Endorsement Store Interface Implementation

.gitignore

@@ -9,6 +9,7 @@ policy/cmd/polcli/polcli
 protogen
 provisioning/cmd/provisioning-service/provisioning-service
 scheme/bin
+store-plugin/bin
 plugin/test/bin
 scheme/enacttrust/test/tokens/*.token
 scheme/tpm-enacttrust/test/cmd/gen-token/gen-token

Makefile

@@ -7,6 +7,7 @@ SUBDIR += builtin
 SUBDIR += auth
 SUBDIR += config
 SUBDIR += coserv
+SUBDIR += store-plugin
 SUBDIR += handler
 SUBDIR += kvstore
 SUBDIR += log
@@ -47,9 +48,10 @@ IGNORE_COVERAGE += github.com/veraison/services/vts/trustedservices
 IGNORE_COVERAGE += github.com/veraison/services/vtsclient
 IGNORE_COVERAGE += github.com/veraison/services/coserv/api
 IGNORE_COVERAGE += github.com/veraison/services/coserv/cmd/coserv-service
-IGNORE_COVERAGE += github.com/veraison/services/scheme/amd-kds-coserv
-IGNORE_COVERAGE += github.com/veraison/services/scheme/nvidia-coserv
+IGNORE_COVERAGE += github.com/veraison/services/store-plugin/amd-kds-coserv
+IGNORE_COVERAGE += github.com/veraison/services/store-plugin/nvidia-coserv
 IGNORE_COVERAGE += github.com/veraison/services/scheme/nvidia
+IGNORE_COVERAGE += github.com/veraison/services/store-plugin/corim-store
 IGNORE_COVERAGE += github.com/veraison/services/scheme/parsec-cca
 IGNORE_COVERAGE += github.com/veraison/services/scheme/parsec-tpm
 IGNORE_COVERAGE += github.com/veraison/services/scheme/psa-iot

builtin/builtin_loader.go

@@ -10,11 +10,12 @@ import (
 	"go.uber.org/zap"
 )
 
-var defaultBuiltinLoader *BuiltinLoader
+var defaultBuiltinSchemeLoader *BuiltinLoader
 
 type BuiltinLoader struct {
 	logger *zap.SugaredLogger
 
+	class             PluginClass
 	loadedByName      map[string]plugin.IPluggable
 	loadedByMediaType map[string]plugin.IPluggable
 
@@ -23,16 +24,20 @@ type BuiltinLoader struct {
 	registeredPluginTypes map[string]string
 }
 
-func NewBuiltinLoader(logger *zap.SugaredLogger) *BuiltinLoader {
-	return &BuiltinLoader{logger: logger}
+func NewBuiltinLoader(logger *zap.SugaredLogger, class PluginClass) *BuiltinLoader {
+	return &BuiltinLoader{
+		logger: logger,
+		class:  class,
+	}
 }
 
 func CreateBuiltinLoader(
 	cfg map[string]any,
+	class PluginClass,
 	pluginParams map[string]*plugin.Parameters,
 	logger *zap.SugaredLogger,
 ) (*BuiltinLoader, error) {
-	loader := NewBuiltinLoader(logger)
+	loader := NewBuiltinLoader(logger, class)
 	err := loader.Init(cfg, pluginParams)
 	return loader, err
 }
@@ -70,11 +75,11 @@ func (o *BuiltinLoader) GetRegisteredMediaTypesByCategory(category string) []str
 }
 
 func DiscoverBuiltin[I plugin.IPluggable]() error {
-	return DiscoverBuiltinUsing[I](defaultBuiltinLoader)
+	return DiscoverBuiltinUsing[I](defaultBuiltinSchemeLoader)
 }
 
 func DiscoverBuiltinUsing[I plugin.IPluggable](loader *BuiltinLoader) error {
-	for _, p := range plugins {
+	for _, p := range plugins[loader.class] {
 		_, ok := p.(I)
 		if !ok {
 			continue
@@ -117,7 +122,7 @@ func DiscoverBuiltinUsing[I plugin.IPluggable](loader *BuiltinLoader) error {
 }
 
