the stores are logged as warning (/vts/trustedservices/store.go:122). The reason was to avoid the operation from failing some of the stores are down. But now I realized that this is a bad idea. Will update to return on unexpected store errors.

Checking: do you still plan to address this?

The error is propagated till vts/endorsementstore/store.go, forgot to update the final layer. Will update to throw an error on any store errors other than ENOTFOUND.

thomas-fossati · 2026-08-12T07:37:43Z

+	if err := CloseCorimStore(o.StoreManager); err != nil {
+		o.logger.Errorf("failed to close corim store: %v", err)
 	}

-	if err := o.Store.Close(); err != nil {
-		o.logger.Errorf("store closure failed: %v", err)
+	if err := o.StoreManager.Close(); err != nil {
+		o.logger.Errorf("store plugin manager shutdown failed: %v", err)


Potential ENOCOFFEE :-) Would this effectively result in a double close?

No, StoreManager.Close does not properly close the corim-store (see #435 (comment)). This is a hacky fix and should be fixed before merging the pr.

thomas-fossati · 2026-08-12T07:44:14Z

+	if err != nil {
+		o.logger.Infof("could not find coserv result in store")


What is the reasoning behind masking any error as ENOTFOUND/404?
From a ReST perspective, we want to be able to tell our clinets that there is something wrong with the service (5xx) rather than with their query (4xx).

The API layer seems to treats all errors from VTS as Internal Server Error.

coserv:

services/coserv/api/handler.go

Lines 225 to 231 in f997c52

// Forward query to VTS

res, err := o.EndorsementDistibutor.GetEndorsements(tenantID, coservQuery, mediaType)

if err != nil {

status := http.StatusBadRequest

reportProblem(c, status, err.Error())

return

}

verification:

services/verification/api/handler.go

Lines 414 to 430 in f997c52

// Forward the evidence to the verifier. We expect the verifier to be

// able to cope with bad evidence, so the error here should only be

// reported if something in the verifier or the connection goes wrong.

// Any problems with the evidence are expected to be reported via the

// attestation result.

attestationResult, err := o.Verifier.ProcessEvidence(tenantID, session.Nonce,

evidence, mediaType)

if err != nil {

o.logger.Error(err)

session.SetStatus(StatusFailed)

mustStoreSession(o.SessionManager, session, id, tenantID)

ReportProblem(c,

http.StatusInternalServerError,

"error encountered while processing evidence",

)

return

}

But more context can be added to the error. I will try to do that.

OK, thanks for checking.
I think that's a problem with the frontends that we'll need to fix.
However, first they need to get the right signal from VTS :-)

thomas-fossati · 2026-08-12T07:49:50Z

+
+func (s *DefaultStore) ExecuteCoservQuery(mediaType, query string) (*coserv.Coserv, error) {
+	s.logger.Infof("got coserv query: %v", query)
+	fallbackAuthority, err := comid.NewCryptoKeyTaggedBytes([]byte("dummyauth"))


curious: why we need to use this "dummyauth"?

This is a copy-paste of an older version of the code (before #420). I should update this with the latest changes. Thanks for pointing it out.

thomas-fossati · 2026-08-12T07:50:55Z

+option go_package = "github.com/veraison/services/proto";
+
+message GetEndorsementsArgs {
+  bytes environment = 1 [json_name = "environemnt-map"];


Suggested change

bytes environment = 1 [json_name = "environemnt-map"];

bytes environment = 1 [json_name = "environment-map"];

thomas-fossati · 2026-08-12T07:51:28Z

+	if subs["coserv"].IsSet("signer") {
+		coservContext, err = coserv.NewCoservContextFromViper(subs["coserv"])
+		if err != nil {
+			log.Fatal("CoSERV config initialization: %v", err)


Suggested change

log.Fatal("CoSERV config initialization: %v", err)

log.Fatalf("CoSERV config initialization: %v", err)

DhanusML · 2026-08-26T09:53:08Z

Major changes:

VTS config now includes an active-stores section containing a list of store plugins that will be used (see /vts/endorsementstore for details)
Added Fini method in IPluggable

thomas-fossati

Thanks! I have re-reviewed and added a few comments.

thomas-fossati · 2026-08-31T07:27:19Z

+	maps.Copy(pluginConfig, endorsementStoreConfig)
+
+	log.Debug("loading scheme and endorsement store plugins")
+	psubs, err := config.GetSubs(subs["plugin"], "*go-plugin", "*builtin", "go-plugin-stores")


Should this be made conditional instead?

