From a1c61cde74a1ee75aaf80bb58ef0bcea10f6137f Mon Sep 17 00:00:00 2001 From: Paul Howard Date: Wed, 28 Aug 2024 17:03:57 +0100 Subject: [PATCH] fix: Temporarily allow WARNING as well as AFFIRMING status in EAR sub-modules. Keeps things working while deeper issues are addressed. Signed-off-by: Paul Howard --- rust-keybroker/keybroker-server/src/verifier.rs | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/rust-keybroker/keybroker-server/src/verifier.rs b/rust-keybroker/keybroker-server/src/verifier.rs index bea6ba9..3cc48e8 100644 --- a/rust-keybroker/keybroker-server/src/verifier.rs +++ b/rust-keybroker/keybroker-server/src/verifier.rs @@ -60,12 +60,14 @@ pub fn verify_with_veraison_instance( verification_key_string.as_bytes(), )?; - // The simplest possible appraisal policy: accept if we have an AFFIRMING result from - // every submodule of the token. - let verified = ear - .submods - .iter() - .all(|(_module, appraisal)| appraisal.status == TrustTier::Affirming); + // The simplest possible appraisal policy: accept if we have an AFFIRMING or WARNING result + // from every submodule. + // TODO: This policy is rather too "relaxed" - the simplest and strictest policy would be + // to require AFFIRMING from every submodule. We have some integration issues with Veraison + // today that prevent this. + let verified = ear.submods.iter().all(|(_module, appraisal)| { + appraisal.status == TrustTier::Affirming || appraisal.status == TrustTier::Warning + }); Ok(verified) }