Add ci for running on genoa

.github/workflows/ci.yml

@@ -170,6 +170,9 @@ jobs:
           echo "::group::Disk usage"
           df -kh
           echo "::endgroup::"
+          echo "::group::Mounts"
+          mount
+          echo "::endgroup::"
           echo "::group::CPU Info"
           cat /proc/cpuinfo
           echo "::endgroup::"
@@ -219,3 +222,80 @@ jobs:
             build/workspace/*/*.ledger/*
           if-no-files-found: ignore
         if: success() || failure()
+
+  build_and_test_caci_genoa:
+    name: "Confidential Container CI on Genoa"
+    runs-on: [self-hosted, 1ES.Pool=gha-c-caci-ci-south-central-us]
+    needs: checks
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: "Ensure running on Genoa hardware"
+        run: |
+          cat /proc/cpuinfo | grep "model.*: 17"
+        shell: bash
+
+      - name: "Dump environment"
+        run: |
+          set -ex
+          # Dump environment variables, extract Fabric_NodeIPOrFQDN
+          # and save it to a file for reconfiguration test using THIM.
+          cat /proc/*/environ | tr '\000' '\n' | sort -u | grep Fabric_NodeIPOrFQDN > /Fabric_NodeIPOrFQDN
+          echo "::group::Disk usage"
+          df -kh
+          echo "::endgroup::"
+          echo "::group::Mounts"
+          mount
+          echo "::endgroup::"
+          echo "::group::CPU Info"
+          cat /proc/cpuinfo
+          echo "::endgroup::"
+        shell: bash
+
+      - name: "Build Debug"
+        run: |
+          set -ex
+          git config --global --add safe.directory /__w/CCF/CCF
+          mkdir build
+          cd build
+          cmake -GNinja -DCOMPILE_TARGET=snp -DCMAKE_BUILD_TYPE=Debug ..
+          ninja
+        shell: bash
+
+      - name: "Tests"
+        run: |
+          set -ex
+          cd build
+          rm -rf /github/home/.cache
+          mkdir -p /github/home/.cache
+          # Unit tests
+          ./tests.sh --output-on-failure -L unit -j$(nproc --all)
+          # End to end tests
+          ./tests.sh --timeout 360 --output-on-failure -LE "benchmark|suite|unit"
+        shell: bash
+
+      - name: "Capture dmesg"
+        run: |
+          set -ex
+          echo "::group::Disk usage"
+          df -kh
+          echo "::endgroup::"
+          dmesg > dmesg.log
+        shell: bash
+        if: success() || failure()
+
+      - name: "Upload logs"
+        uses: actions/upload-artifact@v4
+        with:
+          name: logs-caci-snp-genoa
+          path: |
+            dmesg.log
+            build/workspace/*/*.config.json
+            build/workspace/*/out
+            build/workspace/*/err
+            build/workspace/*/*.ledger/*
+          if-no-files-found: ignore
+        if: success() || failure()

tests/npm_tests.py

@@ -1,7 +1,7 @@
 # Copyright (c) Microsoft Corporation. All rights reserved.
 # Licensed under the Apache 2.0 License.
 #
-from base64 import b64encode
+from base64 import b64encode, b64decode
 from cryptography.exceptions import InvalidSignature
 from cryptography.hazmat.primitives.asymmetric import ec
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
@@ -848,15 +848,26 @@ def corrupt_value(value: str):
             )
 
             # Test too long an endorsement
+            extended_endorsements = (
+                b64decode(primary_quote_info["endorsements"])
+                + b"-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----"
+            )
+            extended_endorsements = b64encode(extended_endorsements).decode(
+                encoding="utf-8"
+            )
             r = c.post(
                 "/app/verifySnpAttestation",
                 {
                     "evidence": primary_quote_info["raw"],
-                    "endorsements": primary_quote_info["endorsements"] + "1",
+                    "endorsements": extended_endorsements,
                     "uvm_endorsements": primary_quote_info["uvm_endorsements"],
                 },
             )
             assert r.status_code == http.HTTPStatus.BAD_REQUEST, r.status_code
+            assert (
+                "Expected 3 endorsement certificates but got 4"
+                in r.body.json()["error"]["message"]
+            )
 
             # Test corrupted endorsements
             r = c.post(