 func GetBuiltinHandleByMediaType[I plugin.IPluggable](mediaType string) (I, error) {
-	return GetBuiltinHandleByMediaTypeUsing[I](defaultBuiltinLoader, mediaType)
+	return GetBuiltinHandleByMediaTypeUsing[I](defaultBuiltinSchemeLoader, mediaType)
 }
 
 func GetBuiltinHandleByMediaTypeUsing[I plugin.IPluggable](
@@ -196,5 +201,5 @@ func GetBuiltinHandleByAttestationSchemeUsing[I plugin.IPluggable](
 }
 
 func init() {
-	defaultBuiltinLoader = NewBuiltinLoader(log.Named("builtin"))
+	defaultBuiltinSchemeLoader = NewBuiltinLoader(log.Named("builtin"), SchemePlugin)
 }

builtin/builtin_manager.go

@@ -23,6 +23,7 @@ func NewBuiltinManager[I plugin.IPluggable](
 
 func CreateBuiltinManager[I plugin.IPluggable](
 	v *viper.Viper,
+	class PluginClass,
 	pluginParams map[string]*plugin.Parameters,
 	logger *zap.SugaredLogger,
 	name string,
@@ -32,7 +33,7 @@ func CreateBuiltinManager[I plugin.IPluggable](
 		return nil, err
 	}
 
-	loader, err := CreateBuiltinLoader(subs["builtin"].AllSettings(), pluginParams, logger)
+	loader, err := CreateBuiltinLoader(subs["builtin"].AllSettings(), class, pluginParams, logger)
 	if err != nil {
 		return nil, err
 	}

builtin/schemes.go → builtin/plugins.go

@@ -6,25 +6,42 @@ import (
 	"github.com/veraison/services/handler"
 	"github.com/veraison/services/plugin"
 
-	scheme9 "github.com/veraison/services/scheme/amd-kds-coserv"
 	scheme3 "github.com/veraison/services/scheme/arm-cca"
 	scheme10 "github.com/veraison/services/scheme/da-spdm"
-	scheme8 "github.com/veraison/services/scheme/nvidia-coserv"
 	scheme1 "github.com/veraison/services/scheme/parsec-cca"
 	scheme5 "github.com/veraison/services/scheme/parsec-tpm"
 	scheme6 "github.com/veraison/services/scheme/psa-iot"
 	scheme7 "github.com/veraison/services/scheme/sevsnp"
 	scheme4 "github.com/veraison/services/scheme/tpm-enacttrust"
+	store3 "github.com/veraison/services/store-plugin/amd-kds-coserv"
+	store1 "github.com/veraison/services/store-plugin/corim-store"
+	store2 "github.com/veraison/services/store-plugin/nvidia-coserv"
 )
 
-var plugins = []plugin.IPluggable{
+type PluginClass uint8
+
+const (
+	SchemePlugin PluginClass = iota
+	StorePlugin
+)
+
+var plugins = map[PluginClass][]plugin.IPluggable{
+	SchemePlugin: schemePlugins,
+	StorePlugin:  storePlugins,
+}
+
+var schemePlugins = []plugin.IPluggable{
 	handler.MustNewSchemeImplementationWrapper(scheme1.Descriptor, scheme1.NewImplementation()),
 	handler.MustNewSchemeImplementationWrapper(scheme3.Descriptor, scheme3.NewImplementation()),
 	handler.MustNewSchemeImplementationWrapper(scheme4.Descriptor, scheme4.NewImplementation()),
 	handler.MustNewSchemeImplementationWrapper(scheme5.Descriptor, scheme5.NewImplementation()),
 	handler.MustNewSchemeImplementationWrapper(scheme6.Descriptor, scheme6.NewImplementation()),
 	handler.MustNewSchemeImplementationWrapper(scheme7.Descriptor, scheme7.NewImplementation()),
 	handler.MustNewSchemeImplementationWrapper(scheme10.Descriptor, scheme10.NewImplementation()),
-	&scheme8.CoservProxyHandler{},
-	&scheme9.CoservProxyHandler{},
+}
+
+var storePlugins = []plugin.IPluggable{
+	&store2.CoservProxyHandler{},
+	&store3.CoservProxyHandler{},
+	store1.NewStore(),
 }

