feat(platform): Add 4 new platform claims for draft-ffm-rats-cca-token-03 by hqrui · Pull Request #47 · veraison/ccatoken

hqrui · 2026-07-06T14:07:22Z

Description

Issue: #46

This PR adds 4 new platform claims for draft-ffm-rats-cca-token-03 support:

Client ID (mandatory, always 1)
TBB RoTPK (optional, array of hashes of keys w/metadata. Single item and array structs and interfaces are defined in this PR.)
Manufacturing config (optional, bytes)
Peer signers (optional, bytes)

Due to the large scope, the final new platform claim (extension devices) as well as the new realm claim (MEC policy) for draft-ffm-rats-cca-token-03 will be added in separate PRs.

New structs and interfaces are defined for TBBRoTPKItem and TBBRoTPKItems, which are based off SwComponent and SwComponents in veraison/psatoken.

Notes:

This PR allows an empty array for TBB ROTPK, even though the spec says it should have at least 1 item if specified. This follows the approach for SwComponents as implemented in psatoken and reused here.
A local type claimsV2 is defined here to allow CBOR/JSON marshaling and unmarshaling. Unfortunately, the approach used for V1 doesn't work out of the box, so the implementation here is more complicated. (Defining "type claimsV2 ClaimsV2" leads to unwanted inheritance of Claims.UnmarshalCBOR/JSON and MarshalCBOR/JSON).
ClientID is always 1. Its type is int32 to be consistent with psatoken, which already defines a ClientID field.

For discussion:

Whether to have this isNilRotPKItem function, which psatoken.SwComponents doesn't have. The reflect.ValueOf(k).Kind() == reflect.Ptr check allows this new test to pass while it would fail with runtime error if we just checked (item == nil). A corresponding test for psatoken.SwComponents would fail.
Whether TBBRoTPKItems should be a parametrised type like SwComponents, or just use TBBRoTPKItem as the contained type like currently in this PR.
Naming scheme: my current naming scheme (ClaimsV2, ProfileV2, ProfileNameV2 etc.) differs from the psatoken naming scheme (P2Claims, Profile2, Profile2Name). The context is slightly different from psatoken though, as our earlier version of claims here are simply called "Claims" whereas they are more helpfully called "P1Claims" in psatoken.

Checklist

Code compiles correctly
Created tests which fail without the change (if possible)
All tests passing
Extended the README / documentation, if necessary

Note: No updates to README here, I think we should update in 1 shot when all the platform and realm claims are updated to this new profile.

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

hqrui · 2026-07-08T08:25:47Z

+// TBBRoTPKey represents a single item in the CCA platform TBB ROTPK claim.
+type TBBRoTPKey struct {
+	Name        *string `cbor:"1,keyasint" json:"description"`  // e.g. "CM" or "DM"
+	ActiveArray *int32  `cbor:"2,keyasint" json:"active-array"` // active ROTPK array


ActiveArrayIndex and active-array-index for JSON

hqrui · 2026-07-08T08:28:10Z

+import "github.com/veraison/psatoken"
+
+// TBBRoTPKey represents a single item in the CCA platform TBB ROTPK claim.
+type TBBRoTPKey struct {


Suggested change

type TBBRoTPKey struct {

type TBBRoTPKItem struct {

hqrui · 2026-07-08T08:30:27Z

+
+// TBBRoTPKey represents a single item in the CCA platform TBB ROTPK claim.
+type TBBRoTPKey struct {
+	Name        *string `cbor:"1,keyasint" json:"description"`  // e.g. "CM" or "DM"


Must be CM or DM case insensitive

Error message: expected CM or DM but received ...

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

…ken/(i)swcomponents.go Signed-off-by: Qirui Huang <qirui.huang@arm.com>

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

…ners. Fix tests. Signed-off-by: Qirui Huang <qirui.huang@arm.com>

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

…ed' errors to claims v1. Signed-off-by: Qirui Huang <qirui.huang@arm.com>

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

hqrui · 2026-07-14T09:54:22Z

+	return newClaimsV2()
+}
+
+type addedClaimsV2 struct {


consider new name

hqrui · 2026-07-14T09:55:30Z

+	addedClaimsV2
+}
+
+func toPlainClaimsV2(c ClaimsV2) plainClaimsV2 {


to double check cbor (edit: checked 2 encoded cbors on cbor.me)

to change to pass as pointer (linter below), change types used in invocation

hqrui · 2026-07-14T10:02:24Z

+}
+
+// MarshalJSON encodes the claims into JSON
+func (c ClaimsV2) MarshalJSON() ([]byte, error) {


check if can pass by pointer

the existing claims V1 in main also passes by value, not pointer

Since ClaimsV2.MarshalJSON is intended to override Claims.MarshalJSON, let's keep the parameter type the same (value not pointer)

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

…tr instead of reusing v1 test variables Signed-off-by: Qirui Huang <qirui.huang@arm.com>

