Implementation of evidence generation library in RUST by shefali-kamal · Pull Request #1 · veraison/rust-regl

shefali-kamal · 2026-06-22T15:03:57Z

This PR adds following features:

Interfaces:

A TSM report builder abstraction (non-dyn compatible).
Attester (which is dyn compatible)

Implementations:

LinuxTsmReportBuilder: implementation of tsm report interface for linux configfs-tsm ABI
CcaTsmAttester: Attester for CCA using linux tsm report builder
Generic RatsdAttester: posts a challenge to a RATSD daemon and returns the raw JSON response. No TEE-specific parsing.
CcaRatsdAttester: wraps RatsdAttester with CCA-specific CMW envelope parsing and evidence extraction.
Add CCA token decode and pretty-print utilities for ARM CCA
Add for ARM CCA UT for all the above features.

Signed-off-by: Thomas Fossati <thomas.fossati@linaro.org>

yogeshbdeshpande · 2026-06-23T16:08:20Z

+use simulated::FakeTsmBuilder;
+
+/// Arm CCA nonce size in bytes, as required by the CCA specification.
+///


In general, looks good but it is more advisable to use:
https://datatracker.ietf.org/doc/draft-ffm-rats-cca-token/
for any CCA Claims reference

yogeshbdeshpande · 2026-06-23T16:17:44Z

+use regl::attesters::{cca, ratsd, Attester};
+use url::Url;
+
+// Generic RATSD — explicit URL required


@shefali-kamal May be I am missing something here, but I see the same URL in

Generic RATSD (where explicit URL is required )&

CCA specific RATSD

The evidence returned by 1 is the ratsd token. The CCA specific ratsd attester extracts and returns the ccatoken present inside the ratsd evidence.

@DhanusML I am referring to comment on Line 20, where you mentioned, explicit URL is required, versus
Line 25, where also an explicit URL is required.

@yogeshbdeshpande Both attesters talk to the same RATSD server that's why the URL is identical in both examples. The RatsdAttester returns the raw ratsd JSON response, while CcaRatsdAttester wraps it and extracts just the CCA token from inside the CMW envelope.

The comment "explicit URL required" on line 20 isn't meant to contrast with the CCA variant. It's just noting that neither attester auto-discovers the RATSD endpoint or reads it from an env var; you must pass a Url explicitly via with_url(). That applies equally to both. I will add a similar comment on line 25 for consistency.

yogeshbdeshpande · 2026-06-23T16:19:14Z

+// TSM-backed attester (requires Linux CCA TSM hardware and root/sudo)
+let attester = cca::CcaTsmAttester::default();
+let evidence = attester.get_evidence(&challenge).unwrap();
+```


A question more than a comment:

Do you plan to include an example of cca-sim | CcaSimulatedAttester ?

I do not see any sample JSON files in the repository, so how does the Simulator operates. Where is the source for the claims?

If the simulator hard codes the claims in the file, simulated.rs, then perhaps it would be good to feed in the data from JSON files, for easy modification of claims (as inputs) to the Simulator.

Yes, a simulated attester implementation that builds a ccatoken using the claims list and cpak is planned for the next pull request. The current implementation returns the contents of src/attesters/cca/data/evidence.cbor.

i would request please keep a JSON or YML schema of claims which are encoded in evidence.cbor

@yogeshbdeshpande In the next pull request, the simulated attester implementation will take input from user provided claims in the form of JSON file. The evidence will be created from the provided claims.

yogeshbdeshpande · 2026-06-23T16:21:58Z

+| Attester | Struct | Backend | Description |
+|---|---|---|---|
+| `cca-tsm` | `CcaTsmAttester` | Linux TSM (`/sys/kernel/config/tsm`) | Talks directly to the kernel TSM interface on Arm CCA hardware. Requires root or write access to configfs-tsm. |
+| `cca-ratsd` | `CcaRatsdAttester` | RATSD daemon | Posts a challenge to a [RATSD](https://github.com/veraison/ratsd) daemon, then parses the CMW envelope to extract the Arm CCA attestation token. "CCA-specific" means it knows how to find and decode CCA evidence inside the CMW — it looks for items whose content type contains `configfs-tsm` and whose provider is `arm_cca_guest`. |


Just curious, the Attester at Line 10 and Line 12 can be folded into one Attester, with a simple flag at the input where the returned results can be displayed in either format..?

The example binary is currently only for arm-cca and does not expose the ratsd attester.

The goal is to abstract the different means of evidence fetching available for an attestation scheme. So ratsd and cca are implemented as two different modules, each containing their family of attester(s) that implement trait Attester<AttesterError>. Hence ratsd and cca-ratsd represent different objects at the top level and the example cli should reflect this.

