Skip to content

Conversation

@ameba23
Copy link
Collaborator

@ameba23 ameba23 commented Dec 12, 2025

This will allow azure's V6 instance outdated SEAM loader when a command line option enables it.

The issues i am currently having with this:

  • dcap-qvl does not publicly expose the TCB info related structs. I have copy and pasted them as a workaround, and will make an issue asking them to make them public.
  • If we modify anything in the TCB info, the DCAP validation fails because it includes a verification of the signature in the collateral:
called `Result::unwrap()` on an `Err` value: DcapVerification(DcapQvl(Rsa signature is invalid for tcb_info in quote_collateral))

https://github.com/Phala-Network/dcap-qvl/blob/c95e85a5dd47975ad7c56be8afbecb6ef7288330/src/verify.rs#L207-L218

I am not sure why we don't also have this issue in CVM reverse proxy. I don't yet know if there is a workaround we can do for this without making a PR to dcap-qvl (which might be tricky as they are unlikely to want changes which override security checks).

This problem currently does not show up in tests because of the check:

    if tcb_info.fmspc == AZURE_V6_BAD_FMSPC {

which means we don't actually modify anything in the test case. But if i remove that check i get a signature error.

@ameba23 ameba23 marked this pull request as draft December 12, 2025 16:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant