misc updates and improvements by 0x416e746f6e · Pull Request #20 · flashbots/attested-tls

0x416e746f6e · 2026-04-14T10:18:01Z

this PR:

makes detect() functions (that auto-determine platform) and AttestedCertificateResolver::new() non-async so that they could be used outside tokio
implements builder pattern for cert resolver/verifier
implements pubkey allow-lists for self-signed certs
switches to non-async verify_attestation_sync() in the context of blocking verify_attestation_binding()
renames primary_name to subject in the context of TLS cert related functions
enables using pre-determined key-pairs for attestation certs
re-exports rcgen to avoid version collisions when the downstream needs to access rcgen
other minor fixes

ameba23

🥇 Great to have these fixes.

Re: passing in keypair - i would lean towards having its as an Option and generating if not given. But don't feel too strongly.

Re: blocking API for attestation generation - i agree this makes sense as things are right now. But as mentioned here i would consider actually switching to async quote generation via configfs-tsm. Happy to merge this as-is and have that discussion later.

0x416e746f6e · 2026-04-17T15:26:39Z

Re: passing in keypair - i would lean towards having its as an Option and generating if not given. But don't feel too strongly.

implemented builder patterns for cert resolver and verifier. using predefined key-pair is now optional (as well as bunch of other things)

refs #18

(if in the future we add a new attestation type, the catch-all case will backfire)

… anton/misc-updates-and-improvements

ameba23

💯 Great improvements.

The builder pattern especially is a big improvement.

We should document that if calling attestation generation from a tokio runtime users of the library should use spawn_blocking. But since that was already the case i consider it not directly relevant to this PR.

ameba23 · 2026-04-24T10:21:09Z

-        let response = reqwest::get(url)
-            .await
+        let mut response = ureq::get(&url)
+            .timeout(Duration::from_millis(1000))


Maybe put the duration in a constant at the top of the file

ameba23 · 2026-04-24T10:28:25Z

    /// Underlying verifier when used with a private CA rather than
    /// self-signed
-    server_inner: Option<Arc<WebPkiServerVerifier>>,
+    server_verifier: Arc<WebPkiServerVerifier>,


+1 for better naming these fields

ameba23 · 2026-04-24T10:35:02Z

    /// Report data of pre-trusted certificates with cache expiry time
-    trusted_certificates: Arc<RwLock<HashMap<[u8; 64], UnixTime>>>,
+    trusted_certs: Arc<RwLock<HashMap<[u8; 64], UnixTime>>>,
+    /// Hashes of public keys allowed for self-signed certificates


Should we mention which that this is sha512 and what exactly is hashed? Does calling cert.public_key().raw give us der-encoded public key?

ameba23 · 2026-04-24T10:38:16Z

-                    })
-            })
-        })?;
+        self.attestation_verifier


ameba23 · 2026-04-24T10:42:34Z

@@ -862,15 +1041,15 @@ mod tests {
    #[tokio::test(flavor = "multi_thread")]


Maybe not directly relevant to this PR but i think that since now we stopped using tokio's block_in_place, we no longer need the multi_thread flavor for tests.

ameba23 · 2026-04-24T10:49:00Z

    };

-    if !response.status().is_success() {
+    if !resp.status() != 200 {


Can you check this line. I think that the first ! is left over from when we used reqwest, and actually the could be doing a bit-wise ! on resp.status() here which is not what we want

ameba23 · 2026-04-24T10:58:29Z

+        let server_verifier = WebPkiServerVerifier::builder_with_provider(
+            self.root_cert_store.clone().unwrap_or_else(|| {
+                let mut root_certs = rustls::RootCertStore::empty();
+                root_certs.extend(webpki_roots::TLS_SERVER_ROOTS.to_owned());


I think this is a slight behavior change - the default path is to use public webpki roots as well as self-signed, whereas before it was only self-signed.

I don't think this is bad, but maybe worth mentioning in a doccomment somewhere.

