demo-hello-world-enclave does not pass caution verify attestation #288

modalala commented 2026年06月14日 03:13:40 +02:00

to reproduce:
checkout caution on commit 04065310
(currently main on caution/platform)
make install-cli
caution login --qr
git clone https://codeberg.org/caution/demo-hello-world-enclave.git
( currently ca1e0c14 is main on demo-hello-world-enclave)
cd demo-hello-world-enclave/
caution init
git push caution main

I see:

 `remote: Deploying branch 'main' at ca1e0c14f2b6ea76928131861def83f84ba77e6c`
 ...
 `remote: Deployment successful!`

caution verify
I see:

 `PCR0: MISMATCH` and `PCR1: MISMATCH`
 `Error: Attestation verification failed`

to reproduce: checkout caution on commit `04065310` (currently `main` on `caution/platform`) `make install-cli` `caution login --qr` `git clone https://codeberg.org/caution/demo-hello-world-enclave.git` ( currently `ca1e0c14` is `main` on `demo-hello-world-enclave`) `cd demo-hello-world-enclave/` `caution init` `git push caution main` I see: ``` `remote: Deploying branch 'main' at ca1e0c14f2b6ea76928131861def83f84ba77e6c` ... `remote: Deployment successful!` ``` `caution verify` I see: ``` `PCR0: MISMATCH` and `PCR1: MISMATCH` `Error: Attestation verification failed` ```

anton commented 2026年06月14日 19:37:53 +02:00

I can't reproduce this. Not sure how it's failing for you. Try to replicate with no_cache: true, you may have an old image or something

I can't reproduce this. Not sure how it's failing for you. Try to replicate with `no_cache: true`, you may have an old image or something

modalala commented 2026年06月15日 10:48:17 +02:00

Okay, thank you @anton

I tried:
(caution logged in)
checkout caution main on (now commit 40ecf936),
make install-cli
git clone https://codeberg.org/caution/demo-hello-world-enclave.git
(currently ca1e0c14 is main)
edit Procfile to include no_cache: true and point to my own fork of demo-hello-world-enclave with app_sources:
git commit -S -m "..."
caution init
push to my fork on main branch
git push caution HEAD:main

seeing:

remote: Deploying branch 'main' at a250b2e69309d44e5e0c454c96760750a817db61
...
remote: Deployment successful!
...
Run 'caution verify' to verify the application attestation.

caution verify
produces PCR mismatches and the same Error: Attestation verification failed

I also did docker buildx prune --all - though I do have some docker images and containers (none running except my buildx runner) hanging around.

Because I'm getting the same result again, I'll leave the issue open.

Okay, thank you @anton I tried: (caution logged in) checkout caution `main` on (now commit `40ecf936`), `make install-cli` `git clone https://codeberg.org/caution/demo-hello-world-enclave.git` (currently `ca1e0c14` is `main`) edit Procfile to include `no_cache: true` and point to my own fork of `demo-hello-world-enclave` with `app_sources:` `git commit -S -m "..."` `caution init` push to my fork on `main` branch `git push caution HEAD:main` seeing: ``` remote: Deploying branch 'main' at a250b2e69309d44e5e0c454c96760750a817db61 ... remote: Deployment successful! ... Run 'caution verify' to verify the application attestation. ``` `caution verify` produces PCR mismatches and the same `Error: Attestation verification failed` I also did `docker buildx prune --all` - though I do have some docker images and containers (none running except my `buildx` runner) hanging around. Because I'm getting the same result again, I'll leave the issue open.

anton commented 2026年06月25日 20:25:15 +02:00

Closing this as nobody has been able to reproduce this.

Closing this as nobody has been able to reproduce this.