mirror of
https://github.com/block/buzz.git
synced 2026-10-27 04:30:52 +00:00
5397ea49e2
## Summary Apple SDK 27.1 device captures include authenticator extension data that the current verifier rejects. Replace the general appattest dependency with a private gateway module that verifies the complete original bytes, frames enrollment and assertions separately, and accepts well-formed optional extensions without SDK-specific length or flag allowlists. The module retains established signature, P-256, CBOR, and certificate-chain libraries. App identity, exact enrollment environment, credential/key binding, nonce, challenge, and increasing-counter checks remain enforced. Bounded parsing rejects ambiguous duplicate keys, truncation, trailing data, and oversized inputs. Fixture helpers are test-only. Adapted code retains both upstream MIT notices and source provenance. Category/version properties remain authenticated observations under the chosen compatibility-release policy. This does not implement Apple's additional distribution-category/version enforcement; introducing those restrictions requires a separately defined deployment policy. The [verification contract](https://github.com/block/buzz/blob/app-attest-owned-verifier/docs/app-attest-compatibility.md) records this and other limits. Related: https://github.com/block/buzz/pull/8020 addresses assertion extension handling. This change also covers enrollment extensions, credential-key parsing, and certificate validation. ### Validation - Gateway suites: 77 default tests and 79 personal-development tests passed, plus startup policy and Clippy. - Added signed enrollment/certificate, generated CBOR mutation, maximum-counter, and PostgreSQL race/replay coverage. All 12 isolated Postgres tests passed. Apple's historical fixture is tested structurally, not accepted as a current enrollment. Positive synthetic leaf certificates are generated at test time. - Protected SDK 26.5/27.1 enrollments and assertions pass the verifier, including the same key across SDK upgrades; development enrollment rejects under production policy. Captures are personal-development identities, not supported production-identity evidence. - Full local CI passed Rust tests and reached 6,828 passing desktop JS tests before an unchanged 10 ms focus-timer test failed; its five-test file passed in isolation. The pre-push native suite had 3,421 passes and an unchanged 300 ms child-PID test failure, also passing in isolation. Prior ACP timing flakes and these unrelated hook exceptions do not waive required CI. - Windows CI exposed a missing system OpenSSL installation for the test fixture generator. The test dependency now builds bundled OpenSSL; all 30 focused App Attest tests pass locally. [Current-head CI](https://github.com/block/buzz/actions/runs/38636062347) passed, including Windows Rust, PostgreSQL, and desktop integration tests. - [Prior-head Codex review](https://github.com/block/buzz/pull/8329#issuecomment-6177515598) found no major issues. Carl subsequently identified a dropped credential-length workaround; fixed in [27f9f26](27f9f2624f), with 34 focused/protected tests and Clippy passing. [Current-head Codex review](https://github.com/block/buzz/pull/8329#issuecomment-6178361143) found no major issues; physical iOS 26 testing was explicitly waived by Tom on October 14, 2026. No iOS 26 device test was performed. The SDK comparison used the same iOS 27.0.1 device, so it demonstrates SDK-linked variation without establishing OS-version causation. - Isolated candidate HTTP/device validation passed with separate authority state and no APNs delivery: SDK 26.5 enrollment/delegation, SDK 27.1 delegation with the exact same key and installation, and fresh SDK 27.1 enrollment/delegation. Assertions changed from 37 to 102 bytes across the upgrade; accepted counter increased from 1 to 3 and delegation generation from 1 to 2. All three runs rejected tampering and replay (401) and consumed challenges (404). Existing Buzz app builds were preserved. No production rollout is included. - Existing-installation validation passed against the current-head Dev gateway: a guarded SDK 27.1 diagnostic reused the stored key and installation, advanced the assertion counter from 88 to 89 and delegation from 89 to 90, and published the existing active relay lease at generation 9 (previously 8). Independent database reads confirmed the changes and preserved key, epoch, and expiry. The original app build was restored in place with current data and keys intact. --------- Signed-off-by: Tom Brow <tomb@block.xyz>
6 lines
227 B
Plaintext
6 lines
227 B
Plaintext
-----BEGIN EC PRIVATE KEY-----
|
|
MHcCAQEEIFM/DSPwekMvsqNpx/wpynoxNHL6driuUlXKdzaxVuIEoAoGCCqGSM49
|
|
AwEHoUQDQgAEV0CVN6maPcws9sWaatGchX2DflqRurhHbfvhikXGo45iYjGAacTg
|
|
ba3nAoLz5a2XUu1JR4ZlINmXX577u/gxCA==
|
|
-----END EC PRIVATE KEY-----
|