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

hqrui added 5 commits July 6, 2026 15:15

Create TbbRotpkItem struct

eab1f55

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

add interface for TbbRotpkItem

d184162

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

ad tbb_rotpk_array struct and interface

9133163

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

add nolint:structcheck to tbb_rotpkarray

7c773c3

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

add tbbrotpk to claims

19d5ead

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

hqrui force-pushed the platform-claims-2.0.0 branch from b687776 to 19d5ead Compare July 6, 2026 14:15

hqrui added 5 commits July 6, 2026 17:15

elaborate on rotpk comment

97519d7

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

rename to rotpkey; start of test

aa46c30

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

add a few tests for test_tbbrotpkeys

6064def

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

more rotpkey(s) unit tests

4c66a44

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

remove unnecessary else for linter

58610e0

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

hqrui commented Jul 8, 2026

View reviewed changes

hqrui added 16 commits July 8, 2026 10:40

Rename RoTPKey to ROTPKItem

4395944

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

rename TBBRoTPKItem.ActiveArray to ActiveArrayIndex

111b08e

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

Force TBBRoTPKItem.name to be CM or DM (case insensitive) only

d2ac08f

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

remove check against empty tbbrotpk array

ab8442c

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

rename 3 files

2c3dd68

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

Refactor TBBRoTPKItems and add ITBBRoTPKItems, to be similar to psato…

e6c0794

…ken/(i)swcomponents.go Signed-off-by: Qirui Huang <qirui.huang@arm.com>

revert claims.go, iclaims.go to state in main branch

00ed0cf

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

copy claims to claimsv2

a45fd50

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

rename claims to claims_v1. Change claims_v2 to register profilev2.

1c05818

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

More name changes to 'V1'. Changed copyright year to 2026.

024ff97

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

fixes to claims_v2, move registration to claims

ec89e9c

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

rename claims V1 back to claims

529af54

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

make empty byte strings error for ManufacturingConfig and for PeerSig…

c2d043f

…ners. Fix tests. Signed-off-by: Qirui Huang <qirui.huang@arm.com>

add another test. Fix inconsistent naming in a rotpk test

6290505

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

Add getters and setters for 4 new fields to iclaims, and 'unimplement…

09fe46f

…ed' errors to claims v1. Signed-off-by: Qirui Huang <qirui.huang@arm.com>

Add plain claims v2 type for marshaling/unmarshaling, one testcase.

9240162

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

hqrui added 11 commits July 10, 2026 09:35

Add json test files for platform claims v2

284e261

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

First working cbor v2 test

cf9a445

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

fix: add missing client id validation test

009796d

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

working claims v2 json unmarshaling

efe6e39

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

fix: change tag 'description' to 'name'

28f6441

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

Add more cbor testcases

ddb7dc0

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

add cbor tests

138ce8e

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

fix an old json test

dfdf80b

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

Marshaling tests

15da7a6

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

Add more platform v2 tests

cd3a3b0

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

Fix lint make (ID in caps)

2a33226

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

hqrui changed the title ~~Platform claims 2.0.0~~ feat(platform): Add 4 new platform claims Jul 13, 2026

hqrui changed the title ~~feat(platform): Add 4 new platform claims~~ feat(platform): Add 4 new platform claims for draft-ffm-rats-cca-token-03 Jul 13, 2026

hqrui added 4 commits July 13, 2026 15:38

remove unnecessary comments

676d1dc

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

Split tbb rotpk item test into multiple functions

34cc382

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

Reorder tests

f4ca693

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

restructure testcase directory structure

1e3affb

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

hqrui commented Jul 14, 2026

View reviewed changes

Comment thread platform/claims_v2.go

return newClaimsV2()

}

type addedClaimsV2 struct {

hqrui Jul 14, 2026

Copy link
Copy Markdown

Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

consider new name

hqrui commented Jul 14, 2026

View reviewed changes

hqrui added 5 commits July 14, 2026 11:31

Use pointers for params of toPlainClaimsV2 and fromPlainClaimsV2

48d5c24

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

Use testtbbrotpk name var

93f1847

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

Improve v2 tests to use independent tbbrotpk hash and peer signers bs…

c137ad0

…tr instead of reusing v1 test variables Signed-off-by: Qirui Huang <qirui.huang@arm.com>

use variables for test tbb rotpk array index and index

d7f8877

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

Add a very brief test for claims v2 to iclaims_test

79fd278

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

hqrui marked this pull request as ready for review July 15, 2026 13:47

make tbb_rotpk_items_test.go tidier

b1df3b5

Signed-off-by: Qirui Huang <qirui.huang@arm.com>

This was referenced Jul 22, 2026

feat(platform): add platform extension devices claim #48

Draft

(old) realm claims 2.0.0 #44

Closed

hqrui requested a review from yogeshbdeshpande July 22, 2026 13:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(platform): Add 4 new platform claims for draft-ffm-rats-cca-token-03#47

feat(platform): Add 4 new platform claims for draft-ffm-rats-cca-token-03#47
hqrui wants to merge 51 commits into
mainfrom
platform-claims-2.0.0

hqrui commented Jul 6, 2026 •

edited

Loading

Uh oh!

hqrui Jul 8, 2026 •

edited

Loading

Uh oh!

hqrui Jul 8, 2026

Uh oh!

hqrui Jul 8, 2026

Uh oh!

hqrui Jul 8, 2026

Uh oh!

hqrui Jul 8, 2026

Uh oh!

hqrui Jul 8, 2026

Uh oh!

hqrui Jul 8, 2026

Uh oh!

hqrui Jul 14, 2026

Uh oh!

hqrui Jul 14, 2026 •

edited

Loading

Uh oh!

hqrui Jul 14, 2026

Uh oh!

hqrui Jul 14, 2026

Uh oh!

hqrui Jul 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hqrui commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

hqrui Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hqrui Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

hqrui commented Jul 6, 2026 •

edited

Loading

hqrui Jul 8, 2026 •

edited

Loading

hqrui Jul 14, 2026 •

edited

Loading