tpm-key_attestation 0.14.0 → 0.14.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/actions/install-openssl/action.yml +36 -0
- data/.github/actions/install-ruby/action.yml +68 -0
- data/.github/workflows/build.yml +61 -7
- data/Appraisals +4 -0
- data/CHANGELOG.md +8 -0
- data/Gemfile +1 -1
- data/Gemfile.lock +20 -11
- data/gemfiles/openssl_2_1.gemfile +1 -1
- data/gemfiles/openssl_2_2.gemfile +1 -1
- data/gemfiles/openssl_3_0.gemfile +1 -1
- data/gemfiles/openssl_3_1.gemfile +1 -1
- data/gemfiles/openssl_3_2.gemfile +1 -1
- data/gemfiles/openssl_3_3.gemfile +12 -0
- data/lib/tpm/aik_certificate.rb +14 -5
- data/lib/tpm/key_attestation/version.rb +1 -1
- data/lib/tpm/openssl_helper.rb +9 -0
- metadata +6 -2
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: ac67cd1f8602f280de57b3a79c3d9d2f204ee1d94957bc0f6fab02a5d8266bc1
|
4
|
+
data.tar.gz: 2fac7ff34e04e53b94d2b98c3dddac46a32539d577c6ef37bd2bb82a9b742cf6
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 9e1a57b93516d73c96a8511cf9829f520bda4945dce30de0ea6a4b2d82ec8e61409f7cc2fa406c322cfb88a8e5d31afdd1b116713f142b560d4937fe258c4cec
|
7
|
+
data.tar.gz: ab57e0026ee79af4de43959785435612f65b776e44ba0dfe17c12e070717630ea758e76adb401f8e045bbeb6bc51ca55cc19b369e46f466d2218bf55b9763bd3
|
@@ -0,0 +1,36 @@
|
|
1
|
+
name: Install OpenSSL
|
2
|
+
inputs:
|
3
|
+
version:
|
4
|
+
description: 'The version of OpenSSL to install'
|
5
|
+
required: true
|
6
|
+
os:
|
7
|
+
description: 'The operating system to install OpenSSL on'
|
8
|
+
required: true
|
9
|
+
runs:
|
10
|
+
using: 'composite'
|
11
|
+
steps:
|
12
|
+
- name: Cache OpenSSL library
|
13
|
+
id: cache-openssl
|
14
|
+
uses: actions/cache@v4
|
15
|
+
with:
|
16
|
+
path: ~/openssl
|
17
|
+
key: openssl-${{ inputs.version }}-${{ inputs.os }}
|
18
|
+
|
19
|
+
- name: Compile OpenSSL library
|
20
|
+
if: steps.cache-openssl.outputs.cache-hit != 'true'
|
21
|
+
shell: bash
|
22
|
+
run: |
|
23
|
+
mkdir -p tmp/build-openssl && cd tmp/build-openssl
|
24
|
+
case ${{ inputs.version }} in
|
25
|
+
1.1.*)
|
26
|
+
OPENSSL_COMMIT=OpenSSL_
|
27
|
+
OPENSSL_COMMIT+=$(echo ${{ inputs.version }} | sed -e 's/\./_/g')
|
28
|
+
git clone -b $OPENSSL_COMMIT --depth 1 https://github.com/openssl/openssl.git .
|
29
|
+
echo "Git commit: $(git rev-parse HEAD)"
|
30
|
+
./Configure --prefix=$HOME/openssl --libdir=lib linux-x86_64
|
31
|
+
make depend && make -j4 && make install_sw
|
32
|
+
;;
|
33
|
+
*)
|
34
|
+
echo "Don't know how to build OpenSSL ${{ inputs.version }}"
|
35
|
+
;;
|
36
|
+
esac
|
@@ -0,0 +1,68 @@
|
|
1
|
+
name: Install Ruby
|
2
|
+
inputs:
|
3
|
+
version:
|
4
|
+
description: 'The version of Ruby to install'
|
5
|
+
required: true
|
6
|
+
os:
|
7
|
+
description: 'The operating system to install Ruby on'
|
8
|
+
required: true
|
9
|
+
runs:
|
10
|
+
using: 'composite'
|
11
|
+
steps:
|
12
|
+
- name: Cache Ruby
|
13
|
+
id: ruby-cache
|
14
|
+
uses: actions/cache@v4
|
15
|
+
with:
|
16
|
+
path: ~/rubies/ruby-${{ inputs.version }}
|
17
|
+
key: ruby-${{ inputs.version }}-${{ inputs.os }}-openssl-1.1.1w
|
18
|
+
|
19
|
+
- name: Install Ruby
|
20
|
+
if: steps.ruby-cache.outputs.cache-hit != 'true'
|
21
|
+
shell: bash
|
22
|
+
run: |
|
23
|
+
latest_patch=$(curl -s https://cache.ruby-lang.org/pub/ruby/${{ inputs.version }}/ \
|
24
|
+
| grep -oP "ruby-${{ inputs.version }}\.\d+\.tar\.xz" \
|
25
|
+
| grep -oP "\d+(?=\.tar\.xz)" \
|
26
|
+
| sort -V | tail -n 1)
|
27
|
+
|
28
|
+
wget https://cache.ruby-lang.org/pub/ruby/${{ inputs.version }}/ruby-${{ inputs.version }}.${latest_patch}.tar.xz
|
29
|
+
tar -xJvf ruby-${{ inputs.version }}.${latest_patch}.tar.xz
|
30
|
+
cd ruby-${{ inputs.version }}.${latest_patch}
|
31
|
+
./configure --prefix=$HOME/rubies/ruby-${{ inputs.version }} --with-openssl-dir=$HOME/openssl
|
32
|
+
make
|
33
|
+
make install
|
34
|
+
|
35
|
+
- name: Update PATH
|
36
|
+
shell: bash
|
37
|
+
run: |
|
38
|
+
echo "~/rubies/ruby-${{ inputs.version }}/bin" >> $GITHUB_PATH
|
39
|
+
|
40
|
+
- name: Install Bundler
|
41
|
+
shell: bash
|
42
|
+
run: |
|
43
|
+
case ${{ inputs.version }} in
|
44
|
+
2.7* | 3.*)
|
45
|
+
echo "Skipping Bundler installation for Ruby ${{ inputs.version }}"
|
46
|
+
;;
|
47
|
+
2.5* | 2.6*)
|
48
|
+
gem install bundler -v '~> 2.3.0'
|
49
|
+
;;
|
50
|
+
*)
|
51
|
+
echo "Don't know how to install Bundler for Ruby ${{ inputs.version }}"
|
52
|
+
;;
|
53
|
+
esac
|
54
|
+
|
55
|
+
- name: Cache Bundler Install
|
56
|
+
id: bundler-cache
|
57
|
+
uses: actions/cache@v4
|
58
|
+
env:
|
59
|
+
GEMFILE: ${{ env.BUNDLE_GEMFILE || 'Gemfile' }}
|
60
|
+
with:
|
61
|
+
path: ./vendor/bundle
|
62
|
+
key: bundler-ruby-${{ inputs.version }}-${{ inputs.os }}-${{ hashFiles(env.Gemfile, 'tpm-key_attestation.gemspec') }}
|
63
|
+
|
64
|
+
- name: Install dependencies
|
65
|
+
shell: bash
|
66
|
+
run: |
|
67
|
+
bundle config set --local path ../vendor/bundle
|
68
|
+
bundle install
|
data/.github/workflows/build.yml
CHANGED
@@ -7,23 +7,35 @@
|
|
7
7
|
|
8
8
|
name: build
|
9
9
|
|
10
|
-
on:
|
11
|
-
push:
|
12
|
-
branches: [master]
|
13
|
-
pull_request:
|
14
|
-
types: [opened, synchronize]
|
10
|
+
on: push
|
15
11
|
|
16
12
|
jobs:
|
13
|
+
lint:
|
14
|
+
runs-on: ubuntu-latest
|
15
|
+
|
16
|
+
steps:
|
17
|
+
- name: Check out repository code
|
18
|
+
uses: actions/checkout@v4
|
19
|
+
|
20
|
+
- name: Set up Ruby
|
21
|
+
uses: ruby/setup-ruby@v1
|
22
|
+
with:
|
23
|
+
ruby-version: '3.4'
|
24
|
+
bundler-cache: true
|
25
|
+
|
26
|
+
- name: Lint code for consistent style
|
27
|
+
run: bundle exec rubocop -f github
|
17
28
|
test:
|
18
29
|
runs-on: ${{ matrix.os }}
|
19
30
|
strategy:
|
20