deployments/docker/src/builder-dispatcher

@@ -25,19 +25,21 @@ function deploy() {
     local gobin=$(go env GOPATH)/bin
 
     echo "creating deployment directory structure under $DEPLOY_DIR"
-    mkdir -p $DEPLOY_DIR/plugins
+    mkdir -p $DEPLOY_DIR/plugins/schemes
     mkdir -p $DEPLOY_DIR/stores
     mkdir -p $DEPLOY_DIR/logs
     mkdir -p $DEPLOY_DIR/utils
     mkdir -p $DEPLOY_DIR/certs
+    mkdir -p $DEPLOY_DIR/plugins/stores
 
     echo "deploying services"
     cp $BUILD_DIR/provisioning/cmd/provisioning-service/provisioning-service $DEPLOY_DIR/
     cp $BUILD_DIR/verification/cmd/verification-service/verification-service $DEPLOY_DIR/
     cp $BUILD_DIR/vts/cmd/vts-service/vts-service $DEPLOY_DIR/
     cp $BUILD_DIR/management/cmd/management-service/management-service $DEPLOY_DIR/
     cp $BUILD_DIR/coserv/cmd/coserv-service/coserv-service $DEPLOY_DIR/
-    cp $BUILD_DIR/scheme/bin/* $DEPLOY_DIR/plugins/
+    cp $BUILD_DIR/scheme/bin/* $DEPLOY_DIR/plugins/schemes/
+    cp $BUILD_DIR/store-plugin/bin/* $DEPLOY_DIR/plugins/stores/
     cp $BUILD_DIR/deployments/docker/src/skey.jwk $DEPLOY_DIR/
     cp $BUILD_DIR/deployments/docker/src/coserv-signer.jwk $DEPLOY_DIR/
     cp $BUILD_DIR/deployments/docker/src/service-entrypoint $DEPLOY_DIR/

deployments/docker/src/config.yaml.template

@@ -26,10 +26,6 @@ coserv:
   protocol: https
   cert: /opt/veraison/coserv.crt
   cert-key: /opt/veraison/coserv.key
-  max-expiry: 5 mins
-  signer:
-    alg: ES256
-    key: /opt/veraison/coserv-signer.jwk
 vts:
   server-addr: vts-service:${VTS_PORT}
   tls: true
@@ -42,11 +38,10 @@ ear-signer:
   key: skey.jwk
 plugin:
   backend: go-plugin
-  go-plugin:
-    dir: ./plugins/
-store:
-  dbms: sqlite
-  dsn: stores/vts/store.sql
+  go-plugin-schemes:
+    dir: ./plugins/schemes/
+  go-plugin-stores:
+    dir: ./plugins/stores/
 po-store:
   backend: sql
   sql:
@@ -55,6 +50,20 @@ po-store:
     datasource: stores/vts/po-store.sql
 po-agent:
     backend: opa
+endorsement-store:
+  coserv:
+    max-expiry: 5 mins
+    signer:
+      alg: ES256
+      key: /opt/veraison/coserv-signer.jwk
+  active-plugins:
+    - corim-store
+    - nvidia-coserv-proxy-handler
+    - amd-kds-coserv-proxy-handler
+  plugin-parameters:
+    corim-store:
+      dbms: sqlite
+      dsn: /opt/veraison/stores/vts/store.sql
 auth:
   backend: keycloak
   host: keycloak-service

deployments/native/README.md

@@ -368,6 +368,8 @@ structure
 ├── env
 ├── logs
 ├── plugins
+│   ├── schemes
+│   └── stores
 ├── signing
 ├── stores
 └── systemd (or launchd)
@@ -401,9 +403,10 @@ This directory contains service logs.
 
