Fix ekcert checking by arianvp · Pull Request #21 · spiffe/spire-tpm-plugin

arianvp · 2025-08-23T21:31:39Z

Fixes #19

arianvp · 2025-10-09T09:14:05Z

@kfox1111 care to have a look? Without this golang fails to validate spec-compliant EKCerts

kfox1111

Thanks for working on this. Sorry for the delay. Some questions inline

kfox1111 · 2025-10-15T15:24:00Z

pkg/server/server.go

+		oidTcgKpEKCertificate := asn1.ObjectIdentifier{2, 23, 133, 8, 1}
+		for _, id := range ek.Certificate.UnknownExtKeyUsage {
+			if id.Equal(oidTcgKpEKCertificate) {
+			}
+		}


oh no I think we should throw an error here if it's not this key usage. Let me add that.

To solve this correctly in a way that is forwards and backwards compatible we need golang/go#75325

Otherwise, if golang ever starts accepting this OID in the standard library, this code will break.

Luckily this just landed in Go 1.26

How aggressive is SPIRE with adopting new go versions? If we are fine with requiring Go 1.26,I can make the check. Otherwise I suggest we remove this code completely and file an issue to improve this later

go 1.26 lands in February btw

after further reading the spec; the field is not critical and also not mandatory. it's marked as Extended Key Usage ExtKeyUsageSyntax tcg-kp-EKCertificate MAY non-critical

So I think I'm going to leave it out for now. As there might be EK Certs in the wild that do not have the field.

https://trustedcomputinggroup.org/wp-content/uploads/TCG-EK-Credential-Profile-for-TPM-Family-2.0-Level-0-Version-2.6_pub.pdf

Oh look at this: Merged a few days ago: google/go-attestation#471 🥳

pkg/server/server.go

arianvp · 2025-11-11T13:42:13Z

Hmm any idea why CI is not triggering on my PR?

kfox1111 · 2025-11-11T18:15:19Z

Hmm any idea why CI is not triggering on my PR?

hmm... offhand, no. It looks to me like it should work... will try and dig in soon.

torfjor · 2026-01-22T09:11:26Z

Friendly bump 👋. Would be nice to have this upstream!

kfox1111 · 2026-01-23T22:35:58Z

Thanks for the reminder. will have a look

kfox1111 · 2026-01-23T22:36:42Z

Looks like the only thing outstanding is a fix for the deadcode/exception handling.

arianvp · 2026-01-24T00:17:48Z

I'll fix this tomorrow.

arianvp · 2026-01-25T18:21:28Z

go.mod

 require (
-	github.com/google/go-attestation v0.4.4-0.20220404204839-8820d49b18d9
-	github.com/google/go-tpm-tools v0.3.8
+	github.com/google/go-attestation v0.6.1-0.20260123045045-5514d09200e7


This is the (unreleased) commit that implements exactly what we want. google/go-attestation@5514d09

kfox1111

LGTM. Thanks! :)

kfox1111 · 2026-01-27T00:07:51Z

Some testing failures

arianvp · 2026-01-27T00:18:07Z

I've been trying to get the test suite working locally but it seems incompatible with openssl 3 and my distro doesn't ship anything else...

arianvp · 2026-01-27T00:23:15Z

Okay I'll try to get this fixed. :)

arianvp · 2026-01-27T00:32:51Z

Ah seems CI is running in ubuntu 20.04 which is not even supported anymore. Seems there is quite a bit of work to clean this up. I doubt the test suite even passes on master on newer versions at the moment

kfox1111 · 2026-01-27T00:38:13Z

quite possible. The tests were inherited from ages ago.

arianvp · 2026-01-27T22:01:51Z

I commited fixes and ran the tests locally on NixOS and they pass. I naively bumped the CI dockerfile to 24.04 in the hope that that fixes it in CI too

wagdav

I looked into the build errors and I left some suggestions to fix it. Hope it helps to get this merged!

ci/docker/Dockerfile

We use (unreleased) new version of go-attestation which implements this for us. So we get it for free Fix EKCert checking We simply use the newly added functionality for this in go-attestation

arianvp · 2026-02-11T12:27:38Z

The whole ci seems to be a mess frankly. Giving another shot to clean it up with your suggestions but I have very little tolerance having to deal with docker so if it doesn't work I'll offer switching to Nix for CI or someone else will have to push this PR over the finish line. I'm fine with just pointing my stuff to this branch. The code is working fine for me and all the tests pass 🤷

arianvp · 2026-02-11T12:32:41Z

I installed podman and podman-compose now but I just get permission denied errors etc. I give up. Someone else can try and fix this.

