cmd/rofl: Support verifying versioned ROFL enclave IDs - #710
Conversation
Sorry, something went wrong.
✅ Deploy Preview for oasisprotocol-cli canceled.
|
Sorry, something went wrong.
kostko
left a comment
There was a problem hiding this comment.
Shouldn't it compare the version with the latest configured version under the top-level version field instead of just using the highest version?
Sorry, something went wrong.
| // Any enclave identity present in the manifest (latest or versioned) is an | ||
| // acceptable match for the build. |
There was a problem hiding this comment.
It seems strange that one would verify against any version? Usually one would have the manifest be one for the version indicated in the version field and historic versions would be available from source control.
Sorry, something went wrong.
There was a problem hiding this comment.
I enabled verification for both now - either the untagged one or the one defined in the ROFL version. The flow is not that clean anymore though. Maybe the previous behavior was better assuming that the untagged version is simply the one defined in the global version.
Sorry, something went wrong.
There was a problem hiding this comment.
I think it makes sense that both mean the same? And maybe also versions higher than the version in the manifest should trigger some sort of warning?
Sorry, something went wrong.
This comes in handy, if you want to pin the latest enclave ID too in your manifest and allow oasis rofl build --verify to work.
Reviewers
At least 1 approving review is required to merge this pull request.
I'm not sure if this behavior of oasis rofl build --verify is intentional, but the --verify flag only works, if the matched enclave ID does not have a version set.
Some projects may prefer to version all enclave IDs and not only the historical ones.