0x416e746f6e requested a review from ameba23 April 14, 2026 10:18

0x416e746f6e self-assigned this Apr 14, 2026

0x416e746f6e mentioned this pull request Apr 14, 2026

Add attested-tls crate #6

Merged

ameba23 approved these changes Apr 14, 2026

View reviewed changes

Comment thread crates/attestation/src/lib.rs

Comment thread crates/attestation/src/measurements.rs

Comment thread crates/attested-tls/src/lib.rs

Comment thread crates/attested-tls/src/lib.rs

Comment thread crates/attestation/Cargo.toml Outdated

Base automatically changed from peg/attested-tls-expose-cert-verifier to main April 17, 2026 06:29

0x416e746f6e changed the base branch from main to peg/add-sync-verifier-fn April 17, 2026 12:50

0x416e746f6e force-pushed the anton/misc-updates-and-improvements branch 2 times, most recently from 56281b9 to 530838f Compare April 17, 2026 13:04

0x416e746f6e changed the base branch from peg/add-sync-verifier-fn to main April 17, 2026 13:05

0x416e746f6e changed the base branch from main to peg/add-sync-verifier-fn April 17, 2026 13:05

0x416e746f6e force-pushed the anton/misc-updates-and-improvements branch from 530838f to 56281b9 Compare April 17, 2026 13:16

0x416e746f6e changed the base branch from peg/add-sync-verifier-fn to main April 17, 2026 13:16

0x416e746f6e changed the base branch from main to peg/add-sync-verifier-fn April 17, 2026 13:24

0x416e746f6e force-pushed the anton/misc-updates-and-improvements branch 2 times, most recently from 12ad663 to 8799225 Compare April 17, 2026 15:24

0x416e746f6e force-pushed the anton/misc-updates-and-improvements branch 4 times, most recently from eb6bc81 to 65b85eb Compare April 17, 2026 21:52

0x416e746f6e added 6 commits April 17, 2026 23:54

chore: make detect() non-async

96a4b01

refs #18

chore: rename primary_name to subject

ca43025

feat: allow using custom key-pairs

0f8ff05

fix: re-export ra_tls::rcgen

63c31e4

fix: make AttestedCertificateResolver::new() non-async

c6644a4

fix: be explicit w.r.t attestation types

014c45f

(if in the future we add a new attestation type, the catch-all case will backfire)

0x416e746f6e force-pushed the anton/misc-updates-and-improvements branch 2 times, most recently from d49510d to ccf73a0 Compare April 22, 2026 15:47

feat: implement builder for cert resolver/verifier

b513778

0x416e746f6e force-pushed the anton/misc-updates-and-improvements branch from ccf73a0 to b513778 Compare April 22, 2026 16:04

0x416e746f6e added 2 commits April 23, 2026 14:03

feat: implement allow-lists of self-signed cert pubkeys

9237f3b

chore: switch to blocking verifier

bfc2190

Base automatically changed from peg/add-sync-verifier-fn to main April 24, 2026 06:05

0x416e746f6e changed the title ~~wip: misc updates and improvements~~ misc updates and improvements Apr 24, 2026

Merge branch 'main' of https://github.com/flashbots/attested-tls into…

61b7d58

… anton/misc-updates-and-improvements

0x416e746f6e marked this pull request as ready for review April 24, 2026 09:09

0x416e746f6e requested a review from ameba23 April 24, 2026 09:10

ameba23 approved these changes Apr 24, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

misc updates and improvements#20

misc updates and improvements#20
0x416e746f6e wants to merge 10 commits intomainfrom
anton/misc-updates-and-improvements

0x416e746f6e commented Apr 14, 2026 •

edited

Loading

Uh oh!

ameba23 left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

0x416e746f6e commented Apr 17, 2026

Uh oh!

ameba23 left a comment

Uh oh!

ameba23 Apr 24, 2026

Uh oh!

ameba23 Apr 24, 2026

Uh oh!

ameba23 Apr 24, 2026

Uh oh!

ameba23 Apr 24, 2026

Uh oh!

ameba23 Apr 24, 2026

Uh oh!

ameba23 Apr 24, 2026

Uh oh!

ameba23 Apr 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -862,15 +1041,15 @@ mod tests {
		#[tokio::test(flavor = "multi_thread")]

Conversation

0x416e746f6e commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ameba23 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

0x416e746f6e commented Apr 17, 2026

Uh oh!

ameba23 left a comment

Choose a reason for hiding this comment

Uh oh!

ameba23 Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

ameba23 Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

ameba23 Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

ameba23 Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

ameba23 Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

ameba23 Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

ameba23 Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

0x416e746f6e commented Apr 14, 2026 •

edited

Loading