I suspect this breaks when the services are built with make SCHEME_LOADER=builtin

config for endorsement store plugins are copied to pluginConfig in line 93.

The go-plugin should be renamed to go-plugin-schemes to be consistent with go-plugin-stores.

thomas-fossati · 2026-08-31T07:30:01Z

+	if err := s.Store.Close(); err != nil {
+		s.logger.Errorf("Failed to close corim-store: %v", err)
+		return err
+	}


This could panic if Init failed before assigning s.Store:

Suggested change

if err := s.Store.Close(); err != nil {

s.logger.Errorf("Failed to close corim-store: %v", err)

return err

}

if s.Store != nil {

if err := s.Store.Close(); err != nil {

s.logger.Errorf("Failed to close corim-store: %v", err)

return err

}

}

Generally, Fini() should only be called if Init() succeeds, so it's reasonable to assume that Store has been initialized inside Fini().

OK, then let's panic() on a nil s.Store if that's an invariant

Actually in the current implementation, Fini is also called if Init fails (Close is called to terminate the plugin server if Init fails (goplugin_loader.go:177)).

I will make changes there and also panic on a nil s.Store here

thomas-fossati · 2026-08-31T07:32:28Z

+		if err != nil {
+			o.logger.Warnw("could not find in store", "valID", valID, "error", err)


Checking: do you still plan to address this?

thomas-fossati · 2026-08-31T07:35:00Z

+	if err != nil {
+		o.logger.Infof("could not find coserv result in store")


OK, thanks for checking.
I think that's a problem with the frontends that we'll need to fix.
However, first they need to get the right signal from VTS :-)

thomas-fossati · 2026-08-31T07:37:47Z

+	store := VtsEndorsementStore{
+		logger: logger,
+	}
+	for _, pl := range plugins {


I think we need to explicitly check that the plugins list is not empty here.

thomas-fossati · 2026-08-31T07:39:15Z

+	}
+	var unused any
+	if err := c.client.Call("Plugin.AddCorimBytes", &args, &unused); err != nil {
+		return err


Suggested change

return err

return ParseError(err)

setrofim · 2026-09-03T10:21:09Z

 ├── bin
 ├── certs
 ├── config
+├── endorsementstore


I think the name should make it clearer that the directory contains plugins (rather than the actual store database). Also rather than increasing the number of top-level directories, it would good to move this under plugin/ so that it looks something like

├── plugins ├── schemes │ ├── arm-cca.plugin │ └── ... └── stores ├── corim-store.plugin └── ...

setrofim · 2026-09-03T10:24:56Z

@@ -73,14 +84,10 @@ func (s CoservProxyHandler) addTrustAnchorForInstance(i *coserv.StatefulInstance
 		return err
 	}

-	// TODO(paulhowardarm) - This authority is a dummy value.
+	// TODO(paulhowardarm)


At this point, probably remove the TODO as well

Only the dummy authority issue is resolved. Rest of the points are still todo

setrofim · 2026-09-03T10:27:35Z

+
+.DEFAULT_GOAL := test
+
+GOPKG := github.com/veraison/services/endorsementstore/amd-kds-coserv


Similar to directory naming in the deployment, I would change the package name to make it clearer that this is a plugin maybe store-plugin instead of endorsementstore?

setrofim · 2026-09-03T10:29:26Z

Minor nit, but for consistency call the package corim-store rather than corimstore.

setrofim · 2026-09-03T10:31:24Z

+)
+
+// implement the IEndorsementStore interface for corimstore.Store
+type DefaultStore struct {


Change the name to just Store since this isn't really default in the context of this module.

setrofim · 2026-09-03T10:39:58Z

+	if err := s.Store.Close(); err != nil {
+		s.logger.Errorf("Failed to close corim-store: %v", err)
+		return err
+	}


Generally, Fini() should only be called if Init() succeeds, so it's reasonable to assume that Store has been initialized inside Fini().

setrofim · 2026-09-03T10:47:12Z

+	return SchemeName
+}
+
+func (s *DefaultStore) GetSupportedMediaTypes() map[string][]string {


That's not really clear from the API though, and even with the old CoSERV implementations this was a bit of a hack. Now that we're officially adding a new type of plugins, unrelated to attestation schemes, I think the general plugin API needs to be rethought, rather than piggybacking on the exiting IPluggable definition that was created with attestation schemes in mind.