Though offer to dump all this docker-compose stuff for doing this with nix still stands :)

wagdav · 2026-02-11T13:34:35Z

@arianvp Using Docker Desktop on Mac, I could build the CI image with your latest changes. The GitHub Actions is now waiting for a maintainer's approval to run.

🤞 🍀

kfox1111 · 2026-02-11T19:12:22Z

I was never involved in the tests, so I'm shooting a little blind there, but it looks ok to me.

kfox1111

LGTM. Thanks! :)

arianvp · 2026-02-11T19:33:51Z

Wooohooo!

kfox1111 reviewed Oct 15, 2025

View reviewed changes

arianvp force-pushed the fix-ekcert-checking branch from fa66b8e to ed13fbe Compare January 25, 2026 18:19

arianvp commented Jan 25, 2026

View reviewed changes

arianvp force-pushed the fix-ekcert-checking branch from ed13fbe to 3660a48 Compare January 25, 2026 18:45

arianvp mentioned this pull request Jan 25, 2026

Add TPM information to selectors #27

Draft

kfox1111 approved these changes Jan 26, 2026

View reviewed changes

arianvp force-pushed the fix-ekcert-checking branch from 3660a48 to bd61580 Compare January 27, 2026 22:01

KiaraGrouwstra mentioned this pull request Feb 6, 2026

Add SPIRE NixOS Module NixOS/nixpkgs#481447

Open

13 tasks

wagdav reviewed Feb 11, 2026

View reviewed changes

ci/docker/Dockerfile Outdated Show resolved Hide resolved

ci/docker/Dockerfile Show resolved Hide resolved

Fix EKCert validation

a41192f

We use (unreleased) new version of go-attestation which implements this for us. So we get it for free Fix EKCert checking We simply use the newly added functionality for this in go-attestation

arianvp force-pushed the fix-ekcert-checking branch from bd61580 to a41192f Compare February 11, 2026 12:17

kfox1111 approved these changes Feb 11, 2026

View reviewed changes

kfox1111 merged commit 86db606 into spiffe:master Feb 11, 2026
1 check passed

Comments

Conversation

arianvp commented Aug 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

arianvp commented Oct 9, 2025

Uh oh!

kfox1111 left a comment

Choose a reason for hiding this comment

Uh oh!

kfox1111 Oct 15, 2025

Choose a reason for hiding this comment

Uh oh!

arianvp Oct 15, 2025

Choose a reason for hiding this comment

Uh oh!

arianvp Jan 25, 2026

Choose a reason for hiding this comment

Uh oh!

arianvp Jan 25, 2026

Choose a reason for hiding this comment

Uh oh!

arianvp Jan 25, 2026

Choose a reason for hiding this comment

Uh oh!

arianvp Jan 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

arianvp commented Nov 11, 2025

Uh oh!

kfox1111 commented Nov 11, 2025

Uh oh!

torfjor commented Jan 22, 2026

Uh oh!

kfox1111 commented Jan 23, 2026

Uh oh!

kfox1111 commented Jan 23, 2026

Uh oh!

arianvp commented Jan 24, 2026

Uh oh!

arianvp Jan 25, 2026

Choose a reason for hiding this comment

Uh oh!

kfox1111 left a comment

Choose a reason for hiding this comment

Uh oh!

kfox1111 commented Jan 27, 2026

Uh oh!

arianvp commented Jan 27, 2026

Uh oh!

arianvp commented Jan 27, 2026

Uh oh!

arianvp commented Jan 27, 2026

Uh oh!

kfox1111 commented Jan 27, 2026

Uh oh!

arianvp commented Jan 27, 2026

Uh oh!

wagdav left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

arianvp commented Feb 11, 2026

Uh oh!

arianvp commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wagdav commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kfox1111 commented Feb 11, 2026

Uh oh!

kfox1111 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

arianvp commented Feb 11, 2026

Uh oh!

arianvp commented Aug 23, 2025 •

edited

Loading

arianvp commented Feb 11, 2026 •

edited

Loading

wagdav commented Feb 11, 2026 •

edited

Loading