mirror of
https://github.com/luxfi/cc.git
synced 2026-09-24 00:24:54 +00:00
zeekay
0d0faff0f8
ARM CCA Realm attestation: a CBOR/COSE CCA token collection (platform token signed by the operator-pinned CPAK/IAK + realm token signed by the RAK, with the H(RAK) platform-realm binding enforced). Vendor arm.cca, fail-closed zero value, real COSE_Sign1 verification. armcca branched before the registry landed and carried its own parallel copy (extraVerifiers map + a duplicate registerVerifier + a second VerifierFor lookup). Converged to the one registry: deleted that block so armcca.go's init() registers through the canonical registerVerifier in verifier.go, and repointed its self-registration test to RegisteredVerifier. There is one registry, one lookup, one dispatch path — no second way. go.mod: unioned the require blocks (cbor/v2, go-sev-guest, go-tdx-guest, veraison/ccatoken, go-cose); go mod tidy clean; ccatoken is v1.4.0 and its transitive jwx/v2, secp256k1/v4 carry their major in the import path — no dep bumped to a new major. doc.go + verifier.go: ARM CCA is now a real 6th Kind, not pending. verifier_test.go: TestRegistry_RoutesEveryKind covers all six. go build/vet/test + go test -race ./attest/... green; gofmt clean.