@calimero-network/mero-js 24.7.0 → 25.0.0

package/dist/index.cjs

@@ -61,6 +61,7 @@ __export(index_exports, {
   NotForAccountError: () => NotForAccountError,
   OWNER_OP_KIND: () => OWNER_OP_KIND,
   PRESENCE_DOMAIN: () => PRESENCE_DOMAIN,
+  PRODUCTION_PROFILE: () => PRODUCTION_PROFILE,
   RELAY_NODE_KEY_RETRY_MS: () => RELAY_NODE_KEY_RETRY_MS,
   REQUEST_PROOF_HEADER: () => REQUEST_PROOF_HEADER,
   RelayClient: () => RelayClient,
@@ -6846,6 +6847,9 @@ function createQuoteVerifier(options) {
       throw new Error(`The platform's TCB status is ${verified.status}, which is not accepted`);
     }
     const td = tdReport(verified.report);
+    if (td.tdAttributes?.length !== 8 || (td.tdAttributes[0] & 1) !== 0) {
+      throw new Error("The quote is from a debug TD, or its TD attributes cannot be read");
+    }
     const measured = [td.mrTd, td.rtMr0, td.rtMr1, td.rtMr2, td.rtMr3].map((register) => hex(register));
     if (allowedImages.length > 0 && !allowedImages.includes(measured.join())) {
       throw new Error(
@@ -6898,7 +6902,8 @@ var TCB_STATUSES = [
   "OutOfDate",
   "OutOfDateConfigurationNeeded"
 ];
-function trustedMeasurementsFromReleases(releases, { profile }) {
+var PRODUCTION_PROFILE = "locked-read-only";
+function trustedMeasurementsFromReleases(releases, { profile, allowDebugProfile = false }) {
   if (releases.length === 0) {
     throw new Error("No release given, so no image would be trusted");
   }
@@ -6913,6 +6918,11 @@ function trustedMeasurementsFromReleases(releases, { profile }) {
       const known = Object.keys(release?.profiles ?? {}).join(", ") || "none";
       throw new Error(`${name} has no profile ${JSON.stringify(profile)} (it has: ${known})`);
     }
+    if (profile !== PRODUCTION_PROFILE && !allowDebugProfile) {
+      throw new Error(
+        `${JSON.stringify(profile)} is not a production profile: its image is readable by whoever operates the node. Trust ${JSON.stringify(PRODUCTION_PROFILE)}, or pass allowDebugProfile to test`
+      );
+    }
     const accepted = (image.allowed_tcb_statuses ?? ["uptodate"]).map((status) => tcbStatus(status, name));
     statuses = statuses === void 0 ? accepted : statuses.filter((status) => accepted.includes(status));
     return {
@@ -7401,7 +7411,10 @@ async function trustSignedRelease(options) {
   if (compareReleaseVersions(version, minimum) < 0) {
     throw new Error(`Release ${version} is older than the minimum trusted, ${minimum}`);
   }
-  return trustedMeasurementsFromReleases([published], { profile: options.profile });
+  return trustedMeasurementsFromReleases([published], {
+    profile: options.profile,
+    allowDebugProfile: options.allowDebugProfile
+  });
 }
 function createSignedReleaseVerifier(options) {
   releaseVersion(options.minReleaseVersion, "minReleaseVersion");
@@ -7409,6 +7422,7 @@ function createSignedReleaseVerifier(options) {
     const trusted = await trustSignedRelease({
       release: await options.release(),
       profile: options.profile,
+      allowDebugProfile: options.allowDebugProfile,
       minReleaseVersion: options.minReleaseVersion,
       identity: options.identity,
       issuer: options.issuer