DhanusML · 2026-09-03T13:22:40Z

 		if err := pluginContext.Handle.Init(params); err != nil {
-			o.logger.Errorf("plugin q: %s", pluginName, err.Error())
+			o.logger.Errorf("plugin %q: %s", pluginName, err.Error())
+			pluginContext.Close()


Close calls Fini and then Client.Kill. But as per https://github.com/veraison/services/pull/435/changes#r3923652647, Fini should only be called during graceful exit. So, this should be changed to pluginContext.client.Kill().

yogeshbdeshpande · 2026-09-07T17:25:31Z

@@ -0,0 +1,148 @@
+// Copyright 2025-2026 Contributors to the Veraison project.
+// SPDX-License-Identifier: Apache-2.0
+package corimstore


the package name should be corim-store

package name should be a valid identifier, so it cannot contain - character (https://go.dev/ref/spec#Package_clause)

The convention is to replace - with _ when mapping directories to package names; so this should be corim_store

yogeshbdeshpande · 2026-09-07T17:26:31Z

+
+const (
+	PluginName = "corim-store"
+	SchemeName = "ANY"


Is it mandatory to have the schemename in the plugin, in theory this is not needed..?

the struct Store should implement IPluggable, which has a method GetAttestationScheme. Right now, scheme name is only used to stub this method.

yogeshbdeshpande · 2026-09-07T17:31:01Z

+		return err
+	}
+
+	// The store must be initialized before it may be used. In general, we


Suggested change

// The store must be initialized before it may be used. In general, we

// The store must be initialized before it can be used. In general, we

yogeshbdeshpande

started reviewing the changes, will complete it by tomorrow

yogeshbdeshpande · 2026-09-07T17:33:32Z

@@ -1 +1 @@
 # Copyright 2021-2026 Contributors to the Veraison project.


This file, is not pertaining to your changes, perhaps, your changes needs re-base so that this file does not appear in this PR.

I assume the comment is on /scheme/tpm-enacttrust/test/cmd/gen-token/main.go. The change was done because copyright check (part of make test) was failing because the file was recently updated (in #449) but the year in the header was not updated.

setrofim · 2026-09-10T10:02:42Z

@@ -0,0 +1,148 @@
+// Copyright 2025-2026 Contributors to the Veraison project.
+// SPDX-License-Identifier: Apache-2.0
+package corimstore


The convention is to replace - with _ when mapping directories to package names; so this should be corim_store

setrofim · 2026-09-10T10:19:14Z

+	maps.Copy(pluginConfig, endorsementStoreConfig)
+
+	log.Debug("loading scheme and endorsement store plugins")
+	psubs, err := config.GetSubs(subs["plugin"], "*go-plugin", "*builtin", "go-plugin-stores")


The go-plugin should be renamed to go-plugin-schemes to be consistent with go-plugin-stores.

setrofim · 2026-09-10T11:08:44Z

+	}
+
+	// for builtin loader
+	builtinPluginConfig := maps.Clone(pluginConfig)


I would drop builtinPluginConfig and just merge endorsementStorePluginConfig into pluginConfig, and later on, pass pluginConfig to all loaders.

We don't want builtin configuration to be in any way different from plugin configuration (the loading method should be as transparent as possible).

As in builtin configuration the same loader is used for both plugin types, it also means that the two types of plugins share a namespace (we cannot have a scheme plugin and a store plugin with the same name). The loader will raise an error (though, as builtin loader is rarely exercised we might miss it), however when copying parameters below, rather an just using maps.Copy(), you need to make sure there are no clashing keys and raise an error.

An alternative, and I think this is the better solution, would be to ensure that store and scheme plugins live in different namespaces. This means using separate loaders, even in built in configuration. This would require modifying the builtin loader to take a list plugins as an argument rather than assuming github.com/veraison/builtin.plugins list. That list can than be split in two -- one for schemes and one for stores.

setrofim · 2026-09-10T11:21:12Z

+	return SchemeName
+}
+
+func (s *Store) GetSupportedMediaTypes() map[string][]string {


So as discussed elsewhere, I don't think media types make sense the context of the store and this should be removed.