Maybe when the example binary starts to expose other schemes, the interface can be something like: attester <scheme-name> <mode> [options]. But right now it is cca-attester <mode> [options].

yogeshbdeshpande · 2026-06-23T16:24:08Z

+| `cca-ratsd` | `CcaRatsdAttester` | RATSD daemon | Posts a challenge to a [RATSD](https://github.com/veraison/ratsd) daemon, then parses the CMW envelope to extract the Arm CCA attestation token. "CCA-specific" means it knows how to find and decode CCA evidence inside the CMW — it looks for items whose content type contains `configfs-tsm` and whose provider is `arm_cca_guest`. |
+| `cca-sim` | `CcaSimulatedAttester` | Embedded blob | Returns a pre-built CCA token embedded at compile time. Useful for testing and development without hardware or a running RATSD. |
+| `ratsd` | `RatsdAttester` | RATSD daemon (generic) | Posts a challenge to a RATSD daemon and returns the raw JSON response as-is. No TEE-specific parsing — use this if you want the CMW envelope or other RATSD-level data directly. |
+


Is there a plan to add support for validating or checking the token, meaning:

Verifying that Valid Claims exist in the token..?

Verifying the signature on the token, to check the Crypto is correct..?
Such tooling will be beneficial in the community!

veraison/rust-ccatoken has both these features. This library (rust-regl) is only for fetching evidence and treats evidence as opaque bytestring (except the pretty-print function, which uses veraison/rust-ccatoken to deserialize the token, but does not perform any cryptographic checks).

Yes, I am aware that the rust/ccatoken library provides an API for integration of ccatoken verification.

My question was more of a CLI tooling which is your focus and a CLI tool for easy and handy Crypto Verification of CCA Evidence (please see an equivalent golang implementation in veraison/evcli )

@yogeshbdeshpande I understand that you're asking about a CLI that does full cryptographic verification (signature check, claim validation), similar to what evcli does in Go. That is currently out of scope for rust-regl, which is purely an evidence gathering library (fetch, don't verify). The verification piece lives in veraison/rust-ccatoken, which already has the APIs for decoding and crypto checks. A separate CLI binary that wraps rust-ccatoken for verification can be the right place for that. We can track it as a follow-up issue if there's interest.

yogeshbdeshpande · 2026-06-23T16:32:48Z

@shefali-kamal : Thanks for the great work, this is quite useful.

Once the PR is merged, as new useful repository will be added. kindly remember to add this repo in the list
here

thomas-fossati

Very good stuff, thanks!

I have left a few comments inline.

Contains definitions of all interfaces. Also contains working examples demonstrating the usage. Interfaces: 1. A TSM report builder abstraction (non-dyn compatible). 2. Attester (which is dyn compatible) Implementations: 1. LinuxTsmReportBuilder: implementation of tsm report interface for linux configfs-tsm ABI 2. CcaTsmAttester: Attester for CCA using linux tsm report builder 3. CcaSimAttester: Attester for CCA which generates simulated evidence. The intented usage of the TSM report builder interface is to mock configfs-tsm behaviours. This can be seen in the implementation of the FakeTsmBuilder, which is used by CcaSimAttester. Signed-off-by: Dhanus M Lal <Dhanus.MLal@fujitsu.com>

Add attester trait and implementations for CCA evidence collection: - Generic RatsdAttester (src/attesters/ratsd.rs): HTTP transport layer that posts a challenge to a RATSD daemon and returns the raw JSON response. No TEE-specific parsing. - CcaRatsdAttester (src/attesters/cca/ratsd.rs): wraps RatsdAttester with CCA-specific CMW envelope parsing and evidence extraction. Reuses cmw::monad::Monad directly, collects evidence from Linux configfs-tsm on real CCA hardware. - CcaSimulatedAttester returns embedded pre-built evidence.cbor. Includes example binary (examples/attester.rs) supporting --attester cca-tsm|cca-sim|cca-ratsd. Add tests for CCA attesters (nonce validation, CMW parsing, error paths), RatsdAttester httpmock round-trip, simulated CCA backend, and TSM error type conversions and context() behavior. Signed-off-by: BISWAS, SREYAN <SREYAN.BISWAS@fujitsu.com> [Dhanus.MLal@fujitsu.com: resolved conflicts in deny.toml] Signed-off-by: Dhanus M Lal <Dhanus.MLal@fujitsu.com>