31
|
fail-fast: false
|
21
32
|
matrix:
|
22
33
|
os:
|
23
|
-
- ubuntu-
|
34
|
+
- ubuntu-24.04
|
24
35
|
- windows-latest
|
25
36
|
- macos-13
|
26
37
|
ruby:
|
38
|
+
- '3.4'
|
27
39
|
- '3.3'
|
28
40
|
- '3.2'
|
29
41
|
- '3.1'
|
@@ -38,6 +50,7 @@ jobs:
|
|
38
50
|
- openssl_3_0
|
39
51
|
- openssl_3_1
|
40
52
|
- openssl_3_2
|
53
|
+
- openssl_3_3
|
41
54
|
exclude:
|
42
55
|
- ruby: '2.4'
|
43
56
|
gemfile: openssl_3_0
|
@@ -53,6 +66,12 @@ jobs:
|
|
53
66
|
gemfile: openssl_3_2
|
54
67
|
- ruby: '2.6'
|
55
68
|
gemfile: openssl_3_2
|
69
|
+
- ruby: '2.4'
|
70
|
+
gemfile: openssl_3_3
|
71
|
+
- ruby: '2.5'
|
72
|
+
gemfile: openssl_3_3
|
73
|
+
- ruby: '2.6'
|
74
|
+
gemfile: openssl_3_3
|
56
75
|
- ruby: '3.1'
|
57
76
|
gemfile: openssl_2_2
|
58
77
|
os: macos-13
|
@@ -83,13 +102,48 @@ jobs:
|
|
83
102
|
- ruby: '3.3'
|
84
103
|
gemfile: openssl_2_1
|
85
104
|
os: windows-latest
|
105
|
+
- ruby: '3.4'
|
106
|
+
gemfile: openssl_2_2
|
107
|
+
os: macos-13
|
108
|
+
- ruby: '3.4'
|
109
|
+
gemfile: openssl_2_1
|
110
|
+
os: macos-13
|
111
|
+
- ruby: '3.4'
|
112
|
+
gemfile: openssl_2_2
|
113
|
+
os: windows-latest
|
114
|
+
- ruby: '3.4'
|
115
|
+
gemfile: openssl_2_1
|
116
|
+
os: windows-latest
|
117
|
+
- ruby: '3.4'
|
118
|
+
gemfile: openssl_3_0
|
119
|
+
os: windows-latest
|
120
|
+
- ruby: '2.4'
|
121
|
+
os: ubuntu-24.04
|
86
122
|
env:
|
87
123
|
BUNDLE_GEMFILE: gemfiles/${{ matrix.gemfile }}.gemfile
|
88
124
|
steps:
|
89
125
|
- uses: actions/checkout@v4
|
126
|
+
|
90
127
|
- run: rm Gemfile.lock
|
128
|
+
|
129
|
+
- name: Install OpenSSL
|
130
|
+
if: matrix.os == 'ubuntu-24.04'
|
131
|
+
uses: ./.github/actions/install-openssl
|
132
|
+
with:
|
133
|
+
version: "1.1.1w"
|
134
|
+
os: ${{ matrix.os }}
|
135
|
+
|
91
136
|
- uses: ruby/setup-ruby@v1
|
137
|
+
if: matrix.os != 'ubuntu-24.04'
|
92
138
|
with:
|
93
139
|
ruby-version: ${{ matrix.ruby }}
|
94
140
|
bundler-cache: true
|
95
|
-
|
141
|
+
|
142
|
+
- name: Manually set up Ruby
|
143
|
+
if: matrix.os == 'ubuntu-24.04'
|
144
|
+
uses: ./.github/actions/install-ruby
|
145
|
+
with:
|
146
|
+
version: ${{ matrix.ruby }}
|
147
|
+
os: ${{ matrix.os }}
|
148
|
+
|
149
|
+
- run: bundle exec rspec
|
data/Appraisals
CHANGED
data/CHANGELOG.md
CHANGED
@@ -1,5 +1,11 @@
|
|
1
1
|
# Changelog
|
2
2
|
|
3
|
+
## [v0.14.1] - 2025-05-23
|
4
|
+
|
5
|
+
### Fixed
|
6
|
+
|
7
|
+
- Support for OpenSSL 3.5+ `OID` values returned from the extensions created by `OpenSSL::X509::ExtensionFactory`. [@nicolastemciuc]
|
8
|
+
|
3
9
|
## [v0.14.0] - 2025-02-06
|
4
10
|
|
5
11
|
- Handle incompatibility between `parameters` and `unique` in `TPublic`. [@nicolastemciuc], [@santiagorodriguez96]
|
@@ -93,6 +99,8 @@ replacement of `JOSE` format `algorithm` string
|
|
93
99
|
- `TPM::EKCertificate` wrapper
|
94
100
|
- `TPM::SAttest` wrapper
|
95
101
|
|
102
|
+
[v0.14.1]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.14.0...v0.14.1/
|
103
|
+
[v0.14.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.13.1...v0.14.0/
|
96
104
|
[v0.13.1]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.13.0...v0.13.1/
|
97
105
|
[v0.13.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.12.1...v0.13.0/
|
98
106
|
[v0.12.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.11.0...v0.12.0/
|
data/Gemfile
CHANGED
data/Gemfile.lock
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
PATH
|
2
2
|
remote: .