The existing plugin code needs to be rejigged to not assume all plugins have associated media types. The simplest, bare minimum, solution would be to return nil here and make sure that gets interpreted correctly by the loader.

A better solution would be to refactor the plugin code so that instead of just

type GoPluginLoader struct { Location string logger *zap.SugaredLogger loadedByName map[string]IPluginContext loadedByMediaType map[string]IPluginContext pluginMap map[string]plugin.Plugin pluginParams map[string]*Parameters registeredPluginTypes map[string]string }

that we have now, we would have

type GoPluginLoader struct { Location string logger *zap.SugaredLogger loadedByName map[string]IPluginContext // This gets specified as Plugins when creating a new go-plugin client. pluginMap map[string]plugin.Plugin pluginParams map[string]*Parameters registeredPluginTypes map[string]string } type MediaTypeGoPluginLoader struct { GoPluginLoader loadedByMediaType map[string]IPluginContext }

And all media type related methods moved into MediaTypeGoPluginLoader which would then correspond a new IMediaTypeLoader interface which contains and extends the existing ILoader. Similar modifications would need to be done to IPluggable and IManager interfaces and their implementations. So the media type functionally is layered on top of general plugin functionality. The schemes will then use the new media type based API, and the stores can use the old API that no longer requires a vestigial media type.

setrofim · 2026-09-10T11:33:21Z

+// AggregateStoreParams aggregates different configurations to create
+// a consolidated parameters map, that can be passed to the store plugin
+// manager. The configurations come from store plugin configuration
+// section, vts configuration section and coserv configuration section.


Rather than doing this, I think it would make more sense to restructure configuration so that all endorsement-store related configuration is in a single section. In particular, the old CoSERV section does not need to exist

coserv configuration should not be merged with the endorsement store
configuration because coserv service is the consumer of coserv configuration.
This pattern is followed in all the services except coserv section, which
contains max-expiry and signer sub-sections, which are used by vts. Maybe this
should be first separated as

# used by coserv service coserv: listen-addr: ... protocol: ... cert: ... cert-key: ... # used by vts coserv-signer: alg: ... key: ... max-expiry: ...

(expiry in the coserv-signer section because max-expiry is also (indirectly)
the validity period of the signature).

Now, the common coserv configuration which all the stores use are max-expiry and
the public part of signing key. Since vts is the primary owner of these
parameters, I decided to let vts parse these configurations and then extract
them from the signer object (coserv.Context) and pass them to the store.

It is possible to move just the expiry parameter to a unified store config, but
the fallback authority will have to be extracted from the signer.

coserv configuration should not be merged with the endorsement store
configuration because coserv service is the consumer of coserv configuration.

Yes, you're right, sorry, I was over-eager with that because I was just looking at vts/cmd/vts-service/config.yaml.

which contains max-expiry and signer sub-sections, which are used by vts. Maybe this should be first separated as [...]

Yes, moving that is probably the right thing to do. Actually, I think both singer and max-expiry can just move under endorsement-store; and active-store (currently under vts) should move there as well. This will remove the need for AggregateStoreParams() as everything will be in a single sub and can be loaded using the normal config loading mechanism.

EDIT: the names should probably change to make it clearer what the configs control; so the config would look something like

endorsement-store: coserv-signer: alg: ES256 key: ./skey.jwk coserv-max-expiry: 1m active-plugins: - corim-store plugin-parameters: corim-store: dbms: sqlite3 dsn: file::memory:?cache=shared trace-sql: false

setrofim · 2026-09-10T11:37:30Z

+}
+
+// Create StoreCommonParams from a coservContext
+func CreateStoreCommonParams(coservContext *vtscoserv.Context) (*plugin.Parameters, error) {


This seems.. backwards. The context should be created from the config parameters and not the other way round.

setrofim · 2026-09-10T11:39:40Z

+func CreateEndorsementStore(plugins []string, manager StoreManager, logger *zap.SugaredLogger) (handler.IEndorsementStore, error) {
+	if len(plugins) == 0 {
+		err := errors.New("no plugins in `active-stores` list")
+		logger.Errorf("could not create endorsementstore: %v", err)


Do not log here. The error is returned and should be handled (including logging it) by the calling context.

