cmd/rofl: Support verifying versioned ROFL enclave IDs - #710
Conversation
✅ Deploy Preview for oasisprotocol-cli canceled.
|
kostko
left a comment
kostko
left a comment
There was a problem hiding this comment.
Shouldn't it compare the version with the latest configured version under the top-level version field instead of just using the highest version?
325d516 to
da36be0
Compare
| // Any enclave identity present in the manifest (latest or versioned) is an | ||
| // acceptable match for the build. |
There was a problem hiding this comment.
It seems strange that one would verify against any version? Usually one would have the manifest be one for the version indicated in the version field and historic versions would be available from source control.
There was a problem hiding this comment.
I enabled verification for both now - either the untagged one or the one defined in the ROFL version. The flow is not that clean anymore though. Maybe the previous behavior was better assuming that the untagged version is simply the one defined in the global version.
There was a problem hiding this comment.
I think it makes sense that both mean the same? And maybe also versions higher than the version in the manifest should trigger some sort of warning?
This comes in handy, if you want to pin the latest enclave ID too in your manifest and allow oasis rofl build --verify to work.
da36be0 to
2c2a372
Compare
2 participants
I'm not sure if this behavior of
oasis rofl build --verifyis intentional, but the--verifyflag only works, if the matched enclave ID does not have a version set.Some projects may prefer to version all enclave IDs and not only the historical ones.