Add util submodule for decoding and displaying CCA attestation tokens: - types.rs: serde-annotated CcaToken, PlatformClaims, RealmClaims, SwComponent structs with base64 field serialization - decode.rs: decode_cca_token() delegates to ccatoken::Evidence::decode, then converts to REGL's serde-enabled types - print.rs: pretty_print_token() for human-readable JSON output matching evcli cca print format - examples/attester.rs: add --print flag with pretty_print_token Add tests for CBOR decode pipeline, pretty-print JSON output, and CcaToken serde round-trip. Add ccatoken, serde, ciborium dependencies needed by the utils. Signed-off-by: BISWAS, SREYAN <SREYAN.BISWAS@fujitsu.com>

Signed-off-by: Dhanus M Lal <Dhanus.MLal@fujitsu.com>

yogeshbdeshpande · 2026-06-24T11:14:41Z

@DhanusML, @shefali-kamal Do you have a equivalent github issue, which captures the requirement or the problem space, which you are trying to solve using this PR?

thomas-fossati

thanks!

shefali-kamal · 2026-06-24T18:20:07Z

@DhanusML, @shefali-kamal Do you have a equivalent github issue, which captures the requirement or the problem space, which you are trying to solve using this PR?

@yogeshbdeshpande as of now we have not created any GH Issue/enhancement for this.

shefali-kamal · 2026-06-24T18:21:42Z

@shefali-kamal : Thanks for the great work, this is quite useful.

Once the PR is merged, as new useful repository will be added. kindly remember to add this repo in the list here

Yes @yogeshbdeshpande we will make sure to add this. Once you approve the PR I will merge it and add the details in the repo list.

yogeshbdeshpande

LGTM!

Since this is very much a Work In Progress, where more items are required before we mark this as complete, I would request implementer of the PR to make a note of the changes requested in the comments either via github issue or some other tracking mechanism and then merge the changes for this PR!

thomas-fossati · 2026-07-01T09:07:24Z

@paulhowardarm do you plan to provide your review?

If not, I believe it can be merged.

paulhowardarm · 2026-07-01T09:15:37Z

@paulhowardarm do you plan to provide your review?

If not, I believe it can be merged.

@thomas-fossati Two approvals is sufficient, I think, so please feel free to go ahead and merge. Thanks to all contributors and reviewers for the excellent work here.

add CI

1cd6167

Signed-off-by: Thomas Fossati <thomas.fossati@linaro.org>

shefali-kamal requested review from paulhowardarm and thomas-fossati June 22, 2026 15:14

yogeshbdeshpande reviewed Jun 23, 2026

View reviewed changes

thomas-fossati reviewed Jun 23, 2026

View reviewed changes

Comment thread src/tsm/linuxtsm.rs

Comment thread src/tsm/linuxtsm.rs

Comment thread src/attesters/cca/ratsd.rs Outdated

Comment thread src/attesters/cca/utils/decode.rs Outdated

Comment thread src/attesters/cca/mod.rs Outdated

DhanusML and others added 4 commits June 24, 2026 14:53

chore: update dependencies

1b2a9d6

Signed-off-by: Dhanus M Lal <Dhanus.MLal@fujitsu.com>

shefali-kamal force-pushed the main branch from e678167 to 1b2a9d6 Compare June 24, 2026 14:31

shefali-kamal requested review from thomas-fossati and yogeshbdeshpande June 24, 2026 14:31

thomas-fossati approved these changes Jun 24, 2026

View reviewed changes

yogeshbdeshpande approved these changes Jun 25, 2026

View reviewed changes

DhanusML mentioned this pull request Jun 25, 2026

feature: simulated CCA attester #2

Open

sb-fuji mentioned this pull request Jul 1, 2026

Backlog: PR #1 review follow-ups #3

Open

thomas-fossati merged commit 76aafee into veraison:main Jul 1, 2026
4 checks passed

Uh oh!

Conversation

shefali-kamal commented Jun 22, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yogeshbdeshpande Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sb-fuji Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sb-fuji Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yogeshbdeshpande commented Jun 23, 2026

Uh oh!

thomas-fossati left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yogeshbdeshpande commented Jun 24, 2026

Uh oh!

thomas-fossati left a comment

Choose a reason for hiding this comment

Uh oh!

shefali-kamal commented Jun 24, 2026

Uh oh!

shefali-kamal commented Jun 24, 2026

Uh oh!

yogeshbdeshpande left a comment

Choose a reason for hiding this comment

Uh oh!

thomas-fossati commented Jul 1, 2026

Uh oh!

paulhowardarm commented Jul 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

yogeshbdeshpande Jun 23, 2026 •

edited

Loading

sb-fuji Jul 1, 2026 •

edited

Loading

sb-fuji Jul 1, 2026 •

edited

Loading