setrofim · 2026-09-10T11:40:06Z

+
+func CreateEndorsementStore(plugins []string, manager StoreManager, logger *zap.SugaredLogger) (handler.IEndorsementStore, error) {
+	if len(plugins) == 0 {
+		err := errors.New("no plugins in `active-stores` list")


Suggested change

err := errors.New("no plugins in `active-stores` list")

err := errors.New("no names in `active-stores` list")

setrofim · 2026-09-10T11:40:25Z

+	return s.stores, nil
+}
+
+func CreateEndorsementStore(plugins []string, manager StoreManager, logger *zap.SugaredLogger) (handler.IEndorsementStore, error) {


rename plugins to pluginNames

thomas-fossati

a few more comments

thomas-fossati · 2026-09-15T12:50:35Z

  go-plugin:
    dir: ../../../scheme/bin/


this should go, right?

Correct. go-plugin should be changed to go-plugin-schemes. Thanks for pointing it out. Same shoudl be done in vts/cmd/vts-service/config.yaml.

thomas-fossati · 2026-09-15T12:56:37Z

+	// CoSERV interface would be disabled.
+	if s.CoservCfg == nil {
+		s.logger.Errorf("store is not configured for CoSERV")
+		return nil, errors.New("missing configurations for CoSERV service")


shouldn't this return one of the errors handled by logOrErr() (i.e., errnotfound/errunsupported)? I think we want ExecuteCoservQuery to skip to the next active store rather than stop the loop.

This is neither of those errors. Instead this is a misconfiguration because this happens when trying to execute coserv query when the store is not configured for coserv. This can be caught in Init by throwing an error if coserv config is not being passed but that would cause store initialization to fail on deployments that do not enable coserv service.

Note that CoservCfg is passed from vts to all store plugins if the config.yaml contains coserv configurations.

This is neither of those errors. Instead this is a misconfiguration because this happens when trying to execute coserv query when the store is not configured for coserv.

ok, but if this is a misconfiguration, it shouldn't reach this deep.

This can be caught in Init by throwing an error if coserv config is not being passed but that would cause store initialization to fail on deployments that do not enable coserv service.

tricky.

Note that CoservCfg is passed from vts to all store plugins if the config.yaml contains coserv configurations.

so, is the error even possible? If not, panic'ing is probably a better option.

thomas-fossati · 2026-09-15T13:05:01Z

-}
+	resp, err := o.endorsementStore.ExecuteCoservQuery(profile, queryIn.Query)
+	if err != nil {
+		o.logger.Infof("could not find coserv result in store")


please attach the original error to the log message or it'll get lost. (there may be other errors than ENOTFOUND that are worth surfacing.)

thomas-fossati · 2026-09-15T13:08:09Z

+		s.logger.Errorf("failed to fetch store list: %v", err)
+		return err
+	}
+	store := stores[0] // stores is guaranteed to contain at least one entry


question: how can we be sure that stores[0] is not read-only?

If stores[0] does not support write operation, in the current implementation, endorsement provisioning will fail. So the user should make sure that the first store in the list is not read-only. Since the default configurations had corim-store as the first entry, this was fine. Maybe a better approach would be to try AddCorimBytes until a store does not return ErrUnsupported.

If stores[0] does not support write operation, in the current implementation, endorsement provisioning will fail. So the user should make sure that the first store in the list is not read-only. Since the default configurations had corim-store as the first entry, this was fine.

ok. Is this assumption clearly documented?

Maybe a better approach would be to try AddCorimBytes until a store does not return ErrUnsupported.

definitely :-)

Maybe a better approach would be to try AddCorimBytes until a store does not return ErrUnsupported.

definitely :-)

Actually, I'm not sure that's necessarily a great idea, since it's not immediately obvious where writes will be directed to. I think a better solution would be to ensure that the first (highest priority) store is writable. And rather than relying to catching and handling ErrNotSupported, the store API should be extended with a method for querying its capabilities (e.g. if it's writable); that way, this can be validated during initialization.