 #### `plugins`
 
-This directly contains attestation scheme plugins.
+This directly contains attestation scheme plugins (in the `schemes` sub directory)
+and endorsement store plugins (in the `stores` sub directory).
 
-(note: if the deployment was crated with `-s` option, the plugins will in fact
+(note: if the deployment was created with `-s` option, the plugins will in fact
 be symlinks to their source locations.)
 
 #### `signing`

deployments/native/config/services.yaml.template

@@ -26,10 +26,6 @@ coserv:
   protocol: https
   cert: ${VERAISON_CERTS_DIR}/coserv.crt
   cert-key: ${VERAISON_CERTS_DIR}/coserv.key
-  max-expiry: 5 mins
-  signer:
-    alg: ES256
-    key: ${VERAISON_SIGNING_DIR}/coserv-signer.jwk
 vts:
   server-addr: ${VTS_HOST}:${VTS_PORT}
   tls: true
@@ -42,8 +38,10 @@ ear-signer:
   key: ${VERAISON_SIGNING_DIR}/skey.jwk
 plugin:
   backend: go-plugin
-  go-plugin:
-    dir: ${VERAISON_PLUGINS_DIR}/
+  go-plugin-schemes:
+    dir: ${VERAISON_SCHEME_PLUGINS_DIR}/
+  go-plugin-stores:
+    dir: ${VERAISON_STORE_PLUGINS_DIR}/
 ##############################################################################
 # The store entries below configure the stores for endorsements, trust
 # anchors, and policies. They are configured to use sqlite3 by default. sqlite3
@@ -58,17 +56,30 @@ plugin:
 # on localhost on its default port, the user is "veraison" with password
 # "password", and the relevant database is "veraison".
 ##############################################################################
-store:
-  trace-sql: false
+endorsement-store:
+  coserv:
+    max-expiry: 5 mins
+    signer:
+      alg: ES256
+      key: ${VERAISON_SIGNING_DIR}/coserv-signer.jwk
+  active-plugins:
+    - corim-store
+    - nvidia-coserv-proxy-handler
+    - amd-kds-coserv-proxy-handler
 
-  dbms: sqlite3
-  dsn: ${VERAISON_STORES_DIR}/store.sql
+  # configurations for the corim-store plugin
+  plugin-parameters:
+    corim-store:
+      trace-sql: false
 
-  #dbms: pgx
-  #dsn: postgres://veraison:password@localhost:5432/veraison
-
-  #dbms: mysql
-  #dsn: veraison:password@tcp(localhost:3306)/veraison
+      dbms: sqlite3
+      dsn: ${VERAISON_STORES_DIR}/store.sql
+
+      #dbms: pgx
+      #dsn: postgres://veraison:password@localhost:5432/veraison
+
+      #dbms: mysql
+      #dsn: veraison:password@tcp(localhost:3306)/veraison
 po-store:
   backend: sql
   sql:

deployments/native/deployment.cfg

@@ -53,4 +53,7 @@ VERAISON_SYSTEMD_USER_DIR=$(echo ${VERAISON_ROOT}/${VERAISON_SYSTEMD_USER_SUBDIR
 VERAISON_TMUX_DIR=$(echo ${VERAISON_ROOT}/${VERAISON_TMUX_SUBDIR:-} | tr -s '/')
 VERAISON_LICENSE_DIR=$(echo ${VERAISON_ROOT}/${VERAISON_LICENSE_SUBDIR:-} | tr -s '/')
 