|
3
3
|
specs:
|
4
|
-
tpm-key_attestation (0.14.
|
4
|
+
tpm-key_attestation (0.14.1)
|
5
5
|
bindata (~> 2.4)
|
6
6
|
openssl (> 2.0)
|
7
7
|
openssl-signature_algorithm (~> 1.0)
|
@@ -17,18 +17,20 @@ GEM
|
|
17
17
|
bindata (2.5.0)
|
18
18
|
byebug (11.1.3)
|
19
19
|
diff-lcs (1.5.1)
|
20
|
-
|
20
|
+
json (2.10.1)
|
21
|
+
language_server-protocol (3.17.0.4)
|
22
|
+
lint_roller (1.1.0)
|
21
23
|
openssl (3.2.0)
|
22
24
|
openssl-signature_algorithm (1.3.0)
|
23
25
|
openssl (> 2.0)
|
24
26
|
parallel (1.26.3)
|
25
|
-
parser (3.3.
|
27
|
+
parser (3.3.7.1)
|
26
28
|
ast (~> 2.4.1)
|
27
29
|
racc
|
28
30
|
racc (1.8.1)
|
29
31
|
rainbow (3.1.1)
|
30
32
|
rake (13.2.1)
|
31
|
-
|
33
|
+
regexp_parser (2.10.0)
|
32
34
|
rspec (3.13.0)
|
33
35
|
rspec-core (~> 3.13.0)
|
34
36
|
rspec-expectations (~> 3.13.0)
|
@@ -42,17 +44,24 @@ GEM
|
|
42
44
|
diff-lcs (>= 1.2.0, < 2.0)
|
43
45
|
rspec-support (~> 3.13.0)
|
44
46
|
rspec-support (3.13.2)
|
45
|
-
rubocop (
|
46
|
-
|
47
|
+
rubocop (1.72.2)
|
48
|
+
json (~> 2.3)
|
49
|
+
language_server-protocol (~> 3.17.0.2)
|
50
|
+
lint_roller (~> 1.1.0)
|
47
51
|
parallel (~> 1.10)
|
48
|
-
parser (>=
|
52
|
+
parser (>= 3.3.0.2)
|
49
53
|
rainbow (>= 2.2.2, < 4.0)
|
50
|
-
|
54
|
+
regexp_parser (>= 2.9.3, < 3.0)
|
55
|
+
rubocop-ast (>= 1.38.0, < 2.0)
|
51
56
|
ruby-progressbar (~> 1.7)
|
52
|
-
unicode-display_width (>=
|
57
|
+
unicode-display_width (>= 2.4.0, < 4.0)
|
58
|
+
rubocop-ast (1.38.0)
|
59
|
+
parser (>= 3.3.1.0)
|
53
60
|
ruby-progressbar (1.13.0)
|
54
61
|
thor (1.3.2)
|
55
|
-
unicode-display_width (1.
|
62
|
+
unicode-display_width (3.1.4)
|
63
|
+
unicode-emoji (~> 4.0, >= 4.0.4)
|
64
|
+
unicode-emoji (4.0.4)
|
56
65
|
|
57
66
|
PLATFORMS
|
58
67
|
ruby
|
@@ -62,7 +71,7 @@ DEPENDENCIES
|
|
62
71
|
byebug (~> 11.0)
|
63
72
|
rake (~> 13.0)
|
64
73
|
rspec (~> 3.0)
|
65
|
-
rubocop (~>
|
74
|
+
rubocop (~> 1)
|
66
75
|
tpm-key_attestation!