Maybe a better approach would be to try AddCorimBytes until a store does not return ErrUnsupported.

definitely :-)

Actually, I'm not sure that's necessarily a great idea, since it's not immediately obvious where writes will be directed to. I think a better solution would be to ensure that the first (highest priority) store is writable. And rather than relying to catching and handling ErrNotSupported, the store API should be extended with a method for querying its capabilities (e.g. if it's writable); that way, this can be validated during initialization.

that's an even better approach. Though it's a bit more intrusive.

thomas-fossati · 2026-09-15T13:12:06Z

+func (s *CoservProxyHandler) Init(params *plugin.Parameters) error {
+	var cfg vtsstore.StoreCommonParams
+	if err := (&cfg).FromParams(params); err != nil {
+		s.StoreCommonParams = nil


please add a warning-level log here

If plugin initialization fails, kill the plugin process. Otherwise, the plugin server process runs in the background and is not terminated even when the service exits. Also fix typo in logging (q -> %q) Signed-off-by: Dhanus M Lal <Dhanus.MLal@fujitsu.com>

Add method to join two parameter objects Signed-off-by: Dhanus M Lal <Dhanus.MLal@fujitsu.com>

Add Fini method in IPlugable that can be called to free the resources used by the plugin. The plugin loader now calls this method before killing the plugin process. Signed-off-by: Dhanus M Lal <Dhanus.MLal@fujitsu.com>

Definition of protobuf messages used as arguments for endorsement store interface. Signed-off-by: Dhanus M Lal <Dhanus.MLal@fujitsu.com>

The store plugin interface definition and implementation of the RPC layer (for go-plugin client and server). Endorsement store interface contains methods for 1. Fetching key and value triples using environment map 2. Fetching CoSERV result by passing a CoSERV query as input 3. Adding CoRIM bytes to the store Signed-off-by: Dhanus M Lal <Dhanus.MLal@fujitsu.com>

CreateGoPluginManager now takes pluginClass as an additional input, which specifies the subsection under plugin that should be used by the manager to load plugins from. Signed-off-by: Dhanus M Lal <Dhanus.MLal@fujitsu.com>

VTS uses a store composed of multiple store plugins. For each store operation (except addition), the operation is iterated over the component stores until a match is found. The store plugins to be used by vts are passed as a list in the vts configuration in the active-stores section. The store plugins may take initialization parameters, these are passed to them via the plugin parameters. Some configurations are common for all plugins. Such parameters are broadcasted to all the active store plugins. Examples of such config parameters include the CoSERV configuration (default expiry time of the results and a fallback authority for adding the service's authority in the quads). This commit converts the existing corim-store into a store plugin. The coserv proxy plugins have also been converted into store plugins, with only the ExecuteCoservQuery method implemented. The following store plugins are now available * corim-store * amd-kds-coserv-proxy-handler * nvidia-coserv-proxy-handler The native and docker deployments are updtated to use all these stores in this order in the active-stores list. BREAKING CHANGE: Existing configurations won't work anymore because the store section of the config (which had corim-store configuration) is now part of the corim-store plugin parameter. For the native and docker deployments, the directory structure of plugin binaries have also changed. In the plugins section, go-plugins subsection containing the plugin loading configuration has been renamed to go-plugin-schemes (now for scheme plugins) and a new section go-plugin-stores has been added for store plugins. Signed-off-by: Dhanus M Lal <Dhanus.MLal@fujitsu.com>

Signed-off-by: Dhanus M Lal <Dhanus.MLal@fujitsu.com>

setrofim · 2026-09-17T08:12:36Z

-	subs, err := config.GetSubs(v, "store", "po-store",
-		"*po-agent", "plugin", "*vts", "ear-signer", "*coserv", "*logging", "*scheme")
+	subs, err := config.GetSubs(v, "po-store",
+		"*po-agent", "plugin", "*vts", "ear-signer", "*coserv-signer",


I don't think the coserv-signer sub is ever used?

setrofim requested changes Aug 5, 2026

View reviewed changes

yogeshbdeshpande reviewed Aug 7, 2026

View reviewed changes

THS-on requested a review from thomas-fossati August 11, 2026 15:37

thomas-fossati reviewed Aug 12, 2026

View reviewed changes

shefali-kamal force-pushed the main branch from 3b90932 to de59141 Compare August 26, 2026 09:22

shefali-kamal requested review from setrofim, thomas-fossati and yogeshbdeshpande August 26, 2026 09:28

shefali-kamal force-pushed the main branch from de59141 to 7fb41ad Compare August 28, 2026 04:37

thomas-fossati reviewed Aug 31, 2026

View reviewed changes

shefali-kamal force-pushed the main branch 2 times, most recently from f32357f to c27bcbb Compare September 3, 2026 07:33

