Skip to content

Commit 19868c3

Browse files
Refining
1 parent 7d28708 commit 19868c3

File tree

2 files changed

+9
-9
lines changed

2 files changed

+9
-9
lines changed

content/learning-paths/servers-and-cloud-computing/cca-trustee/cca-trustee.md

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ processing, is a common practice in confidential computing.
2525
This Learning Path is similar to
2626
[Run an end-to-end Attestation Flow with Arm CCA](/learning-paths/servers-and-cloud-computing/cca-essentials/).
2727

28-
The main difference is that, instead of the KBS from the [Veraison](https://github.com/veraison) project, you will use components implemented in the [Confidential Containers (CoCo)](https://github.com/confidential-containers) to support the [IETF RATS model](https://datatracker.ietf.org/doc/rfc9334/) (Remote ATtestation procedureS). These components include the Attestation Service (AS), Key Broker Service (KBS), Reference Value Provider Service (RVPS), Attestation Agent (AA), and Confidential Data Hub (CDH).
28+
The main difference is that, instead of the KBS from the [Veraison](https://github.com/veraison) project, you will use components implemented in the [Confidential Containers (CoCo) Project](https://github.com/confidential-containers) to support the [IETF RATS model](https://datatracker.ietf.org/doc/rfc9334/) (Remote ATtestation procedureS). These components include the Attestation Service (AS), Key Broker Service (KBS), Reference Value Provider Service (RVPS), Attestation Agent (AA), and Confidential Data Hub (CDH).
2929
The AS, KBS, and RVPS components are part of the [Trustee project](https://github.com/confidential-containers/trustee),
3030
whereas the AA and CDH are part of the [Guest Components](https://github.com/confidential-containers/guest-components) project in CoCo.
3131

@@ -84,11 +84,10 @@ RVPS verifies, stores, and provides reference values. It receives inputs from th
8484

8585
Guest components run inside the realm (TEE). In RATS terms, these components act as the **Attester**.
8686

87-
For simplicity instead of Attestation Agent (AA) and Confidential Data Hub (CDH)
88-
you will use [KBS Client Tool](https://github.com/confidential-containers/trustee/tree/main/tools/kbs-client).
87+
For simplicity, instead of Attestation Agent (AA) and Confidential Data Hub (CDH), you will use the [KBS Client Tool](https://github.com/confidential-containers/trustee/tree/main/tools/kbs-client).
8988

9089
This is a simple client for the KBS that facilitates basic attestation flows.
91-
You will run this tool inside of a realm to make requests for an attestation result token (EAR) and a secret.
90+
You will run this tool in a realm to make requests for an attestation result token (EAR) and a secret.
9291

9392
The client tool can also be used to provision the KBS/AS with resources and policies.
9493

content/learning-paths/servers-and-cloud-computing/cca-trustee/flow.md

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@ weight: 3 # 1 is first, 2 is second, etc.
77
# Do not modify these elements
88
layout: "learningpathall"
99
---
10+
## Overview
11+
In this section you’ll run the **Trustee services** (AS, KBS, RVPS), launch a **CCA realm** on **Arm FVP**, generate attestation evidence, and request a secret. You’ll intentionally fail the first request to see how **attestation policy** gates secret release, then **endorse the realm initial measurement (RIM)**, re-attest, and successfully retrieve the secret.
1012

11-
## Run Trustee services
12-
13-
### Prerequisites
13+
## Install dependencies
1414

1515
Install Docker. On Ubuntu 24.04 LTS, set up Docker’s APT repository:
1616

@@ -75,7 +75,7 @@ docker compose up -d
7575
✔ Container cca-trustee-kbs-client-1 Started
7676
```
7777

78-
While running the demo you can also check logs of the Trustee services in this termimal:
78+
While running the demo you can also check logs of the Trustee services in this terminal:
7979
``` bash
8080
docker compose logs <service>
8181
```
@@ -147,6 +147,7 @@ Run the attestation command and save the EAT Attestation Result (EAR) message in
147147
```
148148

149149
Request the demo secret with that EAR:
150+
150151
```bash./kbs-client --url http://kbs:8080 get-resource \
151152
--tee-key-file realm.key --attestation-token ear.jwt \
152153
--path "cca-trustee/demo-message/message.txt"
@@ -276,7 +277,7 @@ Verify that the new EAR now contains `affirming` status:
276277
"ear.status": "affirming",
277278
```
278279

279-
and `affirming` result for the `Executables` trustworthness vector:
280+
and `affirming` result for the `Executables` trustworthiness vector:
280281
```bash { output_lines = "2-11" }
281282
./arc verify ear.jwt |grep -A10 "trustworthiness vectors"
282283
[trustworthiness vectors]

0 commit comments

Comments
 (0)