+VERAISON_SCHEME_PLUGINS_DIR=$(echo ${VERAISON_PLUGINS_DIR}/schemes | tr -s '/')
+VERAISON_STORE_PLUGINS_DIR=$(echo ${VERAISON_PLUGINS_DIR}/stores | tr -s '/')
+
 # vim: set ft=bash:

deployments/native/deployment.sh

@@ -27,7 +27,8 @@ SRC_LAUNCHD_DIR=${_THIS_DIR}/launchd
 SRC_CERTS_DIR=${VERAISON_CERTS:-${EXAMPLE_DIR}/certs}
 
 DEPLOYMENT_BIN_DIR=$(echo ${DEPLOYMENT_DEST}/${VERAISON_BIN_DIR} | tr -s '/')
-DEPLOYMENT_PLUGINS_DIR=$(echo ${DEPLOYMENT_DEST}/${VERAISON_PLUGINS_DIR} | tr -s '/')
+DEPLOYMENT_SCHEME_PLUGINS_DIR=$(echo ${DEPLOYMENT_DEST}/${VERAISON_SCHEME_PLUGINS_DIR} | tr -s '/')
+DEPLOYMENT_STORE_PLUGINS_DIR=$(echo ${DEPLOYMENT_DEST}/${VERAISON_STORE_PLUGINS_DIR} | tr -s '/')
 DEPLOYMENT_CERTS_DIR=$(echo ${DEPLOYMENT_DEST}/${VERAISON_CERTS_DIR} | tr -s '/')
 DEPLOYMENT_LOGS_DIR=$(echo ${DEPLOYMENT_DEST}/${VERAISON_LOGS_DIR} | tr -s '/')
 DEPLOYMENT_STORES_DIR=$(echo ${DEPLOYMENT_DEST}/${VERAISON_STORES_DIR} | tr -s '/')
@@ -433,7 +434,8 @@ function help() {
 
 function _init_deployment_dir() {
 	mkdir -p ${DEPLOYMENT_BIN_DIR}
-	mkdir -p ${DEPLOYMENT_PLUGINS_DIR}
+	mkdir -p ${DEPLOYMENT_SCHEME_PLUGINS_DIR}
+	mkdir -p ${DEPLOYMENT_STORE_PLUGINS_DIR}
 	mkdir -p ${DEPLOYMENT_CERTS_DIR}
 	mkdir -p ${DEPLOYMENT_LOGS_DIR}
 	mkdir -p ${DEPLOYMENT_CONFIG_DIR}
@@ -547,7 +549,13 @@ function _symlink_bins() {
 	    while IFS= read -r -d '' path; do
 		path=$(realpath "$path")
 		chmod +x "$path"
-		ln -s $_f "$path" "${DEPLOYMENT_PLUGINS_DIR}/$(basename $path)"
+		ln -s $_f "$path" "${DEPLOYMENT_SCHEME_PLUGINS_DIR}/$(basename $path)"
+	    done
+
+	find "${ROOT_DIR}/store-plugin/bin/" -name '*.plugin' -print0 | grep -z -v handler |
+	    while IFS= read -r -d '' path; do
+		chmod +x "$path"
+		ln -s $_f "$path" "${DEPLOYMENT_STORE_PLUGINS_DIR}/$(basename $path)"
 	    done
 }
 
@@ -561,8 +569,14 @@ function _deploy_bins() {
 
 	find "${ROOT_DIR}/scheme/bin/" -name '*.plugin' -print0 | grep -z -v handler |
 	    while IFS= read -r -d '' path; do
-		    $_INSTALL -m 0755 "$path" "${DEPLOYMENT_PLUGINS_DIR}/$(basename $path)"
+		    $_INSTALL -m 0755 "$path" "${DEPLOYMENT_SCHEME_PLUGINS_DIR}/$(basename $path)"
 	    done
+
+	find "${ROOT_DIR}/endorsementstore/bin/" -name '*.plugin' -print0 | grep -z -v handler |
+	    while IFS= read -r -d '' path; do
+		    $_INSTALL -m 0755 "$path" "${DEPLOYMENT_STORE_PLUGINS_DIR}/$(basename $path)"
+	    done
+
 }
 
 function _deploy_frontend {