setrofim reviewed Sep 3, 2026

View reviewed changes

DhanusML reviewed Sep 3, 2026

View reviewed changes

shefali-kamal force-pushed the main branch from c27bcbb to 5cf2e26 Compare September 7, 2026 16:06

shefali-kamal requested review from setrofim and thomas-fossati September 7, 2026 16:20

yogeshbdeshpande reviewed Sep 7, 2026

View reviewed changes

shefali-kamal force-pushed the main branch from 5cf2e26 to 60d507f Compare September 9, 2026 05:51

setrofim reviewed Sep 10, 2026

View reviewed changes

shefali-kamal force-pushed the main branch from 60d507f to 6d4a571 Compare September 15, 2026 06:06

thomas-fossati reviewed Sep 15, 2026

View reviewed changes

DhanusML added 2 commits September 15, 2026 22:54

feat(plugin/parameters): add merge method

8069ddd

Add method to join two parameter objects Signed-off-by: Dhanus M Lal <Dhanus.MLal@fujitsu.com>

DhanusML added 6 commits September 15, 2026 22:54

feat(plugin): add Fini method in IPluggable

a781454

Add Fini method in IPlugable that can be called to free the resources used by the plugin. The plugin loader now calls this method before killing the plugin process. Signed-off-by: Dhanus M Lal <Dhanus.MLal@fujitsu.com>

feat(proto): protobuf definitions for store

157e2a0

Definition of protobuf messages used as arguments for endorsement store interface. Signed-off-by: Dhanus M Lal <Dhanus.MLal@fujitsu.com>

fix(plugin): set plugin class when creating manager

18effe3

CreateGoPluginManager now takes pluginClass as an additional input, which specifies the subsection under plugin that should be used by the manager to load plugins from. Signed-off-by: Dhanus M Lal <Dhanus.MLal@fujitsu.com>

chore(config): update copyright header

c87b9c2

Signed-off-by: Dhanus M Lal <Dhanus.MLal@fujitsu.com>

shefali-kamal force-pushed the main branch from 6d4a571 to c87b9c2 Compare September 16, 2026 15:02

setrofim reviewed Sep 17, 2026

View reviewed changes

Comment thread vts/cmd/vts-service/main.go

		if err != nil {
		o.logger.Warnw("could not find in store", "valID", valID, "error", err)

		if err != nil {
		o.logger.Infof("could not find coserv result in store")

	// Forward query to VTS
	res, err := o.EndorsementDistibutor.GetEndorsements(tenantID, coservQuery, mediaType)
	if err != nil {
	status := http.StatusBadRequest
	reportProblem(c, status, err.Error())
	return
	}

	// Forward the evidence to the verifier. We expect the verifier to be
	// able to cope with bad evidence, so the error here should only be
	// reported if something in the verifier or the connection goes wrong.
	// Any problems with the evidence are expected to be reported via the
	// attestation result.
	attestationResult, err := o.Verifier.ProcessEvidence(tenantID, session.Nonce,
	evidence, mediaType)
	if err != nil {
	o.logger.Error(err)
	session.SetStatus(StatusFailed)
	mustStoreSession(o.SessionManager, session, id, tenantID)
	ReportProblem(c,
	http.StatusInternalServerError,
	"error encountered while processing evidence",
	)
	return
	}

	bytes environment = 1 [json_name = "environemnt-map"];
	bytes environment = 1 [json_name = "environment-map"];

	log.Fatal("CoSERV config initialization: %v", err)
	log.Fatalf("CoSERV config initialization: %v", err)


		.DEFAULT_GOAL := test

		GOPKG := github.com/veraison/services/endorsementstore/amd-kds-coserv

	// The store must be initialized before it may be used. In general, we
	// The store must be initialized before it can be used. In general, we

		@@ -1 +1 @@
		# Copyright 2021-2026 Contributors to the Veraison project.

	err := errors.New("no plugins in `active-stores` list")
	err := errors.New("no names in `active-stores` list")

Conversation

shefali-kamal commented Aug 4, 2026

Uh oh!

setrofim left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yogeshbdeshpande left a comment

Choose a reason for hiding this comment

Uh oh!

thomas-fossati left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DhanusML commented Aug 26, 2026

Uh oh!

thomas-fossati left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment