helios-rot: make the trait / interface async

.github/workflows/ci.yaml

@@ -10,6 +10,9 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@1.97.1
+      # The Microsoft Ubuntu mirror is unstable: https://github.com/actions/runner-images/issues/7048
+      - name: Disable Microsoft Ubuntu mirror
+        run: sudo sed -i '/azure.archive.ubuntu.com/d' /etc/apt/apt-mirrors.txt
       - run: sudo apt-get update
       - run: sudo apt-get install -y pkg-config libudev-dev
       - run: cargo build --workspace
@@ -21,6 +24,9 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@1.97.1
+      # The Microsoft Ubuntu mirror is unstable: https://github.com/actions/runner-images/issues/7048
+      - name: Disable Microsoft Ubuntu mirror
+        run: sudo sed -i '/azure.archive.ubuntu.com/d' /etc/apt/apt-mirrors.txt
       - run: sudo apt-get update
       - run: sudo apt-get install -y pkg-config libudev-dev
       - run: cargo test --package attest-data
@@ -34,6 +40,9 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@1.97.1
+      # The Microsoft Ubuntu mirror is unstable: https://github.com/actions/runner-images/issues/7048
+      - name: Disable Microsoft Ubuntu mirror
+        run: sudo sed -i '/azure.archive.ubuntu.com/d' /etc/apt/apt-mirrors.txt
       - run: sudo apt-get update
       - run: sudo apt-get install -y pkg-config libudev-dev
       - run: cargo doc --all-features --locked --no-deps

.github/workflows/lint.yaml

@@ -12,6 +12,9 @@ jobs:
       - uses: dtolnay/rust-toolchain@nightly
         with:
           components: clippy
+      # The Microsoft Ubuntu mirror is unstable: https://github.com/actions/runner-images/issues/7048
+      - name: Disable Microsoft Ubuntu mirror
+        run: sudo sed -i '/azure.archive.ubuntu.com/d' /etc/apt/apt-mirrors.txt
       - run: |
           sudo apt-get update
           sudo apt-get install -y pkg-config libudev-dev

helios-rot/Cargo.toml

@@ -25,3 +25,4 @@ unittest = ["pki-playground"]
 
 [dev-dependencies]
 helios-rot = { path = ".", features = ["unittest"] }
+tokio = { workspace = true, features = ["macros", "rt"] }

helios-rot/src/lib.rs

@@ -108,11 +108,12 @@ impl AsRef<[u8]> for Nonce {
 }
 
 /// The `HeliosRot` trait is the interface to the roT in the Helios kernel.
+#[async_trait::async_trait]
 pub trait HeliosRot {
-    type Error;
+    type Error: std::error::Error + Send + Sync;
 
-    fn get_certificates(&self) -> Result<PkiPath, Self::Error>;
-    fn attest(&self, nonce: &Nonce) -> Result<Attestation, Self::Error>;
+    async fn get_certificates(&self) -> Result<PkiPath, Self::Error>;
+    async fn attest(&self, nonce: &Nonce) -> Result<Attestation, Self::Error>;
 }
 
 #[derive(Debug, Error)]
@@ -175,14 +176,15 @@ impl HeliosRotMock {
     }
 }
 
+#[async_trait::async_trait]
 impl HeliosRot for HeliosRotMock {
     type Error = HeliosRotMockError;
 
-    fn get_certificates(&self) -> Result<PkiPath, Self::Error> {
+    async fn get_certificates(&self) -> Result<PkiPath, Self::Error> {
         Ok(self.certs.clone())
     }
 
-    fn attest(&self, nonce: &Nonce) -> Result<Attestation, Self::Error> {
+    async fn attest(&self, nonce: &Nonce) -> Result<Attestation, Self::Error> {
         let sig: Signature = self.alias_key.try_sign(nonce.as_ref())?;
         let sig = P384Signature::from(sig.to_bytes().as_slice().try_into()?);
         Ok(Attestation::P384(sig))
@@ -216,16 +218,16 @@ mod test {
         assert!(res.is_ok());
     }
 
-    #[test]
-    fn attest() {
+    #[tokio::test]
+    async fn attest() {
         let out = PathBuf::from(env::var("OUT_DIR").unwrap());
         let signing_key = out.join("root.key.pem");
 
         let mock = HeliosRotMock::load(out.join("root.cert.pem"), &signing_key)
             .expect("load cert chain & key");
 
         let nonce = Nonce::from_platform_rng(48).expect("get Nonce from RNG");
-        let attestation = mock.attest(&nonce).expect("attest to nonce");
+        let attestation = mock.attest(&nonce).await.expect("attest to nonce");
         let signing_key = fs::read_to_string(&signing_key)
             .expect("Read signing key from file to string");
         let signing_key = SigningKey::from_pkcs8_pem(&signing_key)

verifier/Cargo.toml

@@ -28,6 +28,7 @@ pki-playground = { workspace = true, optional = true }
 [dev-dependencies]
 attest-data = { path = "../attest-data", features = ["std", "testing"] }
 dice-verifier = { path = "../verifier", features = ["unittest"] }
+tokio = { workspace = true, features = ["macros", "rt"] }
 
 [features]
 unittest = ["pki-playground"]

verifier/src/helios_rot.rs

@@ -73,8 +73,8 @@ mod test {
 
     // Use the `helios_rot::HeliosRotMock` to generate an attestation
     // then verify it with `verify_attestation`
-    #[test]
-    fn verify_attestation() {
+    #[tokio::test]
+    async fn verify_attestation() {
         let out = PathBuf::from(env::var("OUT_DIR").unwrap());
 
         let cert_chain = out.join("helios-rot.certlist.pem");
@@ -88,6 +88,7 @@ mod test {
 
         let attestation = rot_mock
             .attest(&nonce)
+            .await
             .expect("Attestation from HeliosRotMock");
 
         let alias_cert = out.join("dpe-tcb-0-20b87885cc8c321f.cert.pem");
@@ -99,8 +100,8 @@ mod test {
         assert!(res.is_ok());
     }
 
-    #[test]
-    fn verify_attestation_bad_nonce() {
+    #[tokio::test]
+    async fn verify_attestation_bad_nonce() {
         use crate::helios_rot::VerifyAttestationError;
 
         let out = PathBuf::from(env::var("OUT_DIR").unwrap());
@@ -116,6 +117,7 @@ mod test {
 
         let attestation = rot_mock
             .attest(&nonce)
+            .await
             .expect("Attestation from HeliosRotMock");
 
         let alias_cert = out.join("dpe-tcb-0-20b87885cc8c321f.cert.pem");