|
67
76
|
|
68
77
|
BUNDLED WITH
|
@@ -0,0 +1,12 @@
|
|
1
|
+
# This file was generated by Appraisal
|
2
|
+
|
3
|
+
source "https://rubygems.org"
|
4
|
+
|
5
|
+
gem "appraisal", "~> 2.5.0"
|
6
|
+
gem "byebug", "~> 11.0"
|
7
|
+
gem "rake", "~> 13.0"
|
8
|
+
gem "rspec", "~> 3.0"
|
9
|
+
gem "rubocop", "~> 1"
|
10
|
+
gem "openssl", "~> 3.3.0"
|
11
|
+
|
12
|
+
gemspec path: "../"
|
data/lib/tpm/aik_certificate.rb
CHANGED
@@ -3,6 +3,7 @@
|
|
3
3
|
require "delegate"
|
4
4
|
require "openssl"
|
5
5
|
require "tpm/constants"
|
6
|
+
require "tpm/openssl_helper"
|
6
7
|
|
7
8
|
module TPM
|
8
9
|
# Section 3.2 in https://www.trustedcomputinggroup.org/wp-content/uploads/Credential_Profile_EK_V2.0_R14_published.pdf
|
@@ -10,11 +11,19 @@ module TPM
|
|
10
11
|
ASN_V3 = 2
|
11
12
|
EMPTY_NAME = OpenSSL::X509::Name.new([]).freeze
|
12
13
|
SAN_DIRECTORY_NAME = 4
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
14
|
+
|
15
|
+
if TPM::OpenSSLHelper.running_openssl_version_35_or_up?
|
16
|
+
OID_TCG_AT_TPM_MANUFACTURER = "tcg-at-tpmManufacturer"
|
17
|
+
OID_TCG_AT_TPM_MODEL = "tcg-at-tpmModel"
|
18
|
+
OID_TCG_AT_TPM_VERSION = "tcg-at-tpmVersion"
|
19
|
+
OID_TCG_KP_AIK_CERTIFICATE = "Attestation Identity Key Certificate"
|
20
|
+
else
|
21
|
+
OID_TCG = "2.23.133"
|
22
|
+
OID_TCG_AT_TPM_MANUFACTURER = "#{OID_TCG}.2.1"
|
23
|
+
OID_TCG_AT_TPM_MODEL = "#{OID_TCG}.2.2"
|
24
|
+
OID_TCG_AT_TPM_VERSION = "#{OID_TCG}.2.3"
|
25
|
+
OID_TCG_KP_AIK_CERTIFICATE = "#{OID_TCG}.8.3"
|
26
|
+
end
|
18
27
|
|
19
28
|
def self.from_der(certificate_der)
|
20
29
|
new(OpenSSL::X509::Certificate.new(certificate_der))
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: tpm-key_attestation
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.14.
|
4
|
+
version: 0.14.1
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Gonzalo
|
8
8
|
autorequire:
|
9
9
|
bindir: exe
|
10
10
|
cert_chain: []
|
11
|
-
date: 2025-
|
11
|
+
date: 2025-06-15 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: bindata
|
@@ -58,6 +58,8 @@ executables: []
|
|
58
58
|
extensions: []
|
59
59
|
extra_rdoc_files: []
|
60
60
|
files:
|
61
|
+
- ".github/actions/install-openssl/action.yml"
|
62
|
+
- ".github/actions/install-ruby/action.yml"
|
61
63
|
- ".github/workflows/build.yml"
|
62
64
|
- ".gitignore"
|
63
65
|
- ".rspec"
|
@@ -77,6 +79,7 @@ files:
|
|
77
79
|
- gemfiles/openssl_3_0.gemfile
|
78
80
|
- gemfiles/openssl_3_1.gemfile
|
79
81
|
- gemfiles/openssl_3_2.gemfile
|
82
|
+
- gemfiles/openssl_3_3.gemfile
|
80
83
|
- lib/tpm/aik_certificate.rb
|
81
84
|
- lib/tpm/certificates/AMD/RootCA/AMD-fTPM-ECC-RootCA.crt
|
82
85
|
- lib/tpm/certificates/AMD/RootCA/AMD-fTPM-RSA-RootCA.crt
|
@@ -108,6 +111,7 @@ files:
|
|
108
111
|
- lib/tpm/constants.rb
|
109
112
|
- lib/tpm/key_attestation.rb
|
110
113
|
- lib/tpm/key_attestation/version.rb
|
114
|
+
- lib/tpm/openssl_helper.rb
|
111
115
|
- lib/tpm/public_area.rb
|
112
116
|
- lib/tpm/s_attest.rb
|
113
117
|
- lib/tpm/s_attest/s_certify_info.rb
|